Bug Summary

File:translate-all.c
Location:line 1189, column 14
Description:Access to field 'cflags' results in a dereference of a null pointer (loaded from variable 'current_tb')

Annotated Source Code

1/*
2 * Host code generation
3 *
4 * Copyright (c) 2003 Fabrice Bellard
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18 */
19#ifdef _WIN32
20#include <windows.h>
21#else
22#include <sys/types.h>
23#include <sys/mman.h>
24#endif
25#include <stdarg.h>
26#include <stdlib.h>
27#include <stdio.h>
28#include <string.h>
29#include <inttypes.h>
30
31#include "config.h"
32
33#include "qemu-common.h"
34#define NO_CPU_IO_DEFS
35#include "cpu.h"
36#include "disas/disas.h"
37#include "tcg.h"
38#if defined(CONFIG_USER_ONLY1)
39#include "qemu.h"
40#if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
41#include <sys/param.h>
42#if __FreeBSD_version >= 700104
43#define HAVE_KINFO_GETVMMAP
44#define sigqueue sigqueue_freebsd /* avoid redefinition */
45#include <sys/time.h>
46#include <sys/proc.h>
47#include <machine/profile.h>
48#define _KERNEL
49#include <sys/user.h>
50#undef _KERNEL
51#undef sigqueue
52#include <libutil.h>
53#endif
54#endif
55#else
56#include "exec/address-spaces.h"
57#endif
58
59#include "exec/cputlb.h"
60#include "translate-all.h"
61#include "qemu/timer.h"
62
63//#define DEBUG_TB_INVALIDATE
64//#define DEBUG_FLUSH
65/* make various TB consistency checks */
66//#define DEBUG_TB_CHECK
67
68#if !defined(CONFIG_USER_ONLY1)
69/* TB consistency checks only implemented for usermode emulation. */
70#undef DEBUG_TB_CHECK
71#endif
72
73#define SMC_BITMAP_USE_THRESHOLD10 10
74
75typedef struct PageDesc {
76 /* list of TBs intersecting this ram page */
77 TranslationBlock *first_tb;
78 /* in order to optimize self modifying code, we count the number
79 of lookups we do to a given page to use a bitmap */
80 unsigned int code_write_count;
81 uint8_t *code_bitmap;
82#if defined(CONFIG_USER_ONLY1)
83 unsigned long flags;
84#endif
85} PageDesc;
86
87/* In system mode we want L1_MAP to be based on ram offsets,
88 while in user mode we want it to be based on virtual addresses. */
89#if !defined(CONFIG_USER_ONLY1)
90#if HOST_LONG_BITS64 < TARGET_PHYS_ADDR_SPACE_BITS52
91# define L1_MAP_ADDR_SPACE_BITS47 HOST_LONG_BITS64
92#else
93# define L1_MAP_ADDR_SPACE_BITS47 TARGET_PHYS_ADDR_SPACE_BITS52
94#endif
95#else
96# define L1_MAP_ADDR_SPACE_BITS47 TARGET_VIRT_ADDR_SPACE_BITS47
97#endif
98
99/* Size of the L2 (and L3, etc) page tables. */
100#define V_L2_BITS10 10
101#define V_L2_SIZE(1 << 10) (1 << V_L2_BITS10)
102
103/* The bits remaining after N lower levels of page tables. */
104#define V_L1_BITS_REM((47 - 12) % 10) \
105 ((L1_MAP_ADDR_SPACE_BITS47 - TARGET_PAGE_BITS12) % V_L2_BITS10)
106
107#if V_L1_BITS_REM((47 - 12) % 10) < 4
108#define V_L1_BITS((47 - 12) % 10) (V_L1_BITS_REM((47 - 12) % 10) + V_L2_BITS10)
109#else
110#define V_L1_BITS((47 - 12) % 10) V_L1_BITS_REM((47 - 12) % 10)
111#endif
112
113#define V_L1_SIZE((target_ulong)1 << ((47 - 12) % 10)) ((target_ulong)1 << V_L1_BITS((47 - 12) % 10))
114
115#define V_L1_SHIFT(47 - 12 - ((47 - 12) % 10)) (L1_MAP_ADDR_SPACE_BITS47 - TARGET_PAGE_BITS12 - V_L1_BITS((47 - 12) % 10))
116
117uintptr_t qemu_real_host_page_size;
118uintptr_t qemu_host_page_size;
119uintptr_t qemu_host_page_mask;
120
121/* This is a multi-level map on the virtual address space.
