2 * virtual page mapping and translated block handling
4 * Copyright (c) 2003 Fabrice Bellard
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
23 #include <sys/types.h>
36 #include "qemu-common.h"
41 #if defined(CONFIG_USER_ONLY)
46 //#define DEBUG_TB_INVALIDATE
49 //#define DEBUG_UNASSIGNED
51 /* make various TB consistency checks */
52 //#define DEBUG_TB_CHECK
53 //#define DEBUG_TLB_CHECK
55 //#define DEBUG_IOPORT
56 //#define DEBUG_SUBPAGE
58 #if !defined(CONFIG_USER_ONLY)
59 /* TB consistency checks only implemented for usermode emulation. */
63 #define SMC_BITMAP_USE_THRESHOLD 10
65 #if defined(TARGET_SPARC64)
66 #define TARGET_PHYS_ADDR_SPACE_BITS 41
67 #elif defined(TARGET_SPARC)
68 #define TARGET_PHYS_ADDR_SPACE_BITS 36
69 #elif defined(TARGET_ALPHA)
70 #define TARGET_PHYS_ADDR_SPACE_BITS 42
71 #define TARGET_VIRT_ADDR_SPACE_BITS 42
72 #elif defined(TARGET_PPC64)
73 #define TARGET_PHYS_ADDR_SPACE_BITS 42
74 #elif defined(TARGET_X86_64)
75 #define TARGET_PHYS_ADDR_SPACE_BITS 42
76 #elif defined(TARGET_I386)
77 #define TARGET_PHYS_ADDR_SPACE_BITS 36
79 #define TARGET_PHYS_ADDR_SPACE_BITS 32
82 static TranslationBlock
*tbs
;
83 int code_gen_max_blocks
;
84 TranslationBlock
*tb_phys_hash
[CODE_GEN_PHYS_HASH_SIZE
];
86 /* any access to the tbs or the page table must use this lock */
87 spinlock_t tb_lock
= SPIN_LOCK_UNLOCKED
;
89 #if defined(__arm__) || defined(__sparc_v9__)
90 /* The prologue must be reachable with a direct jump. ARM and Sparc64
91 have limited branch ranges (possibly also PPC) so place it in a
92 section close to code segment. */
93 #define code_gen_section \
94 __attribute__((__section__(".gen_code"))) \
95 __attribute__((aligned (32)))
97 /* Maximum alignment for Win32 is 16. */
98 #define code_gen_section \
99 __attribute__((aligned (16)))
101 #define code_gen_section \
102 __attribute__((aligned (32)))
105 uint8_t code_gen_prologue
[1024] code_gen_section
;
106 static uint8_t *code_gen_buffer
;
107 static unsigned long code_gen_buffer_size
;
108 /* threshold to flush the translated code buffer */
109 static unsigned long code_gen_buffer_max_size
;
110 uint8_t *code_gen_ptr
;
112 #if !defined(CONFIG_USER_ONLY)
114 uint8_t *phys_ram_dirty
;
115 static int in_migration
;
117 typedef struct RAMBlock
{
121 struct RAMBlock
*next
;
124 static RAMBlock
*ram_blocks
;
125 /* TODO: When we implement (and use) ram deallocation (e.g. for hotplug)
126 then we can no longer assume contiguous ram offsets, and external uses
127 of this variable will break. */
128 ram_addr_t last_ram_offset
;
132 /* current CPU in the current thread. It is only valid inside
134 CPUState
*cpu_single_env
;
135 /* 0 = Do not count executed instructions.
136 1 = Precise instruction counting.
137 2 = Adaptive rate instruction counting. */
139 /* Current instruction counter. While executing translated code this may
140 include some instructions that have not yet been executed. */
143 typedef struct PageDesc
{
144 /* list of TBs intersecting this ram page */
145 TranslationBlock
*first_tb
;
146 /* in order to optimize self modifying code, we count the number
147 of lookups we do to a given page to use a bitmap */
148 unsigned int code_write_count
;
149 uint8_t *code_bitmap
;
150 #if defined(CONFIG_USER_ONLY)
155 typedef struct PhysPageDesc
{
156 /* offset in host memory of the page + io_index in the low bits */
157 ram_addr_t phys_offset
;
158 ram_addr_t region_offset
;
162 #if defined(CONFIG_USER_ONLY) && defined(TARGET_VIRT_ADDR_SPACE_BITS)
163 /* XXX: this is a temporary hack for alpha target.
164 * In the future, this is to be replaced by a multi-level table
165 * to actually be able to handle the complete 64 bits address space.
167 #define L1_BITS (TARGET_VIRT_ADDR_SPACE_BITS - L2_BITS - TARGET_PAGE_BITS)
169 #define L1_BITS (32 - L2_BITS - TARGET_PAGE_BITS)
172 #define L1_SIZE (1 << L1_BITS)
173 #define L2_SIZE (1 << L2_BITS)
175 unsigned long qemu_real_host_page_size
;
176 unsigned long qemu_host_page_bits
;
177 unsigned long qemu_host_page_size
;
178 unsigned long qemu_host_page_mask
;
180 /* XXX: for system emulation, it could just be an array */
181 static PageDesc
*l1_map
[L1_SIZE
];
183 #if !defined(CONFIG_USER_ONLY)
184 static PhysPageDesc
**l1_phys_map
;
186 static void io_mem_init(void);
188 /* io memory support */
189 CPUWriteMemoryFunc
*io_mem_write
[IO_MEM_NB_ENTRIES
][4];
190 CPUReadMemoryFunc
*io_mem_read
[IO_MEM_NB_ENTRIES
][4];
191 void *io_mem_opaque
[IO_MEM_NB_ENTRIES
];
192 static char io_mem_used
[IO_MEM_NB_ENTRIES
];
193 static int io_mem_watch
;
198 static const char *logfilename
= "qemu.log";
200 static const char *logfilename
= "/tmp/qemu.log";
204 static int log_append
= 0;
207 static int tlb_flush_count
;
208 static int tb_flush_count
;
209 static int tb_phys_invalidate_count
;
212 static void map_exec(void *addr
, long size
)
215 VirtualProtect(addr
, size
,
216 PAGE_EXECUTE_READWRITE
, &old_protect
);
220 static void map_exec(void *addr
, long size
)
222 unsigned long start
, end
, page_size
;
224 page_size
= getpagesize();
225 start
= (unsigned long)addr
;
226 start
&= ~(page_size
- 1);
228 end
= (unsigned long)addr
+ size
;
229 end
+= page_size
- 1;
230 end
&= ~(page_size
- 1);
232 mprotect((void *)start
, end
- start
,
233 PROT_READ
| PROT_WRITE
| PROT_EXEC
);
237 static void page_init(void)
239 /* NOTE: we can always suppose that qemu_host_page_size >=
243 SYSTEM_INFO system_info
;
245 GetSystemInfo(&system_info
);
246 qemu_real_host_page_size
= system_info
.dwPageSize
;
249 qemu_real_host_page_size
= getpagesize();
251 if (qemu_host_page_size
== 0)
252 qemu_host_page_size
= qemu_real_host_page_size
;
253 if (qemu_host_page_size
< TARGET_PAGE_SIZE
)
254 qemu_host_page_size
= TARGET_PAGE_SIZE
;
255 qemu_host_page_bits
= 0;
256 while ((1 << qemu_host_page_bits
) < qemu_host_page_size
)
257 qemu_host_page_bits
++;
258 qemu_host_page_mask
= ~(qemu_host_page_size
- 1);
259 #if !defined(CONFIG_USER_ONLY)
260 l1_phys_map
= qemu_vmalloc(L1_SIZE
* sizeof(void *));
261 memset(l1_phys_map
, 0, L1_SIZE
* sizeof(void *));
264 #if !defined(_WIN32) && defined(CONFIG_USER_ONLY)
266 long long startaddr
, endaddr
;
271 last_brk
= (unsigned long)sbrk(0);
272 f
= fopen("/proc/self/maps", "r");
275 n
= fscanf (f
, "%llx-%llx %*[^\n]\n", &startaddr
, &endaddr
);
277 startaddr
= MIN(startaddr
,
278 (1ULL << TARGET_PHYS_ADDR_SPACE_BITS
) - 1);
279 endaddr
= MIN(endaddr
,
280 (1ULL << TARGET_PHYS_ADDR_SPACE_BITS
) - 1);
281 page_set_flags(startaddr
& TARGET_PAGE_MASK
,
282 TARGET_PAGE_ALIGN(endaddr
),
293 static inline PageDesc
**page_l1_map(target_ulong index
)
295 #if TARGET_LONG_BITS > 32
296 /* Host memory outside guest VM. For 32-bit targets we have already
297 excluded high addresses. */
298 if (index
> ((target_ulong
)L2_SIZE
* L1_SIZE
))
301 return &l1_map
[index
>> L2_BITS
];
304 static inline PageDesc
*page_find_alloc(target_ulong index
)
307 lp
= page_l1_map(index
);
313 /* allocate if not found */
314 #if defined(CONFIG_USER_ONLY)
315 size_t len
= sizeof(PageDesc
) * L2_SIZE
;
316 /* Don't use qemu_malloc because it may recurse. */
317 p
= mmap(NULL
, len
, PROT_READ
| PROT_WRITE
,
318 MAP_PRIVATE
| MAP_ANONYMOUS
, -1, 0);
321 unsigned long addr
= h2g(p
);
322 page_set_flags(addr
& TARGET_PAGE_MASK
,
323 TARGET_PAGE_ALIGN(addr
+ len
),
327 p
= qemu_mallocz(sizeof(PageDesc
) * L2_SIZE
);
331 return p
+ (index
& (L2_SIZE
- 1));
334 static inline PageDesc
*page_find(target_ulong index
)
337 lp
= page_l1_map(index
);
345 return p
+ (index
& (L2_SIZE
- 1));
348 #if !defined(CONFIG_USER_ONLY)
349 static PhysPageDesc
*phys_page_find_alloc(target_phys_addr_t index
, int alloc
)
354 p
= (void **)l1_phys_map
;
355 #if TARGET_PHYS_ADDR_SPACE_BITS > 32
357 #if TARGET_PHYS_ADDR_SPACE_BITS > (32 + L1_BITS)
358 #error unsupported TARGET_PHYS_ADDR_SPACE_BITS
360 lp
= p
+ ((index
>> (L1_BITS
+ L2_BITS
)) & (L1_SIZE
- 1));
363 /* allocate if not found */
366 p
= qemu_vmalloc(sizeof(void *) * L1_SIZE
);
367 memset(p
, 0, sizeof(void *) * L1_SIZE
);
371 lp
= p
+ ((index
>> L2_BITS
) & (L1_SIZE
- 1));
375 /* allocate if not found */
378 pd
= qemu_vmalloc(sizeof(PhysPageDesc
) * L2_SIZE
);
380 for (i
= 0; i
< L2_SIZE
; i
++) {
381 pd
[i
].phys_offset
= IO_MEM_UNASSIGNED
;
382 pd
[i
].region_offset
= (index
+ i
) << TARGET_PAGE_BITS
;
385 return ((PhysPageDesc
*)pd
) + (index
& (L2_SIZE
- 1));
388 static inline PhysPageDesc
*phys_page_find(target_phys_addr_t index
)
390 return phys_page_find_alloc(index
, 0);
393 static void tlb_protect_code(ram_addr_t ram_addr
);
394 static void tlb_unprotect_code_phys(CPUState
*env
, ram_addr_t ram_addr
,
396 #define mmap_lock() do { } while(0)
397 #define mmap_unlock() do { } while(0)
400 #define DEFAULT_CODE_GEN_BUFFER_SIZE (32 * 1024 * 1024)
402 #if defined(CONFIG_USER_ONLY)
403 /* Currently it is not recommended to allocate big chunks of data in
404 user mode. It will change when a dedicated libc will be used */
405 #define USE_STATIC_CODE_GEN_BUFFER
408 #ifdef USE_STATIC_CODE_GEN_BUFFER
409 static uint8_t static_code_gen_buffer
[DEFAULT_CODE_GEN_BUFFER_SIZE
];
412 static void code_gen_alloc(unsigned long tb_size
)
414 #ifdef USE_STATIC_CODE_GEN_BUFFER
415 code_gen_buffer
= static_code_gen_buffer
;
416 code_gen_buffer_size
= DEFAULT_CODE_GEN_BUFFER_SIZE
;
417 map_exec(code_gen_buffer
, code_gen_buffer_size
);
419 code_gen_buffer_size
= tb_size
;
420 if (code_gen_buffer_size
== 0) {
421 #if defined(CONFIG_USER_ONLY)
422 /* in user mode, phys_ram_size is not meaningful */
423 code_gen_buffer_size
= DEFAULT_CODE_GEN_BUFFER_SIZE
;
425 /* XXX: needs adjustments */
426 code_gen_buffer_size
= (unsigned long)(ram_size
/ 4);
429 if (code_gen_buffer_size
< MIN_CODE_GEN_BUFFER_SIZE
)
430 code_gen_buffer_size
= MIN_CODE_GEN_BUFFER_SIZE
;
431 /* The code gen buffer location may have constraints depending on
432 the host cpu and OS */
433 #if defined(__linux__)
438 flags
= MAP_PRIVATE
| MAP_ANONYMOUS
;
439 #if defined(__x86_64__)
441 /* Cannot map more than that */
442 if (code_gen_buffer_size
> (800 * 1024 * 1024))
443 code_gen_buffer_size
= (800 * 1024 * 1024);
444 #elif defined(__sparc_v9__)
445 // Map the buffer below 2G, so we can use direct calls and branches
447 start
= (void *) 0x60000000UL
;
448 if (code_gen_buffer_size
> (512 * 1024 * 1024))
449 code_gen_buffer_size
= (512 * 1024 * 1024);
450 #elif defined(__arm__)
451 /* Map the buffer below 32M, so we can use direct calls and branches */
453 start
= (void *) 0x01000000UL
;
454 if (code_gen_buffer_size
> 16 * 1024 * 1024)
455 code_gen_buffer_size
= 16 * 1024 * 1024;
457 code_gen_buffer
= mmap(start
, code_gen_buffer_size
,
458 PROT_WRITE
| PROT_READ
| PROT_EXEC
,
460 if (code_gen_buffer
== MAP_FAILED
) {
461 fprintf(stderr
, "Could not allocate dynamic translator buffer\n");
465 #elif defined(__FreeBSD__) || defined(__FreeBSD_kernel__) || defined(__DragonFly__)
469 flags
= MAP_PRIVATE
| MAP_ANONYMOUS
;
470 #if defined(__x86_64__)
471 /* FreeBSD doesn't have MAP_32BIT, use MAP_FIXED and assume
472 * 0x40000000 is free */
474 addr
= (void *)0x40000000;
475 /* Cannot map more than that */
476 if (code_gen_buffer_size
> (800 * 1024 * 1024))
477 code_gen_buffer_size
= (800 * 1024 * 1024);
479 code_gen_buffer
= mmap(addr
, code_gen_buffer_size
