cpu-exec.c

   1 /*
   2  *  emulator main execution loop
   3  *
   4  *  Copyright (c) 2003-2005 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "config.h"
  20 #include "cpu.h"
  21 #include "disas.h"
  22 #include "tcg.h"
  23 #include "qemu-barrier.h"
  24 #include "qtest.h"
  25
  26 int tb_invalidated_flag;
  27
  28 //#define CONFIG_DEBUG_EXEC
  29
  30 bool qemu_cpu_has_work(CPUArchState *env)
  31 {
  32     return cpu_has_work(env);
  33 }
  34
  35 void cpu_loop_exit(CPUArchState *env)
  36 {
  37     env->current_tb = NULL;
  38     longjmp(env->jmp_env, 1);
  39 }
  40
  41 /* exit the current TB from a signal handler. The host registers are
  42    restored in a state compatible with the CPU emulator
  43  */
  44 #if defined(CONFIG_SOFTMMU)
  45 void cpu_resume_from_signal(CPUArchState *env, void *puc)
  46 {
  47     /* XXX: restore cpu registers saved in host registers */
  48
  49     env->exception_index = -1;
  50     longjmp(env->jmp_env, 1);
  51 }
  52 #endif
  53
  54 /* Execute the code without caching the generated code. An interpreter
  55    could be used if available. */
  56 static void cpu_exec_nocache(CPUArchState *env, int max_cycles,
  57                              TranslationBlock *orig_tb)
  58 {
  59     tcg_target_ulong next_tb;
  60     TranslationBlock *tb;
  61
  62     /* Should never happen.
  63        We only end up here when an existing TB is too long.  */
  64     if (max_cycles > CF_COUNT_MASK)
  65         max_cycles = CF_COUNT_MASK;
  66
  67     tb = tb_gen_code(env, orig_tb->pc, orig_tb->cs_base, orig_tb->flags,
  68                      max_cycles);
  69     env->current_tb = tb;
  70     /* execute the generated code */
  71     next_tb = tcg_qemu_tb_exec(env, tb->tc_ptr);
  72     env->current_tb = NULL;
  73
  74     if ((next_tb & 3) == 2) {
  75         /* Restore PC.  This may happen if async event occurs before
  76            the TB starts executing.  */
  77         cpu_pc_from_tb(env, tb);
  78     }
  79     tb_phys_invalidate(tb, -1);
  80     tb_free(tb);
  81 }
  82
  83 static TranslationBlock *tb_find_slow(CPUArchState *env,
  84                                       target_ulong pc,
  85                                       target_ulong cs_base,
  86                                       uint64_t flags)
  87 {
  88     TranslationBlock *tb, **ptb1;
  89     unsigned int h;
  90     tb_page_addr_t phys_pc, phys_page1;
  91     target_ulong virt_page2;
  92
  93     tb_invalidated_flag = 0;
  94
  95     /* find translated block using physical mappings */
  96     phys_pc = get_page_addr_code(env, pc);
  97     phys_page1 = phys_pc & TARGET_PAGE_MASK;
  98     h = tb_phys_hash_func(phys_pc);
  99     ptb1 = &tb_phys_hash[h];
 100     for(;;) {
 101         tb = *ptb1;
 102         if (!tb)
 103             goto not_found;
 104         if (tb->pc == pc &&
 105             tb->page_addr[0] == phys_page1 &&
 106             tb->cs_base == cs_base &&
 107             tb->flags == flags) {
 108             /* check next page if needed */
 109             if (tb->page_addr[1] != -1) {
 110                 tb_page_addr_t phys_page2;
 111
 112                 virt_page2 = (pc & TARGET_PAGE_MASK) +
 113                     TARGET_PAGE_SIZE;
 114                 phys_page2 = get_page_addr_code(env, virt_page2);
 115                 if (tb->page_addr[1] == phys_page2)
 116                     goto found;
 117             } else {
 118                 goto found;
 119             }
 120         }
 121         ptb1 = &tb->phys_hash_next;
 122     }
 123  not_found:
 124    /* if no translated code available, then translate it now */
 125     tb = tb_gen_code(env, pc, cs_base, flags, 0);
 126
 127  found:
 128     /* Move the last found TB to the head of the list */
 129     if (likely(*ptb1)) {
 130         *ptb1 = tb->phys_hash_next;
 131         tb->phys_hash_next = tb_phys_hash[h];
 132         tb_phys_hash[h] = tb;
 133     }
 134     /* we add the TB in the virtual pc hash table */
 135     env->tb_jmp_cache[tb_jmp_cache_hash_func(pc)] = tb;