122 The bottom level has pointers to PageDesc. */
123static void *l1_map[V_L1_SIZE((target_ulong)1 << ((47 - 12) % 10))];
124
125/* code generation context */
126TCGContext tcg_ctx;
127
128static void tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
129 tb_page_addr_t phys_page2);
130static TranslationBlock *tb_find_pc(uintptr_t tc_ptr);
131
132void cpu_gen_init(void)
133{
134 tcg_context_init(&tcg_ctx);
135}
136
137/* return non zero if the very first instruction is invalid so that
138 the virtual CPU can trigger an exception.
139
140 '*gen_code_size_ptr' contains the size of the generated code (host
141 code).
142*/
143int cpu_gen_codecpu_x86_gen_code(CPUArchStatestruct CPUX86State *env, TranslationBlock *tb, int *gen_code_size_ptr)
144{
145 TCGContext *s = &tcg_ctx;
146 uint8_t *gen_code_buf;
147 int gen_code_size;
148#ifdef CONFIG_PROFILER
149 int64_t ti;
150#endif
151
152#ifdef CONFIG_PROFILER
153 s->tb_count1++; /* includes aborted translations because of
154 exceptions */
155 ti = profile_getclock();
156#endif
157 tcg_func_start(s);
158
159 gen_intermediate_code(env, tb);
160
161 /* generate machine code */
162 gen_code_buf = tb->tc_ptr;
163 tb->tb_next_offset[0] = 0xffff;
164 tb->tb_next_offset[1] = 0xffff;
165 s->tb_next_offset = tb->tb_next_offset;
166#ifdef USE_DIRECT_JUMP
167 s->tb_jmp_offset = tb->tb_jmp_offset;
168 s->tb_next = NULL((void*)0);
169#else
170 s->tb_jmp_offset = NULL((void*)0);
171 s->tb_next = tb->tb_next;
172#endif
173
174#ifdef CONFIG_PROFILER
175 s->tb_count++;
176 s->interm_time += profile_getclock() - ti;
177 s->code_time -= profile_getclock();
178#endif
179 gen_code_size = tcg_gen_code(s, gen_code_buf);
180 *gen_code_size_ptr = gen_code_size;
181#ifdef CONFIG_PROFILER
182 s->code_time += profile_getclock();
183 s->code_in_len += tb->size;
184 s->code_out_len += gen_code_size;
185#endif
186
187#ifdef DEBUG_DISAS
188 if (qemu_loglevel_mask(CPU_LOG_TB_OUT_ASM(1 << 0))) {
189 qemu_log("OUT: [size=%d]\n", *gen_code_size_ptr);
190 log_disas(tb->tc_ptr, *gen_code_size_ptr);
191 qemu_log("\n");
192 qemu_log_flush();
193 }
194#endif
195 return 0;
196}
197
198/* The cpu state corresponding to 'searched_pc' is restored.