,
480 PROT_WRITE
| PROT_READ
| PROT_EXEC
,
482 if (code_gen_buffer
== MAP_FAILED
) {
483 fprintf(stderr
, "Could not allocate dynamic translator buffer\n");
488 code_gen_buffer
= qemu_malloc(code_gen_buffer_size
);
489 map_exec(code_gen_buffer
, code_gen_buffer_size
);
491 #endif /* !USE_STATIC_CODE_GEN_BUFFER */
492 map_exec(code_gen_prologue
, sizeof(code_gen_prologue
));
493 code_gen_buffer_max_size
= code_gen_buffer_size
-
494 code_gen_max_block_size();
495 code_gen_max_blocks
= code_gen_buffer_size
/ CODE_GEN_AVG_BLOCK_SIZE
;
496 tbs
= qemu_malloc(code_gen_max_blocks
* sizeof(TranslationBlock
));
499 /* Must be called before using the QEMU cpus. 'tb_size' is the size
500 (in bytes) allocated to the translation buffer. Zero means default
502 void cpu_exec_init_all(unsigned long tb_size
)
505 code_gen_alloc(tb_size
);
506 code_gen_ptr
= code_gen_buffer
;
508 #if !defined(CONFIG_USER_ONLY)
513 #if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
515 static void cpu_common_pre_save(void *opaque
)
517 CPUState
*env
= opaque
;
519 cpu_synchronize_state(env
);
522 static int cpu_common_pre_load(void *opaque
)
524 CPUState
*env
= opaque
;
526 cpu_synchronize_state(env
);
530 static int cpu_common_post_load(void *opaque
, int version_id
)
532 CPUState
*env
= opaque
;
534 /* 0x01 was CPU_INTERRUPT_EXIT. This line can be removed when the
535 version_id is increased. */
536 env
->interrupt_request
&= ~0x01;
542 static const VMStateDescription vmstate_cpu_common
= {
543 .name
= "cpu_common",
545 .minimum_version_id
= 1,
546 .minimum_version_id_old
= 1,
547 .pre_save
= cpu_common_pre_save
,
548 .pre_load
= cpu_common_pre_load
,
549 .post_load
= cpu_common_post_load
,
550 .fields
= (VMStateField
[]) {
551 VMSTATE_UINT32(halted
, CPUState
),
552 VMSTATE_UINT32(interrupt_request
, CPUState
),
553 VMSTATE_END_OF_LIST()
558 CPUState
*qemu_get_cpu(int cpu
)
560 CPUState
*env
= first_cpu
;
563 if (env
->cpu_index
== cpu
)
571 void cpu_exec_init(CPUState
*env
)
576 #if defined(CONFIG_USER_ONLY)
579 env
->next_cpu
= NULL
;
582 while (*penv
!= NULL
) {
583 penv
= &(*penv
)->next_cpu
;
586 env
->cpu_index
= cpu_index
;
588 QTAILQ_INIT(&env
->breakpoints
);
589 QTAILQ_INIT(&env
->watchpoints
);
591 #if defined(CONFIG_USER_ONLY)
594 #if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
595 vmstate_register(cpu_index
, &vmstate_cpu_common
, env
);
596 register_savevm("cpu", cpu_index
, CPU_SAVE_VERSION
,
597 cpu_save
, cpu_load
, env
);
601 static inline void invalidate_page_bitmap(PageDesc
*p
)
603 if (p
->code_bitmap
) {
604 qemu_free(p
->code_bitmap
);
605 p
->code_bitmap
= NULL
;
607 p
->code_write_count
= 0;
610 /* set to NULL all the 'first_tb' fields in all PageDescs */
611 static void page_flush_tb(void)
616 for(i
= 0; i
< L1_SIZE
; i
++) {
619 for(j
= 0; j
< L2_SIZE
; j
++) {
621 invalidate_page_bitmap(p
);
628 /* flush all the translation blocks */
629 /* XXX: tb_flush is currently not thread safe */
630 void tb_flush(CPUState
*env1
)
633 #if defined(DEBUG_FLUSH)
634 printf("qemu: flush code_size=%ld nb_tbs=%d avg_tb_size=%ld\n",
635 (unsigned long)(code_gen_ptr
- code_gen_buffer
),
637 ((unsigned long)(code_gen_ptr
- code_gen_buffer
)) / nb_tbs
: 0);
639 if ((unsigned long)(code_gen_ptr
- code_gen_buffer
) > code_gen_buffer_size
)
640 cpu_abort(env1
, "Internal error: code buffer overflow\n");
644 for(env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
) {
645 memset (env
->tb_jmp_cache
, 0, TB_JMP_CACHE_SIZE
* sizeof (void *));
648 memset (tb_phys_hash
, 0, CODE_GEN_PHYS_HASH_SIZE
* sizeof (void *));
651 code_gen_ptr
= code_gen_buffer
;
652 /* XXX: flush processor icache at this point if cache flush is
657 #ifdef DEBUG_TB_CHECK
659 static void tb_invalidate_check(target_ulong address
)
661 TranslationBlock
*tb
;
663 address
&= TARGET_PAGE_MASK
;
664 for(i
= 0;i
< CODE_GEN_PHYS_HASH_SIZE
; i
++) {
665 for(tb
= tb_phys_hash
[i
]; tb
!= NULL
; tb
= tb
->phys_hash_next
) {
666 if (!(address
+ TARGET_PAGE_SIZE
<= tb
->pc
||
667 address
>= tb
->pc
+ tb
->size
)) {
668 printf("ERROR invalidate: address=" TARGET_FMT_lx
669 " PC=%08lx size=%04x\n",
670 address
, (long)tb
->pc
, tb
->size
);
676 /* verify that all the pages have correct rights for code */
677 static void tb_page_check(void)
679 TranslationBlock
*tb
;
680 int i
, flags1
, flags2
;
682 for(i
= 0;i
< CODE_GEN_PHYS_HASH_SIZE
; i
++) {
683 for(tb
= tb_phys_hash
[i
]; tb
!= NULL
; tb
= tb
->phys_hash_next
) {
684 flags1
= page_get_flags(tb
->pc
);
685 flags2
= page_get_flags(tb
->pc
+ tb
->size
- 1);
686 if ((flags1
& PAGE_WRITE
) || (flags2
& PAGE_WRITE
)) {
687 printf("ERROR page flags: PC=%08lx size=%04x f1=%x f2=%x\n",
688 (long)tb
->pc
, tb
->size
, flags1
, flags2
);
696 /* invalidate one TB */
697 static inline void tb_remove(TranslationBlock
**ptb
, TranslationBlock
*tb
,
700 TranslationBlock
*tb1
;
704 *ptb
= *(TranslationBlock
**)((char *)tb1
+ next_offset
);
707 ptb
= (TranslationBlock
**)((char *)tb1
+ next_offset
);
711 static inline void tb_page_remove(TranslationBlock
**ptb
, TranslationBlock
*tb
)
713 TranslationBlock
*tb1
;
719 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
721 *ptb
= tb1
->page_next
[n1
];
724 ptb
= &tb1
->page_next
[n1
];
728 static inline void tb_jmp_remove(TranslationBlock
*tb
, int n
)
730 TranslationBlock
*tb1
, **ptb
;
733 ptb
= &tb
->jmp_next
[n
];
736 /* find tb(n) in circular list */
740 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
741 if (n1
== n
&& tb1
== tb
)
744 ptb
= &tb1
->jmp_first
;
746 ptb
= &tb1
->jmp_next
[n1
];
749 /* now we can suppress tb(n) from the list */
750 *ptb
= tb
->jmp_next
[n
];
752 tb
->jmp_next
[n
] = NULL
;
756 /* reset the jump entry 'n' of a TB so that it is not chained to
758 static inline void tb_reset_jump(TranslationBlock
*tb
, int n
)
760 tb_set_jmp_target(tb
, n
, (unsigned long)(tb
->tc_ptr
+ tb
->tb_next_offset
[n
]));
763 void tb_phys_invalidate(TranslationBlock
*tb
, target_ulong page_addr
)
768 target_phys_addr_t phys_pc
;
769 TranslationBlock
*tb1
, *tb2
;
771 /* remove the TB from the hash list */
772 phys_pc
= tb
->page_addr
[0] + (tb
->pc
& ~TARGET_PAGE_MASK
);
773 h
= tb_phys_hash_func(phys_pc
);
774 tb_remove(&tb_phys_hash
[h
], tb
,
775 offsetof(TranslationBlock
, phys_hash_next
));
777 /* remove the TB from the page list */
778 if (tb
->page_addr
[0] != page_addr
) {
779 p
= page_find(tb
->page_addr
[0] >> TARGET_PAGE_BITS
);
780 tb_page_remove(&p
->first_tb
, tb
);
781 invalidate_page_bitmap(p
);
783 if (tb
->page_addr
[1] != -1 && tb
->page_addr
[1] != page_addr
) {
784 p
= page_find(tb
->page_addr
[1] >> TARGET_PAGE_BITS
);
785 tb_page_remove(&p
->first_tb
, tb
);
786 invalidate_page_bitmap(p
);
789 tb_invalidated_flag
= 1;
791 /* remove the TB from the hash list */
792 h
= tb_jmp_cache_hash_func(tb
->pc
);
793 for(env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
) {
794 if (env
->tb_jmp_cache
[h
] == tb
)
795 env
->tb_jmp_cache
[h
] = NULL
;
798 /* suppress this TB from the two jump lists */
799 tb_jmp_remove(tb
, 0);
800 tb_jmp_remove(tb
, 1);
802 /* suppress any remaining jumps to this TB */
808 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
809 tb2
= tb1
->jmp_next
[n1
];
810 tb_reset_jump(tb1
, n1
);
811 tb1
->jmp_next
[n1
] = NULL
;
814 tb
->jmp_first
= (TranslationBlock
*)((long)tb
| 2); /* fail safe */
816 tb_phys_invalidate_count
++;
819 static inline void set_bits(uint8_t *tab
, int start
, int len
)
825 mask
= 0xff << (start
& 7);
826 if ((start
& ~7) == (end
& ~7)) {
828 mask
&= ~(0xff << (end
& 7));
833 start
= (start
+ 8) & ~7;
835 while (start
< end1
) {
840 mask
= ~(0xff << (end
& 7));
846 static void build_page_bitmap(PageDesc
*p
)
848 int n
, tb_start
, tb_end
;
849 TranslationBlock
*tb
;
851 p
->code_bitmap
= qemu_mallocz(TARGET_PAGE_SIZE
/ 8);
856 tb
= (TranslationBlock
*)((long)tb
& ~3);
857 /* NOTE: this is subtle as a TB may span two physical pages */
859 /* NOTE: tb_end may be after the end of the page, but
860 it is not a problem */
861 tb_start
= tb
->pc
& ~TARGET_PAGE_MASK
;
862 tb_end
= tb_start
+ tb
->size
;
863 if (tb_end
> TARGET_PAGE_SIZE
)
864 tb_end
= TARGET_PAGE_SIZE
;
867 tb_end
= ((tb
->pc
+ tb
->size
) & ~TARGET_PAGE_MASK
);
869 set_bits(p
->code_bitmap
, tb_start
, tb_end
- tb_start
);
870 tb
= tb
->page_next
[n
];
874 TranslationBlock
*tb_gen_code(CPUState
*env
,
875 target_ulong pc
, target_ulong cs_base
,
876 int flags
, int cflags
)
878 TranslationBlock
*tb
;
880 target_ulong phys_pc
, phys_page2
, virt_page2
;
883 phys_pc
= get_phys_addr_code(env
, pc
);
886 /* flush must be done */
888 /* cannot fail at this point */
890 /* Don't forget to invalidate previous TB info. */
891 tb_invalidated_flag
= 1;
893 tc_ptr
= code_gen_ptr
;
895 tb
->cs_base
= cs_base
;
898 cpu_gen_code(env
, tb
, &code_gen_size
);
899 code_gen_ptr
= (void *)(((unsigned long)code_gen_ptr
+ code_gen_size
+ CODE_GEN_ALIGN
- 1) & ~(CODE_GEN_ALIGN
- 1));
901 /* check next page if needed */
902 virt_page2
= (pc
+ tb
->size
- 1) & TARGET_PAGE_MASK
;
904 if ((pc
& TARGET_PAGE_MASK
) != virt_page2
) {
905 phys_page2
= get_phys_addr_code(env
, virt_page2
);
907 tb_link_phys(tb
, phys_pc
, phys_page2
);
911 /* invalidate all TBs which intersect with the target physical page
912 starting in range [start;end[. NOTE: start and end must refer to
913 the same physical page. 'is_cpu_write_access' should be true if called
914 from a real cpu write access: the virtual CPU will exit the current
915 TB if code is modified inside this TB. */
916 void tb_invalidate_phys_page_range(target_phys_addr_t start
, target_phys_addr_t end
,
917 int is_cpu_write_access
)
919 TranslationBlock
*tb
, *tb_next
, *saved_tb
;
920 CPUState
*env
= cpu_single_env
;
921 target_ulong tb_start
, tb_end
;
924 #ifdef TARGET_HAS_PRECISE_SMC
925 int current_tb_not_found
= is_cpu_write_access
;
926 TranslationBlock
*current_tb
= NULL
;
927 int current_tb_modified
= 0;
928 target_ulong current_pc
= 0;
929 target_ulong current_cs_base
= 0;
930 int current_flags
= 0;
931 #endif /* TARGET_HAS_PRECISE_SMC */
933 p
= page_find(start
>> TARGET_PAGE_BITS
);
936 if (!p
->code_bitmap
&&
937 ++p
->code_write_count
>= SMC_BITMAP_USE_THRESHOLD
&&
938 is_cpu_write_access
) {
939 /* build code bitmap */
940 build_page_bitmap(p
);
943 /* we remove all the TBs in the range [start, end[ */
944 /* XXX: see if in some cases it could be faster to invalidate all the code */
948 tb
= (TranslationBlock
*)((long)tb
& ~3);
949 tb_next
= tb
->page_next
[n
];
950 /* NOTE: this is subtle as a TB may span two physical pages */
952 /* NOTE: tb_end may be after the end of the page, but
953 it is not a problem */
954 tb_start
= tb
->page_addr
[0] + (tb
->pc
& ~TARGET_PAGE_MASK
);
955 tb_end
= tb_start
+ tb
->size
;
957 tb_start
= tb
->page_addr
[1];
958 tb_end
= tb_start
+ ((tb
->pc
+ tb
->size
) & ~TARGET_PAGE_MASK
);
960 if (!(tb_end
<= start
|| tb_start
>= end
)) {
961 #ifdef TARGET_HAS_PRECISE_SMC
962 if (current_tb_not_found
) {
963 current_tb_not_found
= 0;
965 if (env
->mem_io_pc
) {
966 /* now we have a real cpu fault */
967 current_tb
= tb_find_pc(env
->mem_io_pc
);
970 if (current_tb
== tb
&&
971 (current_tb
->cflags
& CF_COUNT_MASK
) != 1) {
972 /* If we are modifying the current TB, we must stop