 136     return tb;
 137 }
 138
 139 static inline TranslationBlock *tb_find_fast(CPUArchState *env)
 140 {
 141     TranslationBlock *tb;
 142     target_ulong cs_base, pc;
 143     int flags;
 144
 145     /* we record a subset of the CPU state. It will
 146        always be the same before a given translated block
 147        is executed. */
 148     cpu_get_tb_cpu_state(env, &pc, &cs_base, &flags);
 149     tb = env->tb_jmp_cache[tb_jmp_cache_hash_func(pc)];
 150     if (unlikely(!tb || tb->pc != pc || tb->cs_base != cs_base ||
 151                  tb->flags != flags)) {
 152         tb = tb_find_slow(env, pc, cs_base, flags);
 153     }
 154     return tb;
 155 }
 156
 157 static CPUDebugExcpHandler *debug_excp_handler;
 158
 159 CPUDebugExcpHandler *cpu_set_debug_excp_handler(CPUDebugExcpHandler *handler)
 160 {
 161     CPUDebugExcpHandler *old_handler = debug_excp_handler;
 162
 163     debug_excp_handler = handler;
 164     return old_handler;
 165 }
 166
 167 static void cpu_handle_debug_exception(CPUArchState *env)
 168 {
 169     CPUWatchpoint *wp;
 170
 171     if (!env->watchpoint_hit) {
 172         QTAILQ_FOREACH(wp, &env->watchpoints, entry) {
 173             wp->flags &= ~BP_WATCHPOINT_HIT;
 174         }
 175     }
 176     if (debug_excp_handler) {
 177         debug_excp_handler(env);
 178     }
 179 }
 180
 181 /* main execution loop */
 182
 183 volatile sig_atomic_t exit_request;
 184
 185 int cpu_exec(CPUArchState *env)
 186 {
 187     int ret, interrupt_request;
 188     TranslationBlock *tb;
 189     uint8_t *tc_ptr;
 190     tcg_target_ulong next_tb;
 191
 192     if (env->halted) {
 193         if (!cpu_has_work(env)) {
 194             return EXCP_HALTED;
 195         }
 196
 197         env->halted = 0;
 198     }
 199
 200     cpu_single_env = env;
 201
 202     if (unlikely(exit_request)) {
 203         env->exit_request = 1;
 204     }
 205
 206 #if defined(TARGET_I386)
 207     /* put eflags in CPU temporary format */
 208     CC_SRC = env->eflags & (CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C);
 209     DF = 1 - (2 * ((env->eflags >> 10) & 1));
 210     CC_OP = CC_OP_EFLAGS;
 211     env->eflags &= ~(DF_MASK | CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C);
 212 #elif defined(TARGET_SPARC)
 213 #elif defined(TARGET_M68K)
 214     env->cc_op = CC_OP_FLAGS;
 215     env->cc_dest = env->sr & 0xf;
 216     env->cc_x = (env->sr >> 4) & 1;
 217 #elif defined(TARGET_ALPHA)
 218 #elif defined(TARGET_ARM)
 219 #elif defined(TARGET_UNICORE32)
 220 #elif defined(TARGET_PPC)
 221     env->reserve_addr = -1;
 222 #elif defined(TARGET_LM32)
 223 #elif defined(TARGET_MICROBLAZE)
 224 #elif defined(TARGET_MIPS)
 225 #elif defined(TARGET_SH4)
 226 #elif defined(TARGET_CRIS)
 227 #elif defined(TARGET_S390X)
 228 #elif defined(TARGET_XTENSA)
 229     /* XXXXX */
 230 #else
 231 #error unsupported target CPU
 232 #endif
 233     env->exception_index = -1;
 234
 235     /* prepare setjmp context for exception handling */
 236     for(;;) {
 237         if (setjmp(env->jmp_env) == 0) {
 238             /* if an exception is pending, we execute it here */
 239             if (env->exception_index >= 0) {
 240                 if (env->exception_index >= EXCP_INTERRUPT) {
 241                     /* exit request from the cpu execution loop */
 242                     ret = env->exception_index;
 243                     if (ret == EXCP_DEBUG) {
 244                         cpu_handle_debug_exception(env);
 245                     }
 246                     break;
 247                 } else {
 248 #if defined(CONFIG_USER_ONLY)
 249                     /* if user mode only, we simulate a fake exception
 250                        which will be handled outside the cpu execution
 251                        loop */
 252 #if defined(TARGET_I386)
 253                     do_interrupt(env);
 254 #endif
 255                     ret = env->exception_index;
 256                     break;
 257 #else
 258                     do_interrupt(env);
 259                     env->exception_index = -1;