199 */
200static int cpu_restore_state_from_tb(TranslationBlock *tb, CPUArchStatestruct CPUX86State *env,
201 uintptr_t searched_pc)
202{
203 TCGContext *s = &tcg_ctx;
204 int j;
205 uintptr_t tc_ptr;
206#ifdef CONFIG_PROFILER
207 int64_t ti;
208#endif
209
210#ifdef CONFIG_PROFILER
211 ti = profile_getclock();
212#endif
213 tcg_func_start(s);
214
215 gen_intermediate_code_pc(env, tb);
216
217 if (use_icount) {
218 /* Reset the cycle counter to the start of the block. */
219 env->icount_decr.u16.low += tb->icount;
220 /* Clear the IO flag. */
221 env->can_do_io = 0;
222 }
223
224 /* find opc index corresponding to search_pc */
225 tc_ptr = (uintptr_t)tb->tc_ptr;
226 if (searched_pc < tc_ptr)
227 return -1;
228
229 s->tb_next_offset = tb->tb_next_offset;
230#ifdef USE_DIRECT_JUMP
231 s->tb_jmp_offset = tb->tb_jmp_offset;
232 s->tb_next = NULL((void*)0);
233#else
234 s->tb_jmp_offset = NULL((void*)0);
235 s->tb_next = tb->tb_next;
236#endif
237 j = tcg_gen_code_search_pc(s, (uint8_t *)tc_ptr, searched_pc - tc_ptr);
238 if (j < 0)
239 return -1;
240 /* now find start of instruction before */
241 while (s->gen_opc_instr_start[j] == 0) {
242 j--;
243 }
244 env->icount_decr.u16.low -= s->gen_opc_icount[j];
245
246 restore_state_to_opc(env, tb, j);
247
248#ifdef CONFIG_PROFILER
249 s->restore_time += profile_getclock() - ti;
250 s->restore_count++;
251#endif
252 return 0;
253}
254
255bool_Bool cpu_restore_state(CPUArchStatestruct CPUX86State *env, uintptr_t retaddr)
256{
257 TranslationBlock *tb;
258
259 tb = tb_find_pc(retaddr);
260 if (tb) {
261 cpu_restore_state_from_tb(tb, env, retaddr);
262 return true1;
263 }
264 return false0;
265}
266
267#ifdef _WIN32
268static inline void map_exec(void *addr, long size)
269{
270 DWORD old_protect;
271 VirtualProtect(addr, size,
272 PAGE_EXECUTE_READWRITE, &old_protect);
273}
274#else
275static inline void map_exec(void *addr, long size)
276{
277 unsigned long start, end, page_size;
278
279 page_size = getpagesize();
280 start = (unsigned long)addr;
281 start &= ~(page_size - 1);
282
283 end = (unsigned long)addr + size;
284 end += page_size - 1;
285 end &= ~(page_size - 1);
286
287 mprotect((void *)start, end - start,
288 PROT_READ0x1 | PROT_WRITE0x2 | PROT_EXEC0x4);
289}
290#endif
291
292static void page_init(void)
293{
294 /* NOTE: we can always suppose that qemu_host_page_size >=
295 TARGET_PAGE_SIZE */
296#ifdef _WIN32
297 {
298 SYSTEM_INFO system_info;
299
300 GetSystemInfo(&system_info);
301 qemu_real_host_page_size = system_info.dwPageSize;
302 }
303#else
304 qemu_real_host_page_size = getpagesize();
305#endif
306 if (qemu_host_page_size == 0) {
307 qemu_host_page_size = qemu_real_host_page_size;
308 }
309 if (qemu_host_page_size < TARGET_PAGE_SIZE(1 << 12)) {
310 qemu_host_page_size = TARGET_PAGE_SIZE(1 << 12);
311 }
312 qemu_host_page_mask = ~(qemu_host_page_size - 1);
313
314#if defined(CONFIG_BSD) && defined(CONFIG_USER_ONLY1)
315 {
316#ifdef HAVE_KINFO_GETVMMAP
317 struct kinfo_vmentry *freep;
318 int i, cnt;
319
320 freep = kinfo_getvmmap(getpid(), &cnt);
321 if (freep) {