973 its execution. We could be more precise by checking
974 that the modification is after the current PC, but it
975 would require a specialized function to partially
976 restore the CPU state */
978 current_tb_modified
= 1;
979 cpu_restore_state(current_tb
, env
,
980 env
->mem_io_pc
, NULL
);
981 cpu_get_tb_cpu_state(env
, ¤t_pc
, ¤t_cs_base
,
984 #endif /* TARGET_HAS_PRECISE_SMC */
985 /* we need to do that to handle the case where a signal
986 occurs while doing tb_phys_invalidate() */
989 saved_tb
= env
->current_tb
;
990 env
->current_tb
= NULL
;
992 tb_phys_invalidate(tb
, -1);
994 env
->current_tb
= saved_tb
;
995 if (env
->interrupt_request
&& env
->current_tb
)
996 cpu_interrupt(env
, env
->interrupt_request
);
1001 #if !defined(CONFIG_USER_ONLY)
1002 /* if no code remaining, no need to continue to use slow writes */
1004 invalidate_page_bitmap(p
);
1005 if (is_cpu_write_access
) {
1006 tlb_unprotect_code_phys(env
, start
, env
->mem_io_vaddr
);
1010 #ifdef TARGET_HAS_PRECISE_SMC
1011 if (current_tb_modified
) {
1012 /* we generate a block containing just the instruction
1013 modifying the memory. It will ensure that it cannot modify
1015 env
->current_tb
= NULL
;
1016 tb_gen_code(env
, current_pc
, current_cs_base
, current_flags
, 1);
1017 cpu_resume_from_signal(env
, NULL
);
1022 /* len must be <= 8 and start must be a multiple of len */
1023 static inline void tb_invalidate_phys_page_fast(target_phys_addr_t start
, int len
)
1029 qemu_log("modifying code at 0x%x size=%d EIP=%x PC=%08x\n",
1030 cpu_single_env
->mem_io_vaddr
, len
,
1031 cpu_single_env
->eip
,
1032 cpu_single_env
->eip
+ (long)cpu_single_env
->segs
[R_CS
].base
);
1035 p
= page_find(start
>> TARGET_PAGE_BITS
);
1038 if (p
->code_bitmap
) {
1039 offset
= start
& ~TARGET_PAGE_MASK
;
1040 b
= p
->code_bitmap
[offset
>> 3] >> (offset
& 7);
1041 if (b
& ((1 << len
) - 1))
1045 tb_invalidate_phys_page_range(start
, start
+ len
, 1);
1049 #if !defined(CONFIG_SOFTMMU)
1050 static void tb_invalidate_phys_page(target_phys_addr_t addr
,
1051 unsigned long pc
, void *puc
)
1053 TranslationBlock
*tb
;
1056 #ifdef TARGET_HAS_PRECISE_SMC
1057 TranslationBlock
*current_tb
= NULL
;
1058 CPUState
*env
= cpu_single_env
;
1059 int current_tb_modified
= 0;
1060 target_ulong current_pc
= 0;
1061 target_ulong current_cs_base
= 0;
1062 int current_flags
= 0;
1065 addr
&= TARGET_PAGE_MASK
;
1066 p
= page_find(addr
>> TARGET_PAGE_BITS
);
1070 #ifdef TARGET_HAS_PRECISE_SMC
1071 if (tb
&& pc
!= 0) {
1072 current_tb
= tb_find_pc(pc
);
1075 while (tb
!= NULL
) {
1077 tb
= (TranslationBlock
*)((long)tb
& ~3);
1078 #ifdef TARGET_HAS_PRECISE_SMC
1079 if (current_tb
== tb
&&
1080 (current_tb
->cflags
& CF_COUNT_MASK
) != 1) {
1081 /* If we are modifying the current TB, we must stop
1082 its execution. We could be more precise by checking
1083 that the modification is after the current PC, but it
1084 would require a specialized function to partially
1085 restore the CPU state */
1087 current_tb_modified
= 1;
1088 cpu_restore_state(current_tb
, env
, pc
, puc
);
1089 cpu_get_tb_cpu_state(env
, ¤t_pc
, ¤t_cs_base
,
1092 #endif /* TARGET_HAS_PRECISE_SMC */
1093 tb_phys_invalidate(tb
, addr
);
1094 tb
= tb
->page_next
[n
];
1097 #ifdef TARGET_HAS_PRECISE_SMC
1098 if (current_tb_modified
) {
1099 /* we generate a block containing just the instruction
1100 modifying the memory. It will ensure that it cannot modify
1102 env
->current_tb
= NULL
;
1103 tb_gen_code(env
, current_pc
, current_cs_base
, current_flags
, 1);
1104 cpu_resume_from_signal(env
, puc
);
1110 /* add the tb in the target page and protect it if necessary */
1111 static inline void tb_alloc_page(TranslationBlock
*tb
,
1112 unsigned int n
, target_ulong page_addr
)
1115 TranslationBlock
*last_first_tb
;
1117 tb
->page_addr
[n
] = page_addr
;
1118 p
= page_find_alloc(page_addr
>> TARGET_PAGE_BITS
);
1119 tb
->page_next
[n
] = p
->first_tb
;
1120 last_first_tb
= p
->first_tb
;
1121 p
->first_tb
= (TranslationBlock
*)((long)tb
| n
);
1122 invalidate_page_bitmap(p
);
1124 #if defined(TARGET_HAS_SMC) || 1
1126 #if defined(CONFIG_USER_ONLY)
1127 if (p
->flags
& PAGE_WRITE
) {
1132 /* force the host page as non writable (writes will have a
1133 page fault + mprotect overhead) */
1134 page_addr
&= qemu_host_page_mask
;
1136 for(addr
= page_addr
; addr
< page_addr
+ qemu_host_page_size
;
1137 addr
+= TARGET_PAGE_SIZE
) {
1139 p2
= page_find (addr
>> TARGET_PAGE_BITS
);
1143 p2
->flags
&= ~PAGE_WRITE
;
1144 page_get_flags(addr
);
1146 mprotect(g2h(page_addr
), qemu_host_page_size
,
1147 (prot
& PAGE_BITS
) & ~PAGE_WRITE
);
1148 #ifdef DEBUG_TB_INVALIDATE
1149 printf("protecting code page: 0x" TARGET_FMT_lx
"\n",
1154 /* if some code is already present, then the pages are already
1155 protected. So we handle the case where only the first TB is
1156 allocated in a physical page */
1157 if (!last_first_tb
) {
1158 tlb_protect_code(page_addr
);
1162 #endif /* TARGET_HAS_SMC */
1165 /* Allocate a new translation block. Flush the translation buffer if
1166 too many translation blocks or too much generated code. */
1167 TranslationBlock
*tb_alloc(target_ulong pc
)
1169 TranslationBlock
*tb
;
1171 if (nb_tbs
>= code_gen_max_blocks
||
1172 (code_gen_ptr
- code_gen_buffer
) >= code_gen_buffer_max_size
)
1174 tb
= &tbs
[nb_tbs
++];
1180 void tb_free(TranslationBlock
*tb
)
1182 /* In practice this is mostly used for single use temporary TB
1183 Ignore the hard cases and just back up if this TB happens to
1184 be the last one generated. */
1185 if (nb_tbs
> 0 && tb
== &tbs
[nb_tbs
- 1]) {
1186 code_gen_ptr
= tb
->tc_ptr
;
1191 /* add a new TB and link it to the physical page tables. phys_page2 is
1192 (-1) to indicate that only one page contains the TB. */
1193 void tb_link_phys(TranslationBlock
*tb
,
1194 target_ulong phys_pc
, target_ulong phys_page2
)
1197 TranslationBlock
**ptb
;
1199 /* Grab the mmap lock to stop another thread invalidating this TB
1200 before we are done. */
1202 /* add in the physical hash table */
1203 h
= tb_phys_hash_func(phys_pc
);
1204 ptb
= &tb_phys_hash
[h
];
1205 tb
->phys_hash_next
= *ptb
;
1208 /* add in the page list */
1209 tb_alloc_page(tb
, 0, phys_pc
& TARGET_PAGE_MASK
);
1210 if (phys_page2
!= -1)
1211 tb_alloc_page(tb
, 1, phys_page2
);
1213 tb
->page_addr
[1] = -1;
1215 tb
->jmp_first
= (TranslationBlock
*)((long)tb
| 2);
1216 tb
->jmp_next
[0] = NULL
;
1217 tb
->jmp_next
[1] = NULL
;
1219 /* init original jump addresses */
1220 if (tb
->tb_next_offset
[0] != 0xffff)
1221 tb_reset_jump(tb
, 0);
1222 if (tb
->tb_next_offset
[1] != 0xffff)
1223 tb_reset_jump(tb
, 1);
1225 #ifdef DEBUG_TB_CHECK
1231 /* find the TB 'tb' such that tb[0].tc_ptr <= tc_ptr <
1232 tb[1].tc_ptr. Return NULL if not found */
1233 TranslationBlock
*tb_find_pc(unsigned long tc_ptr
)
1235 int m_min
, m_max
, m
;
1237 TranslationBlock
*tb
;
1241 if (tc_ptr
< (unsigned long)code_gen_buffer
||
1242 tc_ptr
>= (unsigned long)code_gen_ptr
)
1244 /* binary search (cf Knuth) */
1247 while (m_min
<= m_max
) {
1248 m
= (m_min
+ m_max
) >> 1;
1250 v
= (unsigned long)tb
->tc_ptr
;
1253 else if (tc_ptr
< v
) {
1262 static void tb_reset_jump_recursive(TranslationBlock
*tb
);
1264 static inline void tb_reset_jump_recursive2(TranslationBlock
*tb
, int n
)
1266 TranslationBlock
*tb1
, *tb_next
, **ptb
;
1269 tb1
= tb
->jmp_next
[n
];
1271 /* find head of list */
1274 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
1277 tb1
= tb1
->jmp_next
[n1
];
1279 /* we are now sure now that tb jumps to tb1 */
1282 /* remove tb from the jmp_first list */
1283 ptb
= &tb_next
->jmp_first
;
1287 tb1
= (TranslationBlock
*)((long)tb1
& ~3);
1288 if (n1
== n
&& tb1
== tb
)
1290 ptb
= &tb1
->jmp_next
[n1
];
1292 *ptb
= tb
->jmp_next
[n
];
1293 tb
->jmp_next
[n
] = NULL
;
1295 /* suppress the jump to next tb in generated code */
1296 tb_reset_jump(tb
, n
);
1298 /* suppress jumps in the tb on which we could have jumped */
1299 tb_reset_jump_recursive(tb_next
);
1303 static void tb_reset_jump_recursive(TranslationBlock
*tb
)
1305 tb_reset_jump_recursive2(tb
, 0);
1306 tb_reset_jump_recursive2(tb
, 1);
1309 #if defined(TARGET_HAS_ICE)
1310 #if defined(CONFIG_USER_ONLY)
1311 static void breakpoint_invalidate(CPUState
*env
, target_ulong pc
)
1313 tb_invalidate_phys_page_range(pc
, pc
+ 1, 0);
1316 static void breakpoint_invalidate(CPUState
*env
, target_ulong pc
)
1318 target_phys_addr_t addr
;
1320 ram_addr_t ram_addr
;
1323 addr
= cpu_get_phys_page_debug(env
, pc
);
1324 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
1326 pd
= IO_MEM_UNASSIGNED
;
1328 pd
= p
->phys_offset
;
1330 ram_addr
= (pd
& TARGET_PAGE_MASK
) | (pc
& ~TARGET_PAGE_MASK
);
1331 tb_invalidate_phys_page_range(ram_addr
, ram_addr
+ 1, 0);
1334 #endif /* TARGET_HAS_ICE */
1336 #if defined(CONFIG_USER_ONLY)
1337 void cpu_watchpoint_remove_all(CPUState
*env
, int mask
)
1342 int cpu_watchpoint_insert(CPUState
*env
, target_ulong addr
, target_ulong len
,
1343 int flags
, CPUWatchpoint
**watchpoint
)
1348 /* Add a watchpoint. */
1349 int cpu_watchpoint_insert(CPUState
*env
, target_ulong addr
, target_ulong len
,
1350 int flags
, CPUWatchpoint
**watchpoint
)
1352 target_ulong len_mask
= ~(len
- 1);
1355 /* sanity checks: allow power-of-2 lengths, deny unaligned watchpoints */
1356 if ((len
!= 1 && len
!= 2 && len
!= 4 && len
!= 8) || (addr
& ~len_mask
)) {
1357 fprintf(stderr
, "qemu: tried to set invalid watchpoint at "
1358 TARGET_FMT_lx
", len=" TARGET_FMT_lu
"\n", addr
, len
);
1361 wp
= qemu_malloc(sizeof(*wp
));
1364 wp
->len_mask
= len_mask
;
1367 /* keep all GDB-injected watchpoints in front */
1369 QTAILQ_INSERT_HEAD(&env
->watchpoints
, wp
, entry
);
1371 QTAILQ_INSERT_TAIL(&env
->watchpoints
, wp
, entry
);
1373 tlb_flush_page(env
, addr
);
1380 /* Remove a specific watchpoint. */
1381 int cpu_watchpoint_remove(CPUState
*env
, target_ulong addr
, target_ulong len
,
1384 target_ulong len_mask
= ~(len
- 1);
1387 QTAILQ_FOREACH(wp
, &env
->watchpoints
, entry
) {
1388 if (addr
== wp
->vaddr
&& len_mask
== wp
->len_mask
1389 && flags
== (wp
->flags
& ~BP_WATCHPOINT_HIT
)) {
1390 cpu_watchpoint_remove_by_ref(env
, wp
);
1397 /* Remove a specific watchpoint by reference. */
1398 void cpu_watchpoint_remove_by_ref(CPUState
*env
, CPUWatchpoint
*watchpoint
)
1400 QTAILQ_REMOVE(&env
->watchpoints
, watchpoint
, entry
);
1402 tlb_flush_page(env
, watchpoint
->vaddr
);
1404 qemu_free(watchpoint
);
1407 /* Remove all matching watchpoints. */
1408 void cpu_watchpoint_remove_all(CPUState
*env
, int mask
)
1410 CPUWatchpoint
*wp
, *next
;
1412 QTAILQ_FOREACH_SAFE(wp
, &env
->watchpoints
, entry
, next
) {
1413 if (wp
->flags
& mask
)
1414 cpu_watchpoint_remove_by_ref(env
, wp
);
1419 /* Add a breakpoint. */
1420 int cpu_breakpoint_insert(CPUState
*env
, target_ulong pc
, int flags
,
1421 CPUBreakpoint
**breakpoint
)
1423 #if defined(TARGET_HAS_ICE)
1426 bp
= qemu_malloc(sizeof(*bp
));
1431 /* keep all GDB-injected breakpoints in front */
1433 QTAILQ_INSERT_HEAD(&env
->breakpoints
, bp
, entry
);
1435 QTAILQ_INSERT_TAIL(&env
->breakpoints
, bp
, entry
);
1437 breakpoint_invalidate(env
, pc
);
1447 /* Remove a specific breakpoint. */
1448 int cpu_breakpoint_remove(CPUState
