]> git.proxmox.com Git - mirror_qemu.git/blame - exec.c
projects / mirror_qemu.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Remove vga LFB accessor hacks.
[mirror_qemu.git] / exec.c
CommitLineData
54936004 1/*
fd6ce8f6 2 * virtual page mapping and translated block handling
5fafdf24 3 *
54936004
FB		 4 * Copyright (c) 2003 Fabrice Bellard
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
fad6cb1a 18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA 02110-1301 USA
54936004 19 */
67b915a5 20#include "config.h"
d5a8f07c
FB		 21#ifdef _WIN32
22#include <windows.h>
23#else
a98d49b1 24#include <sys/types.h>
d5a8f07c
FB		 25#include <sys/mman.h>
26#endif
54936004
FB		 27#include <stdlib.h>
28#include <stdio.h>
29#include <stdarg.h>
30#include <string.h>
31#include <errno.h>
32#include <unistd.h>
33#include <inttypes.h>
34
6180a181
FB		 35#include "cpu.h"
36#include "exec-all.h"
ca10f867 37#include "qemu-common.h"
b67d9a52 38#include "tcg.h"
b3c7724c 39#include "hw/hw.h"
74576198 40#include "osdep.h"
7ba1e619 41#include "kvm.h"
53a5960a
PB		 42#if defined(CONFIG_USER_ONLY)
43#include <qemu.h>
44#endif
54936004 45
fd6ce8f6 46//#define DEBUG_TB_INVALIDATE
66e85a21 47//#define DEBUG_FLUSH
9fa3e853 48//#define DEBUG_TLB
67d3b957 49//#define DEBUG_UNASSIGNED
fd6ce8f6
FB		 50
51/* make various TB consistency checks */
5fafdf24
TS		 52//#define DEBUG_TB_CHECK
53//#define DEBUG_TLB_CHECK
fd6ce8f6 54
1196be37 55//#define DEBUG_IOPORT
db7b5426 56//#define DEBUG_SUBPAGE
1196be37 57
99773bd4
PB		 58#if !defined(CONFIG_USER_ONLY)
59/* TB consistency checks only implemented for usermode emulation. */
60#undef DEBUG_TB_CHECK
61#endif
62
9fa3e853
FB		 63#define SMC_BITMAP_USE_THRESHOLD 10
64
108c49b8
FB		 65#if defined(TARGET_SPARC64)
66#define TARGET_PHYS_ADDR_SPACE_BITS 41
5dcb6b91
BS		 67#elif defined(TARGET_SPARC)
68#define TARGET_PHYS_ADDR_SPACE_BITS 36
bedb69ea
JM		 69#elif defined(TARGET_ALPHA)
70#define TARGET_PHYS_ADDR_SPACE_BITS 42
71#define TARGET_VIRT_ADDR_SPACE_BITS 42
108c49b8
FB		 72#elif defined(TARGET_PPC64)
73#define TARGET_PHYS_ADDR_SPACE_BITS 42
640f42e4 74#elif defined(TARGET_X86_64) && !defined(CONFIG_KQEMU)
00f82b8a 75#define TARGET_PHYS_ADDR_SPACE_BITS 42
640f42e4 76#elif defined(TARGET_I386) && !defined(CONFIG_KQEMU)
00f82b8a 77#define TARGET_PHYS_ADDR_SPACE_BITS 36
108c49b8
FB		 78#else
79/* Note: for compatibility with kqemu, we use 32 bits for x86_64 */
80#define TARGET_PHYS_ADDR_SPACE_BITS 32
81#endif
82
bdaf78e0 83static TranslationBlock *tbs;
26a5f13b 84int code_gen_max_blocks;
9fa3e853 85TranslationBlock *tb_phys_hash[CODE_GEN_PHYS_HASH_SIZE];
bdaf78e0 86static int nb_tbs;
eb51d102
FB		 87/* any access to the tbs or the page table must use this lock */
88spinlock_t tb_lock = SPIN_LOCK_UNLOCKED;
fd6ce8f6 89
141ac468
BS		 90#if defined(__arm__) || defined(__sparc_v9__)
91/* The prologue must be reachable with a direct jump. ARM and Sparc64
92 have limited branch ranges (possibly also PPC) so place it in a
d03d860b
BS		 93 section close to code segment. */
94#define code_gen_section \
95 __attribute__((__section__(".gen_code"))) \
96 __attribute__((aligned (32)))
97#else
98#define code_gen_section \
99 __attribute__((aligned (32)))
100#endif
101
102uint8_t code_gen_prologue[1024] code_gen_section;
bdaf78e0
BS		 103static uint8_t *code_gen_buffer;
104static unsigned long code_gen_buffer_size;
26a5f13b 105/* threshold to flush the translated code buffer */
bdaf78e0 106static unsigned long code_gen_buffer_max_size;
fd6ce8f6
FB		 107uint8_t *code_gen_ptr;
108
e2eef170 109#if !defined(CONFIG_USER_ONLY)
9fa3e853 110int phys_ram_fd;
1ccde1cb 111uint8_t *phys_ram_dirty;
74576198 112static int in_migration;
94a6b54f
PB		 113
114typedef struct RAMBlock {
115 uint8_t *host;
116 ram_addr_t offset;
117 ram_addr_t length;
118 struct RAMBlock *next;
119} RAMBlock;
120
121static RAMBlock *ram_blocks;
122/* TODO: When we implement (and use) ram deallocation (e.g. for hotplug)
123 then we can no longet assume contiguous ram offsets, and external uses
124 of this variable will break. */
125ram_addr_t last_ram_offset;
e2eef170 126#endif
9fa3e853 127
6a00d601
FB		 128CPUState *first_cpu;
129/* current CPU in the current thread. It is only valid inside
130 cpu_exec() */
5fafdf24 131CPUState *cpu_single_env;
2e70f6ef 132/* 0 = Do not count executed instructions.
bf20dc07 133 1 = Precise instruction counting.
2e70f6ef
PB		 134 2 = Adaptive rate instruction counting. */
135int use_icount = 0;
136/* Current instruction counter. While executing translated code this may
137 include some instructions that have not yet been executed. */
138int64_t qemu_icount;
6a00d601 139
54936004 140typedef struct PageDesc {
92e873b9 141 /* list of TBs intersecting this ram page */
fd6ce8f6 142 TranslationBlock *first_tb;
9fa3e853
FB		 143 /* in order to optimize self modifying code, we count the number
144 of lookups we do to a given page to use a bitmap */
145 unsigned int code_write_count;
146 uint8_t *code_bitmap;
147#if defined(CONFIG_USER_ONLY)
148 unsigned long flags;
149#endif
54936004
FB		 150} PageDesc;
151
92e873b9 152typedef struct PhysPageDesc {
0f459d16 153 /* offset in host memory of the page + io_index in the low bits */
00f82b8a 154 ram_addr_t phys_offset;
8da3ff18 155 ram_addr_t region_offset;
92e873b9
FB		 156} PhysPageDesc;
157
54936004 158#define L2_BITS 10
bedb69ea
JM		 159#if defined(CONFIG_USER_ONLY) && defined(TARGET_VIRT_ADDR_SPACE_BITS)
160/* XXX: this is a temporary hack for alpha target.
161 * In the future, this is to be replaced by a multi-level table
162 * to actually be able to handle the complete 64 bits address space.
163 */
164#define L1_BITS (TARGET_VIRT_ADDR_SPACE_BITS - L2_BITS - TARGET_PAGE_BITS)
165#else
03875444 166#define L1_BITS (32 - L2_BITS - TARGET_PAGE_BITS)
bedb69ea 167#endif
54936004
FB		 168
169#define L1_SIZE (1 << L1_BITS)
170#define L2_SIZE (1 << L2_BITS)
171
83fb7adf
FB		 172unsigned long qemu_real_host_page_size;
173unsigned long qemu_host_page_bits;
174unsigned long qemu_host_page_size;
175unsigned long qemu_host_page_mask;
54936004 176
92e873b9 177/* XXX: for system emulation, it could just be an array */
54936004 178static PageDesc *l1_map[L1_SIZE];
bdaf78e0 179static PhysPageDesc **l1_phys_map;
54936004 180
e2eef170
PB		 181#if !defined(CONFIG_USER_ONLY)
182static void io_mem_init(void);
183
33417e70 184/* io memory support */
33417e70
FB		 185CPUWriteMemoryFunc *io_mem_write[IO_MEM_NB_ENTRIES][4];
186CPUReadMemoryFunc *io_mem_read[IO_MEM_NB_ENTRIES][4];
a4193c8a 187void *io_mem_opaque[IO_MEM_NB_ENTRIES];
511d2b14 188static char io_mem_used[IO_MEM_NB_ENTRIES];
6658ffb8
PB		 189static int io_mem_watch;
190#endif
33417e70 191
34865134 192/* log support */
d9b630fd 193static const char *logfilename = "/tmp/qemu.log";
34865134
FB		 194FILE *logfile;
195int loglevel;
e735b91c 196static int log_append = 0;
34865134 197
e3db7226
FB		 198/* statistics */
199static int tlb_flush_count;
200static int tb_flush_count;
201static int tb_phys_invalidate_count;
202
db7b5426
BS		 203#define SUBPAGE_IDX(addr) ((addr) & ~TARGET_PAGE_MASK)
204typedef struct subpage_t {
205 target_phys_addr_t base;
3ee89922
BS		 206 CPUReadMemoryFunc **mem_read[TARGET_PAGE_SIZE][4];
207 CPUWriteMemoryFunc **mem_write[TARGET_PAGE_SIZE][4];
208 void *opaque[TARGET_PAGE_SIZE][2][4];
8da3ff18 209 ram_addr_t region_offset[TARGET_PAGE_SIZE][2][4];
db7b5426
BS		 210} subpage_t;
211
7cb69cae
FB		 212#ifdef _WIN32
213static void map_exec(void *addr, long size)
214{
215 DWORD old_protect;
216 VirtualProtect(addr, size,
217 PAGE_EXECUTE_READWRITE, &old_protect);
218
219}
220#else
221static void map_exec(void *addr, long size)
222{
4369415f 223 unsigned long start, end, page_size;
7cb69cae 224
4369415f 225 page_size = getpagesize();
7cb69cae 226 start = (unsigned long)addr;
4369415f 227 start &= ~(page_size - 1);
7cb69cae
FB		 228
229 end = (unsigned long)addr + size;
4369415f
FB		 230 end += page_size - 1;
231 end &= ~(page_size - 1);
7cb69cae
FB		 232
233 mprotect((void *)start, end - start,
234 PROT_READ | PROT_WRITE | PROT_EXEC);
235}
236#endif
237
b346ff46 238static void page_init(void)
54936004 239{
83fb7adf 240 /* NOTE: we can always suppose that qemu_host_page_size >=
54936004 241 TARGET_PAGE_SIZE */
c2b48b69
AL		 242#ifdef _WIN32
243 {
244 SYSTEM_INFO system_info;
245
246 GetSystemInfo(&system_info);
247 qemu_real_host_page_size = system_info.dwPageSize;
248 }
249#else
250 qemu_real_host_page_size = getpagesize();
251#endif
83fb7adf
FB		 252 if (qemu_host_page_size == 0)
253 qemu_host_page_size = qemu_real_host_page_size;
254 if (qemu_host_page_size < TARGET_PAGE_SIZE)
255 qemu_host_page_size = TARGET_PAGE_SIZE;
256 qemu_host_page_bits = 0;
257 while ((1 << qemu_host_page_bits) < qemu_host_page_size)
258 qemu_host_page_bits++;
259 qemu_host_page_mask = ~(qemu_host_page_size - 1);
108c49b8
FB		 260 l1_phys_map = qemu_vmalloc(L1_SIZE * sizeof(void *));
261 memset(l1_phys_map, 0, L1_SIZE * sizeof(void *));
50a9569b
AZ		 262
263#if !defined(_WIN32) && defined(CONFIG_USER_ONLY)
264 {
265 long long startaddr, endaddr;
266 FILE *f;
267 int n;
268
c8a706fe 269 mmap_lock();
0776590d 270 last_brk = (unsigned long)sbrk(0);
50a9569b
AZ		 271 f = fopen("/proc/self/maps", "r");
272 if (f) {
273 do {
274 n = fscanf (f, "%llx-%llx %*[^\n]\n", &startaddr, &endaddr);
275 if (n == 2) {
e0b8d65a
BS		 276 startaddr = MIN(startaddr,
277 (1ULL << TARGET_PHYS_ADDR_SPACE_BITS) - 1);
278 endaddr = MIN(endaddr,
279 (1ULL << TARGET_PHYS_ADDR_SPACE_BITS) - 1);
b5fc909e 280 page_set_flags(startaddr & TARGET_PAGE_MASK,
50a9569b
AZ		 281 TARGET_PAGE_ALIGN(endaddr),
282 PAGE_RESERVED);
283 }
284 } while (!feof(f));
285 fclose(f);
286 }
c8a706fe 287 mmap_unlock();
50a9569b
AZ		 288 }
289#endif
54936004
FB		 290}
291
434929bf 292static inline PageDesc **page_l1_map(target_ulong index)
54936004 293{
17e2377a
PB		 294#if TARGET_LONG_BITS > 32
295 /* Host memory outside guest VM. For 32-bit targets we have already
296 excluded high addresses. */
d8173e0f 297 if (index > ((target_ulong)L2_SIZE * L1_SIZE))
17e2377a
PB		 298 return NULL;
299#endif
434929bf
AL		 300 return &l1_map[index >> L2_BITS];
301}
302
303static inline PageDesc *page_find_alloc(target_ulong index)
304{
305 PageDesc **lp, *p;
306 lp = page_l1_map(index);
307 if (!lp)
308 return NULL;
309
54936004
FB		 310 p = *lp;
311 if (!p) {
312 /* allocate if not found */
17e2377a 313#if defined(CONFIG_USER_ONLY)
17e2377a
PB		 314 size_t len = sizeof(PageDesc) * L2_SIZE;
315 /* Don't use qemu_malloc because it may recurse. */
316 p = mmap(0, len, PROT_READ | PROT_WRITE,
317 MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
54936004 318 *lp = p;
fb1c2cd7
AJ		 319 if (h2g_valid(p)) {
320 unsigned long addr = h2g(p);
17e2377a
PB		 321 page_set_flags(addr & TARGET_PAGE_MASK,
322 TARGET_PAGE_ALIGN(addr + len),
323 PAGE_RESERVED);
324 }
325#else
326 p = qemu_mallocz(sizeof(PageDesc) * L2_SIZE);
327 *lp = p;
328#endif
54936004
FB		 329 }
330 return p + (index & (L2_SIZE - 1));
331}
332
00f82b8a 333static inline PageDesc *page_find(target_ulong index)
54936004 334{
434929bf
AL		 335 PageDesc **lp, *p;
336 lp = page_l1_map(index);
337 if (!lp)
338 return NULL;
54936004 339
434929bf 340 p = *lp;
54936004
FB		 341 if (!p)
342 return 0;
fd6ce8f6
FB		 343 return p + (index & (L2_SIZE - 1));
344}
345
108c49b8 346static PhysPageDesc *phys_page_find_alloc(target_phys_addr_t index, int alloc)
92e873b9 347{
108c49b8 348 void **lp, **p;
e3f4e2a4 349 PhysPageDesc *pd;
92e873b9 350
108c49b8
FB		 351 p = (void **)l1_phys_map;
352#if TARGET_PHYS_ADDR_SPACE_BITS > 32
353
354#if TARGET_PHYS_ADDR_SPACE_BITS > (32 + L1_BITS)
355#error unsupported TARGET_PHYS_ADDR_SPACE_BITS
356#endif
357 lp = p + ((index >> (L1_BITS + L2_BITS)) & (L1_SIZE - 1));
92e873b9
FB		 358 p = *lp;
359 if (!p) {
360 /* allocate if not found */
108c49b8
FB		 361 if (!alloc)
362 return NULL;
363 p = qemu_vmalloc(sizeof(void *) * L1_SIZE);
364 memset(p, 0, sizeof(void *) * L1_SIZE);
365 *lp = p;
366 }
367#endif
368 lp = p + ((index >> L2_BITS) & (L1_SIZE - 1));
e3f4e2a4
PB		 369 pd = *lp;
370 if (!pd) {
371 int i;
108c49b8
FB		 372 /* allocate if not found */
373 if (!alloc)
374 return NULL;
e3f4e2a4
PB		 375 pd = qemu_vmalloc(sizeof(PhysPageDesc) * L2_SIZE);
376 *lp = pd;
67c4d23c 377 for (i = 0; i < L2_SIZE; i++) {
e3f4e2a4 378 pd[i].phys_offset = IO_MEM_UNASSIGNED;
67c4d23c
PB		 379 pd[i].region_offset = (index + i) << TARGET_PAGE_BITS;
380 }
92e873b9 381 }
e3f4e2a4 382 return ((PhysPageDesc *)pd) + (index & (L2_SIZE - 1));
92e873b9
FB		 383}
384
108c49b8 385static inline PhysPageDesc *phys_page_find(target_phys_addr_t index)
92e873b9 386{
108c49b8 387 return phys_page_find_alloc(index, 0);
92e873b9
FB		 388}
389
9fa3e853 390#if !defined(CONFIG_USER_ONLY)
6a00d601 391static void tlb_protect_code(ram_addr_t ram_addr);
5fafdf24 392static void tlb_unprotect_code_phys(CPUState *env, ram_addr_t ram_addr,
3a7d929e 393 target_ulong vaddr);
c8a706fe
PB		 394#define mmap_lock() do { } while(0)
395#define mmap_unlock() do { } while(0)
9fa3e853 396#endif
fd6ce8f6 397
4369415f
FB		 398#define DEFAULT_CODE_GEN_BUFFER_SIZE (32 * 1024 * 1024)
399
400#if defined(CONFIG_USER_ONLY)
401/* Currently it is not recommanded to allocate big chunks of data in
402 user mode. It will change when a dedicated libc will be used */
403#define USE_STATIC_CODE_GEN_BUFFER
404#endif
405
406#ifdef USE_STATIC_CODE_GEN_BUFFER
407static uint8_t static_code_gen_buffer[DEFAULT_CODE_GEN_BUFFER_SIZE];
408#endif
409
8fcd3692 410static void code_gen_alloc(unsigned long tb_size)
26a5f13b 411{
4369415f
FB		 412#ifdef USE_STATIC_CODE_GEN_BUFFER
413 code_gen_buffer = static_code_gen_buffer;
414 code_gen_buffer_size = DEFAULT_CODE_GEN_BUFFER_SIZE;
415 map_exec(code_gen_buffer, code_gen_buffer_size);
416#else
26a5f13b
FB		 417 code_gen_buffer_size = tb_size;
418 if (code_gen_buffer_size == 0) {
4369415f
FB		 419#if defined(CONFIG_USER_ONLY)
420 /* in user mode, phys_ram_size is not meaningful */
421 code_gen_buffer_size = DEFAULT_CODE_GEN_BUFFER_SIZE;
422#else
26a5f13b 423 /* XXX: needs ajustments */
94a6b54f 424 code_gen_buffer_size = (unsigned long)(ram_size / 4);
4369415f 425#endif
26a5f13b
FB		 426 }
427 if (code_gen_buffer_size < MIN_CODE_GEN_BUFFER_SIZE)
428 code_gen_buffer_size = MIN_CODE_GEN_BUFFER_SIZE;
429 /* The code gen buffer location may have constraints depending on
430 the host cpu and OS */
431#if defined(__linux__)
432 {
433 int flags;
141ac468
BS		 434 void *start = NULL;
435
26a5f13b
FB		 436 flags = MAP_PRIVATE | MAP_ANONYMOUS;
437#if defined(__x86_64__)
438 flags |= MAP_32BIT;
439 /* Cannot map more than that */
440 if (code_gen_buffer_size > (800 * 1024 * 1024))
441 code_gen_buffer_size = (800 * 1024 * 1024);
141ac468
BS		 442#elif defined(__sparc_v9__)
443 // Map the buffer below 2G, so we can use direct calls and branches
444 flags |= MAP_FIXED;
445 start = (void *) 0x60000000UL;
446 if (code_gen_buffer_size > (512 * 1024 * 1024))
447 code_gen_buffer_size = (512 * 1024 * 1024);
1cb0661e 448#elif defined(__arm__)
63d41246 449 /* Map the buffer below 32M, so we can use direct calls and branches */
1cb0661e
AZ		 450 flags |= MAP_FIXED;
451 start = (void *) 0x01000000UL;
452 if (code_gen_buffer_size > 16 * 1024 * 1024)
453 code_gen_buffer_size = 16 * 1024 * 1024;
26a5f13b 454#endif
141ac468
BS		 455 code_gen_buffer = mmap(start, code_gen_buffer_size,
456 PROT_WRITE | PROT_READ | PROT_EXEC,
26a5f13b
FB		 457 flags, -1, 0);
458 if (code_gen_buffer == MAP_FAILED) {
459 fprintf(stderr, "Could not allocate dynamic translator buffer\n");
460 exit(1);
461 }
462 }
c5e97233 463#elif defined(__FreeBSD__) || defined(__DragonFly__)
06e67a82
AL		 464 {
465 int flags;
466 void *addr = NULL;
467 flags = MAP_PRIVATE | MAP_ANONYMOUS;
468#if defined(__x86_64__)
469 /* FreeBSD doesn't have MAP_32BIT, use MAP_FIXED and assume
470 * 0x40000000 is free */
471 flags |= MAP_FIXED;
472 addr = (void *)0x40000000;
473 /* Cannot map more than that */
474 if (code_gen_buffer_size > (800 * 1024 * 1024))
475 code_gen_buffer_size = (800 * 1024 * 1024);
476#endif
477 code_gen_buffer = mmap(addr, code_gen_buffer_size,
478 PROT_WRITE | PROT_READ | PROT_EXEC,
479 flags, -1, 0);
480 if (code_gen_buffer == MAP_FAILED) {
481 fprintf(stderr, "Could not allocate dynamic translator buffer\n");
482 exit(1);
483 }
484 }
26a5f13b
FB		 485#else
486 code_gen_buffer = qemu_malloc(code_gen_buffer_size);
26a5f13b
FB		 487 map_exec(code_gen_buffer, code_gen_buffer_size);
488#endif
4369415f 489#endif /* !USE_STATIC_CODE_GEN_BUFFER */
26a5f13b
FB		 490 map_exec(code_gen_prologue, sizeof(code_gen_prologue));
491 code_gen_buffer_max_size = code_gen_buffer_size -
492 code_gen_max_block_size();
493 code_gen_max_blocks = code_gen_buffer_size / CODE_GEN_AVG_BLOCK_SIZE;
494 tbs = qemu_malloc(code_gen_max_blocks * sizeof(TranslationBlock));
495}
496
497/* Must be called before using the QEMU cpus. 'tb_size' is the size
498 (in bytes) allocated to the translation buffer. Zero means default
499 size. */
500void cpu_exec_init_all(unsigned long tb_size)
501{
26a5f13b
FB		 502 cpu_gen_init();
503 code_gen_alloc(tb_size);
504 code_gen_ptr = code_gen_buffer;
4369415f 505 page_init();
e2eef170 506#if !defined(CONFIG_USER_ONLY)
26a5f13b 507 io_mem_init();
e2eef170 508#endif
26a5f13b
FB		 509}
510
9656f324
PB		 511#if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
512
513#define CPU_COMMON_SAVE_VERSION 1
514
515static void cpu_common_save(QEMUFile *f, void *opaque)
516{
517 CPUState *env = opaque;
518
519 qemu_put_be32s(f, &env->halted);
520 qemu_put_be32s(f, &env->interrupt_request);
521}
522
523static int cpu_common_load(QEMUFile *f, void *opaque, int version_id)
524{
525 CPUState *env = opaque;
526
527 if (version_id != CPU_COMMON_SAVE_VERSION)
528 return -EINVAL;
529
530 qemu_get_be32s(f, &env->halted);
75f482ae 531 qemu_get_be32s(f, &env->interrupt_request);
3098dba0
AJ		 532 /* 0x01 was CPU_INTERRUPT_EXIT. This line can be removed when the
533 version_id is increased. */
534 env->interrupt_request &= ~0x01;
9656f324
PB		 535 tlb_flush(env, 1);
536
537 return 0;
538}
539#endif
540
6a00d601 541void cpu_exec_init(CPUState *env)
fd6ce8f6 542{
6a00d601
FB		 543 CPUState **penv;
544 int cpu_index;
545
c2764719
PB		 546#if defined(CONFIG_USER_ONLY)
547 cpu_list_lock();
548#endif
6a00d601
FB		 549 env->next_cpu = NULL;
550 penv = &first_cpu;
551 cpu_index = 0;
552 while (*penv != NULL) {
553 penv = (CPUState **)&(*penv)->next_cpu;
554 cpu_index++;
555 }
556 env->cpu_index = cpu_index;
268a362c 557 env->numa_node = 0;
c0ce998e
AL		 558 TAILQ_INIT(&env->breakpoints);
559 TAILQ_INIT(&env->watchpoints);
6a00d601 560 *penv = env;
c2764719
PB		 561#if defined(CONFIG_USER_ONLY)
562 cpu_list_unlock();
563#endif
b3c7724c 564#if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
9656f324
PB		 565 register_savevm("cpu_common", cpu_index, CPU_COMMON_SAVE_VERSION,
566 cpu_common_save, cpu_common_load, env);
b3c7724c
PB		 567 register_savevm("cpu", cpu_index, CPU_SAVE_VERSION,
568 cpu_save, cpu_load, env);
569#endif
fd6ce8f6
FB		 570}
571
9fa3e853
FB		 572static inline void invalidate_page_bitmap(PageDesc *p)
573{
574 if (p->code_bitmap) {
59817ccb 575 qemu_free(p->code_bitmap);
9fa3e853
FB		 576 p->code_bitmap = NULL;
577 }
578 p->code_write_count = 0;
579}
580
fd6ce8f6
FB		 581/* set to NULL all the 'first_tb' fields in all PageDescs */
582static void page_flush_tb(void)
583{
584 int i, j;
585 PageDesc *p;
586
587 for(i = 0; i < L1_SIZE; i++) {
588 p = l1_map[i];
589 if (p) {
9fa3e853
FB		 590 for(j = 0; j < L2_SIZE; j++) {
591 p->first_tb = NULL;
592 invalidate_page_bitmap(p);
593 p++;
594 }
fd6ce8f6
FB		 595 }
596 }
597}
598
599/* flush all the translation blocks */
d4e8164f 600/* XXX: tb_flush is currently not thread safe */
6a00d601 601void tb_flush(CPUState *env1)
fd6ce8f6 602{
6a00d601 603 CPUState *env;
0124311e 604#if defined(DEBUG_FLUSH)
ab3d1727
BS		 605 printf("qemu: flush code_size=%ld nb_tbs=%d avg_tb_size=%ld\n",
606 (unsigned long)(code_gen_ptr - code_gen_buffer),
607 nb_tbs, nb_tbs > 0 ?