 260 #endif
 261                 }
 262             }
 263
 264             next_tb = 0; /* force lookup of first TB */
 265             for(;;) {
 266                 interrupt_request = env->interrupt_request;
 267                 if (unlikely(interrupt_request)) {
 268                     if (unlikely(env->singlestep_enabled & SSTEP_NOIRQ)) {
 269                         /* Mask out external interrupts for this step. */
 270                         interrupt_request &= ~CPU_INTERRUPT_SSTEP_MASK;
 271                     }
 272                     if (interrupt_request & CPU_INTERRUPT_DEBUG) {
 273                         env->interrupt_request &= ~CPU_INTERRUPT_DEBUG;
 274                         env->exception_index = EXCP_DEBUG;
 275                         cpu_loop_exit(env);
 276                     }
 277 #if defined(TARGET_ARM) || defined(TARGET_SPARC) || defined(TARGET_MIPS) || \
 278     defined(TARGET_PPC) || defined(TARGET_ALPHA) || defined(TARGET_CRIS) || \
 279     defined(TARGET_MICROBLAZE) || defined(TARGET_LM32) || defined(TARGET_UNICORE32)
 280                     if (interrupt_request & CPU_INTERRUPT_HALT) {
 281                         env->interrupt_request &= ~CPU_INTERRUPT_HALT;
 282                         env->halted = 1;
 283                         env->exception_index = EXCP_HLT;
 284                         cpu_loop_exit(env);
 285                     }
 286 #endif
 287 #if defined(TARGET_I386)
 288 #if !defined(CONFIG_USER_ONLY)
 289                     if (interrupt_request & CPU_INTERRUPT_POLL) {
 290                         env->interrupt_request &= ~CPU_INTERRUPT_POLL;
 291                         apic_poll_irq(env->apic_state);
 292                     }
 293 #endif
 294                     if (interrupt_request & CPU_INTERRUPT_INIT) {
 295                             svm_check_intercept(env, SVM_EXIT_INIT);
 296                             do_cpu_init(env);
 297                             env->exception_index = EXCP_HALTED;
 298                             cpu_loop_exit(env);
 299                     } else if (interrupt_request & CPU_INTERRUPT_SIPI) {
 300                             do_cpu_sipi(env);
 301                     } else if (env->hflags2 & HF2_GIF_MASK) {
 302                         if ((interrupt_request & CPU_INTERRUPT_SMI) &&
 303                             !(env->hflags & HF_SMM_MASK)) {
 304                             svm_check_intercept(env, SVM_EXIT_SMI);
 305                             env->interrupt_request &= ~CPU_INTERRUPT_SMI;
 306                             do_smm_enter(env);
 307                             next_tb = 0;
 308                         } else if ((interrupt_request & CPU_INTERRUPT_NMI) &&
 309                                    !(env->hflags2 & HF2_NMI_MASK)) {
 310                             env->interrupt_request &= ~CPU_INTERRUPT_NMI;
 311                             env->hflags2 |= HF2_NMI_MASK;
 312                             do_interrupt_x86_hardirq(env, EXCP02_NMI, 1);
 313                             next_tb = 0;
 314                         } else if (interrupt_request & CPU_INTERRUPT_MCE) {
 315                             env->interrupt_request &= ~CPU_INTERRUPT_MCE;
 316                             do_interrupt_x86_hardirq(env, EXCP12_MCHK, 0);
 317                             next_tb = 0;
 318                         } else if ((interrupt_request & CPU_INTERRUPT_HARD) &&
 319                                    (((env->hflags2 & HF2_VINTR_MASK) &&
 320                                      (env->hflags2 & HF2_HIF_MASK)) ||
 321                                     (!(env->hflags2 & HF2_VINTR_MASK) &&
 322                                      (env->eflags & IF_MASK &&
 323                                       !(env->hflags & HF_INHIBIT_IRQ_MASK))))) {
 324                             int intno;
 325                             svm_check_intercept(env, SVM_EXIT_INTR);
 326                             env->interrupt_request &= ~(CPU_INTERRUPT_HARD | CPU_INTERRUPT_VIRQ);
 327                             intno = cpu_get_pic_interrupt(env);