*env
, target_ulong pc
, int flags
)
1450 #if defined(TARGET_HAS_ICE)
1453 QTAILQ_FOREACH(bp
, &env
->breakpoints
, entry
) {
1454 if (bp
->pc
== pc
&& bp
->flags
== flags
) {
1455 cpu_breakpoint_remove_by_ref(env
, bp
);
1465 /* Remove a specific breakpoint by reference. */
1466 void cpu_breakpoint_remove_by_ref(CPUState
*env
, CPUBreakpoint
*breakpoint
)
1468 #if defined(TARGET_HAS_ICE)
1469 QTAILQ_REMOVE(&env
->breakpoints
, breakpoint
, entry
);
1471 breakpoint_invalidate(env
, breakpoint
->pc
);
1473 qemu_free(breakpoint
);
1477 /* Remove all matching breakpoints. */
1478 void cpu_breakpoint_remove_all(CPUState
*env
, int mask
)
1480 #if defined(TARGET_HAS_ICE)
1481 CPUBreakpoint
*bp
, *next
;
1483 QTAILQ_FOREACH_SAFE(bp
, &env
->breakpoints
, entry
, next
) {
1484 if (bp
->flags
& mask
)
1485 cpu_breakpoint_remove_by_ref(env
, bp
);
1490 /* enable or disable single step mode. EXCP_DEBUG is returned by the
1491 CPU loop after each instruction */
1492 void cpu_single_step(CPUState
*env
, int enabled
)
1494 #if defined(TARGET_HAS_ICE)
1495 if (env
->singlestep_enabled
!= enabled
) {
1496 env
->singlestep_enabled
= enabled
;
1498 kvm_update_guest_debug(env
, 0);
1500 /* must flush all the translated code to avoid inconsistencies */
1501 /* XXX: only flush what is necessary */
1508 /* enable or disable low levels log */
1509 void cpu_set_log(int log_flags
)
1511 loglevel
= log_flags
;
1512 if (loglevel
&& !logfile
) {
1513 logfile
= fopen(logfilename
, log_append
? "a" : "w");
1515 perror(logfilename
);
1518 #if !defined(CONFIG_SOFTMMU)
1519 /* must avoid mmap() usage of glibc by setting a buffer "by hand" */
1521 static char logfile_buf
[4096];
1522 setvbuf(logfile
, logfile_buf
, _IOLBF
, sizeof(logfile_buf
));
1524 #elif !defined(_WIN32)
1525 /* Win32 doesn't support line-buffering and requires size >= 2 */
1526 setvbuf(logfile
, NULL
, _IOLBF
, 0);
1530 if (!loglevel
&& logfile
) {
1536 void cpu_set_log_filename(const char *filename
)
1538 logfilename
= strdup(filename
);
1543 cpu_set_log(loglevel
);
1546 static void cpu_unlink_tb(CPUState
*env
)
1548 /* FIXME: TB unchaining isn't SMP safe. For now just ignore the
1549 problem and hope the cpu will stop of its own accord. For userspace
1550 emulation this often isn't actually as bad as it sounds. Often
1551 signals are used primarily to interrupt blocking syscalls. */
1552 TranslationBlock
*tb
;
1553 static spinlock_t interrupt_lock
= SPIN_LOCK_UNLOCKED
;
1555 spin_lock(&interrupt_lock
);
1556 tb
= env
->current_tb
;
1557 /* if the cpu is currently executing code, we must unlink it and
1558 all the potentially executing TB */
1560 env
->current_tb
= NULL
;
1561 tb_reset_jump_recursive(tb
);
1563 spin_unlock(&interrupt_lock
);
1566 /* mask must never be zero, except for A20 change call */
1567 void cpu_interrupt(CPUState
*env
, int mask
)
1571 old_mask
= env
->interrupt_request
;
1572 env
->interrupt_request
|= mask
;
1574 #ifndef CONFIG_USER_ONLY
1576 * If called from iothread context, wake the target cpu in
1579 if (!qemu_cpu_self(env
)) {
1586 env
->icount_decr
.u16
.high
= 0xffff;
1587 #ifndef CONFIG_USER_ONLY
1589 && (mask
& ~old_mask
) != 0) {
1590 cpu_abort(env
, "Raised interrupt while not in I/O function");
1598 void cpu_reset_interrupt(CPUState
*env
, int mask
)
1600 env
->interrupt_request
&= ~mask
;
1603 void cpu_exit(CPUState
*env
)
1605 env
->exit_request
= 1;
1609 const CPULogItem cpu_log_items
[] = {
1610 { CPU_LOG_TB_OUT_ASM
, "out_asm",
1611 "show generated host assembly code for each compiled TB" },
1612 { CPU_LOG_TB_IN_ASM
, "in_asm",
1613 "show target assembly code for each compiled TB" },
1614 { CPU_LOG_TB_OP
, "op",
1615 "show micro ops for each compiled TB" },
1616 { CPU_LOG_TB_OP_OPT
, "op_opt",
1619 "before eflags optimization and "
1621 "after liveness analysis" },
1622 { CPU_LOG_INT
, "int",
1623 "show interrupts/exceptions in short format" },
1624 { CPU_LOG_EXEC
, "exec",
1625 "show trace before each executed TB (lots of logs)" },
1626 { CPU_LOG_TB_CPU
, "cpu",
1627 "show CPU state before block translation" },
1629 { CPU_LOG_PCALL
, "pcall",
1630 "show protected mode far calls/returns/exceptions" },
1631 { CPU_LOG_RESET
, "cpu_reset",
1632 "show CPU state before CPU resets" },
1635 { CPU_LOG_IOPORT
, "ioport",
1636 "show all i/o ports accesses" },
1641 #ifndef CONFIG_USER_ONLY
1642 static QLIST_HEAD(memory_client_list
, CPUPhysMemoryClient
) memory_client_list
1643 = QLIST_HEAD_INITIALIZER(memory_client_list
);
1645 static void cpu_notify_set_memory(target_phys_addr_t start_addr
,
1647 ram_addr_t phys_offset
)
1649 CPUPhysMemoryClient
*client
;
1650 QLIST_FOREACH(client
, &memory_client_list
, list
) {
1651 client
->set_memory(client
, start_addr
, size
, phys_offset
);
1655 static int cpu_notify_sync_dirty_bitmap(target_phys_addr_t start
,
1656 target_phys_addr_t end
)
1658 CPUPhysMemoryClient
*client
;
1659 QLIST_FOREACH(client
, &memory_client_list
, list
) {
1660 int r
= client
->sync_dirty_bitmap(client
, start
, end
);
1667 static int cpu_notify_migration_log(int enable
)
1669 CPUPhysMemoryClient
*client
;
1670 QLIST_FOREACH(client
, &memory_client_list
, list
) {
1671 int r
= client
->migration_log(client
, enable
);
1678 static void phys_page_for_each_in_l1_map(PhysPageDesc
**phys_map
,
1679 CPUPhysMemoryClient
*client
)
1684 for (l1
= 0; l1
< L1_SIZE
; ++l1
) {
1689 for (l2
= 0; l2
< L2_SIZE
; ++l2
) {
1690 if (pd
[l2
].phys_offset
== IO_MEM_UNASSIGNED
) {
1693 client
->set_memory(client
, pd
[l2
].region_offset
,
1694 TARGET_PAGE_SIZE
, pd
[l2
].phys_offset
);
1699 static void phys_page_for_each(CPUPhysMemoryClient
*client
)
1701 #if TARGET_PHYS_ADDR_SPACE_BITS > 32
1703 #if TARGET_PHYS_ADDR_SPACE_BITS > (32 + L1_BITS)
1704 #error unsupported TARGET_PHYS_ADDR_SPACE_BITS
1706 void **phys_map
= (void **)l1_phys_map
;
1711 for (l1
= 0; l1
< L1_SIZE
; ++l1
) {
1713 phys_page_for_each_in_l1_map(phys_map
[l1
], client
);
1720 phys_page_for_each_in_l1_map(l1_phys_map
, client
);
1724 void cpu_register_phys_memory_client(CPUPhysMemoryClient
*client
)
1726 QLIST_INSERT_HEAD(&memory_client_list
, client
, list
);
1727 phys_page_for_each(client
);
1730 void cpu_unregister_phys_memory_client(CPUPhysMemoryClient
*client
)
1732 QLIST_REMOVE(client
, list
);
1736 static int cmp1(const char *s1
, int n
, const char *s2
)
1738 if (strlen(s2
) != n
)
1740 return memcmp(s1
, s2
, n
) == 0;
1743 /* takes a comma separated list of log masks. Return 0 if error. */
1744 int cpu_str_to_log_mask(const char *str
)
1746 const CPULogItem
*item
;
1753 p1
= strchr(p
, ',');
1756 if(cmp1(p
,p1
-p
,"all")) {
1757 for(item
= cpu_log_items
; item
->mask
!= 0; item
++) {
1761 for(item
= cpu_log_items
; item
->mask
!= 0; item
++) {
1762 if (cmp1(p
, p1
- p
, item
->name
))
1776 void cpu_abort(CPUState
*env
, const char *fmt
, ...)
1783 fprintf(stderr
, "qemu: fatal: ");
1784 vfprintf(stderr
, fmt
, ap
);
1785 fprintf(stderr
, "\n");
1787 cpu_dump_state(env
, stderr
, fprintf
, X86_DUMP_FPU
| X86_DUMP_CCOP
);
1789 cpu_dump_state(env
, stderr
, fprintf
, 0);
1791 if (qemu_log_enabled()) {
1792 qemu_log("qemu: fatal: ");
1793 qemu_log_vprintf(fmt
, ap2
);
1796 log_cpu_state(env
, X86_DUMP_FPU
| X86_DUMP_CCOP
);
1798 log_cpu_state(env
, 0);
1805 #if defined(CONFIG_USER_ONLY)
1807 struct sigaction act
;
1808 sigfillset(&act
.sa_mask
);
1809 act
.sa_handler
= SIG_DFL
;
1810 sigaction(SIGABRT
, &act
, NULL
);
1816 CPUState
*cpu_copy(CPUState
*env
)
1818 CPUState
*new_env
= cpu_init(env
->cpu_model_str
);
1819 CPUState
*next_cpu
= new_env
->next_cpu
;
1820 int cpu_index
= new_env
->cpu_index
;
1821 #if defined(TARGET_HAS_ICE)
1826 memcpy(new_env
, env
, sizeof(CPUState
));
1828 /* Preserve chaining and index. */
1829 new_env
->next_cpu
= next_cpu
;
1830 new_env
->cpu_index
= cpu_index
;
1832 /* Clone all break/watchpoints.
1833 Note: Once we support ptrace with hw-debug register access, make sure
1834 BP_CPU break/watchpoints are handled correctly on clone. */
1835 QTAILQ_INIT(&env
->breakpoints
);
1836 QTAILQ_INIT(&env
->watchpoints
);
1837 #if defined(TARGET_HAS_ICE)
1838 QTAILQ_FOREACH(bp
, &env
->breakpoints
, entry
) {
1839 cpu_breakpoint_insert(new_env
, bp
->pc
, bp
->flags
, NULL
);
1841 QTAILQ_FOREACH(wp
, &env
->watchpoints
, entry
) {
1842 cpu_watchpoint_insert(new_env
, wp
->vaddr
, (~wp
->len_mask
) + 1,
1850 #if !defined(CONFIG_USER_ONLY)
1852 static inline void tlb_flush_jmp_cache(CPUState
*env
, target_ulong addr
)
1856 /* Discard jump cache entries for any tb which might potentially
1857 overlap the flushed page. */
1858 i
= tb_jmp_cache_hash_page(addr
- TARGET_PAGE_SIZE
);
1859 memset (&env
->tb_jmp_cache
[i
], 0,
1860 TB_JMP_PAGE_SIZE
* sizeof(TranslationBlock
*));
1862 i
= tb_jmp_cache_hash_page(addr
);
1863 memset (&env
->tb_jmp_cache
[i
], 0,
1864 TB_JMP_PAGE_SIZE
* sizeof(TranslationBlock
*));
1867 static CPUTLBEntry s_cputlb_empty_entry
= {
1874 /* NOTE: if flush_global is true, also flush global entries (not
1876 void tlb_flush(CPUState
*env
, int flush_global
)
1880 #if defined(DEBUG_TLB)
1881 printf("tlb_flush:\n");
1883 /* must reset current TB so that interrupts cannot modify the
1884 links while we are modifying them */
1885 env
->current_tb
= NULL
;
1887 for(i
= 0; i
< CPU_TLB_SIZE
; i
++) {
1889 for (mmu_idx
= 0; mmu_idx
< NB_MMU_MODES
; mmu_idx
++) {
1890 env
->tlb_table
[mmu_idx
][i
] = s_cputlb_empty_entry
;
1894 memset (env
->tb_jmp_cache
, 0, TB_JMP_CACHE_SIZE
* sizeof (void *));
1899 static inline void tlb_flush_entry(CPUTLBEntry
*tlb_entry
, target_ulong addr
)
1901 if (addr
== (tlb_entry
->addr_read
&
1902 (TARGET_PAGE_MASK
| TLB_INVALID_MASK
)) ||
1903 addr
== (tlb_entry
->addr_write
&
1904 (TARGET_PAGE_MASK
| TLB_INVALID_MASK
)) ||
1905 addr
== (tlb_entry
->addr_code
&
1906 (TARGET_PAGE_MASK
| TLB_INVALID_MASK
))) {
1907 *tlb_entry
= s_cputlb_empty_entry
;
1911 void tlb_flush_page(CPUState
*env
, target_ulong addr
)
1916 #if defined(DEBUG_TLB)
1917 printf("tlb_flush_page: " TARGET_FMT_lx
"\n", addr
);
1919 /* must reset current TB so that interrupts cannot modify the
1920 links while we are modifying them */
1921 env
->current_tb
= NULL
;
1923 addr
&= TARGET_PAGE_MASK
;
1924 i
= (addr
>> TARGET_PAGE_BITS
) & (CPU_TLB_SIZE
- 1);
1925 for (mmu_idx
= 0; mmu_idx
< NB_MMU_MODES
; mmu_idx
++)
1926 tlb_flush_entry(&env
->tlb_table
[mmu_idx
][i
], addr
);
1928 tlb_flush_jmp_cache(env
, addr
);
1931 /* update the TLBs so that writes to code in the virtual page 'addr'
1933 static void tlb_protect_code(ram_addr_t ram_addr
)
1935 cpu_physical_memory_reset_dirty(ram_addr
,
1936 ram_addr
+ TARGET_PAGE_SIZE
,
1940 /* update the TLB so that writes in physical page 'phys_addr' are no longer
1941 tested for self modifying code */
1942 static void tlb_unprotect_code_phys(CPUState
*env
, ram_addr_t ram_addr
,
1945 phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
] |= CODE_DIRTY_FLAG
;
1948 static inline void tlb_reset_dirty_range(CPUTLBEntry
*tlb_entry
,
1949 unsigned long start
, unsigned long length
)
1952 if ((tlb_entry
->addr_write
& ~TARGET_PAGE_MASK
) == IO_MEM_RAM
) {
1953 addr
= (tlb_entry
->addr_write
& TARGET_PAGE_MASK
) + tlb_entry
->addend
;
1954 if ((addr
- start
) < length
) {
1955 tlb_entry
->addr_write