608 ((unsigned long)(code_gen_ptr - code_gen_buffer)) / nb_tbs : 0);
fd6ce8f6 609#endif
26a5f13b 610 if ((unsigned long)(code_gen_ptr - code_gen_buffer) > code_gen_buffer_size)
a208e54a
PB		 611 cpu_abort(env1, "Internal error: code buffer overflow\n");
612
fd6ce8f6 613 nb_tbs = 0;
3b46e624 614
6a00d601
FB		 615 for(env = first_cpu; env != NULL; env = env->next_cpu) {
616 memset (env->tb_jmp_cache, 0, TB_JMP_CACHE_SIZE * sizeof (void *));
617 }
9fa3e853 618
8a8a608f 619 memset (tb_phys_hash, 0, CODE_GEN_PHYS_HASH_SIZE * sizeof (void *));
fd6ce8f6 620 page_flush_tb();
9fa3e853 621
fd6ce8f6 622 code_gen_ptr = code_gen_buffer;
d4e8164f
FB		 623 /* XXX: flush processor icache at this point if cache flush is
624 expensive */
e3db7226 625 tb_flush_count++;
fd6ce8f6
FB		 626}
627
628#ifdef DEBUG_TB_CHECK
629
bc98a7ef 630static void tb_invalidate_check(target_ulong address)
fd6ce8f6
FB		 631{
632 TranslationBlock *tb;
633 int i;
634 address &= TARGET_PAGE_MASK;
99773bd4
PB		 635 for(i = 0;i < CODE_GEN_PHYS_HASH_SIZE; i++) {
636 for(tb = tb_phys_hash[i]; tb != NULL; tb = tb->phys_hash_next) {
fd6ce8f6
FB		 637 if (!(address + TARGET_PAGE_SIZE <= tb->pc ||
638 address >= tb->pc + tb->size)) {
639 printf("ERROR invalidate: address=%08lx PC=%08lx size=%04x\n",
99773bd4 640 address, (long)tb->pc, tb->size);
fd6ce8f6
FB		 641 }
642 }
643 }
644}
645
646/* verify that all the pages have correct rights for code */
647static void tb_page_check(void)
648{
649 TranslationBlock *tb;
650 int i, flags1, flags2;
3b46e624 651
99773bd4
PB		 652 for(i = 0;i < CODE_GEN_PHYS_HASH_SIZE; i++) {
653 for(tb = tb_phys_hash[i]; tb != NULL; tb = tb->phys_hash_next) {
fd6ce8f6
FB		 654 flags1 = page_get_flags(tb->pc);
655 flags2 = page_get_flags(tb->pc + tb->size - 1);
656 if ((flags1 & PAGE_WRITE) || (flags2 & PAGE_WRITE)) {
657 printf("ERROR page flags: PC=%08lx size=%04x f1=%x f2=%x\n",
99773bd4 658 (long)tb->pc, tb->size, flags1, flags2);
fd6ce8f6
FB		 659 }
660 }
661 }
662}
663
bdaf78e0 664static void tb_jmp_check(TranslationBlock *tb)
d4e8164f
FB		 665{
666 TranslationBlock *tb1;
667 unsigned int n1;
668
669 /* suppress any remaining jumps to this TB */
670 tb1 = tb->jmp_first;
671 for(;;) {
672 n1 = (long)tb1 & 3;
673 tb1 = (TranslationBlock *)((long)tb1 & ~3);
674 if (n1 == 2)
675 break;
676 tb1 = tb1->jmp_next[n1];
677 }
678 /* check end of list */
679 if (tb1 != tb) {
680 printf("ERROR: jmp_list from 0x%08lx\n", (long)tb);
681 }
682}
683
fd6ce8f6
FB		 684#endif
685
686/* invalidate one TB */
687static inline void tb_remove(TranslationBlock **ptb, TranslationBlock *tb,
688 int next_offset)
689{
690 TranslationBlock *tb1;
691 for(;;) {
692 tb1 = *ptb;
693 if (tb1 == tb) {
694 *ptb = *(TranslationBlock **)((char *)tb1 + next_offset);
695 break;
696 }
697 ptb = (TranslationBlock **)((char *)tb1 + next_offset);
698 }
699}
700
9fa3e853
FB		 701static inline void tb_page_remove(TranslationBlock **ptb, TranslationBlock *tb)
702{
703 TranslationBlock *tb1;
704 unsigned int n1;
705
706 for(;;) {
707 tb1 = *ptb;
708 n1 = (long)tb1 & 3;
709 tb1 = (TranslationBlock *)((long)tb1 & ~3);
710 if (tb1 == tb) {
711 *ptb = tb1->page_next[n1];
712 break;
713 }
714 ptb = &tb1->page_next[n1];
715 }
716}
717
d4e8164f
FB		 718static inline void tb_jmp_remove(TranslationBlock *tb, int n)
719{
720 TranslationBlock *tb1, **ptb;
721 unsigned int n1;
722
723 ptb = &tb->jmp_next[n];
724 tb1 = *ptb;
725 if (tb1) {
726 /* find tb(n) in circular list */
727 for(;;) {
728 tb1 = *ptb;
729 n1 = (long)tb1 & 3;
730 tb1 = (TranslationBlock *)((long)tb1 & ~3);
731 if (n1 == n && tb1 == tb)
732 break;
733 if (n1 == 2) {
734 ptb = &tb1->jmp_first;
735 } else {
736 ptb = &tb1->jmp_next[n1];
737 }
738 }
739 /* now we can suppress tb(n) from the list */
740 *ptb = tb->jmp_next[n];
741
742 tb->jmp_next[n] = NULL;
743 }
744}
745
746/* reset the jump entry 'n' of a TB so that it is not chained to
747 another TB */
748static inline void tb_reset_jump(TranslationBlock *tb, int n)
749{
750 tb_set_jmp_target(tb, n, (unsigned long)(tb->tc_ptr + tb->tb_next_offset[n]));
751}
752
2e70f6ef 753void tb_phys_invalidate(TranslationBlock *tb, target_ulong page_addr)
fd6ce8f6 754{
6a00d601 755 CPUState *env;
8a40a180 756 PageDesc *p;
d4e8164f 757 unsigned int h, n1;
00f82b8a 758 target_phys_addr_t phys_pc;
8a40a180 759 TranslationBlock *tb1, *tb2;
3b46e624 760
8a40a180
FB		 761 /* remove the TB from the hash list */
762 phys_pc = tb->page_addr[0] + (tb->pc & ~TARGET_PAGE_MASK);
763 h = tb_phys_hash_func(phys_pc);
5fafdf24 764 tb_remove(&tb_phys_hash[h], tb,
8a40a180
FB		 765 offsetof(TranslationBlock, phys_hash_next));
766
767 /* remove the TB from the page list */
768 if (tb->page_addr[0] != page_addr) {
769 p = page_find(tb->page_addr[0] >> TARGET_PAGE_BITS);
770 tb_page_remove(&p->first_tb, tb);
771 invalidate_page_bitmap(p);
772 }
773 if (tb->page_addr[1] != -1 && tb->page_addr[1] != page_addr) {
774 p = page_find(tb->page_addr[1] >> TARGET_PAGE_BITS);
775 tb_page_remove(&p->first_tb, tb);
776 invalidate_page_bitmap(p);
777 }
778
36bdbe54 779 tb_invalidated_flag = 1;
59817ccb 780
fd6ce8f6 781 /* remove the TB from the hash list */
8a40a180 782 h = tb_jmp_cache_hash_func(tb->pc);
6a00d601
FB		 783 for(env = first_cpu; env != NULL; env = env->next_cpu) {
784 if (env->tb_jmp_cache[h] == tb)
785 env->tb_jmp_cache[h] = NULL;
786 }
d4e8164f
FB		 787
788 /* suppress this TB from the two jump lists */
789 tb_jmp_remove(tb, 0);
790 tb_jmp_remove(tb, 1);
791
792 /* suppress any remaining jumps to this TB */
793 tb1 = tb->jmp_first;
794 for(;;) {
795 n1 = (long)tb1 & 3;
796 if (n1 == 2)
797 break;
798 tb1 = (TranslationBlock *)((long)tb1 & ~3);
799 tb2 = tb1->jmp_next[n1];
800 tb_reset_jump(tb1, n1);
801 tb1->jmp_next[n1] = NULL;
802 tb1 = tb2;
803 }
804 tb->jmp_first = (TranslationBlock *)((long)tb | 2); /* fail safe */
9fa3e853 805
e3db7226 806 tb_phys_invalidate_count++;
9fa3e853
FB		 807}
808
809static inline void set_bits(uint8_t *tab, int start, int len)
810{
811 int end, mask, end1;
812
813 end = start + len;
814 tab += start >> 3;
815 mask = 0xff << (start & 7);
816 if ((start & ~7) == (end & ~7)) {
817 if (start < end) {
818 mask &= ~(0xff << (end & 7));
819 *tab |= mask;
820 }
821 } else {
822 *tab++ |= mask;
823 start = (start + 8) & ~7;
824 end1 = end & ~7;
825 while (start < end1) {
826 *tab++ = 0xff;
827 start += 8;
828 }
829 if (start < end) {
830 mask = ~(0xff << (end & 7));
831 *tab |= mask;
832 }
833 }
834}
835
836static void build_page_bitmap(PageDesc *p)
837{
838 int n, tb_start, tb_end;
839 TranslationBlock *tb;
3b46e624 840
b2a7081a 841 p->code_bitmap = qemu_mallocz(TARGET_PAGE_SIZE / 8);
9fa3e853
FB		 842
843 tb = p->first_tb;
844 while (tb != NULL) {
845 n = (long)tb & 3;
846 tb = (TranslationBlock *)((long)tb & ~3);
847 /* NOTE: this is subtle as a TB may span two physical pages */
848 if (n == 0) {
849 /* NOTE: tb_end may be after the end of the page, but
850 it is not a problem */
851 tb_start = tb->pc & ~TARGET_PAGE_MASK;
852 tb_end = tb_start + tb->size;
853 if (tb_end > TARGET_PAGE_SIZE)
854 tb_end = TARGET_PAGE_SIZE;
855 } else {
856 tb_start = 0;
857 tb_end = ((tb->pc + tb->size) & ~TARGET_PAGE_MASK);
858 }
859 set_bits(p->code_bitmap, tb_start, tb_end - tb_start);
860 tb = tb->page_next[n];
861 }
862}
863
2e70f6ef
PB		 864TranslationBlock *tb_gen_code(CPUState *env,
865 target_ulong pc, target_ulong cs_base,
866 int flags, int cflags)
d720b93d
FB		 867{
868 TranslationBlock *tb;
869 uint8_t *tc_ptr;
870 target_ulong phys_pc, phys_page2, virt_page2;
871 int code_gen_size;
872
c27004ec
FB		 873 phys_pc = get_phys_addr_code(env, pc);
874 tb = tb_alloc(pc);
d720b93d
FB		 875 if (!tb) {
876 /* flush must be done */
877 tb_flush(env);
878 /* cannot fail at this point */
c27004ec 879 tb = tb_alloc(pc);
2e70f6ef
PB		 880 /* Don't forget to invalidate previous TB info. */
881 tb_invalidated_flag = 1;
d720b93d
FB		 882 }
883 tc_ptr = code_gen_ptr;
884 tb->tc_ptr = tc_ptr;
885 tb->cs_base = cs_base;
886 tb->flags = flags;
887 tb->cflags = cflags;
d07bde88 888 cpu_gen_code(env, tb, &code_gen_size);
d720b93d 889 code_gen_ptr = (void *)(((unsigned long)code_gen_ptr + code_gen_size + CODE_GEN_ALIGN - 1) & ~(CODE_GEN_ALIGN - 1));
3b46e624 890
d720b93d 891 /* check next page if needed */
c27004ec 892 virt_page2 = (pc + tb->size - 1) & TARGET_PAGE_MASK;
d720b93d 893 phys_page2 = -1;
c27004ec 894 if ((pc & TARGET_PAGE_MASK) != virt_page2) {
d720b93d
FB		 895 phys_page2 = get_phys_addr_code(env, virt_page2);
896 }
897 tb_link_phys(tb, phys_pc, phys_page2);
2e70f6ef 898 return tb;
d720b93d 899}
3b46e624 900
9fa3e853
FB		 901/* invalidate all TBs which intersect with the target physical page
902 starting in range [start;end[. NOTE: start and end must refer to
d720b93d
FB		 903 the same physical page. 'is_cpu_write_access' should be true if called
904 from a real cpu write access: the virtual CPU will exit the current
905 TB if code is modified inside this TB. */
00f82b8a 906void tb_invalidate_phys_page_range(target_phys_addr_t start, target_phys_addr_t end,
d720b93d
FB		 907 int is_cpu_write_access)
908{
6b917547 909 TranslationBlock *tb, *tb_next, *saved_tb;
d720b93d 910 CPUState *env = cpu_single_env;
9fa3e853 911 target_ulong tb_start, tb_end;
6b917547
AL		 912 PageDesc *p;
913 int n;
914#ifdef TARGET_HAS_PRECISE_SMC
915 int current_tb_not_found = is_cpu_write_access;
916 TranslationBlock *current_tb = NULL;
917 int current_tb_modified = 0;
918 target_ulong current_pc = 0;
919 target_ulong current_cs_base = 0;
920 int current_flags = 0;
921#endif /* TARGET_HAS_PRECISE_SMC */
9fa3e853
FB		 922
923 p = page_find(start >> TARGET_PAGE_BITS);
5fafdf24 924 if (!p)
9fa3e853 925 return;
5fafdf24 926 if (!p->code_bitmap &&
d720b93d
FB		 927 ++p->code_write_count >= SMC_BITMAP_USE_THRESHOLD &&
928 is_cpu_write_access) {
9fa3e853
FB		 929 /* build code bitmap */
930 build_page_bitmap(p);
931 }
932
933 /* we remove all the TBs in the range [start, end[ */
934 /* XXX: see if in some cases it could be faster to invalidate all the code */
935 tb = p->first_tb;
936 while (tb != NULL) {
937 n = (long)tb & 3;
938 tb = (TranslationBlock *)((long)tb & ~3);
939 tb_next = tb->page_next[n];
940 /* NOTE: this is subtle as a TB may span two physical pages */
941 if (n == 0) {
942 /* NOTE: tb_end may be after the end of the page, but
943 it is not a problem */
944 tb_start = tb->page_addr[0] + (tb->pc & ~TARGET_PAGE_MASK);
945 tb_end = tb_start + tb->size;
946 } else {
947 tb_start = tb->page_addr[1];
948 tb_end = tb_start + ((tb->pc + tb->size) & ~TARGET_PAGE_MASK);
949 }
950 if (!(tb_end <= start || tb_start >= end)) {
d720b93d
FB		 951#ifdef TARGET_HAS_PRECISE_SMC
952 if (current_tb_not_found) {
953 current_tb_not_found = 0;
954 current_tb = NULL;
2e70f6ef 955 if (env->mem_io_pc) {
d720b93d 956 /* now we have a real cpu fault */
2e70f6ef 957 current_tb = tb_find_pc(env->mem_io_pc);
d720b93d
FB		 958 }
959 }
960 if (current_tb == tb &&
2e70f6ef 961 (current_tb->cflags & CF_COUNT_MASK) != 1) {
d720b93d
FB		 962 /* If we are modifying the current TB, we must stop
963 its execution. We could be more precise by checking
964 that the modification is after the current PC, but it
965 would require a specialized function to partially
966 restore the CPU state */
3b46e624 967
d720b93d 968 current_tb_modified = 1;
5fafdf24 969 cpu_restore_state(current_tb, env,
2e70f6ef 970 env->mem_io_pc, NULL);
6b917547
AL		 971 cpu_get_tb_cpu_state(env, &current_pc, &current_cs_base,
972 &current_flags);
d720b93d
FB		 973 }
974#endif /* TARGET_HAS_PRECISE_SMC */
6f5a9f7e
FB		 975 /* we need to do that to handle the case where a signal
976 occurs while doing tb_phys_invalidate() */
977 saved_tb = NULL;
978 if (env) {
979 saved_tb = env->current_tb;
980 env->current_tb = NULL;
981 }
9fa3e853 982 tb_phys_invalidate(tb, -1);
6f5a9f7e
FB		 983 if (env) {
984 env->current_tb = saved_tb;
985 if (env->interrupt_request && env->current_tb)
986 cpu_interrupt(env, env->interrupt_request);
987 }
9fa3e853
FB		 988 }
989 tb = tb_next;
990 }
991#if !defined(CONFIG_USER_ONLY)
992 /* if no code remaining, no need to continue to use slow writes */
993 if (!p->first_tb) {
994 invalidate_page_bitmap(p);
d720b93d 995 if (is_cpu_write_access) {
2e70f6ef 996 tlb_unprotect_code_phys(env, start, env->mem_io_vaddr);
d720b93d
FB		 997 }
998 }
999#endif
1000#ifdef TARGET_HAS_PRECISE_SMC
1001 if (current_tb_modified) {
1002 /* we generate a block containing just the instruction
1003 modifying the memory. It will ensure that it cannot modify
1004 itself */
ea1c1802 1005 env->current_tb = NULL;
2e70f6ef 1006 tb_gen_code(env, current_pc, current_cs_base, current_flags, 1);
d720b93d 1007 cpu_resume_from_signal(env, NULL);
9fa3e853 1008 }
fd6ce8f6 1009#endif
9fa3e853 1010}
fd6ce8f6 1011
9fa3e853 1012/* len must be <= 8 and start must be a multiple of len */
00f82b8a 1013static inline void tb_invalidate_phys_page_fast(target_phys_addr_t start, int len)
9fa3e853
FB		 1014{
1015 PageDesc *p;
1016 int offset, b;
59817ccb 1017#if 0
a4193c8a 1018 if (1) {
93fcfe39
AL		 1019 qemu_log("modifying code at 0x%x size=%d EIP=%x PC=%08x\n",
1020 cpu_single_env->mem_io_vaddr, len,
1021 cpu_single_env->eip,
1022 cpu_single_env->eip + (long)cpu_single_env->segs[R_CS].base);
59817ccb
FB		 1023 }
1024#endif
9fa3e853 1025 p = page_find(start >> TARGET_PAGE_BITS);
5fafdf24 1026 if (!p)
9fa3e853
FB		 1027 return;
1028 if (p->code_bitmap) {
1029 offset = start & ~TARGET_PAGE_MASK;
1030 b = p->code_bitmap[offset >> 3] >> (offset & 7);
1031 if (b & ((1 << len) - 1))
1032 goto do_invalidate;
1033 } else {
1034 do_invalidate:
d720b93d 1035 tb_invalidate_phys_page_range(start, start + len, 1);
9fa3e853
FB		 1036 }
1037}
1038
9fa3e853 1039#if !defined(CONFIG_SOFTMMU)
00f82b8a 1040static void tb_invalidate_phys_page(target_phys_addr_t addr,
d720b93d 1041 unsigned long pc, void *puc)
9fa3e853 1042{
6b917547 1043 TranslationBlock *tb;
9fa3e853 1044 PageDesc *p;
6b917547 1045 int n;
d720b93d 1046#ifdef TARGET_HAS_PRECISE_SMC
6b917547 1047 TranslationBlock *current_tb = NULL;
d720b93d 1048 CPUState *env = cpu_single_env;
6b917547
AL		 1049 int current_tb_modified = 0;
1050 target_ulong current_pc = 0;
1051 target_ulong current_cs_base = 0;
1052 int current_flags = 0;
d720b93d 1053#endif
9fa3e853
FB		 1054
1055 addr &= TARGET_PAGE_MASK;
1056 p = page_find(addr >> TARGET_PAGE_BITS);
5fafdf24 1057 if (!p)
9fa3e853
FB		 1058 return;
1059 tb = p->first_tb;
d720b93d
FB		 1060#ifdef TARGET_HAS_PRECISE_SMC
1061 if (tb && pc != 0) {
1062 current_tb = tb_find_pc(pc);
1063 }
1064#endif
9fa3e853
FB		 1065 while (tb != NULL) {
1066 n = (long)tb & 3;
1067 tb = (TranslationBlock *)((long)tb & ~3);
d720b93d
FB		 1068#ifdef TARGET_HAS_PRECISE_SMC
1069 if (current_tb == tb &&
2e70f6ef 1070 (current_tb->cflags & CF_COUNT_MASK) != 1) {
d720b93d
FB		 1071 /* If we are modifying the current TB, we must stop
1072 its execution. We could be more precise by checking
1073 that the modification is after the current PC, but it
1074 would require a specialized function to partially
1075 restore the CPU state */
3b46e624 1076
d720b93d
FB		 1077 current_tb_modified = 1;
1078 cpu_restore_state(current_tb, env, pc, puc);
6b917547