322 mmap_lock();
323 for (i = 0; i < cnt; i++) {
324 unsigned long startaddr, endaddr;
325
326 startaddr = freep[i].kve_start;
327 endaddr = freep[i].kve_end;
328 if (h2g_valid(startaddr)({ unsigned long __guest = (unsigned long)(startaddr) - guest_base
; (__guest < (1ul << 47)) && (!reserved_va ||
(__guest < reserved_va)); })) {
329 startaddr = h2g(startaddr)({ ((({ unsigned long __guest = (unsigned long)(startaddr) - guest_base
; (__guest < (1ul << 47)) && (!reserved_va ||
(__guest < reserved_va)); })) ? (void) (0) : __assert_fail
("({ unsigned long __guest = (unsigned long)(startaddr) - guest_base; (__guest < (1ul << 47)) && (!reserved_va || (__guest < reserved_va)); })"
, "/home/stefan/src/qemu/qemu.org/qemu/translate-all.c", 329,
__PRETTY_FUNCTION__)); ({ unsigned long __ret = (unsigned long
)(startaddr) - guest_base; (abi_ulong)__ret; }); }) & TARGET_PAGE_MASK~((1 << 12) - 1);
330
331 if (h2g_valid(endaddr)({ unsigned long __guest = (unsigned long)(endaddr) - guest_base
; (__guest < (1ul << 47)) && (!reserved_va ||
(__guest < reserved_va)); })) {
332 endaddr = h2g(endaddr)({ ((({ unsigned long __guest = (unsigned long)(endaddr) - guest_base
; (__guest < (1ul << 47)) && (!reserved_va ||
(__guest < reserved_va)); })) ? (void) (0) : __assert_fail
("({ unsigned long __guest = (unsigned long)(endaddr) - guest_base; (__guest < (1ul << 47)) && (!reserved_va || (__guest < reserved_va)); })"
, "/home/stefan/src/qemu/qemu.org/qemu/translate-all.c", 332,
__PRETTY_FUNCTION__)); ({ unsigned long __ret = (unsigned long
)(endaddr) - guest_base; (abi_ulong)__ret; }); });
333 page_set_flags(startaddr, endaddr, PAGE_RESERVED);
334 } else {
335#if TARGET_ABI_BITS64 <= L1_MAP_ADDR_SPACE_BITS47
336 endaddr = ~0ul;
337 page_set_flags(startaddr, endaddr, PAGE_RESERVED);
338#endif
339 }
340 }
341 }
342 free(freep);
343 mmap_unlock();
344 }
345#else
346 FILE *f;
347
348 last_brk = (unsigned long)sbrk(0);
349
350 f = fopen("/compat/linux/proc/self/maps", "r");
351 if (f) {
352 mmap_lock();
353
354 do {
355 unsigned long startaddr, endaddr;
356 int n;
357
358 n = fscanf(f, "%lx-%lx %*[^\n]\n", &startaddr, &endaddr);
359
360 if (n == 2 && h2g_valid(startaddr)({ unsigned long __guest = (unsigned long)(startaddr) - guest_base
; (__guest < (1ul << 47)) && (!reserved_va ||
(__guest < reserved_va)); })) {
361 startaddr = h2g(startaddr)({ ((({ unsigned long __guest = (unsigned long)(startaddr) - guest_base
; (__guest < (1ul << 47)) && (!reserved_va ||
(__guest < reserved_va)); })) ? (void) (0) : __assert_fail
("({ unsigned long __guest = (unsigned long)(startaddr) - guest_base; (__guest < (1ul << 47)) && (!reserved_va || (__guest < reserved_va)); })"
, "/home/stefan/src/qemu/qemu.org/qemu/translate-all.c", 361,
__PRETTY_FUNCTION__)); ({ unsigned long __ret = (unsigned long
)(startaddr) - guest_base; (abi_ulong)__ret; }); }) & TARGET_PAGE_MASK~((1 << 12) - 1);
362
363 if (h2g_valid(endaddr)({ unsigned long __guest = (unsigned long)(endaddr) - guest_base
; (__guest < (1ul << 47)) && (!reserved_va ||
(__guest < reserved_va)); })) {