 328                             qemu_log_mask(CPU_LOG_TB_IN_ASM, "Servicing hardware INT=0x%02x\n", intno);
 329                             do_interrupt_x86_hardirq(env, intno, 1);
 330                             /* ensure that no TB jump will be modified as
 331                                the program flow was changed */
 332                             next_tb = 0;
 333 #if !defined(CONFIG_USER_ONLY)
 334                         } else if ((interrupt_request & CPU_INTERRUPT_VIRQ) &&
 335                                    (env->eflags & IF_MASK) &&
 336                                    !(env->hflags & HF_INHIBIT_IRQ_MASK)) {
 337                             int intno;
 338                             /* FIXME: this should respect TPR */
 339                             svm_check_intercept(env, SVM_EXIT_VINTR);
 340                             intno = ldl_phys(env->vm_vmcb + offsetof(struct vmcb, control.int_vector));
 341                             qemu_log_mask(CPU_LOG_TB_IN_ASM, "Servicing virtual hardware INT=0x%02x\n", intno);
 342                             do_interrupt_x86_hardirq(env, intno, 1);
 343                             env->interrupt_request &= ~CPU_INTERRUPT_VIRQ;
 344                             next_tb = 0;
 345 #endif
 346                         }
 347                     }
 348 #elif defined(TARGET_PPC)
 349                     if ((interrupt_request & CPU_INTERRUPT_RESET)) {
 350                         cpu_state_reset(env);
 351                     }
 352                     if (interrupt_request & CPU_INTERRUPT_HARD) {
 353                         ppc_hw_interrupt(env);
 354                         if (env->pending_interrupts == 0)
 355                             env->interrupt_request &= ~CPU_INTERRUPT_HARD;
 356                         next_tb = 0;
 357                     }
 358 #elif defined(TARGET_LM32)
 359                     if ((interrupt_request & CPU_INTERRUPT_HARD)
 360                         && (env->ie & IE_IE)) {
 361                         env->exception_index = EXCP_IRQ;
 362                         do_interrupt(env);
 363                         next_tb = 0;
 364                     }
 365 #elif defined(TARGET_MICROBLAZE)
 366                     if ((interrupt_request & CPU_INTERRUPT_HARD)
 367                         && (env->sregs[SR_MSR] & MSR_IE)
 368                         && !(env->sregs[SR_MSR] & (MSR_EIP | MSR_BIP))
 369                         && !(env->iflags & (D_FLAG | IMM_FLAG))) {
 370                         env->exception_index = EXCP_IRQ;
 371                         do_interrupt(env);
 372                         next_tb = 0;
 373                     }
 374 #elif defined(TARGET_MIPS)
 375                     if ((interrupt_request & CPU_INTERRUPT_HARD) &&
 376                         cpu_mips_hw_interrupts_pending(env)) {
 377                         /* Raise it */
 378                         env->exception_index = EXCP_EXT_INTERRUPT;
 379                         env->error_code = 0;
 380                         do_interrupt(env);
 381                         next_tb = 0;
 382                     }
 383 #elif defined(TARGET_SPARC)
 384                     if (interrupt_request & CPU_INTERRUPT_HARD) {
 385                         if (cpu_interrupts_enabled(env) &&
 386                             env->interrupt_index > 0) {
 387                             int pil = env->interrupt_index & 0xf;
 388                             int type = env->interrupt_index & 0xf0;
 389
 390                             if (((type == TT_EXTINT) &&
 391                                   cpu_pil_allowed(env, pil)) ||
 392                                   type != TT_EXTINT) {
 393                                 env->exception_index = env->interrupt_index;
 394                                 do_interrupt(env);
 395                                 next_tb = 0;
 396                             }
 397                         }
 398                     }
 399 #elif defined(TARGET_ARM)
 400                     if (interrupt_request & CPU_INTERRUPT_FIQ