AL		 1079 cpu_get_tb_cpu_state(env, &current_pc, &current_cs_base,
1080 &current_flags);
d720b93d
FB		 1081 }
1082#endif /* TARGET_HAS_PRECISE_SMC */
9fa3e853
FB		 1083 tb_phys_invalidate(tb, addr);
1084 tb = tb->page_next[n];
1085 }
fd6ce8f6 1086 p->first_tb = NULL;
d720b93d
FB		 1087#ifdef TARGET_HAS_PRECISE_SMC
1088 if (current_tb_modified) {
1089 /* we generate a block containing just the instruction
1090 modifying the memory. It will ensure that it cannot modify
1091 itself */
ea1c1802 1092 env->current_tb = NULL;
2e70f6ef 1093 tb_gen_code(env, current_pc, current_cs_base, current_flags, 1);
d720b93d
FB		 1094 cpu_resume_from_signal(env, puc);
1095 }
1096#endif
fd6ce8f6 1097}
9fa3e853 1098#endif
fd6ce8f6
FB		 1099
1100/* add the tb in the target page and protect it if necessary */
5fafdf24 1101static inline void tb_alloc_page(TranslationBlock *tb,
53a5960a 1102 unsigned int n, target_ulong page_addr)
fd6ce8f6
FB		 1103{
1104 PageDesc *p;
9fa3e853
FB		 1105 TranslationBlock *last_first_tb;
1106
1107 tb->page_addr[n] = page_addr;
3a7d929e 1108 p = page_find_alloc(page_addr >> TARGET_PAGE_BITS);
9fa3e853
FB		 1109 tb->page_next[n] = p->first_tb;
1110 last_first_tb = p->first_tb;
1111 p->first_tb = (TranslationBlock *)((long)tb | n);
1112 invalidate_page_bitmap(p);
fd6ce8f6 1113
107db443 1114#if defined(TARGET_HAS_SMC) || 1
d720b93d 1115
9fa3e853 1116#if defined(CONFIG_USER_ONLY)
fd6ce8f6 1117 if (p->flags & PAGE_WRITE) {
53a5960a
PB		 1118 target_ulong addr;
1119 PageDesc *p2;
9fa3e853
FB		 1120 int prot;
1121
fd6ce8f6
FB		 1122 /* force the host page as non writable (writes will have a
1123 page fault + mprotect overhead) */
53a5960a 1124 page_addr &= qemu_host_page_mask;
fd6ce8f6 1125 prot = 0;
53a5960a
PB		 1126 for(addr = page_addr; addr < page_addr + qemu_host_page_size;
1127 addr += TARGET_PAGE_SIZE) {
1128
1129 p2 = page_find (addr >> TARGET_PAGE_BITS);
1130 if (!p2)
1131 continue;
1132 prot |= p2->flags;
1133 p2->flags &= ~PAGE_WRITE;
1134 page_get_flags(addr);
1135 }
5fafdf24 1136 mprotect(g2h(page_addr), qemu_host_page_size,
fd6ce8f6
FB		 1137 (prot & PAGE_BITS) & ~PAGE_WRITE);
1138#ifdef DEBUG_TB_INVALIDATE
ab3d1727 1139 printf("protecting code page: 0x" TARGET_FMT_lx "\n",
53a5960a 1140 page_addr);
fd6ce8f6 1141#endif
fd6ce8f6 1142 }
9fa3e853
FB		 1143#else
1144 /* if some code is already present, then the pages are already
1145 protected. So we handle the case where only the first TB is
1146 allocated in a physical page */
1147 if (!last_first_tb) {
6a00d601 1148 tlb_protect_code(page_addr);
9fa3e853
FB		 1149 }
1150#endif
d720b93d
FB		 1151
1152#endif /* TARGET_HAS_SMC */
fd6ce8f6
FB		 1153}
1154
1155/* Allocate a new translation block. Flush the translation buffer if
1156 too many translation blocks or too much generated code. */
c27004ec 1157TranslationBlock *tb_alloc(target_ulong pc)
fd6ce8f6
FB		 1158{
1159 TranslationBlock *tb;
fd6ce8f6 1160
26a5f13b
FB		 1161 if (nb_tbs >= code_gen_max_blocks ||
1162 (code_gen_ptr - code_gen_buffer) >= code_gen_buffer_max_size)
d4e8164f 1163 return NULL;
fd6ce8f6
FB		 1164 tb = &tbs[nb_tbs++];
1165 tb->pc = pc;
b448f2f3 1166 tb->cflags = 0;
d4e8164f
FB		 1167 return tb;
1168}
1169
2e70f6ef
PB		 1170void tb_free(TranslationBlock *tb)
1171{
bf20dc07 1172 /* In practice this is mostly used for single use temporary TB
2e70f6ef
PB		 1173 Ignore the hard cases and just back up if this TB happens to
1174 be the last one generated. */
1175 if (nb_tbs > 0 && tb == &tbs[nb_tbs - 1]) {
1176 code_gen_ptr = tb->tc_ptr;
1177 nb_tbs--;
1178 }
1179}
1180
9fa3e853
FB		 1181/* add a new TB and link it to the physical page tables. phys_page2 is
1182 (-1) to indicate that only one page contains the TB. */
5fafdf24 1183void tb_link_phys(TranslationBlock *tb,
9fa3e853 1184 target_ulong phys_pc, target_ulong phys_page2)
d4e8164f 1185{
9fa3e853
FB		 1186 unsigned int h;
1187 TranslationBlock **ptb;
1188
c8a706fe
PB		 1189 /* Grab the mmap lock to stop another thread invalidating this TB
1190 before we are done. */
1191 mmap_lock();
9fa3e853
FB		 1192 /* add in the physical hash table */
1193 h = tb_phys_hash_func(phys_pc);
1194 ptb = &tb_phys_hash[h];
1195 tb->phys_hash_next = *ptb;
1196 *ptb = tb;
fd6ce8f6
FB		 1197
1198 /* add in the page list */
9fa3e853
FB		 1199 tb_alloc_page(tb, 0, phys_pc & TARGET_PAGE_MASK);
1200 if (phys_page2 != -1)
1201 tb_alloc_page(tb, 1, phys_page2);
1202 else
1203 tb->page_addr[1] = -1;
9fa3e853 1204
d4e8164f
FB		 1205 tb->jmp_first = (TranslationBlock *)((long)tb | 2);
1206 tb->jmp_next[0] = NULL;
1207 tb->jmp_next[1] = NULL;
1208
1209 /* init original jump addresses */
1210 if (tb->tb_next_offset[0] != 0xffff)
1211 tb_reset_jump(tb, 0);
1212 if (tb->tb_next_offset[1] != 0xffff)
1213 tb_reset_jump(tb, 1);
8a40a180
FB		 1214
1215#ifdef DEBUG_TB_CHECK
1216 tb_page_check();
1217#endif
c8a706fe 1218 mmap_unlock();
fd6ce8f6
FB		 1219}
1220
9fa3e853
FB		 1221/* find the TB 'tb' such that tb[0].tc_ptr <= tc_ptr <
1222 tb[1].tc_ptr. Return NULL if not found */
1223TranslationBlock *tb_find_pc(unsigned long tc_ptr)
fd6ce8f6 1224{
9fa3e853
FB		 1225 int m_min, m_max, m;
1226 unsigned long v;
1227 TranslationBlock *tb;
a513fe19
FB		 1228
1229 if (nb_tbs <= 0)
1230 return NULL;
1231 if (tc_ptr < (unsigned long)code_gen_buffer ||
1232 tc_ptr >= (unsigned long)code_gen_ptr)
1233 return NULL;
1234 /* binary search (cf Knuth) */
1235 m_min = 0;
1236 m_max = nb_tbs - 1;
1237 while (m_min <= m_max) {
1238 m = (m_min + m_max) >> 1;
1239 tb = &tbs[m];
1240 v = (unsigned long)tb->tc_ptr;
1241 if (v == tc_ptr)
1242 return tb;
1243 else if (tc_ptr < v) {
1244 m_max = m - 1;
1245 } else {
1246 m_min = m + 1;
1247 }
5fafdf24 1248 }
a513fe19
FB		 1249 return &tbs[m_max];
1250}
7501267e 1251
ea041c0e
FB		 1252static void tb_reset_jump_recursive(TranslationBlock *tb);
1253
1254static inline void tb_reset_jump_recursive2(TranslationBlock *tb, int n)
1255{
1256 TranslationBlock *tb1, *tb_next, **ptb;
1257 unsigned int n1;
1258
1259 tb1 = tb->jmp_next[n];
1260 if (tb1 != NULL) {
1261 /* find head of list */
1262 for(;;) {
1263 n1 = (long)tb1 & 3;
1264 tb1 = (TranslationBlock *)((long)tb1 & ~3);
1265 if (n1 == 2)
1266 break;
1267 tb1 = tb1->jmp_next[n1];
1268 }
1269 /* we are now sure now that tb jumps to tb1 */
1270 tb_next = tb1;
1271
1272 /* remove tb from the jmp_first list */
1273 ptb = &tb_next->jmp_first;
1274 for(;;) {
1275 tb1 = *ptb;
1276 n1 = (long)tb1 & 3;
1277 tb1 = (TranslationBlock *)((long)tb1 & ~3);
1278 if (n1 == n && tb1 == tb)
1279 break;
1280 ptb = &tb1->jmp_next[n1];
1281 }
1282 *ptb = tb->jmp_next[n];
1283 tb->jmp_next[n] = NULL;
3b46e624 1284
ea041c0e
FB		 1285 /* suppress the jump to next tb in generated code */
1286 tb_reset_jump(tb, n);
1287
0124311e 1288 /* suppress jumps in the tb on which we could have jumped */
ea041c0e
FB		 1289 tb_reset_jump_recursive(tb_next);
1290 }
1291}
1292
1293static void tb_reset_jump_recursive(TranslationBlock *tb)
1294{
1295 tb_reset_jump_recursive2(tb, 0);
1296 tb_reset_jump_recursive2(tb, 1);
1297}
1298
1fddef4b 1299#if defined(TARGET_HAS_ICE)
d720b93d
FB		 1300static void breakpoint_invalidate(CPUState *env, target_ulong pc)
1301{
9b3c35e0
JM		 1302 target_phys_addr_t addr;
1303 target_ulong pd;
c2f07f81
PB		 1304 ram_addr_t ram_addr;
1305 PhysPageDesc *p;
d720b93d 1306
c2f07f81
PB		 1307 addr = cpu_get_phys_page_debug(env, pc);
1308 p = phys_page_find(addr >> TARGET_PAGE_BITS);
1309 if (!p) {
1310 pd = IO_MEM_UNASSIGNED;
1311 } else {
1312 pd = p->phys_offset;
1313 }
1314 ram_addr = (pd & TARGET_PAGE_MASK) | (pc & ~TARGET_PAGE_MASK);
706cd4b5 1315 tb_invalidate_phys_page_range(ram_addr, ram_addr + 1, 0);
d720b93d 1316}
c27004ec 1317#endif
d720b93d 1318
6658ffb8 1319/* Add a watchpoint. */
a1d1bb31
AL		 1320int cpu_watchpoint_insert(CPUState *env, target_ulong addr, target_ulong len,
1321 int flags, CPUWatchpoint **watchpoint)
6658ffb8 1322{
b4051334 1323 target_ulong len_mask = ~(len - 1);
c0ce998e 1324 CPUWatchpoint *wp;
6658ffb8 1325
b4051334
AL		 1326 /* sanity checks: allow power-of-2 lengths, deny unaligned watchpoints */
1327 if ((len != 1 && len != 2 && len != 4 && len != 8) || (addr & ~len_mask)) {
1328 fprintf(stderr, "qemu: tried to set invalid watchpoint at "
1329 TARGET_FMT_lx ", len=" TARGET_FMT_lu "\n", addr, len);
1330 return -EINVAL;
1331 }
a1d1bb31 1332 wp = qemu_malloc(sizeof(*wp));
a1d1bb31
AL		 1333
1334 wp->vaddr = addr;
b4051334 1335 wp->len_mask = len_mask;
a1d1bb31
AL		 1336 wp->flags = flags;
1337
2dc9f411 1338 /* keep all GDB-injected watchpoints in front */
c0ce998e
AL		 1339 if (flags & BP_GDB)
1340 TAILQ_INSERT_HEAD(&env->watchpoints, wp, entry);
1341 else
1342 TAILQ_INSERT_TAIL(&env->watchpoints, wp, entry);
6658ffb8 1343
6658ffb8 1344 tlb_flush_page(env, addr);
a1d1bb31
AL		 1345
1346 if (watchpoint)
1347 *watchpoint = wp;
1348 return 0;
6658ffb8
PB		 1349}
1350
a1d1bb31
AL		 1351/* Remove a specific watchpoint. */
1352int cpu_watchpoint_remove(CPUState *env, target_ulong addr, target_ulong len,
1353 int flags)
6658ffb8 1354{
b4051334 1355 target_ulong len_mask = ~(len - 1);
a1d1bb31 1356 CPUWatchpoint *wp;
6658ffb8 1357
c0ce998e 1358 TAILQ_FOREACH(wp, &env->watchpoints, entry) {
b4051334 1359 if (addr == wp->vaddr && len_mask == wp->len_mask
6e140f28 1360 && flags == (wp->flags & ~BP_WATCHPOINT_HIT)) {
a1d1bb31 1361 cpu_watchpoint_remove_by_ref(env, wp);
6658ffb8
PB		 1362 return 0;
1363 }
1364 }
a1d1bb31 1365 return -ENOENT;
6658ffb8
PB		 1366}
1367
a1d1bb31
AL		 1368/* Remove a specific watchpoint by reference. */
1369void cpu_watchpoint_remove_by_ref(CPUState *env, CPUWatchpoint *watchpoint)
1370{
c0ce998e 1371 TAILQ_REMOVE(&env->watchpoints, watchpoint, entry);
7d03f82f 1372
a1d1bb31
AL		 1373 tlb_flush_page(env, watchpoint->vaddr);
1374
1375 qemu_free(watchpoint);
1376}
1377
1378/* Remove all matching watchpoints. */
1379void cpu_watchpoint_remove_all(CPUState *env, int mask)
1380{
c0ce998e 1381 CPUWatchpoint *wp, *next;
a1d1bb31 1382
c0ce998e 1383 TAILQ_FOREACH_SAFE(wp, &env->watchpoints, entry, next) {
a1d1bb31
AL		 1384 if (wp->flags & mask)
1385 cpu_watchpoint_remove_by_ref(env, wp);
c0ce998e 1386 }
7d03f82f
EI		 1387}
1388
a1d1bb31
AL		 1389/* Add a breakpoint. */
1390int cpu_breakpoint_insert(CPUState *env, target_ulong pc, int flags,
1391 CPUBreakpoint **breakpoint)
4c3a88a2 1392{
1fddef4b 1393#if defined(TARGET_HAS_ICE)
c0ce998e 1394 CPUBreakpoint *bp;
3b46e624 1395
a1d1bb31 1396 bp = qemu_malloc(sizeof(*bp));
4c3a88a2 1397
a1d1bb31
AL		 1398 bp->pc = pc;
1399 bp->flags = flags;
1400
2dc9f411 1401 /* keep all GDB-injected breakpoints in front */
c0ce998e
AL		 1402 if (flags & BP_GDB)
1403 TAILQ_INSERT_HEAD(&env->breakpoints, bp, entry);
1404 else
1405 TAILQ_INSERT_TAIL(&env->breakpoints, bp, entry);
3b46e624 1406
d720b93d 1407 breakpoint_invalidate(env, pc);
a1d1bb31
AL		 1408
1409 if (breakpoint)
1410 *breakpoint = bp;
4c3a88a2
FB		 1411 return 0;
1412#else
a1d1bb31 1413 return -ENOSYS;
4c3a88a2
FB		 1414#endif
1415}
1416
a1d1bb31
AL		 1417/* Remove a specific breakpoint. */
1418int cpu_breakpoint_remove(CPUState *env, target_ulong pc, int flags)
1419{
7d03f82f 1420#if defined(TARGET_HAS_ICE)
a1d1bb31
AL		 1421 CPUBreakpoint *bp;
1422
c0ce998e 1423 TAILQ_FOREACH(bp, &env->breakpoints, entry) {
a1d1bb31
AL		 1424 if (bp->pc == pc && bp->flags == flags) {
1425 cpu_breakpoint_remove_by_ref(env, bp);
1426 return 0;
1427 }
7d03f82f 1428 }
a1d1bb31
AL		 1429 return -ENOENT;
1430#else
1431 return -ENOSYS;
7d03f82f
EI		 1432#endif
1433}
1434
a1d1bb31
AL		 1435/* Remove a specific breakpoint by reference. */
1436void cpu_breakpoint_remove_by_ref(CPUState *env, CPUBreakpoint *breakpoint)
4c3a88a2 1437{
1fddef4b 1438#if defined(TARGET_HAS_ICE)
c0ce998e 1439 TAILQ_REMOVE(&env->breakpoints, breakpoint, entry);
d720b93d 1440
a1d1bb31
AL		 1441 breakpoint_invalidate(env, breakpoint->pc);
1442
1443 qemu_free(breakpoint);
1444#endif
1445}
1446
1447/* Remove all matching breakpoints. */
1448void cpu_breakpoint_remove_all(CPUState *env, int mask)
1449{
1450#if defined(TARGET_HAS_ICE)
c0ce998e 1451 CPUBreakpoint *bp, *next;
a1d1bb31 1452
c0ce998e 1453 TAILQ_FOREACH_SAFE(bp, &env->breakpoints, entry, next) {
a1d1bb31
AL		 1454 if (bp->flags & mask)
1455 cpu_breakpoint_remove_by_ref(env, bp);
c0ce998e 1456 }
4c3a88a2
FB		 1457#endif
1458}
1459
c33a346e
FB		 1460/* enable or disable single step mode. EXCP_DEBUG is returned by the
1461 CPU loop after each instruction */
1462void cpu_single_step(CPUState *env, int enabled)
1463{
1fddef4b 1464#if defined(TARGET_HAS_ICE)
c33a346e
FB		 1465 if (env->singlestep_enabled != enabled) {
1466 env->singlestep_enabled = enabled;
e22a25c9
AL		 1467 if (kvm_enabled())
1468 kvm_update_guest_debug(env, 0);
1469 else {
1470 /* must flush all the translated code to avoid inconsistancies */
1471 /* XXX: only flush what is necessary */
1472 tb_flush(env);
1473 }
c33a346e
FB		 1474 }
1475#endif
1476}
1477
34865134
FB		 1478/* enable or disable low levels log */
1479void cpu_set_log(int log_flags)
1480{
1481 loglevel = log_flags;
1482 if (loglevel && !logfile) {
11fcfab4 1483 logfile = fopen(logfilename, log_append ? "a" : "w");
34865134
FB		 1484 if (!logfile) {
1485 perror(logfilename);
1486 _exit(1);
1487 }
9fa3e853
FB		 1488#if !defined(CONFIG_SOFTMMU)
1489 /* must avoid mmap() usage of glibc by setting a buffer "by hand" */
1490 {
b55266b5 1491 static char logfile_buf[4096];
9fa3e853
FB		 1492 setvbuf(logfile, logfile_buf, _IOLBF, sizeof(logfile_buf));
1493 }
1494#else
34865134 1495 setvbuf(logfile, NULL, _IOLBF, 0);
9fa3e853 1496#endif
e735b91c
PB		 1497 log_append = 1;
1498 }
1499 if (!loglevel && logfile) {
1500 fclose(logfile);
1501 logfile = NULL;
34865134
FB		 1502 }
1503}
1504
1505void cpu_set_log_filename(const char *filename)
1506{
1507 logfilename = strdup(filename);
e735b91c
PB		 1508 if (logfile) {
1509 fclose(logfile);
1510 logfile = NULL;
1511 }
1512 cpu_set_log(loglevel);
34865134 1513}
c33a346e 1514
3098dba0 1515static void cpu_unlink_tb(CPUState *env)
ea041c0e 1516{
3098dba0
AJ		 1517#if defined(USE_NPTL)
1518 /* FIXME: TB unchaining isn't SMP safe. For now just ignore the
1519 problem and hope the cpu will stop of its own accord. For userspace
1520 emulation this often isn't actually as bad as it sounds. Often
1521 signals are used primarily to interrupt blocking syscalls. */
1522#else
ea041c0e 1523 TranslationBlock *tb;
15a51156 1524 static spinlock_t interrupt_lock = SPIN_LOCK_UNLOCKED;
59817ccb 1525
3098dba0
AJ		 1526 tb = env->current_tb;
1527 /* if the cpu is currently executing code, we must unlink it and
1528 all the potentially executing TB */
1529 if (tb && !testandset(&interrupt_lock)) {
1530 env->current_tb = NULL;
1531 tb_reset_jump_recursive(tb);
1532 resetlock(&interrupt_lock);
be214e6c 1533 }
3098dba0
AJ		 1534#endif
1535}
1536
1537/* mask must never be zero, except for A20 change call */
1538void cpu_interrupt(CPUState *env, int mask)
1539{
1540 int old_mask;
be214e6c 1541
2e70f6ef 1542 old_mask = env->interrupt_request;
68a79315 1543 env->interrupt_request |= mask;
3098dba0 1544
8edac960
AL		 1545#ifndef CONFIG_USER_ONLY
1546 /*
1547 * If called from iothread context, wake the target cpu in
1548 * case its halted.