364 endaddr = h2g(endaddr)({ ((({ unsigned long __guest = (unsigned long)(endaddr) - guest_base
; (__guest < (1ul << 47)) && (!reserved_va ||
(__guest < reserved_va)); })) ? (void) (0) : __assert_fail
("({ unsigned long __guest = (unsigned long)(endaddr) - guest_base; (__guest < (1ul << 47)) && (!reserved_va || (__guest < reserved_va)); })"
, "/home/stefan/src/qemu/qemu.org/qemu/translate-all.c", 364,
__PRETTY_FUNCTION__)); ({ unsigned long __ret = (unsigned long
)(endaddr) - guest_base; (abi_ulong)__ret; }); });
365 } else {
366 endaddr = ~0ul;
367 }
368 page_set_flags(startaddr, endaddr, PAGE_RESERVED);
369 }
370 } while (!feof(f));
371
372 fclose(f);
373 mmap_unlock();
374 }
375#endif
376 }
377#endif
378}
379
380static PageDesc *page_find_alloc(tb_page_addr_t index, int alloc)
381{
382 PageDesc *pd;
383 void **lp;
384 int i;
385
386#if defined(CONFIG_USER_ONLY1)
387 /* We can't use g_malloc because it may recurse into a locked mutex. */
388# define ALLOC(P, SIZE) \
389 do { \
390 P = mmap(NULL((void*)0), SIZE, PROT_READ0x1 | PROT_WRITE0x2, \
391 MAP_PRIVATE0x02 | MAP_ANONYMOUS0x20, -1, 0); \
392 } while (0)
393#else
394# define ALLOC(P, SIZE) \
395 do { P = g_malloc0(SIZE); } while (0)
396#endif
397
398 /* Level 1. Always allocated. */
399 lp = l1_map + ((index >> V_L1_SHIFT(47 - 12 - ((47 - 12) % 10))) & (V_L1_SIZE((target_ulong)1 << ((47 - 12) % 10)) - 1));
400
401 /* Level 2..N-1. */
402 for (i = V_L1_SHIFT(47 - 12 - ((47 - 12) % 10)) / V_L2_BITS10 - 1; i > 0; i--) {
403 void **p = *lp;
404
405 if (p == NULL((void*)0)) {
406 if (!alloc) {
407 return NULL((void*)0);
408 }
409 ALLOC(p, sizeof(void *) * V_L2_SIZE(1 << 10));
410 *lp = p;
411 }
412
413 lp = p + ((index >> (i * V_L2_BITS10)) & (V_L2_SIZE(1 << 10) - 1));
414 }
415
416 pd = *lp;
417 if (pd == NULL((void*)0)) {
418 if (!alloc) {
419 return NULL((void*)0);
420 }
421 ALLOC(pd, sizeof(PageDesc) * V_L2_SIZE(1 << 10));
422 *lp = pd;
423 }
424
425#undef ALLOC
426
427 return pd + (index & (V_L2_SIZE(1 << 10) - 1));
428}
429
430static inline PageDesc *page_find(tb_page_addr_t index)
431{
432 return page_find_alloc(index, 0);
433}
434
435#if !defined(CONFIG_USER_ONLY1)
436#define mmap_lock() do { } while (0)
437#define mmap_unlock() do { } while (0)
438#endif
439
440#if defined(CONFIG_USER_ONLY1)
441/* Currently it is not recommended to allocate big chunks of data in
442 user mode. It will change when a dedicated libc will be used. */
443/* ??? 64-bit hosts ought to have no problem mmaping data outside the
444 region in which the guest needs to run. Revisit this. */
445#define USE_STATIC_CODE_GEN_BUFFER
446#endif
447
448/* ??? Should configure for this, not list operating systems here. */
449#if (defined(__linux__1) \
450 || defined(__FreeBSD__) || defined(__FreeBSD_kernel__) \
451 || defined(__DragonFly__) || defined(__OpenBSD__) \
452 || defined(__NetBSD__))
453# define USE_MMAP
454#endif
455
456/* Minimum size of the code gen buffer. This number is randomly chosen,
457 but not so small that we can't have a fair number of TB's live. */