 401                         && !(env->uncached_cpsr & CPSR_F)) {
 402                         env->exception_index = EXCP_FIQ;
 403                         do_interrupt(env);
 404                         next_tb = 0;
 405                     }
 406                     /* ARMv7-M interrupt return works by loading a magic value
 407                        into the PC.  On real hardware the load causes the
 408                        return to occur.  The qemu implementation performs the
 409                        jump normally, then does the exception return when the
 410                        CPU tries to execute code at the magic address.
 411                        This will cause the magic PC value to be pushed to
 412                        the stack if an interrupt occurred at the wrong time.
 413                        We avoid this by disabling interrupts when
 414                        pc contains a magic address.  */
 415                     if (interrupt_request & CPU_INTERRUPT_HARD
 416                         && ((IS_M(env) && env->regs[15] < 0xfffffff0)
 417                             || !(env->uncached_cpsr & CPSR_I))) {
 418                         env->exception_index = EXCP_IRQ;
 419                         do_interrupt(env);
 420                         next_tb = 0;
 421                     }
 422 #elif defined(TARGET_UNICORE32)
 423                     if (interrupt_request & CPU_INTERRUPT_HARD
 424                         && !(env->uncached_asr & ASR_I)) {
 425                         do_interrupt(env);
 426                         next_tb = 0;
 427                     }
 428 #elif defined(TARGET_SH4)
 429                     if (interrupt_request & CPU_INTERRUPT_HARD) {
 430                         do_interrupt(env);
 431                         next_tb = 0;
 432                     }
 433 #elif defined(TARGET_ALPHA)
 434                     {
 435                         int idx = -1;
 436                         /* ??? This hard-codes the OSF/1 interrupt levels.  */
 437                         switch (env->pal_mode ? 7 : env->ps & PS_INT_MASK) {
 438                         case 0 ... 3:
 439                             if (interrupt_request & CPU_INTERRUPT_HARD) {
 440                                 idx = EXCP_DEV_INTERRUPT;
 441                             }
 442                             /* FALLTHRU */
 443                         case 4:
 444                             if (interrupt_request & CPU_INTERRUPT_TIMER) {
 445                                 idx = EXCP_CLK_INTERRUPT;
 446                             }
 447                             /* FALLTHRU */
 448                         case 5:
 449                             if (interrupt_request & CPU_INTERRUPT_SMP) {
 450                                 idx = EXCP_SMP_INTERRUPT;
 451                             }
 452                             /* FALLTHRU */
 453                         case 6:
 454                             if (interrupt_request & CPU_INTERRUPT_MCHK) {
 455                                 idx = EXCP_MCHK;
 456                             }
 457                         }
 458                         if (idx >= 0) {
 459                             env->exception_index = idx;
 460                             env->error_code = 0;
 461                             do_interrupt(env);
 462                             next_tb = 0;
 463                         }
 464                     }
 465 #elif defined(TARGET_CRIS)
 466                     if (interrupt_request & CPU_INTERRUPT_HARD
 467                         && (env->pregs[PR_CCS] & I_FLAG)
 468                         && !env->locked_irq) {
 469                         env->exception_index = EXCP_IRQ;
 470                         do_interrupt(env);
 471                         next_tb = 0;
 472                     }
 473                     if (interrupt_request & CPU_INTERRUPT_NMI
 474                         && (env->pregs[PR_CCS] & M_FLAG)) {
 475                         env->exception_index = EXCP_NMI;