1549 */
1550 if (!qemu_cpu_self(env)) {
1551 qemu_cpu_kick(env);
1552 return;
1553 }
1554#endif
1555
2e70f6ef 1556 if (use_icount) {
266910c4 1557 env->icount_decr.u16.high = 0xffff;
2e70f6ef 1558#ifndef CONFIG_USER_ONLY
2e70f6ef 1559 if (!can_do_io(env)
be214e6c 1560 && (mask & ~old_mask) != 0) {
2e70f6ef
PB		 1561 cpu_abort(env, "Raised interrupt while not in I/O function");
1562 }
1563#endif
1564 } else {
3098dba0 1565 cpu_unlink_tb(env);
ea041c0e
FB		 1566 }
1567}
1568
b54ad049
FB		 1569void cpu_reset_interrupt(CPUState *env, int mask)
1570{
1571 env->interrupt_request &= ~mask;
1572}
1573
3098dba0
AJ		 1574void cpu_exit(CPUState *env)
1575{
1576 env->exit_request = 1;
1577 cpu_unlink_tb(env);
1578}
1579
c7cd6a37 1580const CPULogItem cpu_log_items[] = {
5fafdf24 1581 { CPU_LOG_TB_OUT_ASM, "out_asm",
f193c797
FB		 1582 "show generated host assembly code for each compiled TB" },
1583 { CPU_LOG_TB_IN_ASM, "in_asm",
1584 "show target assembly code for each compiled TB" },
5fafdf24 1585 { CPU_LOG_TB_OP, "op",
57fec1fe 1586 "show micro ops for each compiled TB" },
f193c797 1587 { CPU_LOG_TB_OP_OPT, "op_opt",
e01a1157
BS		 1588 "show micro ops "
1589#ifdef TARGET_I386
1590 "before eflags optimization and "
f193c797 1591#endif
e01a1157 1592 "after liveness analysis" },
f193c797
FB		 1593 { CPU_LOG_INT, "int",
1594 "show interrupts/exceptions in short format" },
1595 { CPU_LOG_EXEC, "exec",
1596 "show trace before each executed TB (lots of logs)" },
9fddaa0c 1597 { CPU_LOG_TB_CPU, "cpu",
e91c8a77 1598 "show CPU state before block translation" },
f193c797
FB		 1599#ifdef TARGET_I386
1600 { CPU_LOG_PCALL, "pcall",
1601 "show protected mode far calls/returns/exceptions" },
eca1bdf4
AL		 1602 { CPU_LOG_RESET, "cpu_reset",
1603 "show CPU state before CPU resets" },
f193c797 1604#endif
8e3a9fd2 1605#ifdef DEBUG_IOPORT
fd872598
FB		 1606 { CPU_LOG_IOPORT, "ioport",
1607 "show all i/o ports accesses" },
8e3a9fd2 1608#endif
f193c797
FB		 1609 { 0, NULL, NULL },
1610};
1611
1612static int cmp1(const char *s1, int n, const char *s2)
1613{
1614 if (strlen(s2) != n)
1615 return 0;
1616 return memcmp(s1, s2, n) == 0;
1617}
3b46e624 1618
f193c797
FB		 1619/* takes a comma separated list of log masks. Return 0 if error. */
1620int cpu_str_to_log_mask(const char *str)
1621{
c7cd6a37 1622 const CPULogItem *item;
f193c797
FB		 1623 int mask;
1624 const char *p, *p1;
1625
1626 p = str;
1627 mask = 0;
1628 for(;;) {
1629 p1 = strchr(p, ',');
1630 if (!p1)
1631 p1 = p + strlen(p);
8e3a9fd2
FB		 1632 if(cmp1(p,p1-p,"all")) {
1633 for(item = cpu_log_items; item->mask != 0; item++) {
1634 mask |= item->mask;
1635 }
1636 } else {
f193c797
FB		 1637 for(item = cpu_log_items; item->mask != 0; item++) {
1638 if (cmp1(p, p1 - p, item->name))
1639 goto found;
1640 }
1641 return 0;
8e3a9fd2 1642 }
f193c797
FB		 1643 found:
1644 mask |= item->mask;
1645 if (*p1 != ',')
1646 break;
1647 p = p1 + 1;
1648 }
1649 return mask;
1650}
ea041c0e 1651
7501267e
FB		 1652void cpu_abort(CPUState *env, const char *fmt, ...)
1653{
1654 va_list ap;
493ae1f0 1655 va_list ap2;
7501267e
FB		 1656
1657 va_start(ap, fmt);
493ae1f0 1658 va_copy(ap2, ap);
7501267e
FB		 1659 fprintf(stderr, "qemu: fatal: ");
1660 vfprintf(stderr, fmt, ap);
1661 fprintf(stderr, "\n");
1662#ifdef TARGET_I386
7fe48483
FB		 1663 cpu_dump_state(env, stderr, fprintf, X86_DUMP_FPU | X86_DUMP_CCOP);
1664#else
1665 cpu_dump_state(env, stderr, fprintf, 0);
7501267e 1666#endif
93fcfe39
AL		 1667 if (qemu_log_enabled()) {
1668 qemu_log("qemu: fatal: ");
1669 qemu_log_vprintf(fmt, ap2);
1670 qemu_log("\n");
f9373291 1671#ifdef TARGET_I386
93fcfe39 1672 log_cpu_state(env, X86_DUMP_FPU | X86_DUMP_CCOP);
f9373291 1673#else
93fcfe39 1674 log_cpu_state(env, 0);
f9373291 1675#endif
31b1a7b4 1676 qemu_log_flush();
93fcfe39 1677 qemu_log_close();
924edcae 1678 }
493ae1f0 1679 va_end(ap2);
f9373291 1680 va_end(ap);
7501267e
FB		 1681 abort();
1682}
1683
c5be9f08
TS		 1684CPUState *cpu_copy(CPUState *env)
1685{
01ba9816 1686 CPUState *new_env = cpu_init(env->cpu_model_str);
c5be9f08
TS		 1687 CPUState *next_cpu = new_env->next_cpu;
1688 int cpu_index = new_env->cpu_index;
5a38f081
AL		 1689#if defined(TARGET_HAS_ICE)
1690 CPUBreakpoint *bp;
1691 CPUWatchpoint *wp;
1692#endif
1693
c5be9f08 1694 memcpy(new_env, env, sizeof(CPUState));
5a38f081
AL		 1695
1696 /* Preserve chaining and index. */
c5be9f08
TS		 1697 new_env->next_cpu = next_cpu;
1698 new_env->cpu_index = cpu_index;
5a38f081
AL		 1699
1700 /* Clone all break/watchpoints.
1701 Note: Once we support ptrace with hw-debug register access, make sure
1702 BP_CPU break/watchpoints are handled correctly on clone. */
1703 TAILQ_INIT(&env->breakpoints);
1704 TAILQ_INIT(&env->watchpoints);
1705#if defined(TARGET_HAS_ICE)
1706 TAILQ_FOREACH(bp, &env->breakpoints, entry) {
1707 cpu_breakpoint_insert(new_env, bp->pc, bp->flags, NULL);
1708 }
1709 TAILQ_FOREACH(wp, &env->watchpoints, entry) {
1710 cpu_watchpoint_insert(new_env, wp->vaddr, (~wp->len_mask) + 1,
1711 wp->flags, NULL);
1712 }
1713#endif
1714
c5be9f08
TS		 1715 return new_env;
1716}
1717
0124311e
FB		 1718#if !defined(CONFIG_USER_ONLY)
1719
5c751e99
EI		 1720static inline void tlb_flush_jmp_cache(CPUState *env, target_ulong addr)
1721{
1722 unsigned int i;
1723
1724 /* Discard jump cache entries for any tb which might potentially
1725 overlap the flushed page. */
1726 i = tb_jmp_cache_hash_page(addr - TARGET_PAGE_SIZE);
1727 memset (&env->tb_jmp_cache[i], 0,
1728 TB_JMP_PAGE_SIZE * sizeof(TranslationBlock *));
1729
1730 i = tb_jmp_cache_hash_page(addr);
1731 memset (&env->tb_jmp_cache[i], 0,
1732 TB_JMP_PAGE_SIZE * sizeof(TranslationBlock *));
1733}
1734
ee8b7021
FB		 1735/* NOTE: if flush_global is true, also flush global entries (not
1736 implemented yet) */
1737void tlb_flush(CPUState *env, int flush_global)
33417e70 1738{
33417e70 1739 int i;
0124311e 1740
9fa3e853
FB		 1741#if defined(DEBUG_TLB)
1742 printf("tlb_flush:\n");
1743#endif
0124311e
FB		 1744 /* must reset current TB so that interrupts cannot modify the
1745 links while we are modifying them */
1746 env->current_tb = NULL;
1747
33417e70 1748 for(i = 0; i < CPU_TLB_SIZE; i++) {
84b7b8e7
FB		 1749 env->tlb_table[0][i].addr_read = -1;
1750 env->tlb_table[0][i].addr_write = -1;
1751 env->tlb_table[0][i].addr_code = -1;
1752 env->tlb_table[1][i].addr_read = -1;
1753 env->tlb_table[1][i].addr_write = -1;
1754 env->tlb_table[1][i].addr_code = -1;
6fa4cea9
JM		 1755#if (NB_MMU_MODES >= 3)
1756 env->tlb_table[2][i].addr_read = -1;
1757 env->tlb_table[2][i].addr_write = -1;
1758 env->tlb_table[2][i].addr_code = -1;
e37e6ee6
AJ		 1759#endif
1760#if (NB_MMU_MODES >= 4)
6fa4cea9
JM		 1761 env->tlb_table[3][i].addr_read = -1;
1762 env->tlb_table[3][i].addr_write = -1;
1763 env->tlb_table[3][i].addr_code = -1;
1764#endif
e37e6ee6
AJ		 1765#if (NB_MMU_MODES >= 5)
1766 env->tlb_table[4][i].addr_read = -1;
1767 env->tlb_table[4][i].addr_write = -1;
1768 env->tlb_table[4][i].addr_code = -1;
6fa4cea9 1769#endif
e37e6ee6 1770
33417e70 1771 }
9fa3e853 1772
8a40a180 1773 memset (env->tb_jmp_cache, 0, TB_JMP_CACHE_SIZE * sizeof (void *));
9fa3e853 1774
640f42e4 1775#ifdef CONFIG_KQEMU
0a962c02
FB		 1776 if (env->kqemu_enabled) {
1777 kqemu_flush(env, flush_global);
1778 }
9fa3e853 1779#endif
e3db7226 1780 tlb_flush_count++;
33417e70
FB		 1781}
1782
274da6b2 1783static inline void tlb_flush_entry(CPUTLBEntry *tlb_entry, target_ulong addr)
61382a50 1784{
5fafdf24 1785 if (addr == (tlb_entry->addr_read &
84b7b8e7 1786 (TARGET_PAGE_MASK | TLB_INVALID_MASK)) ||
5fafdf24 1787 addr == (tlb_entry->addr_write &
84b7b8e7 1788 (TARGET_PAGE_MASK | TLB_INVALID_MASK)) ||
5fafdf24 1789 addr == (tlb_entry->addr_code &
84b7b8e7
FB		 1790 (TARGET_PAGE_MASK | TLB_INVALID_MASK))) {
1791 tlb_entry->addr_read = -1;
1792 tlb_entry->addr_write = -1;
1793 tlb_entry->addr_code = -1;
1794 }
61382a50
FB		 1795}
1796
2e12669a 1797void tlb_flush_page(CPUState *env, target_ulong addr)
33417e70 1798{
8a40a180 1799 int i;
0124311e 1800
9fa3e853 1801#if defined(DEBUG_TLB)
108c49b8 1802 printf("tlb_flush_page: " TARGET_FMT_lx "\n", addr);
9fa3e853 1803#endif
0124311e
FB		 1804 /* must reset current TB so that interrupts cannot modify the
1805 links while we are modifying them */
1806 env->current_tb = NULL;
61382a50
FB		 1807
1808 addr &= TARGET_PAGE_MASK;
1809 i = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
84b7b8e7
FB		 1810 tlb_flush_entry(&env->tlb_table[0][i], addr);
1811 tlb_flush_entry(&env->tlb_table[1][i], addr);
6fa4cea9
JM		 1812#if (NB_MMU_MODES >= 3)
1813 tlb_flush_entry(&env->tlb_table[2][i], addr);
e37e6ee6
AJ		 1814#endif
1815#if (NB_MMU_MODES >= 4)
6fa4cea9
JM		 1816 tlb_flush_entry(&env->tlb_table[3][i], addr);
1817#endif
e37e6ee6
AJ		 1818#if (NB_MMU_MODES >= 5)
1819 tlb_flush_entry(&env->tlb_table[4][i], addr);
6fa4cea9 1820#endif
0124311e 1821
5c751e99 1822 tlb_flush_jmp_cache(env, addr);
9fa3e853 1823
640f42e4 1824#ifdef CONFIG_KQEMU
0a962c02
FB		 1825 if (env->kqemu_enabled) {
1826 kqemu_flush_page(env, addr);
1827 }
1828#endif
9fa3e853
FB		 1829}
1830
9fa3e853
FB		 1831/* update the TLBs so that writes to code in the virtual page 'addr'
1832 can be detected */
6a00d601 1833static void tlb_protect_code(ram_addr_t ram_addr)
9fa3e853 1834{
5fafdf24 1835 cpu_physical_memory_reset_dirty(ram_addr,
6a00d601
FB		 1836 ram_addr + TARGET_PAGE_SIZE,
1837 CODE_DIRTY_FLAG);
9fa3e853
FB		 1838}
1839
9fa3e853 1840/* update the TLB so that writes in physical page 'phys_addr' are no longer
3a7d929e 1841 tested for self modifying code */
5fafdf24 1842static void tlb_unprotect_code_phys(CPUState *env, ram_addr_t ram_addr,
3a7d929e 1843 target_ulong vaddr)
9fa3e853 1844{
3a7d929e 1845 phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] |= CODE_DIRTY_FLAG;
1ccde1cb
FB		 1846}
1847
5fafdf24 1848static inline void tlb_reset_dirty_range(CPUTLBEntry *tlb_entry,
1ccde1cb
FB		 1849 unsigned long start, unsigned long length)
1850{
1851 unsigned long addr;
84b7b8e7
FB		 1852 if ((tlb_entry->addr_write & ~TARGET_PAGE_MASK) == IO_MEM_RAM) {
1853 addr = (tlb_entry->addr_write & TARGET_PAGE_MASK) + tlb_entry->addend;
1ccde1cb 1854 if ((addr - start) < length) {
0f459d16 1855 tlb_entry->addr_write = (tlb_entry->addr_write & TARGET_PAGE_MASK) | TLB_NOTDIRTY;
1ccde1cb
FB		 1856 }
1857 }
1858}
1859
5579c7f3 1860/* Note: start and end must be within the same ram block. */
3a7d929e 1861void cpu_physical_memory_reset_dirty(ram_addr_t start, ram_addr_t end,
0a962c02 1862 int dirty_flags)
1ccde1cb
FB		 1863{
1864 CPUState *env;
4f2ac237 1865 unsigned long length, start1;
0a962c02
FB		 1866 int i, mask, len;
1867 uint8_t *p;
1ccde1cb
FB		 1868
1869 start &= TARGET_PAGE_MASK;
1870 end = TARGET_PAGE_ALIGN(end);
1871
1872 length = end - start;
1873 if (length == 0)
1874 return;
0a962c02 1875 len = length >> TARGET_PAGE_BITS;
640f42e4 1876#ifdef CONFIG_KQEMU
6a00d601
FB		 1877 /* XXX: should not depend on cpu context */
1878 env = first_cpu;
3a7d929e 1879 if (env->kqemu_enabled) {
f23db169
FB		 1880 ram_addr_t addr;
1881 addr = start;
1882 for(i = 0; i < len; i++) {
1883 kqemu_set_notdirty(env, addr);
1884 addr += TARGET_PAGE_SIZE;
1885 }
3a7d929e
FB		 1886 }
1887#endif
f23db169
FB		 1888 mask = ~dirty_flags;
1889 p = phys_ram_dirty + (start >> TARGET_PAGE_BITS);
1890 for(i = 0; i < len; i++)
1891 p[i] &= mask;
1892
1ccde1cb
FB		 1893 /* we modify the TLB cache so that the dirty bit will be set again
1894 when accessing the range */
5579c7f3
PB		 1895 start1 = (unsigned long)qemu_get_ram_ptr(start);
1896 /* Chek that we don't span multiple blocks - this breaks the
1897 address comparisons below. */
1898 if ((unsigned long)qemu_get_ram_ptr(end - 1) - start1
1899 != (end - 1) - start) {
1900 abort();
1901 }
1902
6a00d601
FB		 1903 for(env = first_cpu; env != NULL; env = env->next_cpu) {
1904 for(i = 0; i < CPU_TLB_SIZE; i++)
84b7b8e7 1905 tlb_reset_dirty_range(&env->tlb_table[0][i], start1, length);
6a00d601 1906 for(i = 0; i < CPU_TLB_SIZE; i++)
84b7b8e7 1907 tlb_reset_dirty_range(&env->tlb_table[1][i], start1, length);
6fa4cea9
JM		 1908#if (NB_MMU_MODES >= 3)
1909 for(i = 0; i < CPU_TLB_SIZE; i++)
1910 tlb_reset_dirty_range(&env->tlb_table[2][i], start1, length);
e37e6ee6
AJ		 1911#endif
1912#if (NB_MMU_MODES >= 4)
6fa4cea9
JM		 1913 for(i = 0; i < CPU_TLB_SIZE; i++)
1914 tlb_reset_dirty_range(&env->tlb_table[3][i], start1, length);
1915#endif
e37e6ee6
AJ		 1916#if (NB_MMU_MODES >= 5)
1917 for(i = 0; i < CPU_TLB_SIZE; i++)
1918 tlb_reset_dirty_range(&env->tlb_table[4][i], start1, length);
6fa4cea9 1919#endif
6a00d601 1920 }
1ccde1cb
FB		 1921}
1922
74576198
AL		 1923int cpu_physical_memory_set_dirty_tracking(int enable)
1924{
1925 in_migration = enable;
1926 return 0;
1927}
1928
1929int cpu_physical_memory_get_dirty_tracking(void)
1930{
1931 return in_migration;
1932}
1933
2bec46dc
AL		 1934void cpu_physical_sync_dirty_bitmap(target_phys_addr_t start_addr, target_phys_addr_t end_addr)
1935{
1936 if (kvm_enabled())
1937 kvm_physical_sync_dirty_bitmap(start_addr, end_addr);
1938}
1939
3a7d929e
FB		 1940static inline void tlb_update_dirty(CPUTLBEntry *tlb_entry)
1941{
1942 ram_addr_t ram_addr;
5579c7f3 1943 void *p;
3a7d929e 1944
84b7b8e7 1945 if ((tlb_entry->addr_write & ~TARGET_PAGE_MASK) == IO_MEM_RAM) {
5579c7f3
PB		 1946 p = (void *)(unsigned long)((tlb_entry->addr_write & TARGET_PAGE_MASK)
1947 + tlb_entry->addend);
1948 ram_addr = qemu_ram_addr_from_host(p);
3a7d929e 1949 if (!cpu_physical_memory_is_dirty(ram_addr)) {
0f459d16 1950 tlb_entry->addr_write |= TLB_NOTDIRTY;
3a7d929e
FB		 1951 }
1952 }
1953}
1954
1955/* update the TLB according to the current state of the dirty bits */
1956void cpu_tlb_update_dirty(CPUState *env)
1957{
1958 int i;
1959 for(i = 0; i < CPU_TLB_SIZE; i++)
84b7b8e7 1960 tlb_update_dirty(&env->tlb_table[0][i]);
3a7d929e 1961 for(i = 0; i < CPU_TLB_SIZE; i++)
84b7b8e7 1962 tlb_update_dirty(&env->tlb_table[1][i]);
6fa4cea9
JM		 1963#if (NB_MMU_MODES >= 3)
1964 for(i = 0; i < CPU_TLB_SIZE; i++)
1965 tlb_update_dirty(&env->tlb_table[2][i]);
e37e6ee6
AJ		 1966#endif
1967#if (NB_MMU_MODES >= 4)
6fa4cea9
JM		 1968 for(i = 0; i < CPU_TLB_SIZE; i++)
1969 tlb_update_dirty(&env->tlb_table[3][i]);
1970#endif
e37e6ee6
AJ		 1971#if (NB_MMU_MODES >= 5)
1972 for(i = 0; i < CPU_TLB_SIZE; i++)
1973 tlb_update_dirty(&env->tlb_table[4][i]);
6fa4cea9 1974#endif
3a7d929e
FB		 1975}
1976
0f459d16 1977static inline void tlb_set_dirty1(CPUTLBEntry *tlb_entry, target_ulong vaddr)
1ccde1cb 1978{
0f459d16
PB		 1979 if (tlb_entry->addr_write == (vaddr | TLB_NOTDIRTY))
1980 tlb_entry->addr_write = vaddr;
1ccde1cb
FB		 1981}
1982
0f459d16
PB		 1983/* update the TLB corresponding to virtual page vaddr
1984 so that it is no longer dirty */
1985static inline void tlb_set_dirty(CPUState *env, target_ulong vaddr)
1ccde1cb 1986{
1ccde1cb