458#define MIN_CODE_GEN_BUFFER_SIZE(1024u * 1024) (1024u * 1024)
459
460/* Maximum size of the code gen buffer we'd like to use. Unless otherwise
461 indicated, this is constrained by the range of direct branches on the
462 host cpu, as used by the TCG implementation of goto_tb. */
463#if defined(__x86_64__1)
464# define MAX_CODE_GEN_BUFFER_SIZE(2ul * 1024 * 1024 * 1024) (2ul * 1024 * 1024 * 1024)
465#elif defined(__sparc__)
466# define MAX_CODE_GEN_BUFFER_SIZE(2ul * 1024 * 1024 * 1024) (2ul * 1024 * 1024 * 1024)
467#elif defined(__aarch64__)
468# define MAX_CODE_GEN_BUFFER_SIZE(2ul * 1024 * 1024 * 1024) (128ul * 1024 * 1024)
469#elif defined(__arm__)
470# define MAX_CODE_GEN_BUFFER_SIZE(2ul * 1024 * 1024 * 1024) (16u * 1024 * 1024)
471#elif defined(__s390x__)
472 /* We have a +- 4GB range on the branches; leave some slop. */
473# define MAX_CODE_GEN_BUFFER_SIZE(2ul * 1024 * 1024 * 1024) (3ul * 1024 * 1024 * 1024)
474#else
475# define MAX_CODE_GEN_BUFFER_SIZE(2ul * 1024 * 1024 * 1024) ((size_t)-1)
476#endif
477
478#define DEFAULT_CODE_GEN_BUFFER_SIZE_1(32u * 1024 * 1024) (32u * 1024 * 1024)
479
480#define DEFAULT_CODE_GEN_BUFFER_SIZE((32u * 1024 * 1024) < (2ul * 1024 * 1024 * 1024) ? (32u *
1024 * 1024) : (2ul * 1024 * 1024 * 1024)) \
481 (DEFAULT_CODE_GEN_BUFFER_SIZE_1(32u * 1024 * 1024) < MAX_CODE_GEN_BUFFER_SIZE(2ul * 1024 * 1024 * 1024) \
482 ? DEFAULT_CODE_GEN_BUFFER_SIZE_1(32u * 1024 * 1024) : MAX_CODE_GEN_BUFFER_SIZE(2ul * 1024 * 1024 * 1024))
483
484static inline size_t size_code_gen_buffer(size_t tb_size)
485{
486 /* Size the buffer. */
487 if (tb_size == 0) {
488#ifdef USE_STATIC_CODE_GEN_BUFFER
489 tb_size = DEFAULT_CODE_GEN_BUFFER_SIZE((32u * 1024 * 1024) < (2ul * 1024 * 1024 * 1024) ? (32u *
1024 * 1024) : (2ul * 1024 * 1024 * 1024));
490#else
491 /* ??? Needs adjustments. */
492 /* ??? If we relax the requirement that CONFIG_USER_ONLY use the
493 static buffer, we could size this on RESERVED_VA, on the text
494 segment size of the executable, or continue to use the default. */
495 tb_size = (unsigned long)(ram_size / 4);
496#endif
497 }
498 if (tb_size < MIN_CODE_GEN_BUFFER_SIZE(1024u * 1024)) {
499 tb_size = MIN_CODE_GEN_BUFFER_SIZE(1024u * 1024);
500 }
501 if (tb_size > MAX_CODE_GEN_BUFFER_SIZE(2ul * 1024 * 1024 * 1024)) {
502 tb_size = MAX_CODE_GEN_BUFFER_SIZE(2ul * 1024 * 1024 * 1024);
503 }
504 tcg_ctx.code_gen_buffer_size = tb_size;
505 return tb_size;
506}
507
508#ifdef USE_STATIC_CODE_GEN_BUFFER
509static uint8_t static_code_gen_buffer[DEFAULT_CODE_GEN_BUFFER_SIZE((32u * 1024 * 1024) < (2ul * 1024 * 1024 * 1024) ? (32u *
1024 * 1024) : (2ul * 1024 * 1024 * 1024))]
510 __attribute__((aligned(CODE_GEN_ALIGN16)));
511
512static inline void *alloc_code_gen_buffer(void)
513{
514 map_exec(static_code_gen_buffer, tcg_ctx.code_gen_buffer_size);
515 return static_code_gen_buffer;
516}
517#elif defined(USE_MMAP)
518static inline void *alloc_code_gen_buffer(void)
519{
520 int flags = MAP_PRIVATE0x02 | MAP_ANONYMOUS0x20;
521 uintptr_t start = 0;
522 void *buf;
523
524 /* Constrain the position of the buffer based on the host cpu.