 476                         do_interrupt(env);
 477                         next_tb = 0;
 478                     }
 479 #elif defined(TARGET_M68K)
 480                     if (interrupt_request & CPU_INTERRUPT_HARD
 481                         && ((env->sr & SR_I) >> SR_I_SHIFT)
 482                             < env->pending_level) {
 483                         /* Real hardware gets the interrupt vector via an
 484                            IACK cycle at this point.  Current emulated
 485                            hardware doesn't rely on this, so we
 486                            provide/save the vector when the interrupt is
 487                            first signalled.  */
 488                         env->exception_index = env->pending_vector;
 489                         do_interrupt_m68k_hardirq(env);
 490                         next_tb = 0;
 491                     }
 492 #elif defined(TARGET_S390X) && !defined(CONFIG_USER_ONLY)
 493                     if ((interrupt_request & CPU_INTERRUPT_HARD) &&
 494                         (env->psw.mask & PSW_MASK_EXT)) {
 495                         do_interrupt(env);
 496                         next_tb = 0;
 497                     }
 498 #elif defined(TARGET_XTENSA)
 499                     if (interrupt_request & CPU_INTERRUPT_HARD) {
 500                         env->exception_index = EXC_IRQ;
 501                         do_interrupt(env);
 502                         next_tb = 0;
 503                     }
 504 #endif
 505                    /* Don't use the cached interrupt_request value,
 506                       do_interrupt may have updated the EXITTB flag. */
 507                     if (env->interrupt_request & CPU_INTERRUPT_EXITTB) {
 508                         env->interrupt_request &= ~CPU_INTERRUPT_EXITTB;
 509                         /* ensure that no TB jump will be modified as
 510                            the program flow was changed */
 511                         next_tb = 0;
 512                     }
 513                 }
 514                 if (unlikely(env->exit_request)) {
 515                     env->exit_request = 0;
 516                     env->exception_index = EXCP_INTERRUPT;
 517                     cpu_loop_exit(env);
 518                 }
 519 #if defined(DEBUG_DISAS) || defined(CONFIG_DEBUG_EXEC)
 520                 if (qemu_loglevel_mask(CPU_LOG_TB_CPU)) {
 521                     /* restore flags in standard format */
 522 #if defined(TARGET_I386)
 523                     env->eflags = env->eflags | cpu_cc_compute_all(env, CC_OP)
 524                         | (DF & DF_MASK);
 525                     log_cpu_state(env, X86_DUMP_CCOP);
 526                     env->eflags &= ~(DF_MASK | CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C);
 527 #elif defined(TARGET_M68K)
 528                     cpu_m68k_flush_flags(env, env->cc_op);
 529                     env->cc_op = CC_OP_FLAGS;
 530                     env->sr = (env->sr & 0xffe0)
 531                               | env->cc_dest | (env->cc_x << 4);
 532                     log_cpu_state(env, 0);
 533 #else
 534                     log_cpu_state(env, 0);
 535 #endif
 536                 }
 537 #endif /* DEBUG_DISAS || CONFIG_DEBUG_EXEC */
 538                 spin_lock(&tb_lock);
 539                 tb = tb_find_fast(env);
 540                 /* Note: we do it here to avoid a gcc bug on Mac OS X when
 541                    doing it in tb_find_slow */
 542                 if (tb_invalidated_flag) {
 543                     /* as some TB could have been invalidated because
 544                        of memory exceptions while generating the code, we
 545                        must recompute the hash index here */
 546                     next_tb = 0;
 547                     tb_invalidated_flag = 0;
 548                 }
 549 #ifdef CONFIG_DEBUG_EXEC
 550                 qemu_log_mask(CPU_LOG_EXEC, "Trace %p [" TARGET_FMT_lx "] %s\n",
 551                              tb->tc_ptr, tb->pc,
 552                              lookup_symbol(tb->pc));
 553 #endif