FB		 1987 int i;
1988
0f459d16 1989 vaddr &= TARGET_PAGE_MASK;
1ccde1cb 1990 i = (vaddr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
0f459d16
PB		 1991 tlb_set_dirty1(&env->tlb_table[0][i], vaddr);
1992 tlb_set_dirty1(&env->tlb_table[1][i], vaddr);
6fa4cea9 1993#if (NB_MMU_MODES >= 3)
0f459d16 1994 tlb_set_dirty1(&env->tlb_table[2][i], vaddr);
e37e6ee6
AJ		 1995#endif
1996#if (NB_MMU_MODES >= 4)
0f459d16 1997 tlb_set_dirty1(&env->tlb_table[3][i], vaddr);
6fa4cea9 1998#endif
e37e6ee6
AJ		 1999#if (NB_MMU_MODES >= 5)
2000 tlb_set_dirty1(&env->tlb_table[4][i], vaddr);
6fa4cea9 2001#endif
9fa3e853
FB		 2002}
2003
59817ccb
FB		 2004/* add a new TLB entry. At most one entry for a given virtual address
2005 is permitted. Return 0 if OK or 2 if the page could not be mapped
2006 (can only happen in non SOFTMMU mode for I/O pages or pages
2007 conflicting with the host address space). */
5fafdf24
TS		 2008int tlb_set_page_exec(CPUState *env, target_ulong vaddr,
2009 target_phys_addr_t paddr, int prot,
6ebbf390 2010 int mmu_idx, int is_softmmu)
9fa3e853 2011{
92e873b9 2012 PhysPageDesc *p;
4f2ac237 2013 unsigned long pd;
9fa3e853 2014 unsigned int index;
4f2ac237 2015 target_ulong address;
0f459d16 2016 target_ulong code_address;
108c49b8 2017 target_phys_addr_t addend;
9fa3e853 2018 int ret;
84b7b8e7 2019 CPUTLBEntry *te;
a1d1bb31 2020 CPUWatchpoint *wp;
0f459d16 2021 target_phys_addr_t iotlb;
9fa3e853 2022
92e873b9 2023 p = phys_page_find(paddr >> TARGET_PAGE_BITS);
9fa3e853
FB		 2024 if (!p) {
2025 pd = IO_MEM_UNASSIGNED;
9fa3e853
FB		 2026 } else {
2027 pd = p->phys_offset;
9fa3e853
FB		 2028 }
2029#if defined(DEBUG_TLB)
6ebbf390
JM		 2030 printf("tlb_set_page: vaddr=" TARGET_FMT_lx " paddr=0x%08x prot=%x idx=%d smmu=%d pd=0x%08lx\n",
2031 vaddr, (int)paddr, prot, mmu_idx, is_softmmu, pd);
9fa3e853
FB		 2032#endif
2033
2034 ret = 0;
0f459d16
PB		 2035 address = vaddr;
2036 if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM && !(pd & IO_MEM_ROMD)) {
2037 /* IO memory case (romd handled later) */
2038 address |= TLB_MMIO;
2039 }
5579c7f3 2040 addend = (unsigned long)qemu_get_ram_ptr(pd & TARGET_PAGE_MASK);
0f459d16
PB		 2041 if ((pd & ~TARGET_PAGE_MASK) <= IO_MEM_ROM) {
2042 /* Normal RAM. */
2043 iotlb = pd & TARGET_PAGE_MASK;
2044 if ((pd & ~TARGET_PAGE_MASK) == IO_MEM_RAM)
2045 iotlb |= IO_MEM_NOTDIRTY;
2046 else
2047 iotlb |= IO_MEM_ROM;
2048 } else {
2049 /* IO handlers are currently passed a phsical address.
2050 It would be nice to pass an offset from the base address
2051 of that region. This would avoid having to special case RAM,
2052 and avoid full address decoding in every device.
2053 We can't use the high bits of pd for this because
2054 IO_MEM_ROMD uses these as a ram address. */
8da3ff18
PB		 2055 iotlb = (pd & ~TARGET_PAGE_MASK);
2056 if (p) {
8da3ff18
PB		 2057 iotlb += p->region_offset;
2058 } else {
2059 iotlb += paddr;
2060 }
0f459d16
PB		 2061 }
2062
2063 code_address = address;
2064 /* Make accesses to pages with watchpoints go via the
2065 watchpoint trap routines. */
c0ce998e 2066 TAILQ_FOREACH(wp, &env->watchpoints, entry) {
a1d1bb31 2067 if (vaddr == (wp->vaddr & TARGET_PAGE_MASK)) {
0f459d16
PB		 2068 iotlb = io_mem_watch + paddr;
2069 /* TODO: The memory case can be optimized by not trapping
2070 reads of pages with a write breakpoint. */
2071 address |= TLB_MMIO;
6658ffb8 2072 }
0f459d16 2073 }
d79acba4 2074
0f459d16
PB		 2075 index = (vaddr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
2076 env->iotlb[mmu_idx][index] = iotlb - vaddr;
2077 te = &env->tlb_table[mmu_idx][index];
2078 te->addend = addend - vaddr;
2079 if (prot & PAGE_READ) {
2080 te->addr_read = address;
2081 } else {
2082 te->addr_read = -1;
2083 }
5c751e99 2084
0f459d16
PB		 2085 if (prot & PAGE_EXEC) {
2086 te->addr_code = code_address;
2087 } else {
2088 te->addr_code = -1;
2089 }
2090 if (prot & PAGE_WRITE) {
2091 if ((pd & ~TARGET_PAGE_MASK) == IO_MEM_ROM ||
2092 (pd & IO_MEM_ROMD)) {
2093 /* Write access calls the I/O callback. */
2094 te->addr_write = address | TLB_MMIO;
2095 } else if ((pd & ~TARGET_PAGE_MASK) == IO_MEM_RAM &&
2096 !cpu_physical_memory_is_dirty(pd)) {
2097 te->addr_write = address | TLB_NOTDIRTY;
9fa3e853 2098 } else {
0f459d16 2099 te->addr_write = address;
9fa3e853 2100 }
0f459d16
PB		 2101 } else {
2102 te->addr_write = -1;
9fa3e853 2103 }
9fa3e853
FB		 2104 return ret;
2105}
2106
0124311e
FB		 2107#else
2108
ee8b7021 2109void tlb_flush(CPUState *env, int flush_global)
0124311e
FB		 2110{
2111}
2112
2e12669a 2113void tlb_flush_page(CPUState *env, target_ulong addr)
0124311e
FB		 2114{
2115}
2116
5fafdf24
TS		 2117int tlb_set_page_exec(CPUState *env, target_ulong vaddr,
2118 target_phys_addr_t paddr, int prot,
6ebbf390 2119 int mmu_idx, int is_softmmu)
9fa3e853
FB		 2120{
2121 return 0;
2122}
0124311e 2123
9fa3e853
FB		 2124/* dump memory mappings */
2125void page_dump(FILE *f)
33417e70 2126{
9fa3e853
FB		 2127 unsigned long start, end;
2128 int i, j, prot, prot1;
2129 PageDesc *p;
33417e70 2130
9fa3e853
FB		 2131 fprintf(f, "%-8s %-8s %-8s %s\n",
2132 "start", "end", "size", "prot");
2133 start = -1;
2134 end = -1;
2135 prot = 0;
2136 for(i = 0; i <= L1_SIZE; i++) {
2137 if (i < L1_SIZE)
2138 p = l1_map[i];
2139 else
2140 p = NULL;
2141 for(j = 0;j < L2_SIZE; j++) {
2142 if (!p)
2143 prot1 = 0;
2144 else
2145 prot1 = p[j].flags;
2146 if (prot1 != prot) {
2147 end = (i << (32 - L1_BITS)) | (j << TARGET_PAGE_BITS);
2148 if (start != -1) {
2149 fprintf(f, "%08lx-%08lx %08lx %c%c%c\n",
5fafdf24 2150 start, end, end - start,
9fa3e853
FB		 2151 prot & PAGE_READ ? 'r' : '-',
2152 prot & PAGE_WRITE ? 'w' : '-',
2153 prot & PAGE_EXEC ? 'x' : '-');
2154 }
2155 if (prot1 != 0)
2156 start = end;
2157 else
2158 start = -1;
2159 prot = prot1;
2160 }
2161 if (!p)
2162 break;
2163 }
33417e70 2164 }
33417e70
FB		 2165}
2166
53a5960a 2167int page_get_flags(target_ulong address)
33417e70 2168{
9fa3e853
FB		 2169 PageDesc *p;
2170
2171 p = page_find(address >> TARGET_PAGE_BITS);
33417e70 2172 if (!p)
9fa3e853
FB		 2173 return 0;
2174 return p->flags;
2175}
2176
2177/* modify the flags of a page and invalidate the code if
2178 necessary. The flag PAGE_WRITE_ORG is positionned automatically
2179 depending on PAGE_WRITE */
53a5960a 2180void page_set_flags(target_ulong start, target_ulong end, int flags)
9fa3e853
FB		 2181{
2182 PageDesc *p;
53a5960a 2183 target_ulong addr;
9fa3e853 2184
c8a706fe 2185 /* mmap_lock should already be held. */
9fa3e853
FB		 2186 start = start & TARGET_PAGE_MASK;
2187 end = TARGET_PAGE_ALIGN(end);
2188 if (flags & PAGE_WRITE)
2189 flags |= PAGE_WRITE_ORG;
9fa3e853
FB		 2190 for(addr = start; addr < end; addr += TARGET_PAGE_SIZE) {
2191 p = page_find_alloc(addr >> TARGET_PAGE_BITS);
17e2377a
PB		 2192 /* We may be called for host regions that are outside guest
2193 address space. */
2194 if (!p)
2195 return;
9fa3e853
FB		 2196 /* if the write protection is set, then we invalidate the code
2197 inside */
5fafdf24 2198 if (!(p->flags & PAGE_WRITE) &&
9fa3e853
FB		 2199 (flags & PAGE_WRITE) &&
2200 p->first_tb) {
d720b93d 2201 tb_invalidate_phys_page(addr, 0, NULL);
9fa3e853
FB		 2202 }
2203 p->flags = flags;
2204 }
33417e70
FB		 2205}
2206
3d97b40b
TS		 2207int page_check_range(target_ulong start, target_ulong len, int flags)
2208{
2209 PageDesc *p;
2210 target_ulong end;
2211 target_ulong addr;
2212
55f280c9
AZ		 2213 if (start + len < start)
2214 /* we've wrapped around */
2215 return -1;
2216
3d97b40b
TS		 2217 end = TARGET_PAGE_ALIGN(start+len); /* must do before we loose bits in the next step */
2218 start = start & TARGET_PAGE_MASK;
2219
3d97b40b
TS		 2220 for(addr = start; addr < end; addr += TARGET_PAGE_SIZE) {
2221 p = page_find(addr >> TARGET_PAGE_BITS);
2222 if( !p )
2223 return -1;
2224 if( !(p->flags & PAGE_VALID) )
2225 return -1;
2226
dae3270c 2227 if ((flags & PAGE_READ) && !(p->flags & PAGE_READ))
3d97b40b 2228 return -1;
dae3270c
FB		 2229 if (flags & PAGE_WRITE) {
2230 if (!(p->flags & PAGE_WRITE_ORG))
2231 return -1;
2232 /* unprotect the page if it was put read-only because it
2233 contains translated code */
2234 if (!(p->flags & PAGE_WRITE)) {
2235 if (!page_unprotect(addr, 0, NULL))
2236 return -1;
2237 }
2238 return 0;
2239 }
3d97b40b
TS		 2240 }
2241 return 0;
2242}
2243
9fa3e853
FB		 2244/* called from signal handler: invalidate the code and unprotect the
2245 page. Return TRUE if the fault was succesfully handled. */
53a5960a 2246int page_unprotect(target_ulong address, unsigned long pc, void *puc)
9fa3e853
FB		 2247{
2248 unsigned int page_index, prot, pindex;
2249 PageDesc *p, *p1;
53a5960a 2250 target_ulong host_start, host_end, addr;
9fa3e853 2251
c8a706fe
PB		 2252 /* Technically this isn't safe inside a signal handler. However we
2253 know this only ever happens in a synchronous SEGV handler, so in
2254 practice it seems to be ok. */
2255 mmap_lock();
2256
83fb7adf 2257 host_start = address & qemu_host_page_mask;
9fa3e853
FB		 2258 page_index = host_start >> TARGET_PAGE_BITS;
2259 p1 = page_find(page_index);
c8a706fe
PB		 2260 if (!p1) {
2261 mmap_unlock();
9fa3e853 2262 return 0;
c8a706fe 2263 }
83fb7adf 2264 host_end = host_start + qemu_host_page_size;
9fa3e853
FB		 2265 p = p1;
2266 prot = 0;
2267 for(addr = host_start;addr < host_end; addr += TARGET_PAGE_SIZE) {
2268 prot |= p->flags;
2269 p++;
2270 }
2271 /* if the page was really writable, then we change its
2272 protection back to writable */
2273 if (prot & PAGE_WRITE_ORG) {
2274 pindex = (address - host_start) >> TARGET_PAGE_BITS;
2275 if (!(p1[pindex].flags & PAGE_WRITE)) {
5fafdf24 2276 mprotect((void *)g2h(host_start), qemu_host_page_size,
9fa3e853
FB		 2277 (prot & PAGE_BITS) | PAGE_WRITE);
2278 p1[pindex].flags |= PAGE_WRITE;
2279 /* and since the content will be modified, we must invalidate
2280 the corresponding translated code. */
d720b93d 2281 tb_invalidate_phys_page(address, pc, puc);
9fa3e853
FB		 2282#ifdef DEBUG_TB_CHECK
2283 tb_invalidate_check(address);
2284#endif
c8a706fe 2285 mmap_unlock();
9fa3e853
FB		 2286 return 1;
2287 }
2288 }
c8a706fe 2289 mmap_unlock();
9fa3e853
FB		 2290 return 0;
2291}
2292
6a00d601
FB		 2293static inline void tlb_set_dirty(CPUState *env,
2294 unsigned long addr, target_ulong vaddr)
1ccde1cb
FB		 2295{
2296}
9fa3e853
FB		 2297#endif /* defined(CONFIG_USER_ONLY) */
2298
e2eef170 2299#if !defined(CONFIG_USER_ONLY)
8da3ff18 2300
db7b5426 2301static int subpage_register (subpage_t *mmio, uint32_t start, uint32_t end,
8da3ff18 2302 ram_addr_t memory, ram_addr_t region_offset);
00f82b8a 2303static void *subpage_init (target_phys_addr_t base, ram_addr_t *phys,
8da3ff18 2304 ram_addr_t orig_memory, ram_addr_t region_offset);
db7b5426
BS		 2305#define CHECK_SUBPAGE(addr, start_addr, start_addr2, end_addr, end_addr2, \
2306 need_subpage) \
2307 do { \
2308 if (addr > start_addr) \
2309 start_addr2 = 0; \
2310 else { \
2311 start_addr2 = start_addr & ~TARGET_PAGE_MASK; \
2312 if (start_addr2 > 0) \
2313 need_subpage = 1; \
2314 } \
2315 \
49e9fba2 2316 if ((start_addr + orig_size) - addr >= TARGET_PAGE_SIZE) \
db7b5426
BS		 2317 end_addr2 = TARGET_PAGE_SIZE - 1; \
2318 else { \
2319 end_addr2 = (start_addr + orig_size - 1) & ~TARGET_PAGE_MASK; \
2320 if (end_addr2 < TARGET_PAGE_SIZE - 1) \
2321 need_subpage = 1; \
2322 } \
2323 } while (0)
2324
33417e70
FB		 2325/* register physical memory. 'size' must be a multiple of the target
2326 page size. If (phys_offset & ~TARGET_PAGE_MASK) != 0, then it is an
8da3ff18
PB		 2327 io memory page. The address used when calling the IO function is
2328 the offset from the start of the region, plus region_offset. Both
2329 start_region and regon_offset are rounded down to a page boundary
2330 before calculating this offset. This should not be a problem unless
2331 the low bits of start_addr and region_offset differ. */
2332void cpu_register_physical_memory_offset(target_phys_addr_t start_addr,
2333 ram_addr_t size,
2334 ram_addr_t phys_offset,
2335 ram_addr_t region_offset)
33417e70 2336{
108c49b8 2337 target_phys_addr_t addr, end_addr;
92e873b9 2338 PhysPageDesc *p;
9d42037b 2339 CPUState *env;
00f82b8a 2340 ram_addr_t orig_size = size;
db7b5426 2341 void *subpage;
33417e70 2342
640f42e4 2343#ifdef CONFIG_KQEMU
da260249
FB		 2344 /* XXX: should not depend on cpu context */
2345 env = first_cpu;
2346 if (env->kqemu_enabled) {
2347 kqemu_set_phys_mem(start_addr, size, phys_offset);
2348 }
2349#endif
7ba1e619
AL		 2350 if (kvm_enabled())
2351 kvm_set_phys_mem(start_addr, size, phys_offset);
2352
67c4d23c
PB		 2353 if (phys_offset == IO_MEM_UNASSIGNED) {
2354 region_offset = start_addr;
2355 }
8da3ff18 2356 region_offset &= TARGET_PAGE_MASK;
5fd386f6 2357 size = (size + TARGET_PAGE_SIZE - 1) & TARGET_PAGE_MASK;
49e9fba2
BS		 2358 end_addr = start_addr + (target_phys_addr_t)size;
2359 for(addr = start_addr; addr != end_addr; addr += TARGET_PAGE_SIZE) {
db7b5426
BS		 2360 p = phys_page_find(addr >> TARGET_PAGE_BITS);
2361 if (p && p->phys_offset != IO_MEM_UNASSIGNED) {
00f82b8a 2362 ram_addr_t orig_memory = p->phys_offset;
db7b5426
BS		 2363 target_phys_addr_t start_addr2, end_addr2;
2364 int need_subpage = 0;
2365
2366 CHECK_SUBPAGE(addr, start_addr, start_addr2, end_addr, end_addr2,
2367 need_subpage);
4254fab8 2368 if (need_subpage || phys_offset & IO_MEM_SUBWIDTH) {
db7b5426
BS		 2369 if (!(orig_memory & IO_MEM_SUBPAGE)) {
2370 subpage = subpage_init((addr & TARGET_PAGE_MASK),
8da3ff18
PB		 2371 &p->phys_offset, orig_memory,
2372 p->region_offset);
db7b5426
BS		 2373 } else {
2374 subpage = io_mem_opaque[(orig_memory & ~TARGET_PAGE_MASK)
2375 >> IO_MEM_SHIFT];
2376 }
8da3ff18
PB		 2377 subpage_register(subpage, start_addr2, end_addr2, phys_offset,
2378 region_offset);
2379 p->region_offset = 0;
db7b5426
BS		 2380 } else {
2381 p->phys_offset = phys_offset;
2382 if ((phys_offset & ~TARGET_PAGE_MASK) <= IO_MEM_ROM ||
2383 (phys_offset & IO_MEM_ROMD))
2384 phys_offset += TARGET_PAGE_SIZE;
2385 }
2386 } else {
2387 p = phys_page_find_alloc(addr >> TARGET_PAGE_BITS, 1);
2388 p->phys_offset = phys_offset;
8da3ff18 2389 p->region_offset = region_offset;
db7b5426 2390 if ((phys_offset & ~TARGET_PAGE_MASK) <= IO_MEM_ROM ||
8da3ff18 2391 (phys_offset & IO_MEM_ROMD)) {
db7b5426 2392 phys_offset += TARGET_PAGE_SIZE;
0e8f0967 2393 } else {
db7b5426
BS		 2394 target_phys_addr_t start_addr2, end_addr2;
2395 int need_subpage = 0;
2396
2397 CHECK_SUBPAGE(addr, start_addr, start_addr2, end_addr,
2398 end_addr2, need_subpage);
2399
4254fab8 2400 if (need_subpage || phys_offset & IO_MEM_SUBWIDTH) {
db7b5426 2401 subpage = subpage_init((addr & TARGET_PAGE_MASK),
8da3ff18 2402 &p->phys_offset, IO_MEM_UNASSIGNED,
67c4d23c 2403 addr & TARGET_PAGE_MASK);
db7b5426 2404 subpage_register(subpage, start_addr2, end_addr2,
8da3ff18
PB		 2405 phys_offset, region_offset);