525 Note that these addresses are chosen in concert with the
526 addresses assigned in the relevant linker script file. */
527# if defined(__PIE__) || defined(__PIC__)
528 /* Don't bother setting a preferred location if we're building
529 a position-independent executable. We're more likely to get
530 an address near the main executable if we let the kernel
531 choose the address. */
532# elif defined(__x86_64__1) && defined(MAP_32BIT0x40)
533 /* Force the memory down into low memory with the executable.
534 Leave the choice of exact location with the kernel. */
535 flags |= MAP_32BIT0x40;
536 /* Cannot expect to map more than 800MB in low memory. */
537 if (tcg_ctx.code_gen_buffer_size > 800u * 1024 * 1024) {
538 tcg_ctx.code_gen_buffer_size = 800u * 1024 * 1024;
539 }
540# elif defined(__sparc__)
541 start = 0x40000000ul;
542# elif defined(__s390x__)
543 start = 0x90000000ul;
544# endif
545
546 buf = mmap((void *)start, tcg_ctx.code_gen_buffer_size,
547 PROT_WRITE0x2 | PROT_READ0x1 | PROT_EXEC0x4, flags, -1, 0);
548 return buf == MAP_FAILED((void *) -1) ? NULL((void*)0) : buf;
549}
550#else
551static inline void *alloc_code_gen_buffer(void)
552{
553 void *buf = g_malloc(tcg_ctx.code_gen_buffer_size);
554
555 if (buf) {
556 map_exec(buf, tcg_ctx.code_gen_buffer_size);
557 }
558 return buf;
559}
560#endif /* USE_STATIC_CODE_GEN_BUFFER, USE_MMAP */
561
562static inline void code_gen_alloc(size_t tb_size)
563{
564 tcg_ctx.code_gen_buffer_size = size_code_gen_buffer(tb_size);
565 tcg_ctx.code_gen_buffer = alloc_code_gen_buffer();
566 if (tcg_ctx.code_gen_buffer == NULL((void*)0)) {
567 fprintf(stderrstderr, "Could not allocate dynamic translator buffer\n");
568 exit(1);
569 }
570
571 qemu_madvise(tcg_ctx.code_gen_buffer, tcg_ctx.code_gen_buffer_size,
572 QEMU_MADV_HUGEPAGE14);
573
574 /* Steal room for the prologue at the end of the buffer. This ensures
575 (via the MAX_CODE_GEN_BUFFER_SIZE limits above) that direct branches
576 from TB's to the prologue are going to be in range. It also means
577 that we don't need to mark (additional) portions of the data segment
578 as executable. */
579 tcg_ctx.code_gen_prologue = tcg_ctx.code_gen_buffer +
580 tcg_ctx.code_gen_buffer_size - 1024;
581 tcg_ctx.code_gen_buffer_size -= 1024;
582
583 tcg_ctx.code_gen_buffer_max_size = tcg_ctx.code_gen_buffer_size -
584 (TCG_MAX_OP_SIZE192 * OPC_BUF_SIZE640);
585 tcg_ctx.code_gen_max_blocks = tcg_ctx.code_gen_buffer_size /
586 CODE_GEN_AVG_BLOCK_SIZE64;
587 tcg_ctx.tb_ctx.tbs =
588 g_malloc(tcg_ctx.code_gen_max_blocks * sizeof(TranslationBlock));
589}
590
591/* Must be called before using the QEMU cpus. 'tb_size' is the size
592 (in bytes) allocated to the translation buffer. Zero means default