= (tlb_entry
->addr_write
& TARGET_PAGE_MASK
) | TLB_NOTDIRTY
;
1960 /* Note: start and end must be within the same ram block. */
1961 void cpu_physical_memory_reset_dirty(ram_addr_t start
, ram_addr_t end
,
1965 unsigned long length
, start1
;
1969 start
&= TARGET_PAGE_MASK
;
1970 end
= TARGET_PAGE_ALIGN(end
);
1972 length
= end
- start
;
1975 len
= length
>> TARGET_PAGE_BITS
;
1976 mask
= ~dirty_flags
;
1977 p
= phys_ram_dirty
+ (start
>> TARGET_PAGE_BITS
);
1978 for(i
= 0; i
< len
; i
++)
1981 /* we modify the TLB cache so that the dirty bit will be set again
1982 when accessing the range */
1983 start1
= (unsigned long)qemu_get_ram_ptr(start
);
1984 /* Chek that we don't span multiple blocks - this breaks the
1985 address comparisons below. */
1986 if ((unsigned long)qemu_get_ram_ptr(end
- 1) - start1
1987 != (end
- 1) - start
) {
1991 for(env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
) {
1993 for (mmu_idx
= 0; mmu_idx
< NB_MMU_MODES
; mmu_idx
++) {
1994 for(i
= 0; i
< CPU_TLB_SIZE
; i
++)
1995 tlb_reset_dirty_range(&env
->tlb_table
[mmu_idx
][i
],
2001 int cpu_physical_memory_set_dirty_tracking(int enable
)
2004 in_migration
= enable
;
2005 ret
= cpu_notify_migration_log(!!enable
);
2009 int cpu_physical_memory_get_dirty_tracking(void)
2011 return in_migration
;
2014 int cpu_physical_sync_dirty_bitmap(target_phys_addr_t start_addr
,
2015 target_phys_addr_t end_addr
)
2019 ret
= cpu_notify_sync_dirty_bitmap(start_addr
, end_addr
);
2023 static inline void tlb_update_dirty(CPUTLBEntry
*tlb_entry
)
2025 ram_addr_t ram_addr
;
2028 if ((tlb_entry
->addr_write
& ~TARGET_PAGE_MASK
) == IO_MEM_RAM
) {
2029 p
= (void *)(unsigned long)((tlb_entry
->addr_write
& TARGET_PAGE_MASK
)
2030 + tlb_entry
->addend
);
2031 ram_addr
= qemu_ram_addr_from_host(p
);
2032 if (!cpu_physical_memory_is_dirty(ram_addr
)) {
2033 tlb_entry
->addr_write
|= TLB_NOTDIRTY
;
2038 /* update the TLB according to the current state of the dirty bits */
2039 void cpu_tlb_update_dirty(CPUState
*env
)
2043 for (mmu_idx
= 0; mmu_idx
< NB_MMU_MODES
; mmu_idx
++) {
2044 for(i
= 0; i
< CPU_TLB_SIZE
; i
++)
2045 tlb_update_dirty(&env
->tlb_table
[mmu_idx
][i
]);
2049 static inline void tlb_set_dirty1(CPUTLBEntry
*tlb_entry
, target_ulong vaddr
)
2051 if (tlb_entry
->addr_write
== (vaddr
| TLB_NOTDIRTY
))
2052 tlb_entry
->addr_write
= vaddr
;
2055 /* update the TLB corresponding to virtual page vaddr
2056 so that it is no longer dirty */
2057 static inline void tlb_set_dirty(CPUState
*env
, target_ulong vaddr
)
2062 vaddr
&= TARGET_PAGE_MASK
;
2063 i
= (vaddr
>> TARGET_PAGE_BITS
) & (CPU_TLB_SIZE
- 1);
2064 for (mmu_idx
= 0; mmu_idx
< NB_MMU_MODES
; mmu_idx
++)
2065 tlb_set_dirty1(&env
->tlb_table
[mmu_idx
][i
], vaddr
);
2068 /* add a new TLB entry. At most one entry for a given virtual address
2069 is permitted. Return 0 if OK or 2 if the page could not be mapped
2070 (can only happen in non SOFTMMU mode for I/O pages or pages
2071 conflicting with the host address space). */
2072 int tlb_set_page_exec(CPUState
*env
, target_ulong vaddr
,
2073 target_phys_addr_t paddr
, int prot
,
2074 int mmu_idx
, int is_softmmu
)
2079 target_ulong address
;
2080 target_ulong code_address
;
2081 target_phys_addr_t addend
;
2085 target_phys_addr_t iotlb
;
2087 p
= phys_page_find(paddr
>> TARGET_PAGE_BITS
);
2089 pd
= IO_MEM_UNASSIGNED
;
2091 pd
= p
->phys_offset
;
2093 #if defined(DEBUG_TLB)
2094 printf("tlb_set_page: vaddr=" TARGET_FMT_lx
" paddr=0x%08x prot=%x idx=%d smmu=%d pd=0x%08lx\n",
2095 vaddr
, (int)paddr
, prot
, mmu_idx
, is_softmmu
, pd
);
2100 if ((pd
& ~TARGET_PAGE_MASK
) > IO_MEM_ROM
&& !(pd
& IO_MEM_ROMD
)) {
2101 /* IO memory case (romd handled later) */
2102 address
|= TLB_MMIO
;
2104 addend
= (unsigned long)qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
);
2105 if ((pd
& ~TARGET_PAGE_MASK
) <= IO_MEM_ROM
) {
2107 iotlb
= pd
& TARGET_PAGE_MASK
;
2108 if ((pd
& ~TARGET_PAGE_MASK
) == IO_MEM_RAM
)
2109 iotlb
|= IO_MEM_NOTDIRTY
;
2111 iotlb
|= IO_MEM_ROM
;
2113 /* IO handlers are currently passed a physical address.
2114 It would be nice to pass an offset from the base address
2115 of that region. This would avoid having to special case RAM,
2116 and avoid full address decoding in every device.
2117 We can't use the high bits of pd for this because
2118 IO_MEM_ROMD uses these as a ram address. */
2119 iotlb
= (pd
& ~TARGET_PAGE_MASK
);
2121 iotlb
+= p
->region_offset
;
2127 code_address
= address
;
2128 /* Make accesses to pages with watchpoints go via the
2129 watchpoint trap routines. */
2130 QTAILQ_FOREACH(wp
, &env
->watchpoints
, entry
) {
2131 if (vaddr
== (wp
->vaddr
& TARGET_PAGE_MASK
)) {
2132 iotlb
= io_mem_watch
+ paddr
;
2133 /* TODO: The memory case can be optimized by not trapping
2134 reads of pages with a write breakpoint. */
2135 address
|= TLB_MMIO
;
2139 index
= (vaddr
>> TARGET_PAGE_BITS
) & (CPU_TLB_SIZE
- 1);
2140 env
->iotlb
[mmu_idx
][index
] = iotlb
- vaddr
;
2141 te
= &env
->tlb_table
[mmu_idx
][index
];
2142 te
->addend
= addend
- vaddr
;
2143 if (prot
& PAGE_READ
) {
2144 te
->addr_read
= address
;
2149 if (prot
& PAGE_EXEC
) {
2150 te
->addr_code
= code_address
;
2154 if (prot
& PAGE_WRITE
) {
2155 if ((pd
& ~TARGET_PAGE_MASK
) == IO_MEM_ROM
||
2156 (pd
& IO_MEM_ROMD
)) {
2157 /* Write access calls the I/O callback. */
2158 te
->addr_write
= address
| TLB_MMIO
;
2159 } else if ((pd
& ~TARGET_PAGE_MASK
) == IO_MEM_RAM
&&
2160 !cpu_physical_memory_is_dirty(pd
)) {
2161 te
->addr_write
= address
| TLB_NOTDIRTY
;
2163 te
->addr_write
= address
;
2166 te
->addr_write
= -1;
2173 void tlb_flush(CPUState
*env
, int flush_global
)
2177 void tlb_flush_page(CPUState
*env
, target_ulong addr
)
2182 * Walks guest process memory "regions" one by one
2183 * and calls callback function 'fn' for each region.
2185 int walk_memory_regions(void *priv
,
2186 int (*fn
)(void *, unsigned long, unsigned long, unsigned long))
2188 unsigned long start
, end
;
2190 int i
, j
, prot
, prot1
;
2196 for (i
= 0; i
<= L1_SIZE
; i
++) {
2197 p
= (i
< L1_SIZE
) ? l1_map
[i
] : NULL
;
2198 for (j
= 0; j
< L2_SIZE
; j
++) {
2199 prot1
= (p
== NULL
) ? 0 : p
[j
].flags
;
2201 * "region" is one continuous chunk of memory
2202 * that has same protection flags set.
2204 if (prot1
!= prot
) {
2205 end
= (i
<< (32 - L1_BITS
)) | (j
<< TARGET_PAGE_BITS
);
2207 rc
= (*fn
)(priv
, start
, end
, prot
);
2208 /* callback can stop iteration by returning != 0 */
2225 static int dump_region(void *priv
, unsigned long start
,
2226 unsigned long end
, unsigned long prot
)
2228 FILE *f
= (FILE *)priv
;
2230 (void) fprintf(f
, "%08lx-%08lx %08lx %c%c%c\n",
2231 start
, end
, end
- start
,
2232 ((prot
& PAGE_READ
) ? 'r' : '-'),
2233 ((prot
& PAGE_WRITE
) ? 'w' : '-'),
2234 ((prot
& PAGE_EXEC
) ? 'x' : '-'));
2239 /* dump memory mappings */
2240 void page_dump(FILE *f
)
2242 (void) fprintf(f
, "%-8s %-8s %-8s %s\n",
2243 "start", "end", "size", "prot");
2244 walk_memory_regions(f
, dump_region
);
2247 int page_get_flags(target_ulong address
)
2251 p
= page_find(address
>> TARGET_PAGE_BITS
);
2257 /* modify the flags of a page and invalidate the code if
2258 necessary. The flag PAGE_WRITE_ORG is positioned automatically
2259 depending on PAGE_WRITE */
2260 void page_set_flags(target_ulong start
, target_ulong end
, int flags
)
2265 /* mmap_lock should already be held. */
2266 start
= start
& TARGET_PAGE_MASK
;
2267 end
= TARGET_PAGE_ALIGN(end
);
2268 if (flags
& PAGE_WRITE
)
2269 flags
|= PAGE_WRITE_ORG
;
2270 for(addr
= start
; addr
< end
; addr
+= TARGET_PAGE_SIZE
) {
2271 p
= page_find_alloc(addr
>> TARGET_PAGE_BITS
);
2272 /* We may be called for host regions that are outside guest
2276 /* if the write protection is set, then we invalidate the code
2278 if (!(p
->flags
& PAGE_WRITE
) &&
2279 (flags
& PAGE_WRITE
) &&
2281 tb_invalidate_phys_page(addr
, 0, NULL
);
2287 int page_check_range(target_ulong start
, target_ulong len
, int flags
)
2293 if (start
+ len
< start
)
2294 /* we've wrapped around */
2297 end
= TARGET_PAGE_ALIGN(start
+len
); /* must do before we loose bits in the next step */
2298 start
= start
& TARGET_PAGE_MASK
;
2300 for(addr
= start
; addr
< end
; addr
+= TARGET_PAGE_SIZE
) {
2301 p
= page_find(addr
>> TARGET_PAGE_BITS
);
2304 if( !(p
->flags
& PAGE_VALID
) )
2307 if ((flags
& PAGE_READ
) && !(p
->flags
& PAGE_READ
))
2309 if (flags
& PAGE_WRITE
) {
2310 if (!(p
->flags
& PAGE_WRITE_ORG
))
2312 /* unprotect the page if it was put read-only because it
2313 contains translated code */
2314 if (!(p
->flags
& PAGE_WRITE
)) {
2315 if (!page_unprotect(addr
, 0, NULL
))
2324 /* called from signal handler: invalidate the code and unprotect the
2325 page. Return TRUE if the fault was successfully handled. */
2326 int page_unprotect(target_ulong address
, unsigned long pc
, void *puc
)
2328 unsigned int page_index
, prot
, pindex
;
2330 target_ulong host_start
, host_end
, addr
;
2332 /* Technically this isn't safe inside a signal handler. However we
2333 know this only ever happens in a synchronous SEGV handler, so in
2334 practice it seems to be ok. */
2337 host_start
= address
& qemu_host_page_mask
;
2338 page_index
= host_start
>> TARGET_PAGE_BITS
;
2339 p1
= page_find(page_index
);
2344 host_end
= host_start
+ qemu_host_page_size
;
2347 for(addr
= host_start
;addr
< host_end
; addr
+= TARGET_PAGE_SIZE
) {
2351 /* if the page was really writable, then we change its
2352 protection back to writable */
2353 if (prot
& PAGE_WRITE_ORG
) {
2354 pindex
= (address
- host_start
) >> TARGET_PAGE_BITS
;
2355 if (!(p1
[pindex
].flags
& PAGE_WRITE
)) {
2356 mprotect((void *)g2h(host_start
), qemu_host_page_size
,
2357 (prot
& PAGE_BITS
) | PAGE_WRITE
);
2358 p1
[pindex
].flags
|= PAGE_WRITE
;
2359 /* and since the content will be modified, we must invalidate
2360 the corresponding translated code. */
2361 tb_invalidate_phys_page(address
, pc
, puc
);
2362 #ifdef DEBUG_TB_CHECK
2363 tb_invalidate_check(address
);
2373 static inline void tlb_set_dirty(CPUState
*env
,
2374 unsigned long addr
, target_ulong vaddr
)
2377 #endif /* defined(CONFIG_USER_ONLY) */
2379 #if !defined(CONFIG_USER_ONLY)
2381 #define SUBPAGE_IDX(addr) ((addr) & ~TARGET_PAGE_MASK)
2382 typedef struct subpage_t
{
2383 target_phys_addr_t base
;
2384 CPUReadMemoryFunc
* const *mem_read
[TARGET_PAGE_SIZE
][4];
2385 CPUWriteMemoryFunc
* const *mem_write
[TARGET_PAGE_SIZE
][4];
2386 void *opaque
[TARGET_PAGE_SIZE
][2][4];
2387 ram_addr_t region_offset
[TARGET_PAGE_SIZE
][2][4];
2390 static int subpage_register (subpage_t
*mmio
, uint32_t start
, uint32_t end
,
2391 ram_addr_t memory
, ram_addr_t region_offset
);
2392 static void *subpage_init (target_phys_addr_t base
, ram_addr_t
*phys
,
2393 ram_addr_t orig_memory
, ram_addr_t region_offset
);
2394 #define CHECK_SUBPAGE(addr, start_addr, start_addr2, end_addr, end_addr2, \
2397 if (addr > start_addr) \
2400 start_addr2 = start_addr & ~TARGET_PAGE_MASK; \
2401 if (start_addr2 > 0) \
2405 if ((start_addr + orig_size) - addr >= TARGET_PAGE_SIZE) \
2406 end_addr2 = TARGET_PAGE_SIZE - 1; \
2408 end_addr2 = (start_addr + orig_size - 1) & ~TARGET_PAGE_MASK; \
2409 if (end_addr2 < TARGET_PAGE_SIZE - 1) \
2414 /* register physical memory.