2406 p->region_offset = 0;
db7b5426
BS		 2407 }
2408 }
2409 }
8da3ff18 2410 region_offset += TARGET_PAGE_SIZE;
33417e70 2411 }
3b46e624 2412
9d42037b
FB		 2413 /* since each CPU stores ram addresses in its TLB cache, we must
2414 reset the modified entries */
2415 /* XXX: slow ! */
2416 for(env = first_cpu; env != NULL; env = env->next_cpu) {
2417 tlb_flush(env, 1);
2418 }
33417e70
FB		 2419}
2420
ba863458 2421/* XXX: temporary until new memory mapping API */
00f82b8a 2422ram_addr_t cpu_get_physical_page_desc(target_phys_addr_t addr)
ba863458
FB		 2423{
2424 PhysPageDesc *p;
2425
2426 p = phys_page_find(addr >> TARGET_PAGE_BITS);
2427 if (!p)
2428 return IO_MEM_UNASSIGNED;
2429 return p->phys_offset;
2430}
2431
f65ed4c1
AL		 2432void qemu_register_coalesced_mmio(target_phys_addr_t addr, ram_addr_t size)
2433{
2434 if (kvm_enabled())
2435 kvm_coalesce_mmio_region(addr, size);
2436}
2437
2438void qemu_unregister_coalesced_mmio(target_phys_addr_t addr, ram_addr_t size)
2439{
2440 if (kvm_enabled())
2441 kvm_uncoalesce_mmio_region(addr, size);
2442}
2443
640f42e4 2444#ifdef CONFIG_KQEMU
e9a1ab19 2445/* XXX: better than nothing */
94a6b54f 2446static ram_addr_t kqemu_ram_alloc(ram_addr_t size)
e9a1ab19
FB		 2447{
2448 ram_addr_t addr;
94a6b54f 2449 if ((last_ram_offset + size) > kqemu_phys_ram_size) {
012a7045 2450 fprintf(stderr, "Not enough memory (requested_size = %" PRIu64 ", max memory = %" PRIu64 ")\n",
94a6b54f 2451 (uint64_t)size, (uint64_t)kqemu_phys_ram_size);
e9a1ab19
FB		 2452 abort();
2453 }
94a6b54f
PB		 2454 addr = last_ram_offset;
2455 last_ram_offset = TARGET_PAGE_ALIGN(last_ram_offset + size);
e9a1ab19
FB		 2456 return addr;
2457}
94a6b54f
PB		 2458#endif
2459
2460ram_addr_t qemu_ram_alloc(ram_addr_t size)
2461{
2462 RAMBlock *new_block;
2463
640f42e4 2464#ifdef CONFIG_KQEMU
94a6b54f
PB		 2465 if (kqemu_phys_ram_base) {
2466 return kqemu_ram_alloc(size);
2467 }
2468#endif
2469
2470 size = TARGET_PAGE_ALIGN(size);
2471 new_block = qemu_malloc(sizeof(*new_block));
2472
2473 new_block->host = qemu_vmalloc(size);
2474 new_block->offset = last_ram_offset;
2475 new_block->length = size;
2476
2477 new_block->next = ram_blocks;
2478 ram_blocks = new_block;
2479
2480 phys_ram_dirty = qemu_realloc(phys_ram_dirty,
2481 (last_ram_offset + size) >> TARGET_PAGE_BITS);
2482 memset(phys_ram_dirty + (last_ram_offset >> TARGET_PAGE_BITS),
2483 0xff, size >> TARGET_PAGE_BITS);
2484
2485 last_ram_offset += size;
2486
2487 return new_block->offset;
2488}
e9a1ab19
FB		 2489
2490void qemu_ram_free(ram_addr_t addr)
2491{
94a6b54f 2492 /* TODO: implement this. */
e9a1ab19
FB		 2493}
2494
dc828ca1 2495/* Return a host pointer to ram allocated with qemu_ram_alloc.
5579c7f3
PB		 2496 With the exception of the softmmu code in this file, this should
2497 only be used for local memory (e.g. video ram) that the device owns,
2498 and knows it isn't going to access beyond the end of the block.
2499
2500 It should not be used for general purpose DMA.
2501 Use cpu_physical_memory_map/cpu_physical_memory_rw instead.
2502 */
dc828ca1
PB		 2503void *qemu_get_ram_ptr(ram_addr_t addr)
2504{
94a6b54f
PB		 2505 RAMBlock *prev;
2506 RAMBlock **prevp;
2507 RAMBlock *block;
2508
640f42e4 2509#ifdef CONFIG_KQEMU
94a6b54f
PB		 2510 if (kqemu_phys_ram_base) {
2511 return kqemu_phys_ram_base + addr;
2512 }
2513#endif
2514
2515 prev = NULL;
2516 prevp = &ram_blocks;
2517 block = ram_blocks;
2518 while (block && (block->offset > addr
2519 || block->offset + block->length <= addr)) {
2520 if (prev)
2521 prevp = &prev->next;
2522 prev = block;
2523 block = block->next;
2524 }
2525 if (!block) {
2526 fprintf(stderr, "Bad ram offset %" PRIx64 "\n", (uint64_t)addr);
2527 abort();
2528 }
2529 /* Move this entry to to start of the list. */
2530 if (prev) {
2531 prev->next = block->next;
2532 block->next = *prevp;
2533 *prevp = block;
2534 }
2535 return block->host + (addr - block->offset);
dc828ca1
PB		 2536}
2537
5579c7f3
PB		 2538/* Some of the softmmu routines need to translate from a host pointer
2539 (typically a TLB entry) back to a ram offset. */
2540ram_addr_t qemu_ram_addr_from_host(void *ptr)
2541{
94a6b54f
PB		 2542 RAMBlock *prev;
2543 RAMBlock **prevp;
2544 RAMBlock *block;
2545 uint8_t *host = ptr;
2546
640f42e4 2547#ifdef CONFIG_KQEMU
94a6b54f
PB		 2548 if (kqemu_phys_ram_base) {
2549 return host - kqemu_phys_ram_base;
2550 }
2551#endif
2552
2553 prev = NULL;
2554 prevp = &ram_blocks;
2555 block = ram_blocks;
2556 while (block && (block->host > host
2557 || block->host + block->length <= host)) {
2558 if (prev)
2559 prevp = &prev->next;
2560 prev = block;
2561 block = block->next;
2562 }
2563 if (!block) {
2564 fprintf(stderr, "Bad ram pointer %p\n", ptr);
2565 abort();
2566 }
2567 return block->offset + (host - block->host);
5579c7f3
PB		 2568}
2569
a4193c8a 2570static uint32_t unassigned_mem_readb(void *opaque, target_phys_addr_t addr)
33417e70 2571{
67d3b957 2572#ifdef DEBUG_UNASSIGNED
ab3d1727 2573 printf("Unassigned mem read " TARGET_FMT_plx "\n", addr);
b4f0a316 2574#endif
0a6f8a6d 2575#if defined(TARGET_SPARC)
e18231a3
BS		 2576 do_unassigned_access(addr, 0, 0, 0, 1);
2577#endif
2578 return 0;
2579}
2580
2581static uint32_t unassigned_mem_readw(void *opaque, target_phys_addr_t addr)
2582{
2583#ifdef DEBUG_UNASSIGNED
2584 printf("Unassigned mem read " TARGET_FMT_plx "\n", addr);
2585#endif
0a6f8a6d 2586#if defined(TARGET_SPARC)
e18231a3
BS		 2587 do_unassigned_access(addr, 0, 0, 0, 2);
2588#endif
2589 return 0;
2590}
2591
2592static uint32_t unassigned_mem_readl(void *opaque, target_phys_addr_t addr)
2593{
2594#ifdef DEBUG_UNASSIGNED
2595 printf("Unassigned mem read " TARGET_FMT_plx "\n", addr);
2596#endif
0a6f8a6d 2597#if defined(TARGET_SPARC)
e18231a3 2598 do_unassigned_access(addr, 0, 0, 0, 4);
67d3b957 2599#endif
33417e70
FB		 2600 return 0;
2601}
2602
a4193c8a 2603static void unassigned_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
33417e70 2604{
67d3b957 2605#ifdef DEBUG_UNASSIGNED
ab3d1727 2606 printf("Unassigned mem write " TARGET_FMT_plx " = 0x%x\n", addr, val);
67d3b957 2607#endif
0a6f8a6d 2608#if defined(TARGET_SPARC)
e18231a3
BS		 2609 do_unassigned_access(addr, 1, 0, 0, 1);
2610#endif
2611}
2612
2613static void unassigned_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
2614{
2615#ifdef DEBUG_UNASSIGNED
2616 printf("Unassigned mem write " TARGET_FMT_plx " = 0x%x\n", addr, val);
2617#endif
0a6f8a6d 2618#if defined(TARGET_SPARC)
e18231a3
BS		 2619 do_unassigned_access(addr, 1, 0, 0, 2);
2620#endif
2621}
2622
2623static void unassigned_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
2624{
2625#ifdef DEBUG_UNASSIGNED
2626 printf("Unassigned mem write " TARGET_FMT_plx " = 0x%x\n", addr, val);
2627#endif
0a6f8a6d 2628#if defined(TARGET_SPARC)
e18231a3 2629 do_unassigned_access(addr, 1, 0, 0, 4);
b4f0a316 2630#endif
33417e70
FB		 2631}
2632
2633static CPUReadMemoryFunc *unassigned_mem_read[3] = {
2634 unassigned_mem_readb,
e18231a3
BS		 2635 unassigned_mem_readw,
2636 unassigned_mem_readl,
33417e70
FB		 2637};
2638
2639static CPUWriteMemoryFunc *unassigned_mem_write[3] = {
2640 unassigned_mem_writeb,
e18231a3
BS		 2641 unassigned_mem_writew,
2642 unassigned_mem_writel,
33417e70
FB		 2643};
2644
0f459d16
PB		 2645static void notdirty_mem_writeb(void *opaque, target_phys_addr_t ram_addr,
2646 uint32_t val)
9fa3e853 2647{
3a7d929e 2648 int dirty_flags;
3a7d929e
FB		 2649 dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2650 if (!(dirty_flags & CODE_DIRTY_FLAG)) {
9fa3e853 2651#if !defined(CONFIG_USER_ONLY)
3a7d929e
FB		 2652 tb_invalidate_phys_page_fast(ram_addr, 1);
2653 dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
9fa3e853 2654#endif
3a7d929e 2655 }
5579c7f3 2656 stb_p(qemu_get_ram_ptr(ram_addr), val);
640f42e4 2657#ifdef CONFIG_KQEMU
f32fc648
FB		 2658 if (cpu_single_env->kqemu_enabled &&
2659 (dirty_flags & KQEMU_MODIFY_PAGE_MASK) != KQEMU_MODIFY_PAGE_MASK)
2660 kqemu_modify_page(cpu_single_env, ram_addr);
2661#endif
f23db169
FB		 2662 dirty_flags |= (0xff & ~CODE_DIRTY_FLAG);
2663 phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] = dirty_flags;
2664 /* we remove the notdirty callback only if the code has been
2665 flushed */
2666 if (dirty_flags == 0xff)
2e70f6ef 2667 tlb_set_dirty(cpu_single_env, cpu_single_env->mem_io_vaddr);
9fa3e853
FB		 2668}
2669
0f459d16
PB		 2670static void notdirty_mem_writew(void *opaque, target_phys_addr_t ram_addr,
2671 uint32_t val)
9fa3e853 2672{
3a7d929e 2673 int dirty_flags;
3a7d929e
FB		 2674 dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2675 if (!(dirty_flags & CODE_DIRTY_FLAG)) {
9fa3e853 2676#if !defined(CONFIG_USER_ONLY)
3a7d929e
FB		 2677 tb_invalidate_phys_page_fast(ram_addr, 2);
2678 dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
9fa3e853 2679#endif
3a7d929e 2680 }
5579c7f3 2681 stw_p(qemu_get_ram_ptr(ram_addr), val);
640f42e4 2682#ifdef CONFIG_KQEMU
f32fc648
FB		 2683 if (cpu_single_env->kqemu_enabled &&
2684 (dirty_flags & KQEMU_MODIFY_PAGE_MASK) != KQEMU_MODIFY_PAGE_MASK)
2685 kqemu_modify_page(cpu_single_env, ram_addr);
2686#endif
f23db169
FB		 2687 dirty_flags |= (0xff & ~CODE_DIRTY_FLAG);
2688 phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] = dirty_flags;
2689 /* we remove the notdirty callback only if the code has been
2690 flushed */
2691 if (dirty_flags == 0xff)
2e70f6ef 2692 tlb_set_dirty(cpu_single_env, cpu_single_env->mem_io_vaddr);
9fa3e853
FB		 2693}
2694
0f459d16
PB		 2695static void notdirty_mem_writel(void *opaque, target_phys_addr_t ram_addr,
2696 uint32_t val)
9fa3e853 2697{
3a7d929e 2698 int dirty_flags;
3a7d929e
FB		 2699 dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2700 if (!(dirty_flags & CODE_DIRTY_FLAG)) {
9fa3e853 2701#if !defined(CONFIG_USER_ONLY)
3a7d929e
FB		 2702 tb_invalidate_phys_page_fast(ram_addr, 4);
2703 dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
9fa3e853 2704#endif
3a7d929e 2705 }
5579c7f3 2706 stl_p(qemu_get_ram_ptr(ram_addr), val);
640f42e4 2707#ifdef CONFIG_KQEMU
f32fc648
FB		 2708 if (cpu_single_env->kqemu_enabled &&
2709 (dirty_flags & KQEMU_MODIFY_PAGE_MASK) != KQEMU_MODIFY_PAGE_MASK)
2710 kqemu_modify_page(cpu_single_env, ram_addr);
2711#endif
f23db169
FB		 2712 dirty_flags |= (0xff & ~CODE_DIRTY_FLAG);
2713 phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] = dirty_flags;
2714 /* we remove the notdirty callback only if the code has been
2715 flushed */
2716 if (dirty_flags == 0xff)
2e70f6ef 2717 tlb_set_dirty(cpu_single_env, cpu_single_env->mem_io_vaddr);
9fa3e853
FB		 2718}
2719
3a7d929e 2720static CPUReadMemoryFunc *error_mem_read[3] = {
9fa3e853
FB		 2721 NULL, /* never used */
2722 NULL, /* never used */
2723 NULL, /* never used */
2724};
2725
1ccde1cb
FB		 2726static CPUWriteMemoryFunc *notdirty_mem_write[3] = {
2727 notdirty_mem_writeb,
2728 notdirty_mem_writew,
2729 notdirty_mem_writel,
2730};
2731
0f459d16 2732/* Generate a debug exception if a watchpoint has been hit. */
b4051334 2733static void check_watchpoint(int offset, int len_mask, int flags)
0f459d16
PB		 2734{
2735 CPUState *env = cpu_single_env;
06d55cc1
AL		 2736 target_ulong pc, cs_base;
2737 TranslationBlock *tb;
0f459d16 2738 target_ulong vaddr;
a1d1bb31 2739 CPUWatchpoint *wp;
06d55cc1 2740 int cpu_flags;
0f459d16 2741
06d55cc1
AL		 2742 if (env->watchpoint_hit) {
2743 /* We re-entered the check after replacing the TB. Now raise
2744 * the debug interrupt so that is will trigger after the
2745 * current instruction. */
2746 cpu_interrupt(env, CPU_INTERRUPT_DEBUG);
2747 return;
2748 }
2e70f6ef 2749 vaddr = (env->mem_io_vaddr & TARGET_PAGE_MASK) + offset;
c0ce998e 2750 TAILQ_FOREACH(wp, &env->watchpoints, entry) {
b4051334
AL		 2751 if ((vaddr == (wp->vaddr & len_mask) ||
2752 (vaddr & wp->len_mask) == wp->vaddr) && (wp->flags & flags)) {
6e140f28
AL		 2753 wp->flags |= BP_WATCHPOINT_HIT;
2754 if (!env->watchpoint_hit) {
2755 env->watchpoint_hit = wp;
2756 tb = tb_find_pc(env->mem_io_pc);
2757 if (!tb) {
2758 cpu_abort(env, "check_watchpoint: could not find TB for "
2759 "pc=%p", (void *)env->mem_io_pc);
2760 }
2761 cpu_restore_state(tb, env, env->mem_io_pc, NULL);
2762 tb_phys_invalidate(tb, -1);
2763 if (wp->flags & BP_STOP_BEFORE_ACCESS) {
2764 env->exception_index = EXCP_DEBUG;
2765 } else {
2766 cpu_get_tb_cpu_state(env, &pc, &cs_base, &cpu_flags);
2767 tb_gen_code(env, pc, cs_base, cpu_flags, 1);
2768 }
2769 cpu_resume_from_signal(env, NULL);
06d55cc1 2770 }
6e140f28
AL		 2771 } else {
2772 wp->flags &= ~BP_WATCHPOINT_HIT;
0f459d16
PB		 2773 }
2774 }
2775}
2776
6658ffb8
PB		 2777/* Watchpoint access routines. Watchpoints are inserted using TLB tricks,
2778 so these check for a hit then pass through to the normal out-of-line
2779 phys routines. */
2780static uint32_t watch_mem_readb(void *opaque, target_phys_addr_t addr)
2781{
b4051334 2782 check_watchpoint(addr & ~TARGET_PAGE_MASK, ~0x0, BP_MEM_READ);
6658ffb8
PB		 2783 return ldub_phys(addr);
2784}
2785
2786static uint32_t watch_mem_readw(void *opaque, target_phys_addr_t addr)
2787{
b4051334 2788 check_watchpoint(addr & ~TARGET_PAGE_MASK, ~0x1, BP_MEM_READ);
6658ffb8
PB		 2789 return lduw_phys(addr);
2790}
2791
2792static uint32_t watch_mem_readl(void *opaque, target_phys_addr_t addr)
2793{
b4051334 2794 check_watchpoint(addr & ~TARGET_PAGE_MASK, ~0x3, BP_MEM_READ);
6658ffb8
PB		 2795 return ldl_phys(addr);
2796}
2797
6658ffb8
PB		 2798static void watch_mem_writeb(void *opaque, target_phys_addr_t addr,
2799 uint32_t val)
2800{
b4051334 2801 check_watchpoint(addr & ~TARGET_PAGE_MASK, ~0x0, BP_MEM_WRITE);
6658ffb8
PB		 2802 stb_phys(addr, val);
2803}
2804
2805static void watch_mem_writew(void *opaque, target_phys_addr_t addr,
2806 uint32_t val)
2807{
b4051334 2808 check_watchpoint(addr & ~TARGET_PAGE_MASK, ~0x1, BP_MEM_WRITE);
6658ffb8
PB		 2809 stw_phys(addr, val);
2810}
2811
2812static void watch_mem_writel(void *opaque, target_phys_addr_t addr,
2813 uint32_t val)
2814{
b4051334 2815 check_watchpoint(addr & ~TARGET_PAGE_MASK, ~0x3, BP_MEM_WRITE);
6658ffb8
PB		 2816 stl_phys(addr, val);
2817}
2818
2819static CPUReadMemoryFunc *watch_mem_read[3] = {
2820 watch_mem_readb,
2821 watch_mem_readw,
2822 watch_mem_readl,
2823};
2824
2825static CPUWriteMemoryFunc *watch_mem_write[3] = {
2826 watch_mem_writeb,
2827 watch_mem_writew,
2828 watch_mem_writel,
2829};
6658ffb8 2830
db7b5426
BS		 2831static inline uint32_t subpage_readlen (subpage_t *mmio, target_phys_addr_t addr,
2832 unsigned int len)
2833{
db7b5426
BS		 2834 uint32_t ret;
2835 unsigned int idx;
2836
8da3ff18 2837 idx = SUBPAGE_IDX(addr);
db7b5426
BS		 2838#if defined(DEBUG_SUBPAGE)
2839 printf("%s: subpage %p len %d addr " TARGET_FMT_plx " idx %d\n", __func__,
2840 mmio, len, addr, idx);
2841#endif
8da3ff18
PB		 2842 ret = (**mmio->mem_read[idx][len])(mmio->opaque[idx][0][len],