 554                 /* see if we can patch the calling TB. When the TB
 555                    spans two pages, we cannot safely do a direct
 556                    jump. */
 557                 if (next_tb != 0 && tb->page_addr[1] == -1) {
 558                     tb_add_jump((TranslationBlock *)(next_tb & ~3), next_tb & 3, tb);
 559                 }
 560                 spin_unlock(&tb_lock);
 561
 562                 /* cpu_interrupt might be called while translating the
 563                    TB, but before it is linked into a potentially
 564                    infinite loop and becomes env->current_tb. Avoid
 565                    starting execution if there is a pending interrupt. */
 566                 env->current_tb = tb;
 567                 barrier();
 568                 if (likely(!env->exit_request)) {
 569                     tc_ptr = tb->tc_ptr;
 570                     /* execute the generated code */
 571                     next_tb = tcg_qemu_tb_exec(env, tc_ptr);
 572                     if ((next_tb & 3) == 2) {
 573                         /* Instruction counter expired.  */
 574                         int insns_left;
 575                         tb = (TranslationBlock *)(next_tb & ~3);
 576                         /* Restore PC.  */
 577                         cpu_pc_from_tb(env, tb);
 578                         insns_left = env->icount_decr.u32;
 579                         if (env->icount_extra && insns_left >= 0) {
 580                             /* Refill decrementer and continue execution.  */
 581                             env->icount_extra += insns_left;
 582                             if (env->icount_extra > 0xffff) {
 583                                 insns_left = 0xffff;
 584                             } else {
 585                                 insns_left = env->icount_extra;
 586                             }
 587                             env->icount_extra -= insns_left;
 588                             env->icount_decr.u16.low = insns_left;
 589                         } else {
 590                             if (insns_left > 0) {
 591                                 /* Execute remaining instructions.  */
 592                                 cpu_exec_nocache(env, insns_left, tb);
 593                             }
 594                             env->exception_index = EXCP_INTERRUPT;
 595                             next_tb = 0;
 596                             cpu_loop_exit(env);
 597                         }
 598                     }
 599                 }
 600                 env->current_tb = NULL;
 601                 /* reset soft MMU for next block (it can currently
 602                    only be set by a memory fault) */
 603             } /* for(;;) */
 604         } else {
 605             /* Reload env after longjmp - the compiler may have smashed all
 606              * local variables as longjmp is marked 'noreturn'. */
 607             env = cpu_single_env;
 608         }
 609     } /* for(;;) */
 610
 611
 612 #if defined(TARGET_I386)
 613     /* restore flags in standard format */
 614     env->eflags = env->eflags | cpu_cc_compute_all(env, CC_OP)
 615         | (DF & DF_MASK);
 616 #elif defined(TARGET_ARM)
 617     /* XXX: Save/restore host fpu exception state?.  */
 618 #elif defined(TARGET_UNICORE32)
 619 #elif defined(TARGET_SPARC)
 620 #elif defined(TARGET_PPC)
 621 #elif defined(TARGET_LM32)
 622 #elif defined(TARGET_M68K)
 623     cpu_m68k_flush_flags(env, env->cc_op);
 624     env->cc_op = CC_OP_FLAGS;
 625     env->sr = (env->sr & 0xffe0)
 626               | env->cc_dest | (env->cc_x << 4);
 627 #elif defined(TARGET_MICROBLAZE)
 628 #elif defined(TARGET_MIPS)
 629 #elif defined(TARGET_SH4)
 630 #elif defined(TARGET_ALPHA)
 631 #elif defined(TARGET_CRIS)
 632 #elif defined(TARGET_S390X)
 633 #elif defined(TARGET_XTENSA)
 634     /* XXXXX */
 635 #else
 636 #error unsupported target CPU
 637 #endif
 638
 639     /* fail safe : never use cpu_single_env outside cpu_exec() */
 640     cpu_single_env = NULL;
 641     return ret;
 642 }