2415 For RAM, 'size' must be a multiple of the target page size.
2416 If (phys_offset & ~TARGET_PAGE_MASK) != 0, then it is an
2417 io memory page. The address used when calling the IO function is
2418 the offset from the start of the region, plus region_offset. Both
2419 start_addr and region_offset are rounded down to a page boundary
2420 before calculating this offset. This should not be a problem unless
2421 the low bits of start_addr and region_offset differ. */
2422 void cpu_register_physical_memory_offset(target_phys_addr_t start_addr
,
2424 ram_addr_t phys_offset
,
2425 ram_addr_t region_offset
)
2427 target_phys_addr_t addr
, end_addr
;
2430 ram_addr_t orig_size
= size
;
2433 cpu_notify_set_memory(start_addr
, size
, phys_offset
);
2435 if (phys_offset
== IO_MEM_UNASSIGNED
) {
2436 region_offset
= start_addr
;
2438 region_offset
&= TARGET_PAGE_MASK
;
2439 size
= (size
+ TARGET_PAGE_SIZE
- 1) & TARGET_PAGE_MASK
;
2440 end_addr
= start_addr
+ (target_phys_addr_t
)size
;
2441 for(addr
= start_addr
; addr
!= end_addr
; addr
+= TARGET_PAGE_SIZE
) {
2442 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
2443 if (p
&& p
->phys_offset
!= IO_MEM_UNASSIGNED
) {
2444 ram_addr_t orig_memory
= p
->phys_offset
;
2445 target_phys_addr_t start_addr2
, end_addr2
;
2446 int need_subpage
= 0;
2448 CHECK_SUBPAGE(addr
, start_addr
, start_addr2
, end_addr
, end_addr2
,
2450 if (need_subpage
|| phys_offset
& IO_MEM_SUBWIDTH
) {
2451 if (!(orig_memory
& IO_MEM_SUBPAGE
)) {
2452 subpage
= subpage_init((addr
& TARGET_PAGE_MASK
),
2453 &p
->phys_offset
, orig_memory
,
2456 subpage
= io_mem_opaque
[(orig_memory
& ~TARGET_PAGE_MASK
)
2459 subpage_register(subpage
, start_addr2
, end_addr2
, phys_offset
,
2461 p
->region_offset
= 0;
2463 p
->phys_offset
= phys_offset
;
2464 if ((phys_offset
& ~TARGET_PAGE_MASK
) <= IO_MEM_ROM
||
2465 (phys_offset
& IO_MEM_ROMD
))
2466 phys_offset
+= TARGET_PAGE_SIZE
;
2469 p
= phys_page_find_alloc(addr
>> TARGET_PAGE_BITS
, 1);
2470 p
->phys_offset
= phys_offset
;
2471 p
->region_offset
= region_offset
;
2472 if ((phys_offset
& ~TARGET_PAGE_MASK
) <= IO_MEM_ROM
||
2473 (phys_offset
& IO_MEM_ROMD
)) {
2474 phys_offset
+= TARGET_PAGE_SIZE
;
2476 target_phys_addr_t start_addr2
, end_addr2
;
2477 int need_subpage
= 0;
2479 CHECK_SUBPAGE(addr
, start_addr
, start_addr2
, end_addr
,
2480 end_addr2
, need_subpage
);
2482 if (need_subpage
|| phys_offset
& IO_MEM_SUBWIDTH
) {
2483 subpage
= subpage_init((addr
& TARGET_PAGE_MASK
),
2484 &p
->phys_offset
, IO_MEM_UNASSIGNED
,
2485 addr
& TARGET_PAGE_MASK
);
2486 subpage_register(subpage
, start_addr2
, end_addr2
,
2487 phys_offset
, region_offset
);
2488 p
->region_offset
= 0;
2492 region_offset
+= TARGET_PAGE_SIZE
;
2495 /* since each CPU stores ram addresses in its TLB cache, we must
2496 reset the modified entries */
2498 for(env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
) {
2503 /* XXX: temporary until new memory mapping API */
2504 ram_addr_t
cpu_get_physical_page_desc(target_phys_addr_t addr
)
2508 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
2510 return IO_MEM_UNASSIGNED
;
2511 return p
->phys_offset
;
2514 void qemu_register_coalesced_mmio(target_phys_addr_t addr
, ram_addr_t size
)
2517 kvm_coalesce_mmio_region(addr
, size
);
2520 void qemu_unregister_coalesced_mmio(target_phys_addr_t addr
, ram_addr_t size
)
2523 kvm_uncoalesce_mmio_region(addr
, size
);
2526 void qemu_flush_coalesced_mmio_buffer(void)
2529 kvm_flush_coalesced_mmio_buffer();
2532 #if defined(__linux__) && !defined(TARGET_S390X)
2534 #include <sys/vfs.h>
2536 #define HUGETLBFS_MAGIC 0x958458f6
2538 static long gethugepagesize(const char *path
)
2544 ret
= statfs(path
, &fs
);
2545 } while (ret
!= 0 && errno
== EINTR
);
2552 if (fs
.f_type
!= HUGETLBFS_MAGIC
)
2553 fprintf(stderr
, "Warning: path not on HugeTLBFS: %s\n", path
);
2558 static void *file_ram_alloc(ram_addr_t memory
, const char *path
)
2566 unsigned long hpagesize
;
2568 hpagesize
= gethugepagesize(path
);
2573 if (memory
< hpagesize
) {
2577 if (kvm_enabled() && !kvm_has_sync_mmu()) {
2578 fprintf(stderr
, "host lacks kvm mmu notifiers, -mem-path unsupported\n");
2582 if (asprintf(&filename
, "%s/qemu_back_mem.XXXXXX", path
) == -1) {
2586 fd
= mkstemp(filename
);
2595 memory
= (memory
+hpagesize
-1) & ~(hpagesize
-1);
2598 * ftruncate is not supported by hugetlbfs in older
2599 * hosts, so don't bother bailing out on errors.
2600 * If anything goes wrong with it under other filesystems,
2603 if (ftruncate(fd
, memory
))
2604 perror("ftruncate");
2607 /* NB: MAP_POPULATE won't exhaustively alloc all phys pages in the case
2608 * MAP_PRIVATE is requested. For mem_prealloc we mmap as MAP_SHARED
2609 * to sidestep this quirk.
2611 flags
= mem_prealloc
? MAP_POPULATE
| MAP_SHARED
: MAP_PRIVATE
;
2612 area
= mmap(0, memory
, PROT_READ
| PROT_WRITE
, flags
, fd
, 0);
2614 area
= mmap(0, memory
, PROT_READ
| PROT_WRITE
, MAP_PRIVATE
, fd
, 0);
2616 if (area
== MAP_FAILED
) {
2617 perror("file_ram_alloc: can't mmap RAM pages");
2625 ram_addr_t
qemu_ram_alloc(ram_addr_t size
)
2627 RAMBlock
*new_block
;
2629 size
= TARGET_PAGE_ALIGN(size
);
2630 new_block
= qemu_malloc(sizeof(*new_block
));
2633 #if defined (__linux__) && !defined(TARGET_S390X)
2634 new_block
->host
= file_ram_alloc(size
, mem_path
);
2635 if (!new_block
->host
)
2638 fprintf(stderr
, "-mem-path option unsupported\n");
2642 #if defined(TARGET_S390X) && defined(CONFIG_KVM)
2643 /* XXX S390 KVM requires the topmost vma of the RAM to be < 256GB */
2644 new_block
->host
= mmap((void*)0x1000000, size
,
2645 PROT_EXEC
|PROT_READ
|PROT_WRITE
,
2646 MAP_SHARED
| MAP_ANONYMOUS
, -1, 0);
2648 new_block
->host
= qemu_vmalloc(size
);
2650 #ifdef MADV_MERGEABLE
2651 madvise(new_block
->host
, size
, MADV_MERGEABLE
);
2654 new_block
->offset
= last_ram_offset
;
2655 new_block
->length
= size
;
2657 new_block
->next
= ram_blocks
;
2658 ram_blocks
= new_block
;
2660 phys_ram_dirty
= qemu_realloc(phys_ram_dirty
,
2661 (last_ram_offset
+ size
) >> TARGET_PAGE_BITS
);
2662 memset(phys_ram_dirty
+ (last_ram_offset
>> TARGET_PAGE_BITS
),
2663 0xff, size
>> TARGET_PAGE_BITS
);
2665 last_ram_offset
+= size
;
2668 kvm_setup_guest_memory(new_block
->host
, size
);
2670 return new_block
->offset
;
2673 void qemu_ram_free(ram_addr_t addr
)
2675 /* TODO: implement this. */
2678 /* Return a host pointer to ram allocated with qemu_ram_alloc.
2679 With the exception of the softmmu code in this file, this should
2680 only be used for local memory (e.g. video ram) that the device owns,
2681 and knows it isn't going to access beyond the end of the block.
2683 It should not be used for general purpose DMA.
2684 Use cpu_physical_memory_map/cpu_physical_memory_rw instead.
2686 void *qemu_get_ram_ptr(ram_addr_t addr
)
2693 prevp
= &ram_blocks
;
2695 while (block
&& (block
->offset
> addr
2696 || block
->offset
+ block
->length
<= addr
)) {
2698 prevp
= &prev
->next
;
2700 block
= block
->next
;
2703 fprintf(stderr
, "Bad ram offset %" PRIx64
"\n", (uint64_t)addr
);
2706 /* Move this entry to to start of the list. */
2708 prev
->next
= block
->next
;
2709 block
->next
= *prevp
;
2712 return block
->host
+ (addr
- block
->offset
);
2715 /* Some of the softmmu routines need to translate from a host pointer
2716 (typically a TLB entry) back to a ram offset. */
2717 ram_addr_t
qemu_ram_addr_from_host(void *ptr
)
2721 uint8_t *host
= ptr
;
2725 while (block
&& (block
->host
> host
2726 || block
->host
+ block
->length
<= host
)) {
2728 block
= block
->next
;
2731 fprintf(stderr
, "Bad ram pointer %p\n", ptr
);
2734 return block
->offset
+ (host
- block
->host
);
2737 static uint32_t unassigned_mem_readb(void *opaque
, target_phys_addr_t addr
)
2739 #ifdef DEBUG_UNASSIGNED
2740 printf("Unassigned mem read " TARGET_FMT_plx
"\n", addr
);
2742 #if defined(TARGET_SPARC) || defined(TARGET_MICROBLAZE)
2743 do_unassigned_access(addr
, 0, 0, 0, 1);
2748 static uint32_t unassigned_mem_readw(void *opaque
, target_phys_addr_t addr
)
2750 #ifdef DEBUG_UNASSIGNED
2751 printf("Unassigned mem read " TARGET_FMT_plx
"\n", addr
);
2753 #if defined(TARGET_SPARC) || defined(TARGET_MICROBLAZE)
2754 do_unassigned_access(addr
, 0, 0, 0, 2);
2759 static uint32_t unassigned_mem_readl(void *opaque
, target_phys_addr_t addr
)
2761 #ifdef DEBUG_UNASSIGNED
2762 printf("Unassigned mem read " TARGET_FMT_plx
"\n", addr
);
2764 #if defined(TARGET_SPARC) || defined(TARGET_MICROBLAZE)
2765 do_unassigned_access(addr
, 0, 0, 0, 4);
2770 static void unassigned_mem_writeb(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
2772 #ifdef DEBUG_UNASSIGNED
2773 printf("Unassigned mem write " TARGET_FMT_plx
" = 0x%x\n", addr
, val
);
2775 #if defined(TARGET_SPARC) || defined(TARGET_MICROBLAZE)
2776 do_unassigned_access(addr
, 1, 0, 0, 1);
2780 static void unassigned_mem_writew(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
2782 #ifdef DEBUG_UNASSIGNED
2783 printf("Unassigned mem write " TARGET_FMT_plx
" = 0x%x\n", addr
, val
);
2785 #if defined(TARGET_SPARC) || defined(TARGET_MICROBLAZE)
2786 do_unassigned_access(addr
, 1, 0, 0, 2);
2790 static void unassigned_mem_writel(void *opaque
, target_phys_addr_t addr
, uint32_t val
)
2792 #ifdef DEBUG_UNASSIGNED
2793 printf("Unassigned mem write " TARGET_FMT_plx
" = 0x%x\n", addr
, val
);
2795 #if defined(TARGET_SPARC) || defined(TARGET_MICROBLAZE)
2796 do_unassigned_access(addr
, 1, 0, 0, 4);
2800 static CPUReadMemoryFunc
* const unassigned_mem_read
[3] = {
2801 unassigned_mem_readb
,
2802 unassigned_mem_readw
,
2803 unassigned_mem_readl
,
2806 static CPUWriteMemoryFunc
* const unassigned_mem_write
[3] = {
2807 unassigned_mem_writeb
,
2808 unassigned_mem_writew
,
2809 unassigned_mem_writel
,
2812 static void notdirty_mem_writeb(void *opaque
, target_phys_addr_t ram_addr
,
2816 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2817 if (!(dirty_flags
& CODE_DIRTY_FLAG
)) {
2818 #if !defined(CONFIG_USER_ONLY)
2819 tb_invalidate_phys_page_fast(ram_addr
, 1);
2820 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2823 stb_p(qemu_get_ram_ptr(ram_addr
), val
);
2824 dirty_flags
|= (0xff & ~CODE_DIRTY_FLAG
);
2825 phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
] = dirty_flags
;
2826 /* we remove the notdirty callback only if the code has been
2828 if (dirty_flags
== 0xff)
2829 tlb_set_dirty(cpu_single_env
, cpu_single_env
->mem_io_vaddr
);
2832 static void notdirty_mem_writew(void *opaque
, target_phys_addr_t ram_addr
,
2836 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2837 if (!(dirty_flags
& CODE_DIRTY_FLAG
)) {
2838 #if !defined(CONFIG_USER_ONLY)
2839 tb_invalidate_phys_page_fast(ram_addr
, 2);
2840 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2843 stw_p(qemu_get_ram_ptr(ram_addr
), val
);
2844 dirty_flags
|= (0xff & ~CODE_DIRTY_FLAG
);
2845 phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
] = dirty_flags
;
2846 /* we remove the notdirty callback only if the code has been
2848 if (dirty_flags
== 0xff)
2849 tlb_set_dirty(cpu_single_env
, cpu_single_env
->mem_io_vaddr
);
2852 static void notdirty_mem_writel(void *opaque
, target_phys_addr_t ram_addr
,
2856 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2857 if (!(dirty_flags
& CODE_DIRTY_FLAG
)) {
2858 #if !defined(CONFIG_USER_ONLY)
2859 tb_invalidate_phys_page_fast(ram_addr
, 4);
2860 dirty_flags
= phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
];
2863 stl_p(qemu_get_ram_ptr(ram_addr
), val
);
2864 dirty_flags
|= (0xff & ~CODE_DIRTY_FLAG
);
2865 phys_ram_dirty
[ram_addr
>> TARGET_PAGE_BITS
] = dirty_flags
;
2866 /* we remove the notdirty callback only if the code has been
2868 if (dirty_flags
== 0xff)
2869 tlb_set_dirty(cpu_single_env
, cpu_single_env
->mem_io_vaddr
);
2872 static CPUReadMemoryFunc
* const error_mem_read
[3] = {
2873 NULL
, /* never used */
2874 NULL
, /* never used */
2875 NULL
, /* never used */
2878 static CPUWriteMemoryFunc
* const notdirty_mem_write
[3] = {
2879 notdirty_mem_writeb
,
2880 notdirty_mem_writew
,
2881 notdirty_mem_writel
,
2884 /* Generate a debug exception if a watchpoint has been hit. */
2885 static void check_watchpoint(int offset
, int len_mask
, int flags
)
2887 CPUState
*env
= cpu_single_env
;
2888 target_ulong pc
, cs_base
;
2889 TranslationBlock
*tb
;
2894 if (env
->watchpoint_hit
) {
2895 /* We re-entered the check after replacing the TB. Now raise
2896 * the debug interrupt so that is will trigger after the
2897 * current instruction. */
2898 cpu_interrupt(env
, CPU_INTERRUPT_DEBUG
);
2901 vaddr
= (env
->mem_io_vaddr
& TARGET_PAGE_MASK
) + offset
;
2902 QTAILQ_FOREACH(wp
, &env
->watchpoints
, entry
) {
2903 if ((vaddr
== (wp
->vaddr
& len_mask
) ||
2904 (vaddr
& wp
->len_mask
) == wp
->vaddr
) && (wp