2843 addr + mmio->region_offset[idx][0][len]);
db7b5426
BS		 2844
2845 return ret;
2846}
2847
2848static inline void subpage_writelen (subpage_t *mmio, target_phys_addr_t addr,
2849 uint32_t value, unsigned int len)
2850{
db7b5426
BS		 2851 unsigned int idx;
2852
8da3ff18 2853 idx = SUBPAGE_IDX(addr);
db7b5426
BS		 2854#if defined(DEBUG_SUBPAGE)
2855 printf("%s: subpage %p len %d addr " TARGET_FMT_plx " idx %d value %08x\n", __func__,
2856 mmio, len, addr, idx, value);
2857#endif
8da3ff18
PB		 2858 (**mmio->mem_write[idx][len])(mmio->opaque[idx][1][len],
2859 addr + mmio->region_offset[idx][1][len],
2860 value);
db7b5426
BS		 2861}
2862
2863static uint32_t subpage_readb (void *opaque, target_phys_addr_t addr)
2864{
2865#if defined(DEBUG_SUBPAGE)
2866 printf("%s: addr " TARGET_FMT_plx "\n", __func__, addr);
2867#endif
2868
2869 return subpage_readlen(opaque, addr, 0);
2870}
2871
2872static void subpage_writeb (void *opaque, target_phys_addr_t addr,
2873 uint32_t value)
2874{
2875#if defined(DEBUG_SUBPAGE)
2876 printf("%s: addr " TARGET_FMT_plx " val %08x\n", __func__, addr, value);
2877#endif
2878 subpage_writelen(opaque, addr, value, 0);
2879}
2880
2881static uint32_t subpage_readw (void *opaque, target_phys_addr_t addr)
2882{
2883#if defined(DEBUG_SUBPAGE)
2884 printf("%s: addr " TARGET_FMT_plx "\n", __func__, addr);
2885#endif
2886
2887 return subpage_readlen(opaque, addr, 1);
2888}
2889
2890static void subpage_writew (void *opaque, target_phys_addr_t addr,
2891 uint32_t value)
2892{
2893#if defined(DEBUG_SUBPAGE)
2894 printf("%s: addr " TARGET_FMT_plx " val %08x\n", __func__, addr, value);
2895#endif
2896 subpage_writelen(opaque, addr, value, 1);
2897}
2898
2899static uint32_t subpage_readl (void *opaque, target_phys_addr_t addr)
2900{
2901#if defined(DEBUG_SUBPAGE)
2902 printf("%s: addr " TARGET_FMT_plx "\n", __func__, addr);
2903#endif
2904
2905 return subpage_readlen(opaque, addr, 2);
2906}
2907
2908static void subpage_writel (void *opaque,
2909 target_phys_addr_t addr, uint32_t value)
2910{
2911#if defined(DEBUG_SUBPAGE)
2912 printf("%s: addr " TARGET_FMT_plx " val %08x\n", __func__, addr, value);
2913#endif
2914 subpage_writelen(opaque, addr, value, 2);
2915}
2916
2917static CPUReadMemoryFunc *subpage_read[] = {
2918 &subpage_readb,
2919 &subpage_readw,
2920 &subpage_readl,
2921};
2922
2923static CPUWriteMemoryFunc *subpage_write[] = {
2924 &subpage_writeb,
2925 &subpage_writew,
2926 &subpage_writel,
2927};
2928
2929static int subpage_register (subpage_t *mmio, uint32_t start, uint32_t end,
8da3ff18 2930 ram_addr_t memory, ram_addr_t region_offset)
db7b5426
BS		 2931{
2932 int idx, eidx;
4254fab8 2933 unsigned int i;
db7b5426
BS		 2934
2935 if (start >= TARGET_PAGE_SIZE || end >= TARGET_PAGE_SIZE)
2936 return -1;
2937 idx = SUBPAGE_IDX(start);
2938 eidx = SUBPAGE_IDX(end);
2939#if defined(DEBUG_SUBPAGE)
2940 printf("%s: %p start %08x end %08x idx %08x eidx %08x mem %d\n", __func__,
2941 mmio, start, end, idx, eidx, memory);
2942#endif
2943 memory >>= IO_MEM_SHIFT;
2944 for (; idx <= eidx; idx++) {
4254fab8 2945 for (i = 0; i < 4; i++) {
3ee89922
BS		 2946 if (io_mem_read[memory][i]) {
2947 mmio->mem_read[idx][i] = &io_mem_read[memory][i];
2948 mmio->opaque[idx][0][i] = io_mem_opaque[memory];
8da3ff18 2949 mmio->region_offset[idx][0][i] = region_offset;
3ee89922
BS		 2950 }
2951 if (io_mem_write[memory][i]) {
2952 mmio->mem_write[idx][i] = &io_mem_write[memory][i];
2953 mmio->opaque[idx][1][i] = io_mem_opaque[memory];
8da3ff18 2954 mmio->region_offset[idx][1][i] = region_offset;
3ee89922 2955 }
4254fab8 2956 }
db7b5426
BS		 2957 }
2958
2959 return 0;
2960}
2961
00f82b8a 2962static void *subpage_init (target_phys_addr_t base, ram_addr_t *phys,
8da3ff18 2963 ram_addr_t orig_memory, ram_addr_t region_offset)
db7b5426
BS		 2964{
2965 subpage_t *mmio;
2966 int subpage_memory;
2967
2968 mmio = qemu_mallocz(sizeof(subpage_t));
1eec614b
AL		 2969
2970 mmio->base = base;
2971 subpage_memory = cpu_register_io_memory(0, subpage_read, subpage_write, mmio);
db7b5426 2972#if defined(DEBUG_SUBPAGE)
1eec614b
AL		 2973 printf("%s: %p base " TARGET_FMT_plx " len %08x %d\n", __func__,
2974 mmio, base, TARGET_PAGE_SIZE, subpage_memory);
db7b5426 2975#endif
1eec614b
AL		 2976 *phys = subpage_memory | IO_MEM_SUBPAGE;
2977 subpage_register(mmio, 0, TARGET_PAGE_SIZE - 1, orig_memory,
8da3ff18 2978 region_offset);
db7b5426
BS		 2979
2980 return mmio;
2981}
2982
88715657
AL		 2983static int get_free_io_mem_idx(void)
2984{
2985 int i;
2986
2987 for (i = 0; i<IO_MEM_NB_ENTRIES; i++)
2988 if (!io_mem_used[i]) {
2989 io_mem_used[i] = 1;
2990 return i;
2991 }
2992
2993 return -1;
2994}
2995
33417e70
FB		 2996static void io_mem_init(void)
2997{
88715657
AL		 2998 int i;
2999
3a7d929e 3000 cpu_register_io_memory(IO_MEM_ROM >> IO_MEM_SHIFT, error_mem_read, unassigned_mem_write, NULL);
a4193c8a 3001 cpu_register_io_memory(IO_MEM_UNASSIGNED >> IO_MEM_SHIFT, unassigned_mem_read, unassigned_mem_write, NULL);
3a7d929e 3002 cpu_register_io_memory(IO_MEM_NOTDIRTY >> IO_MEM_SHIFT, error_mem_read, notdirty_mem_write, NULL);
88715657
AL		 3003 for (i=0; i<5; i++)
3004 io_mem_used[i] = 1;
1ccde1cb 3005
0f459d16 3006 io_mem_watch = cpu_register_io_memory(0, watch_mem_read,
6658ffb8 3007 watch_mem_write, NULL);
640f42e4 3008#ifdef CONFIG_KQEMU
94a6b54f
PB		 3009 if (kqemu_phys_ram_base) {
3010 /* alloc dirty bits array */
3011 phys_ram_dirty = qemu_vmalloc(kqemu_phys_ram_size >> TARGET_PAGE_BITS);
3012 memset(phys_ram_dirty, 0xff, kqemu_phys_ram_size >> TARGET_PAGE_BITS);
3013 }
3014#endif
33417e70
FB		 3015}
3016
3017/* mem_read and mem_write are arrays of functions containing the
3018 function to access byte (index 0), word (index 1) and dword (index
3ee89922
BS		 3019 2). Functions can be omitted with a NULL function pointer. The
3020 registered functions may be modified dynamically later.
3021 If io_index is non zero, the corresponding io zone is
4254fab8
BS		 3022 modified. If it is zero, a new io zone is allocated. The return
3023 value can be used with cpu_register_physical_memory(). (-1) is
3024 returned if error. */
33417e70
FB		 3025int cpu_register_io_memory(int io_index,
3026 CPUReadMemoryFunc **mem_read,
a4193c8a
FB		 3027 CPUWriteMemoryFunc **mem_write,
3028 void *opaque)
33417e70 3029{
4254fab8 3030 int i, subwidth = 0;
33417e70
FB		 3031
3032 if (io_index <= 0) {
88715657
AL		 3033 io_index = get_free_io_mem_idx();
3034 if (io_index == -1)
3035 return io_index;
33417e70
FB		 3036 } else {
3037 if (io_index >= IO_MEM_NB_ENTRIES)
3038 return -1;
3039 }
b5ff1b31 3040
33417e70 3041 for(i = 0;i < 3; i++) {
4254fab8
BS		 3042 if (!mem_read[i] || !mem_write[i])
3043 subwidth = IO_MEM_SUBWIDTH;
33417e70
FB		 3044 io_mem_read[io_index][i] = mem_read[i];
3045 io_mem_write[io_index][i] = mem_write[i];
3046 }
a4193c8a 3047 io_mem_opaque[io_index] = opaque;
4254fab8 3048 return (io_index << IO_MEM_SHIFT) | subwidth;
33417e70 3049}
61382a50 3050
88715657
AL		 3051void cpu_unregister_io_memory(int io_table_address)
3052{
3053 int i;
3054 int io_index = io_table_address >> IO_MEM_SHIFT;
3055
3056 for (i=0;i < 3; i++) {
3057 io_mem_read[io_index][i] = unassigned_mem_read[i];
3058 io_mem_write[io_index][i] = unassigned_mem_write[i];
3059 }
3060 io_mem_opaque[io_index] = NULL;
3061 io_mem_used[io_index] = 0;
3062}
3063
8926b517
FB		 3064CPUWriteMemoryFunc **cpu_get_io_memory_write(int io_index)
3065{
3066 return io_mem_write[io_index >> IO_MEM_SHIFT];
3067}
3068
3069CPUReadMemoryFunc **cpu_get_io_memory_read(int io_index)
3070{
3071 return io_mem_read[io_index >> IO_MEM_SHIFT];
3072}
3073
e2eef170
PB		 3074#endif /* !defined(CONFIG_USER_ONLY) */
3075
13eb76e0
FB		 3076/* physical memory access (slow version, mainly for debug) */
3077#if defined(CONFIG_USER_ONLY)
5fafdf24 3078void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
13eb76e0
FB		 3079 int len, int is_write)
3080{
3081 int l, flags;
3082 target_ulong page;
53a5960a 3083 void * p;
13eb76e0
FB		 3084
3085 while (len > 0) {
3086 page = addr & TARGET_PAGE_MASK;
3087 l = (page + TARGET_PAGE_SIZE) - addr;
3088 if (l > len)
3089 l = len;
3090 flags = page_get_flags(page);
3091 if (!(flags & PAGE_VALID))
3092 return;
3093 if (is_write) {
3094 if (!(flags & PAGE_WRITE))
3095 return;
579a97f7 3096 /* XXX: this code should not depend on lock_user */
72fb7daa 3097 if (!(p = lock_user(VERIFY_WRITE, addr, l, 0)))
579a97f7
FB		 3098 /* FIXME - should this return an error rather than just fail? */
3099 return;
72fb7daa
AJ		 3100 memcpy(p, buf, l);
3101 unlock_user(p, addr, l);
13eb76e0
FB		 3102 } else {
3103 if (!(flags & PAGE_READ))
3104 return;
579a97f7 3105 /* XXX: this code should not depend on lock_user */
72fb7daa 3106 if (!(p = lock_user(VERIFY_READ, addr, l, 1)))
579a97f7
FB		 3107 /* FIXME - should this return an error rather than just fail? */
3108 return;
72fb7daa 3109 memcpy(buf, p, l);
5b257578 3110 unlock_user(p, addr, 0);
13eb76e0
FB		 3111 }
3112 len -= l;
3113 buf += l;
3114 addr += l;
3115 }
3116}
8df1cd07 3117
13eb76e0 3118#else
5fafdf24 3119void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
13eb76e0
FB		 3120 int len, int is_write)
3121{
3122 int l, io_index;
3123 uint8_t *ptr;
3124 uint32_t val;
2e12669a
FB		 3125 target_phys_addr_t page;
3126 unsigned long pd;
92e873b9 3127 PhysPageDesc *p;
3b46e624 3128
13eb76e0
FB		 3129 while (len > 0) {
3130 page = addr & TARGET_PAGE_MASK;
3131 l = (page + TARGET_PAGE_SIZE) - addr;
3132 if (l > len)
3133 l = len;
92e873b9 3134 p = phys_page_find(page >> TARGET_PAGE_BITS);
13eb76e0
FB		 3135 if (!p) {
3136 pd = IO_MEM_UNASSIGNED;
3137 } else {
3138 pd = p->phys_offset;
3139 }
3b46e624 3140
13eb76e0 3141 if (is_write) {
3a7d929e 3142 if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
6c2934db 3143 target_phys_addr_t addr1 = addr;
13eb76e0 3144 io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
8da3ff18 3145 if (p)
6c2934db 3146 addr1 = (addr & ~TARGET_PAGE_MASK) + p->region_offset;
6a00d601
FB		 3147 /* XXX: could force cpu_single_env to NULL to avoid
3148 potential bugs */
6c2934db 3149 if (l >= 4 && ((addr1 & 3) == 0)) {
1c213d19 3150 /* 32 bit write access */
c27004ec 3151 val = ldl_p(buf);
6c2934db 3152 io_mem_write[io_index][2](io_mem_opaque[io_index], addr1, val);
13eb76e0 3153 l = 4;
6c2934db 3154 } else if (l >= 2 && ((addr1 & 1) == 0)) {
1c213d19 3155 /* 16 bit write access */
c27004ec 3156 val = lduw_p(buf);
6c2934db 3157 io_mem_write[io_index][1](io_mem_opaque[io_index], addr1, val);
13eb76e0
FB		 3158 l = 2;
3159 } else {
1c213d19 3160 /* 8 bit write access */
c27004ec 3161 val = ldub_p(buf);
6c2934db 3162 io_mem_write[io_index][0](io_mem_opaque[io_index], addr1, val);
13eb76e0
FB		 3163 l = 1;
3164 }
3165 } else {
b448f2f3
FB		 3166 unsigned long addr1;
3167 addr1 = (pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK);
13eb76e0 3168 /* RAM case */
5579c7f3 3169 ptr = qemu_get_ram_ptr(addr1);
13eb76e0 3170 memcpy(ptr, buf, l);
3a7d929e
FB		 3171 if (!cpu_physical_memory_is_dirty(addr1)) {
3172 /* invalidate code */
3173 tb_invalidate_phys_page_range(addr1, addr1 + l, 0);
3174 /* set dirty bit */
5fafdf24 3175 phys_ram_dirty[addr1 >> TARGET_PAGE_BITS] |=
f23db169 3176 (0xff & ~CODE_DIRTY_FLAG);
3a7d929e 3177 }
13eb76e0
FB		 3178 }
3179 } else {
5fafdf24 3180 if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM &&
2a4188a3 3181 !(pd & IO_MEM_ROMD)) {
6c2934db 3182 target_phys_addr_t addr1 = addr;
13eb76e0
FB		 3183 /* I/O case */
3184 io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
8da3ff18 3185 if (p)
6c2934db
AJ		 3186 addr1 = (addr & ~TARGET_PAGE_MASK) + p->region_offset;
3187 if (l >= 4 && ((addr1 & 3) == 0)) {
13eb76e0 3188 /* 32 bit read access */
6c2934db 3189 val = io_mem_read[io_index][2](io_mem_opaque[io_index], addr1);
c27004ec 3190 stl_p(buf, val);
13eb76e0 3191 l = 4;
6c2934db 3192 } else if (l >= 2 && ((addr1 & 1) == 0)) {
13eb76e0 3193 /* 16 bit read access */
6c2934db 3194 val = io_mem_read[io_index][1](io_mem_opaque[io_index], addr1);
c27004ec 3195 stw_p(buf, val);
13eb76e0
FB		 3196 l = 2;
3197 } else {
1c213d19 3198 /* 8 bit read access */
6c2934db 3199 val = io_mem_read[io_index][0](io_mem_opaque[io_index], addr1);
c27004ec 3200 stb_p(buf, val);
13eb76e0
FB		 3201 l = 1;
3202 }
3203 } else {
3204 /* RAM case */
5579c7f3 3205 ptr = qemu_get_ram_ptr(pd & TARGET_PAGE_MASK) +
13eb76e0
FB		 3206 (addr & ~TARGET_PAGE_MASK);
3207 memcpy(buf, ptr, l);
3208 }
3209 }
3210 len -= l;
3211 buf += l;
3212 addr += l;
3213 }
3214}
8df1cd07 3215
d0ecd2aa 3216/* used for ROM loading : can write in RAM and ROM */
5fafdf24 3217void cpu_physical_memory_write_rom(target_phys_addr_t addr,
d0ecd2aa
FB		 3218 const uint8_t *buf, int len)
3219{
3220 int l;
3221 uint8_t *ptr;
3222 target_phys_addr_t page;
3223 unsigned long pd;
3224 PhysPageDesc *p;
3b46e624 3225
d0ecd2aa
FB		 3226 while (len > 0) {
3227 page = addr & TARGET_PAGE_MASK;
3228 l = (page + TARGET_PAGE_SIZE) - addr;
3229 if (l > len)
3230 l = len;
3231 p = phys_page_find(page >> TARGET_PAGE_BITS);
3232 if (!p) {
3233 pd = IO_MEM_UNASSIGNED;
3234 } else {
3235 pd = p->phys_offset;
3236 }
3b46e624 3237
d0ecd2aa 3238 if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM &&
2a4188a3
FB		 3239 (pd & ~TARGET_PAGE_MASK) != IO_MEM_ROM &&
3240 !(pd & IO_MEM_ROMD)) {
d0ecd2aa
FB		 3241 /* do nothing */
3242 } else {
3243 unsigned long addr1;
3244 addr1 = (pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK);
3245 /* ROM/RAM case */
5579c7f3 3246 ptr = qemu_get_ram_ptr(addr1);
d0ecd2aa
FB		 3247 memcpy(ptr, buf, l);
3248 }
3249 len -= l;
3250 buf += l;
3251 addr += l;
3252 }
3253}
3254
6d16c2f8
AL		 3255typedef struct {
3256 void *buffer;
3257 target_phys_addr_t addr;
3258 target_phys_addr_t len;
3259} BounceBuffer;
3260
3261static BounceBuffer bounce;
3262
ba223c29
AL		 3263typedef struct MapClient {
3264 void *opaque;
3265 void (*callback)(void *opaque);
3266 LIST_ENTRY(MapClient) link;
3267} MapClient;
3268
3269static LIST_HEAD(map_client_list, MapClient) map_client_list
3270 = LIST_HEAD_INITIALIZER(map_client_list);
3271
3272void *cpu_register_map_client(void *opaque, void (*callback)(void *opaque))
3273{
3274 MapClient *client = qemu_malloc(sizeof(*client));
3275
3276 client->opaque = opaque;
3277 client->callback = callback;
3278 LIST_INSERT_HEAD(&map_client_list, client, link);
3279 return client;
3280}
3281
3282void cpu_unregister_map_client(void *_client)
3283{
3284 MapClient *client = (MapClient *)_client;
3285
3286 LIST_REMOVE(client, link);
3287}
3288
3289static void cpu_notify_map_clients(void)
3290{
3291 MapClient *client;
3292
3293 while (!LIST_EMPTY(&map_client_list)) {
3294 client = LIST_FIRST(&map_client_list);
3295 client->callback(client->opaque);
3296 LIST_REMOVE(client, link);
3297 }
3298}
3299
6d16c2f8
AL		 3300/* Map a physical memory region into a host virtual address.