->flags
& flags
)) {
2905 wp
->flags
|= BP_WATCHPOINT_HIT
;
2906 if (!env
->watchpoint_hit
) {
2907 env
->watchpoint_hit
= wp
;
2908 tb
= tb_find_pc(env
->mem_io_pc
);
2910 cpu_abort(env
, "check_watchpoint: could not find TB for "
2911 "pc=%p", (void *)env
->mem_io_pc
);
2913 cpu_restore_state(tb
, env
, env
->mem_io_pc
, NULL
);
2914 tb_phys_invalidate(tb
, -1);
2915 if (wp
->flags
& BP_STOP_BEFORE_ACCESS
) {
2916 env
->exception_index
= EXCP_DEBUG
;
2918 cpu_get_tb_cpu_state(env
, &pc
, &cs_base
, &cpu_flags
);
2919 tb_gen_code(env
, pc
, cs_base
, cpu_flags
, 1);
2921 cpu_resume_from_signal(env
, NULL
);
2924 wp
->flags
&= ~BP_WATCHPOINT_HIT
;
2929 /* Watchpoint access routines. Watchpoints are inserted using TLB tricks,
2930 so these check for a hit then pass through to the normal out-of-line
2932 static uint32_t watch_mem_readb(void *opaque
, target_phys_addr_t addr
)
2934 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x0, BP_MEM_READ
);
2935 return ldub_phys(addr
);
2938 static uint32_t watch_mem_readw(void *opaque
, target_phys_addr_t addr
)
2940 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x1, BP_MEM_READ
);
2941 return lduw_phys(addr
);
2944 static uint32_t watch_mem_readl(void *opaque
, target_phys_addr_t addr
)
2946 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x3, BP_MEM_READ
);
2947 return ldl_phys(addr
);
2950 static void watch_mem_writeb(void *opaque
, target_phys_addr_t addr
,
2953 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x0, BP_MEM_WRITE
);
2954 stb_phys(addr
, val
);
2957 static void watch_mem_writew(void *opaque
, target_phys_addr_t addr
,
2960 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x1, BP_MEM_WRITE
);
2961 stw_phys(addr
, val
);
2964 static void watch_mem_writel(void *opaque
, target_phys_addr_t addr
,
2967 check_watchpoint(addr
& ~TARGET_PAGE_MASK
, ~0x3, BP_MEM_WRITE
);
2968 stl_phys(addr
, val
);
2971 static CPUReadMemoryFunc
* const watch_mem_read
[3] = {
2977 static CPUWriteMemoryFunc
* const watch_mem_write
[3] = {
2983 static inline uint32_t subpage_readlen (subpage_t
*mmio
, target_phys_addr_t addr
,
2989 idx
= SUBPAGE_IDX(addr
);
2990 #if defined(DEBUG_SUBPAGE)
2991 printf("%s: subpage %p len %d addr " TARGET_FMT_plx
" idx %d\n", __func__
,
2992 mmio
, len
, addr
, idx
);
2994 ret
= (**mmio
->mem_read
[idx
][len
])(mmio
->opaque
[idx
][0][len
],
2995 addr
+ mmio
->region_offset
[idx
][0][len
]);
3000 static inline void subpage_writelen (subpage_t
*mmio
, target_phys_addr_t addr
,
3001 uint32_t value
, unsigned int len
)
3005 idx
= SUBPAGE_IDX(addr
);
3006 #if defined(DEBUG_SUBPAGE)
3007 printf("%s: subpage %p len %d addr " TARGET_FMT_plx
" idx %d value %08x\n", __func__
,
3008 mmio
, len
, addr
, idx
, value
);
3010 (**mmio
->mem_write
[idx
][len
])(mmio
->opaque
[idx
][1][len
],
3011 addr
+ mmio
->region_offset
[idx
][1][len
],
3015 static uint32_t subpage_readb (void *opaque
, target_phys_addr_t addr
)
3017 #if defined(DEBUG_SUBPAGE)
3018 printf("%s: addr " TARGET_FMT_plx
"\n", __func__
, addr
);
3021 return subpage_readlen(opaque
, addr
, 0);
3024 static void subpage_writeb (void *opaque
, target_phys_addr_t addr
,
3027 #if defined(DEBUG_SUBPAGE)
3028 printf("%s: addr " TARGET_FMT_plx
" val %08x\n", __func__
, addr
, value
);
3030 subpage_writelen(opaque
, addr
, value
, 0);
3033 static uint32_t subpage_readw (void *opaque
, target_phys_addr_t addr
)
3035 #if defined(DEBUG_SUBPAGE)
3036 printf("%s: addr " TARGET_FMT_plx
"\n", __func__
, addr
);
3039 return subpage_readlen(opaque
, addr
, 1);
3042 static void subpage_writew (void *opaque
, target_phys_addr_t addr
,
3045 #if defined(DEBUG_SUBPAGE)
3046 printf("%s: addr " TARGET_FMT_plx
" val %08x\n", __func__
, addr
, value
);
3048 subpage_writelen(opaque
, addr
, value
, 1);
3051 static uint32_t subpage_readl (void *opaque
, target_phys_addr_t addr
)
3053 #if defined(DEBUG_SUBPAGE)
3054 printf("%s: addr " TARGET_FMT_plx
"\n", __func__
, addr
);
3057 return subpage_readlen(opaque
, addr
, 2);
3060 static void subpage_writel (void *opaque
,
3061 target_phys_addr_t addr
, uint32_t value
)
3063 #if defined(DEBUG_SUBPAGE)
3064 printf("%s: addr " TARGET_FMT_plx
" val %08x\n", __func__
, addr
, value
);
3066 subpage_writelen(opaque
, addr
, value
, 2);
3069 static CPUReadMemoryFunc
* const subpage_read
[] = {
3075 static CPUWriteMemoryFunc
* const subpage_write
[] = {
3081 static int subpage_register (subpage_t
*mmio
, uint32_t start
, uint32_t end
,
3082 ram_addr_t memory
, ram_addr_t region_offset
)
3087 if (start
>= TARGET_PAGE_SIZE
|| end
>= TARGET_PAGE_SIZE
)
3089 idx
= SUBPAGE_IDX(start
);
3090 eidx
= SUBPAGE_IDX(end
);
3091 #if defined(DEBUG_SUBPAGE)
3092 printf("%s: %p start %08x end %08x idx %08x eidx %08x mem %ld\n", __func__
,
3093 mmio
, start
, end
, idx
, eidx
, memory
);
3095 memory
>>= IO_MEM_SHIFT
;
3096 for (; idx
<= eidx
; idx
++) {
3097 for (i
= 0; i
< 4; i
++) {
3098 if (io_mem_read
[memory
][i
]) {
3099 mmio
->mem_read
[idx
][i
] = &io_mem_read
[memory
][i
];
3100 mmio
->opaque
[idx
][0][i
] = io_mem_opaque
[memory
];
3101 mmio
->region_offset
[idx
][0][i
] = region_offset
;
3103 if (io_mem_write
[memory
][i
]) {
3104 mmio
->mem_write
[idx
][i
] = &io_mem_write
[memory
][i
];
3105 mmio
->opaque
[idx
][1][i
] = io_mem_opaque
[memory
];
3106 mmio
->region_offset
[idx
][1][i
] = region_offset
;
3114 static void *subpage_init (target_phys_addr_t base
, ram_addr_t
*phys
,
3115 ram_addr_t orig_memory
, ram_addr_t region_offset
)
3120 mmio
= qemu_mallocz(sizeof(subpage_t
));
3123 subpage_memory
= cpu_register_io_memory(subpage_read
, subpage_write
, mmio
);
3124 #if defined(DEBUG_SUBPAGE)
3125 printf("%s: %p base " TARGET_FMT_plx
" len %08x %d\n", __func__
,
3126 mmio
, base
, TARGET_PAGE_SIZE
, subpage_memory
);
3128 *phys
= subpage_memory
| IO_MEM_SUBPAGE
;
3129 subpage_register(mmio
, 0, TARGET_PAGE_SIZE
- 1, orig_memory
,
3135 static int get_free_io_mem_idx(void)
3139 for (i
= 0; i
<IO_MEM_NB_ENTRIES
; i
++)
3140 if (!io_mem_used
[i
]) {
3144 fprintf(stderr
, "RAN out out io_mem_idx, max %d !\n", IO_MEM_NB_ENTRIES
);
3148 /* mem_read and mem_write are arrays of functions containing the
3149 function to access byte (index 0), word (index 1) and dword (index
3150 2). Functions can be omitted with a NULL function pointer.
3151 If io_index is non zero, the corresponding io zone is
3152 modified. If it is zero, a new io zone is allocated. The return
3153 value can be used with cpu_register_physical_memory(). (-1) is
3154 returned if error. */
3155 static int cpu_register_io_memory_fixed(int io_index
,
3156 CPUReadMemoryFunc
* const *mem_read
,
3157 CPUWriteMemoryFunc
* const *mem_write
,
3160 int i
, subwidth
= 0;
3162 if (io_index
<= 0) {
3163 io_index
= get_free_io_mem_idx();
3167 io_index
>>= IO_MEM_SHIFT
;
3168 if (io_index
>= IO_MEM_NB_ENTRIES
)
3172 for(i
= 0;i
< 3; i
++) {
3173 if (!mem_read
[i
] || !mem_write
[i
])
3174 subwidth
= IO_MEM_SUBWIDTH
;
3175 io_mem_read
[io_index
][i
] = mem_read
[i
];
3176 io_mem_write
[io_index
][i
] = mem_write
[i
];
3178 io_mem_opaque
[io_index
] = opaque
;
3179 return (io_index
<< IO_MEM_SHIFT
) | subwidth
;
3182 int cpu_register_io_memory(CPUReadMemoryFunc
* const *mem_read
,
3183 CPUWriteMemoryFunc
* const *mem_write
,
3186 return cpu_register_io_memory_fixed(0, mem_read
, mem_write
, opaque
);
3189 void cpu_unregister_io_memory(int io_table_address
)
3192 int io_index
= io_table_address
>> IO_MEM_SHIFT
;
3194 for (i
=0;i
< 3; i
++) {
3195 io_mem_read
[io_index
][i
] = unassigned_mem_read
[i
];
3196 io_mem_write
[io_index
][i
] = unassigned_mem_write
[i
];
3198 io_mem_opaque
[io_index
] = NULL
;
3199 io_mem_used
[io_index
] = 0;
3202 static void io_mem_init(void)
3206 cpu_register_io_memory_fixed(IO_MEM_ROM
, error_mem_read
, unassigned_mem_write
, NULL
);
3207 cpu_register_io_memory_fixed(IO_MEM_UNASSIGNED
, unassigned_mem_read
, unassigned_mem_write
, NULL
);
3208 cpu_register_io_memory_fixed(IO_MEM_NOTDIRTY
, error_mem_read
, notdirty_mem_write
, NULL
);
3212 io_mem_watch
= cpu_register_io_memory(watch_mem_read
,
3213 watch_mem_write
, NULL
);
3216 #endif /* !defined(CONFIG_USER_ONLY) */
3218 /* physical memory access (slow version, mainly for debug) */
3219 #if defined(CONFIG_USER_ONLY)
3220 int cpu_memory_rw_debug(CPUState
*env
, target_ulong addr
,
3221 uint8_t *buf
, int len
, int is_write
)
3228 page
= addr
& TARGET_PAGE_MASK
;
3229 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3232 flags
= page_get_flags(page
);
3233 if (!(flags
& PAGE_VALID
))
3236 if (!(flags
& PAGE_WRITE
))
3238 /* XXX: this code should not depend on lock_user */
3239 if (!(p
= lock_user(VERIFY_WRITE
, addr
, l
, 0)))
3242 unlock_user(p
, addr
, l
);
3244 if (!(flags
& PAGE_READ
))
3246 /* XXX: this code should not depend on lock_user */
3247 if (!(p
= lock_user(VERIFY_READ
, addr
, l
, 1)))
3250 unlock_user(p
, addr
, 0);
3260 void cpu_physical_memory_rw(target_phys_addr_t addr
, uint8_t *buf
,
3261 int len
, int is_write
)
3266 target_phys_addr_t page
;
3271 page
= addr
& TARGET_PAGE_MASK
;
3272 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3275 p
= phys_page_find(page
>> TARGET_PAGE_BITS
);
3277 pd
= IO_MEM_UNASSIGNED
;
3279 pd
= p
->phys_offset
;
3283 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3284 target_phys_addr_t addr1
= addr
;
3285 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3287 addr1
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3288 /* XXX: could force cpu_single_env to NULL to avoid
3290 if (l
>= 4 && ((addr1
& 3) == 0)) {
3291 /* 32 bit write access */
3293 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr1
, val
);
3295 } else if (l
>= 2 && ((addr1
& 1) == 0)) {
3296 /* 16 bit write access */
3298 io_mem_write
[io_index
][1](io_mem_opaque
[io_index
], addr1
, val
);
3301 /* 8 bit write access */
3303 io_mem_write
[io_index
][0](io_mem_opaque
[io_index
], addr1
, val
);
3307 unsigned long addr1
;
3308 addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3310 ptr
= qemu_get_ram_ptr(addr1
);
3311 memcpy(ptr
, buf
, l
);
3312 if (!cpu_physical_memory_is_dirty(addr1
)) {
3313 /* invalidate code */
3314 tb_invalidate_phys_page_range(addr1
, addr1
+ l
, 0);
3316 phys_ram_dirty
[addr1
>> TARGET_PAGE_BITS
] |=
3317 (0xff & ~CODE_DIRTY_FLAG
);
3321 if ((pd
& ~TARGET_PAGE_MASK
) > IO_MEM_ROM
&&
3322 !(pd
& IO_MEM_ROMD
)) {
3323 target_phys_addr_t addr1
= addr
;
3325 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3327 addr1
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3328 if (l
>= 4 && ((addr1
& 3) == 0)) {
3329 /* 32 bit read access */
3330 val
= io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr1
);
3333 } else if (l
>= 2 && ((addr1
& 1) == 0)) {
3334 /* 16 bit read access */
3335 val
= io_mem_read
[io_index
][1](io_mem_opaque
[io_index
], addr1
);
3339 /* 8 bit read access */
3340 val
= io_mem_read
[io_index
][0](io_mem_opaque
[io_index
], addr1
);
3346 ptr
= qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
) +
3347 (addr
& ~TARGET_PAGE_MASK
);
3348 memcpy(buf
, ptr
, l
);
3357 /* used for ROM loading : can write in RAM and ROM */
3358 void cpu_physical_memory_write_rom(target_phys_addr_t addr
,
3359 const uint8_t *buf
, int len
)
3363 target_phys_addr_t page
;
3368 page
= addr
& TARGET_PAGE_MASK
;
3369 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3372 p
= phys_page_find(page
>> TARGET_PAGE_BITS
);
3374 pd
= IO_MEM_UNASSIGNED
;
3376 pd
= p
->phys_offset
;
3379 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
&&
3380 (pd
& ~TARGET_PAGE_MASK
) != IO_MEM_ROM
&&
3381 !(pd
& IO_MEM_ROMD
)) {
3384 unsigned long addr1
;
3385 addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3387 ptr
= qemu_get_ram_ptr(addr1
);
3388 memcpy(ptr
, buf
, l
);
3398 target_phys_addr_t addr
;
3399 target_phys_addr_t len
;
3402 static BounceBuffer bounce
;
3404 typedef struct MapClient
{
3406 void (*callback
)(void *opaque
);
3407 QLIST_ENTRY(MapClient
) link
;
3410 static QLIST_HEAD(map_client_list
, MapClient
) map_client_list
3411 = QLIST_HEAD_INITIALIZER(map_client_list
);
3413 void *cpu_register_map_client(void *opaque
, void (*callback
)(void *opaque
))
3415 MapClient
*client
= qemu_malloc(sizeof(*client
));
3417 client
->opaque
= opaque
;
3418 client
->callback
= callback
;
3419 QLIST_INSERT_HEAD(&map_client_list
, client
, link
);
3423 void cpu_unregister_map_client(void *_client
)
3425 MapClient
*client
= (MapClient
*)_client
;
3427 QLIST_REMOVE(client
, link
);
3431 static void cpu_notify_map_clients(void)
3435 while (!QLIST_EMPTY(&map_client_list
)) {
3436 client
= QLIST_FIRST(&map_client_list
);
3437 client
->callback(client
->opaque
);
3438 cpu_unregister_map_client(client
);
3442 /* Map a physical memory region into a host virtual address.
3443 * May map a subset of the requested range, given by and returned in *plen.
3444 * May return NULL if resources needed to perform the mapping are exhausted.
3445 * Use only for reads OR writes - not for read-modify-write operations.
3446 * Use cpu_register_map_client() to know when retrying the map operation is
3447 * likely to succeed.
3449 void *cpu_physical_memory_map(target_phys_addr_t addr
,
3450 target_phys_addr_t
*plen
,
3453 target_phys_addr_t len
= *plen
;
3454 target_phys_addr_t done
= 0;
3456 uint8_t *ret
= NULL
;
3458 target_phys_addr_t page
;
3461 unsigned long addr1
;
3464 page
= addr
& TARGET_PAGE_MASK
;
3465 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3468 p
= phys_page_find(page
>> TARGET_PAGE_BITS
);
3470 pd
= IO_MEM_UNASSIGNED
;
3472 pd
= p
->phys_offset
;
3475 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3476 if (done
|| bounce
.buffer
) {
3479 bounce
.buffer
= qemu_memalign(TARGET_PAGE_SIZE
, TARGET_PAGE_SIZE
);
3483 cpu_physical_memory_rw(addr
, bounce
.buffer
, l
, 0);
3485 ptr
= bounce
.buffer
;
3487 addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3488 ptr
= qemu_get_ram_ptr(addr1
);
3492 } else if (ret
+ done
!= ptr
) {
3504 /* Unmaps a memory region previously mapped by cpu_physical_memory_map().
3505 * Will also mark the memory as dirty if is_write == 1. access_len gives
3506 * the amount of memory that was actually read or written by the caller.
3508 void cpu_physical_memory_unmap(void *buffer
, target_phys_addr_t len
,
3509 int is_write
, target_phys_addr_t access_len
)
3511 if (buffer
!= bounce
.buffer
) {
3513 ram_addr_t addr1
= qemu_ram_addr_from_host(buffer
);
3514 while (access_len
) {
3516 l
= TARGET_PAGE_SIZE
;
3519 if (!cpu_physical_memory_is_dirty(addr1
)) {
3520 /* invalidate code */
3521 tb_invalidate_phys_page_range(addr1
, addr1
+ l
, 0);
3523 phys_ram_dirty
[addr1
>> TARGET_PAGE_BITS
] |=
3524 (0xff & ~CODE_DIRTY_FLAG
);
3533 cpu_physical_memory_write(bounce
.addr
, bounce
.buffer
, access_len
);
3535 qemu_vfree(bounce
.buffer
);
3536 bounce
.buffer
= NULL
;
3537 cpu_notify_map_clients();
3540 /* warning: addr must be aligned */
3541 uint32_t ldl_phys(target_phys_addr_t addr
)
3549 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3551 pd
= IO_MEM_UNASSIGNED
;
3553 pd
= p
->phys_offset
;
3556 if ((pd
& ~TARGET_PAGE_MASK
) > IO_MEM_ROM
&&
3557 !(pd
& IO_MEM_ROMD
)) {
3559 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3561 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3562 val
= io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
);
3565 ptr
= qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
) +
3566 (addr
& ~TARGET_PAGE_MASK
);
3572 /* warning: addr must be aligned */
3573 uint64_t ldq_phys(target_phys_addr_t addr
)
3581 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3583 pd
= IO_MEM_UNASSIGNED
;
3585 pd
= p
->phys_offset
;
3588 if ((pd
& ~TARGET_PAGE_MASK
) > IO_MEM_ROM
&&
3589 !(pd
& IO_MEM_ROMD
)) {
3591 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3593 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3594 #ifdef TARGET_WORDS_BIGENDIAN
3595 val
= (uint64_t)io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
) << 32;
3596 val
|= io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
+ 4);
3598 val
= io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
);
3599 val
|= (uint64_t)io_mem_read
[io_index
][2](io_mem_opaque
[io_index
], addr
+ 4) << 32;
3603 ptr
= qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
) +
3604 (addr
& ~TARGET_PAGE_MASK
);
3611 uint32_t ldub_phys(target_phys_addr_t addr
)
3614 cpu_physical_memory_read(addr
, &val
, 1);
3619 uint32_t lduw_phys(target_phys_addr_t addr
)
3622 cpu_physical_memory_read(addr
, (uint8_t *)&val
, 2);
3623 return tswap16(val
);
3626 /* warning: addr must be aligned. The ram page is not masked as dirty
3627 and the code inside is not invalidated. It is useful if the dirty
3628 bits are used to track modified PTEs */
3629 void stl_phys_notdirty(target_phys_addr_t addr
, uint32_t val
)
3636 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3638 pd
= IO_MEM_UNASSIGNED
;
3640 pd
= p
->phys_offset
;
3643 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3644 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3646 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3647 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
, val
);
3649 unsigned long addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3650 ptr
= qemu_get_ram_ptr(addr1
);
3653 if (unlikely(in_migration
)) {
3654 if (!cpu_physical_memory_is_dirty(addr1
)) {
3655 /* invalidate code */
3656 tb_invalidate_phys_page_range(addr1
, addr1
+ 4, 0);
3658 phys_ram_dirty
[addr1
>> TARGET_PAGE_BITS
] |=
3659 (0xff & ~CODE_DIRTY_FLAG
);
3665 void stq_phys_notdirty(target_phys_addr_t addr
, uint64_t val
)
3672 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3674 pd
= IO_MEM_UNASSIGNED
;
3676 pd
= p
->phys_offset
;
3679 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3680 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3682 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3683 #ifdef TARGET_WORDS_BIGENDIAN
3684 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
, val
>> 32);
3685 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
+ 4, val
);
3687 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
, val
);
3688 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
+ 4, val
>> 32);
3691 ptr
= qemu_get_ram_ptr(pd
& TARGET_PAGE_MASK
) +
3692 (addr
& ~TARGET_PAGE_MASK
);
3697 /* warning: addr must be aligned */
3698 void stl_phys(target_phys_addr_t addr
, uint32_t val
)
3705 p
= phys_page_find(addr
>> TARGET_PAGE_BITS
);
3707 pd
= IO_MEM_UNASSIGNED
;
3709 pd
= p
->phys_offset
;
3712 if ((pd
& ~TARGET_PAGE_MASK
) != IO_MEM_RAM
) {
3713 io_index
= (pd
>> IO_MEM_SHIFT
) & (IO_MEM_NB_ENTRIES
- 1);
3715 addr
= (addr
& ~TARGET_PAGE_MASK
) + p
->region_offset
;
3716 io_mem_write
[io_index
][2](io_mem_opaque
[io_index
], addr
, val
);
3718 unsigned long addr1
;
3719 addr1
= (pd
& TARGET_PAGE_MASK
) + (addr
& ~TARGET_PAGE_MASK
);
3721 ptr
= qemu_get_ram_ptr(addr1
);
3723 if (!cpu_physical_memory_is_dirty(addr1
)) {
3724 /* invalidate code */
3725 tb_invalidate_phys_page_range(addr1
, addr1
+ 4, 0);
3727 phys_ram_dirty
[addr1
>> TARGET_PAGE_BITS
] |=
3728 (0xff & ~CODE_DIRTY_FLAG
);
3734 void stb_phys(target_phys_addr_t addr
, uint32_t val
)
3737 cpu_physical_memory_write(addr
, &v
, 1);
3741 void stw_phys(target_phys_addr_t addr
, uint32_t val
)
3743 uint16_t v
= tswap16(val
);
3744 cpu_physical_memory_write(addr
, (const uint8_t *)&v
, 2);
3748 void stq_phys(target_phys_addr_t addr
, uint64_t val
)
3751 cpu_physical_memory_write(addr
, (const uint8_t *)&val
, 8);
3754 /* virtual memory access for debug (includes writing to ROM) */
3755 int cpu_memory_rw_debug(CPUState
*env
, target_ulong addr
,
3756 uint8_t *buf
, int len
, int is_write
)
3759 target_phys_addr_t phys_addr
;
3763 page
= addr
& TARGET_PAGE_MASK
;
3764 phys_addr
= cpu_get_phys_page_debug(env
, page
);
3765 /* if no physical page mapped, return an error */
3766 if (phys_addr
== -1)
3768 l
= (page
+ TARGET_PAGE_SIZE
) - addr
;
3771 phys_addr
+= (addr
& ~TARGET_PAGE_MASK
);
3773 cpu_physical_memory_write_rom(phys_addr
, buf
, l
);
3775 cpu_physical_memory_rw(phys_addr
, buf
, l
, is_write
);
3784 /* in deterministic execution mode, instructions doing device I/Os
3785 must be at the end of the TB */
3786 void cpu_io_recompile(CPUState
*env
, void *retaddr
)
3788 TranslationBlock
*tb
;
3790 target_ulong pc
, cs_base
;
3793 tb
= tb_find_pc((unsigned long)retaddr
);
3795 cpu_abort(env
, "cpu_io_recompile: could not find TB for pc=%p",
3798 n
= env
->icount_decr
.u16
.low
+ tb
->icount
;
3799 cpu_restore_state(tb
, env
, (unsigned long)retaddr
, NULL
);
3800 /* Calculate how many instructions had been executed before the fault
3802 n
= n
- env
->icount_decr
.u16
.low
;
3803 /* Generate a new TB ending on the I/O insn. */
3805 /* On MIPS and SH, delay slot instructions can only be restarted if
3806 they were already the first instruction in the TB. If this is not
3807 the first instruction in a TB then re-execute the preceding
3809 #if defined(TARGET_MIPS)
3810 if ((env
->hflags
& MIPS_HFLAG_BMASK
) != 0 && n
> 1) {
3811 env
->active_tc
.PC
-= 4;
3812 env
->icount_decr
.u16
.low
++;
3813 env
->hflags
&= ~MIPS_HFLAG_BMASK
;
3815 #elif defined(TARGET_SH4)
3816 if ((env
->flags
& ((DELAY_SLOT
| DELAY_SLOT_CONDITIONAL
))) != 0
3819 env
->icount_decr
.u16
.low
++;
3820 env
->flags
&= ~(DELAY_SLOT
| DELAY_SLOT_CONDITIONAL
);
3823 /* This should never happen. */
3824 if (n
> CF_COUNT_MASK
)
3825 cpu_abort(env
, "TB too big during recompile");
3827 cflags
= n
| CF_LAST_IO
;
3829 cs_base
= tb
->cs_base
;
3831 tb_phys_invalidate(tb
, -1);
3832 /* FIXME: In theory this could raise an exception. In practice
3833 we have already translated the block once so it's probably ok. */
3834 tb_gen_code(env
, pc
, cs_base
, flags
, cflags
);
3835 /* TODO: If env->pc != tb->pc (i.e. the faulting instruction was not
3836 the first in the TB) then we end up generating a whole new TB and
3837 repeating the fault, which is horribly inefficient.
3838 Better would be to execute just this insn uncached, or generate a
3840 cpu_resume_from_signal(env
, NULL
);
3843 void dump_exec_info(FILE *f
,
3844 int (*cpu_fprintf
)(FILE *f
, const char *fmt
, ...))
3846 int i
, target_code_size
, max_target_code_size
;
3847 int direct_jmp_count
, direct_jmp2_count
, cross_page
;
3848 TranslationBlock
*tb
;
3850 target_code_size
= 0;
3851 max_target_code_size
= 0;
3853 direct_jmp_count
= 0;
3854 direct_jmp2_count
= 0;
3855 for(i
= 0; i
< nb_tbs
; i
++) {
3857 target_code_size
+= tb
->size
;
3858 if (tb
->size
> max_target_code_size
)
3859 max_target_code_size
= tb
->size
;
3860 if (tb
->page_addr
[1] != -1)
3862 if (tb
->tb_next_offset
[0] != 0xffff) {
3864 if (tb
->tb_next_offset
[1] != 0xffff) {
3865 direct_jmp2_count
++;
3869 /* XXX: avoid using doubles ? */
3870 cpu_fprintf(f
, "Translation buffer state:\n");
3871 cpu_fprintf(f
, "gen code size %ld/%ld\n",
3872 code_gen_ptr
- code_gen_buffer
, code_gen_buffer_max_size
);
3873 cpu_fprintf(f
, "TB count %d/%d\n",
3874 nb_tbs
, code_gen_max_blocks
);
3875 cpu_fprintf(f
, "TB avg target size %d max=%d bytes\n",
3876 nb_tbs
? target_code_size
/ nb_tbs
: 0,
3877 max_target_code_size
);
3878 cpu_fprintf(f
, "TB avg host size %d bytes (expansion ratio: %0.1f)\n",
3879 nb_tbs
? (code_gen_ptr
- code_gen_buffer
) / nb_tbs
: 0,
3880 target_code_size
? (double) (code_gen_ptr
- code_gen_buffer
) / target_code_size
: 0);
3881 cpu_fprintf(f
, "cross page TB count %d (%d%%)\n",
3883 nb_tbs
? (cross_page
* 100) / nb_tbs
: 0);
3884 cpu_fprintf(f
, "direct jump count %d (%d%%) (2 jumps=%d %d%%)\n",
3886 nb_tbs
? (direct_jmp_count
* 100) / nb_tbs
: 0,
3888 nb_tbs
? (direct_jmp2_count
* 100) / nb_tbs
: 0);
3889 cpu_fprintf(f
, "\nStatistics:\n");
3890 cpu_fprintf(f
, "TB flush count %d\n", tb_flush_count
);
3891 cpu_fprintf(f
, "TB invalidate count %d\n", tb_phys_invalidate_count
);
3892 cpu_fprintf(f
, "TLB flush count %d\n", tlb_flush_count
);
3893 tcg_dump_info(f
, cpu_fprintf
);
3896 #if !defined(CONFIG_USER_ONLY)
3898 #define MMUSUFFIX _cmmu
3899 #define GETPC() NULL
3900 #define env cpu_single_env
3901 #define SOFTMMU_CODE_ACCESS
3904 #include "softmmu_template.h"
3907 #include "softmmu_template.h"
3910 #include "softmmu_template.h"
3913 #include "softmmu_template.h"