3301 * May map a subset of the requested range, given by and returned in *plen.
3302 * May return NULL if resources needed to perform the mapping are exhausted.
3303 * Use only for reads OR writes - not for read-modify-write operations.
ba223c29
AL		 3304 * Use cpu_register_map_client() to know when retrying the map operation is
3305 * likely to succeed.
6d16c2f8
AL		 3306 */
3307void *cpu_physical_memory_map(target_phys_addr_t addr,
3308 target_phys_addr_t *plen,
3309 int is_write)
3310{
3311 target_phys_addr_t len = *plen;
3312 target_phys_addr_t done = 0;
3313 int l;
3314 uint8_t *ret = NULL;
3315 uint8_t *ptr;
3316 target_phys_addr_t page;
3317 unsigned long pd;
3318 PhysPageDesc *p;
3319 unsigned long addr1;
3320
3321 while (len > 0) {
3322 page = addr & TARGET_PAGE_MASK;
3323 l = (page + TARGET_PAGE_SIZE) - addr;
3324 if (l > len)
3325 l = len;
3326 p = phys_page_find(page >> TARGET_PAGE_BITS);
3327 if (!p) {
3328 pd = IO_MEM_UNASSIGNED;
3329 } else {
3330 pd = p->phys_offset;
3331 }
3332
3333 if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
3334 if (done || bounce.buffer) {
3335 break;
3336 }
3337 bounce.buffer = qemu_memalign(TARGET_PAGE_SIZE, TARGET_PAGE_SIZE);
3338 bounce.addr = addr;
3339 bounce.len = l;
3340 if (!is_write) {
3341 cpu_physical_memory_rw(addr, bounce.buffer, l, 0);
3342 }
3343 ptr = bounce.buffer;
3344 } else {
3345 addr1 = (pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK);
5579c7f3 3346 ptr = qemu_get_ram_ptr(addr1);
6d16c2f8
AL		 3347 }
3348 if (!done) {
3349 ret = ptr;
3350 } else if (ret + done != ptr) {
3351 break;
3352 }
3353
3354 len -= l;
3355 addr += l;
3356 done += l;
3357 }
3358 *plen = done;
3359 return ret;
3360}
3361
3362/* Unmaps a memory region previously mapped by cpu_physical_memory_map().
3363 * Will also mark the memory as dirty if is_write == 1. access_len gives
3364 * the amount of memory that was actually read or written by the caller.
3365 */
3366void cpu_physical_memory_unmap(void *buffer, target_phys_addr_t len,
3367 int is_write, target_phys_addr_t access_len)
3368{
3369 if (buffer != bounce.buffer) {
3370 if (is_write) {
5579c7f3 3371 ram_addr_t addr1 = qemu_ram_addr_from_host(buffer);
6d16c2f8
AL		 3372 while (access_len) {
3373 unsigned l;
3374 l = TARGET_PAGE_SIZE;
3375 if (l > access_len)
3376 l = access_len;
3377 if (!cpu_physical_memory_is_dirty(addr1)) {
3378 /* invalidate code */
3379 tb_invalidate_phys_page_range(addr1, addr1 + l, 0);
3380 /* set dirty bit */
3381 phys_ram_dirty[addr1 >> TARGET_PAGE_BITS] |=
3382 (0xff & ~CODE_DIRTY_FLAG);
3383 }
3384 addr1 += l;
3385 access_len -= l;
3386 }
3387 }
3388 return;
3389 }
3390 if (is_write) {
3391 cpu_physical_memory_write(bounce.addr, bounce.buffer, access_len);
3392 }
3393 qemu_free(bounce.buffer);
3394 bounce.buffer = NULL;
ba223c29 3395 cpu_notify_map_clients();
6d16c2f8 3396}
d0ecd2aa 3397
8df1cd07
FB		 3398/* warning: addr must be aligned */
3399uint32_t ldl_phys(target_phys_addr_t addr)
3400{
3401 int io_index;
3402 uint8_t *ptr;
3403 uint32_t val;
3404 unsigned long pd;
3405 PhysPageDesc *p;
3406
3407 p = phys_page_find(addr >> TARGET_PAGE_BITS);
3408 if (!p) {
3409 pd = IO_MEM_UNASSIGNED;
3410 } else {
3411 pd = p->phys_offset;
3412 }
3b46e624 3413
5fafdf24 3414 if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM &&
2a4188a3 3415 !(pd & IO_MEM_ROMD)) {
8df1cd07
FB		 3416 /* I/O case */
3417 io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
8da3ff18
PB		 3418 if (p)
3419 addr = (addr & ~TARGET_PAGE_MASK) + p->region_offset;
8df1cd07
FB		 3420 val = io_mem_read[io_index][2](io_mem_opaque[io_index], addr);
3421 } else {
3422 /* RAM case */
5579c7f3 3423 ptr = qemu_get_ram_ptr(pd & TARGET_PAGE_MASK) +
8df1cd07
FB		 3424 (addr & ~TARGET_PAGE_MASK);
3425 val = ldl_p(ptr);
3426 }
3427 return val;
3428}
3429
84b7b8e7
FB		 3430/* warning: addr must be aligned */
3431uint64_t ldq_phys(target_phys_addr_t addr)
3432{
3433 int io_index;
3434 uint8_t *ptr;
3435 uint64_t val;
3436 unsigned long pd;
3437 PhysPageDesc *p;
3438
3439 p = phys_page_find(addr >> TARGET_PAGE_BITS);
3440 if (!p) {
3441 pd = IO_MEM_UNASSIGNED;
3442 } else {
3443 pd = p->phys_offset;
3444 }
3b46e624 3445
2a4188a3
FB		 3446 if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM &&
3447 !(pd & IO_MEM_ROMD)) {
84b7b8e7
FB		 3448 /* I/O case */
3449 io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
8da3ff18
PB		 3450 if (p)
3451 addr = (addr & ~TARGET_PAGE_MASK) + p->region_offset;
84b7b8e7
FB		 3452#ifdef TARGET_WORDS_BIGENDIAN
3453 val = (uint64_t)io_mem_read[io_index][2](io_mem_opaque[io_index], addr) << 32;
3454 val |= io_mem_read[io_index][2](io_mem_opaque[io_index], addr + 4);
3455#else
3456 val = io_mem_read[io_index][2](io_mem_opaque[io_index], addr);
3457 val |= (uint64_t)io_mem_read[io_index][2](io_mem_opaque[io_index], addr + 4) << 32;
3458#endif
3459 } else {
3460 /* RAM case */
5579c7f3 3461 ptr = qemu_get_ram_ptr(pd & TARGET_PAGE_MASK) +
84b7b8e7
FB		 3462 (addr & ~TARGET_PAGE_MASK);
3463 val = ldq_p(ptr);
3464 }
3465 return val;
3466}
3467
aab33094
FB		 3468/* XXX: optimize */
3469uint32_t ldub_phys(target_phys_addr_t addr)
3470{
3471 uint8_t val;
3472 cpu_physical_memory_read(addr, &val, 1);
3473 return val;
3474}
3475
3476/* XXX: optimize */
3477uint32_t lduw_phys(target_phys_addr_t addr)
3478{
3479 uint16_t val;
3480 cpu_physical_memory_read(addr, (uint8_t *)&val, 2);
3481 return tswap16(val);
3482}
3483
8df1cd07
FB		 3484/* warning: addr must be aligned. The ram page is not masked as dirty
3485 and the code inside is not invalidated. It is useful if the dirty
3486 bits are used to track modified PTEs */
3487void stl_phys_notdirty(target_phys_addr_t addr, uint32_t val)
3488{
3489 int io_index;
3490 uint8_t *ptr;
3491 unsigned long pd;
3492 PhysPageDesc *p;
3493
3494 p = phys_page_find(addr >> TARGET_PAGE_BITS);
3495 if (!p) {
3496 pd = IO_MEM_UNASSIGNED;
3497 } else {
3498 pd = p->phys_offset;
3499 }
3b46e624 3500
3a7d929e 3501 if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
8df1cd07 3502 io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
8da3ff18
PB		 3503 if (p)
3504 addr = (addr & ~TARGET_PAGE_MASK) + p->region_offset;
8df1cd07
FB		 3505 io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val);
3506 } else {
74576198 3507 unsigned long addr1 = (pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK);
5579c7f3 3508 ptr = qemu_get_ram_ptr(addr1);
8df1cd07 3509 stl_p(ptr, val);
74576198
AL		 3510
3511 if (unlikely(in_migration)) {
3512 if (!cpu_physical_memory_is_dirty(addr1)) {
3513 /* invalidate code */
3514 tb_invalidate_phys_page_range(addr1, addr1 + 4, 0);
3515 /* set dirty bit */
3516 phys_ram_dirty[addr1 >> TARGET_PAGE_BITS] |=
3517 (0xff & ~CODE_DIRTY_FLAG);
3518 }
3519 }
8df1cd07
FB		 3520 }
3521}
3522
bc98a7ef
JM		 3523void stq_phys_notdirty(target_phys_addr_t addr, uint64_t val)
3524{
3525 int io_index;
3526 uint8_t *ptr;
3527 unsigned long pd;
3528 PhysPageDesc *p;
3529
3530 p = phys_page_find(addr >> TARGET_PAGE_BITS);
3531 if (!p) {
3532 pd = IO_MEM_UNASSIGNED;
3533 } else {
3534 pd = p->phys_offset;
3535 }
3b46e624 3536
bc98a7ef
JM		 3537 if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
3538 io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
8da3ff18
PB		 3539 if (p)
3540 addr = (addr & ~TARGET_PAGE_MASK) + p->region_offset;
bc98a7ef
JM		 3541#ifdef TARGET_WORDS_BIGENDIAN
3542 io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val >> 32);
3543 io_mem_write[io_index][2](io_mem_opaque[io_index], addr + 4, val);
3544#else
3545 io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val);
3546 io_mem_write[io_index][2](io_mem_opaque[io_index], addr + 4, val >> 32);
3547#endif
3548 } else {
5579c7f3 3549 ptr = qemu_get_ram_ptr(pd & TARGET_PAGE_MASK) +
bc98a7ef
JM		 3550 (addr & ~TARGET_PAGE_MASK);
3551 stq_p(ptr, val);
3552 }
3553}
3554
8df1cd07 3555/* warning: addr must be aligned */
8df1cd07
FB		 3556void stl_phys(target_phys_addr_t addr, uint32_t val)
3557{
3558 int io_index;
3559 uint8_t *ptr;
3560 unsigned long pd;
3561 PhysPageDesc *p;
3562
3563 p = phys_page_find(addr >> TARGET_PAGE_BITS);
3564 if (!p) {
3565 pd = IO_MEM_UNASSIGNED;
3566 } else {
3567 pd = p->phys_offset;
3568 }
3b46e624 3569
3a7d929e 3570 if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
8df1cd07 3571 io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
8da3ff18
PB		 3572 if (p)
3573 addr = (addr & ~TARGET_PAGE_MASK) + p->region_offset;
8df1cd07
FB		 3574 io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val);
3575 } else {
3576 unsigned long addr1;
3577 addr1 = (pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK);
3578 /* RAM case */
5579c7f3 3579 ptr = qemu_get_ram_ptr(addr1);
8df1cd07 3580 stl_p(ptr, val);
3a7d929e
FB		 3581 if (!cpu_physical_memory_is_dirty(addr1)) {
3582 /* invalidate code */
3583 tb_invalidate_phys_page_range(addr1, addr1 + 4, 0);
3584 /* set dirty bit */
f23db169
FB		 3585 phys_ram_dirty[addr1 >> TARGET_PAGE_BITS] |=
3586 (0xff & ~CODE_DIRTY_FLAG);
3a7d929e 3587 }
8df1cd07
FB		 3588 }
3589}
3590
aab33094
FB		 3591/* XXX: optimize */
3592void stb_phys(target_phys_addr_t addr, uint32_t val)
3593{
3594 uint8_t v = val;
3595 cpu_physical_memory_write(addr, &v, 1);
3596}
3597
3598/* XXX: optimize */
3599void stw_phys(target_phys_addr_t addr, uint32_t val)
3600{
3601 uint16_t v = tswap16(val);
3602 cpu_physical_memory_write(addr, (const uint8_t *)&v, 2);
3603}
3604
3605/* XXX: optimize */
3606void stq_phys(target_phys_addr_t addr, uint64_t val)
3607{
3608 val = tswap64(val);
3609 cpu_physical_memory_write(addr, (const uint8_t *)&val, 8);
3610}
3611
13eb76e0
FB		 3612#endif
3613
5e2972fd 3614/* virtual memory access for debug (includes writing to ROM) */
5fafdf24 3615int cpu_memory_rw_debug(CPUState *env, target_ulong addr,
b448f2f3 3616 uint8_t *buf, int len, int is_write)
13eb76e0
FB		 3617{
3618 int l;
9b3c35e0
JM		 3619 target_phys_addr_t phys_addr;
3620 target_ulong page;
13eb76e0
FB		 3621
3622 while (len > 0) {
3623 page = addr & TARGET_PAGE_MASK;
3624 phys_addr = cpu_get_phys_page_debug(env, page);
3625 /* if no physical page mapped, return an error */
3626 if (phys_addr == -1)
3627 return -1;
3628 l = (page + TARGET_PAGE_SIZE) - addr;
3629 if (l > len)
3630 l = len;
5e2972fd
AL		 3631 phys_addr += (addr & ~TARGET_PAGE_MASK);
3632#if !defined(CONFIG_USER_ONLY)
3633 if (is_write)
3634 cpu_physical_memory_write_rom(phys_addr, buf, l);
3635 else
3636#endif
3637 cpu_physical_memory_rw(phys_addr, buf, l, is_write);
13eb76e0
FB		 3638 len -= l;
3639 buf += l;
3640 addr += l;
3641 }
3642 return 0;
3643}
3644
2e70f6ef
PB		 3645/* in deterministic execution mode, instructions doing device I/Os
3646 must be at the end of the TB */
3647void cpu_io_recompile(CPUState *env, void *retaddr)
3648{
3649 TranslationBlock *tb;
3650 uint32_t n, cflags;
3651 target_ulong pc, cs_base;
3652 uint64_t flags;
3653
3654 tb = tb_find_pc((unsigned long)retaddr);
3655 if (!tb) {
3656 cpu_abort(env, "cpu_io_recompile: could not find TB for pc=%p",
3657 retaddr);
3658 }
3659 n = env->icount_decr.u16.low + tb->icount;
3660 cpu_restore_state(tb, env, (unsigned long)retaddr, NULL);
3661 /* Calculate how many instructions had been executed before the fault
bf20dc07 3662 occurred. */
2e70f6ef
PB		 3663 n = n - env->icount_decr.u16.low;
3664 /* Generate a new TB ending on the I/O insn. */
3665 n++;
3666 /* On MIPS and SH, delay slot instructions can only be restarted if
3667 they were already the first instruction in the TB. If this is not
bf20dc07 3668 the first instruction in a TB then re-execute the preceding
2e70f6ef
PB		 3669 branch. */
3670#if defined(TARGET_MIPS)
3671 if ((env->hflags & MIPS_HFLAG_BMASK) != 0 && n > 1) {
3672 env->active_tc.PC -= 4;
3673 env->icount_decr.u16.low++;
3674 env->hflags &= ~MIPS_HFLAG_BMASK;
3675 }
3676#elif defined(TARGET_SH4)
3677 if ((env->flags & ((DELAY_SLOT | DELAY_SLOT_CONDITIONAL))) != 0
3678 && n > 1) {
3679 env->pc -= 2;
3680 env->icount_decr.u16.low++;
3681 env->flags &= ~(DELAY_SLOT | DELAY_SLOT_CONDITIONAL);
3682 }
3683#endif
3684 /* This should never happen. */
3685 if (n > CF_COUNT_MASK)
3686 cpu_abort(env, "TB too big during recompile");
3687
3688 cflags = n | CF_LAST_IO;
3689 pc = tb->pc;
3690 cs_base = tb->cs_base;
3691 flags = tb->flags;
3692 tb_phys_invalidate(tb, -1);
3693 /* FIXME: In theory this could raise an exception. In practice
3694 we have already translated the block once so it's probably ok. */
3695 tb_gen_code(env, pc, cs_base, flags, cflags);
bf20dc07 3696 /* TODO: If env->pc != tb->pc (i.e. the faulting instruction was not
2e70f6ef
PB		 3697 the first in the TB) then we end up generating a whole new TB and
3698 repeating the fault, which is horribly inefficient.
3699 Better would be to execute just this insn uncached, or generate a
3700 second new TB. */
3701 cpu_resume_from_signal(env, NULL);
3702}
3703
e3db7226
FB		 3704void dump_exec_info(FILE *f,
3705 int (*cpu_fprintf)(FILE *f, const char *fmt, ...))
3706{
3707 int i, target_code_size, max_target_code_size;
3708 int direct_jmp_count, direct_jmp2_count, cross_page;
3709 TranslationBlock *tb;
3b46e624 3710
e3db7226
FB		 3711 target_code_size = 0;
3712 max_target_code_size = 0;
3713 cross_page = 0;
3714 direct_jmp_count = 0;
3715 direct_jmp2_count = 0;
3716 for(i = 0; i < nb_tbs; i++) {
3717 tb = &tbs[i];
3718 target_code_size += tb->size;
3719 if (tb->size > max_target_code_size)
3720 max_target_code_size = tb->size;
3721 if (tb->page_addr[1] != -1)
3722 cross_page++;
3723 if (tb->tb_next_offset[0] != 0xffff) {
3724 direct_jmp_count++;
3725 if (tb->tb_next_offset[1] != 0xffff) {
3726 direct_jmp2_count++;
3727 }
3728 }
3729 }
3730 /* XXX: avoid using doubles ? */
57fec1fe 3731 cpu_fprintf(f, "Translation buffer state:\n");
26a5f13b
FB		 3732 cpu_fprintf(f, "gen code size %ld/%ld\n",
3733 code_gen_ptr - code_gen_buffer, code_gen_buffer_max_size);
3734 cpu_fprintf(f, "TB count %d/%d\n",
3735 nb_tbs, code_gen_max_blocks);
5fafdf24 3736 cpu_fprintf(f, "TB avg target size %d max=%d bytes\n",
e3db7226
FB		 3737 nb_tbs ? target_code_size / nb_tbs : 0,
3738 max_target_code_size);
5fafdf24 3739 cpu_fprintf(f, "TB avg host size %d bytes (expansion ratio: %0.1f)\n",
e3db7226
FB		 3740 nb_tbs ? (code_gen_ptr - code_gen_buffer) / nb_tbs : 0,
3741 target_code_size ? (double) (code_gen_ptr - code_gen_buffer) / target_code_size : 0);
5fafdf24
TS		 3742 cpu_fprintf(f, "cross page TB count %d (%d%%)\n",
3743 cross_page,
e3db7226
FB		 3744 nb_tbs ? (cross_page * 100) / nb_tbs : 0);
3745 cpu_fprintf(f, "direct jump count %d (%d%%) (2 jumps=%d %d%%)\n",
5fafdf24 3746 direct_jmp_count,
e3db7226
FB		 3747 nb_tbs ? (direct_jmp_count * 100) / nb_tbs : 0,
3748 direct_jmp2_count,
3749 nb_tbs ? (direct_jmp2_count * 100) / nb_tbs : 0);
57fec1fe 3750 cpu_fprintf(f, "\nStatistics:\n");
e3db7226
FB		 3751 cpu_fprintf(f, "TB flush count %d\n", tb_flush_count);
3752 cpu_fprintf(f, "TB invalidate count %d\n", tb_phys_invalidate_count);
3753 cpu_fprintf(f, "TLB flush count %d\n", tlb_flush_count);
b67d9a52 3754 tcg_dump_info(f, cpu_fprintf);
e3db7226
FB		 3755}
3756
5fafdf24 3757#if !defined(CONFIG_USER_ONLY)
61382a50
FB		 3758
3759#define MMUSUFFIX _cmmu
3760#define GETPC() NULL
3761#define env cpu_single_env
b769d8fe 3762#define SOFTMMU_CODE_ACCESS
61382a50
FB		 3763
3764#define SHIFT 0
3765#include "softmmu_template.h"
3766
3767#define SHIFT 1
3768#include "softmmu_template.h"
3769
3770#define SHIFT 2
3771#include "softmmu_template.h"
3772
3773#define SHIFT 3
3774#include "softmmu_template.h"
3775
3776#undef env
3777
3778#endif
QEMU mirror