593 size. */
594void tcg_exec_init(unsigned long tb_size)
595{
596 cpu_gen_init();
597 code_gen_alloc(tb_size);
598 tcg_ctx.code_gen_ptr = tcg_ctx.code_gen_buffer;
599 tcg_register_jit(tcg_ctx.code_gen_buffer, tcg_ctx.code_gen_buffer_size);
600 page_init();
601#if !defined(CONFIG_USER_ONLY1) || !defined(CONFIG_USE_GUEST_BASE1)
602 /* There's no guest base to take into account, so go ahead and
603 initialize the prologue now. */
604 tcg_prologue_init(&tcg_ctx);
605#endif
606}
607
608bool_Bool tcg_enabled(void)
609{
610 return tcg_ctx.code_gen_buffer != NULL((void*)0);
611}
612
613/* Allocate a new translation block. Flush the translation buffer if
614 too many translation blocks or too much generated code. */
615static TranslationBlock *tb_alloc(target_ulong pc)
616{
617 TranslationBlock *tb;
618
619 if (tcg_ctx.tb_ctx.nb_tbs >= tcg_ctx.code_gen_max_blocks ||
620 (tcg_ctx.code_gen_ptr - tcg_ctx.code_gen_buffer) >=
621 tcg_ctx.code_gen_buffer_max_size) {
622 return NULL((void*)0);
623 }
624 tb = &tcg_ctx.tb_ctx.tbs[tcg_ctx.tb_ctx.nb_tbs++];
625 tb->pc = pc;
626 tb->cflags = 0;
627 return tb;
628}
629
630void tb_free(TranslationBlock *tb)
631{
632 /* In practice this is mostly used for single use temporary TB
633 Ignore the hard cases and just back up if this TB happens to
634 be the last one generated. */
635 if (tcg_ctx.tb_ctx.nb_tbs > 0 &&
636 tb == &tcg_ctx.tb_ctx.tbs[tcg_ctx.tb_ctx.nb_tbs - 1]) {
637 tcg_ctx.code_gen_ptr = tb->tc_ptr;
638 tcg_ctx.tb_ctx.nb_tbs--;
639 }
640}
641
642static inline void invalidate_page_bitmap(PageDesc *p)
643{
644 if (p->code_bitmap) {
645 g_free(p->code_bitmap);
646 p->code_bitmap = NULL((void*)0);
647 }
648 p->code_write_count = 0;
649}
650
651/* Set to NULL all the 'first_tb' fields in all PageDescs. */
652static void page_flush_tb_1(int level, void **lp)
653{
654 int i;
655
656 if (*lp == NULL((void*)0)) {
657 return;
658 }
659 if (level == 0) {
660 PageDesc *pd = *lp;
661
662 for (i = 0; i < V_L2_SIZE(1 << 10); ++i) {
663 pd[i].first_tb = NULL((void*)0);
664 invalidate_page_bitmap(pd + i);
665 }
666 } else {
667 void **pp = *lp;
668
669 for (i = 0; i < V_L2_SIZE(1 << 10); ++i) {
670 page_flush_tb_1(level - 1, pp + i);
671 }
672 }
673}
674
675static void page_flush_tb(void)
676{
677 int i;
678
679 for (i = 0; i < V_L1_SIZE((target_ulong)1 << ((47 - 12) % 10)); i++) {
680 page_flush_tb_1(V_L1_SHIFT(47 - 12 - ((47 - 12) % 10)) / V_L2_BITS10 - 1, l1_map + i);
681 }
682}
683
684/* flush all the translation blocks */
685/* XXX: tb_flush is currently not thread safe */
686void tb_flush(CPUArchStatestruct CPUX86State *env1)
687{
688 CPUState *cpu;
689
690#if defined(DEBUG_FLUSH)
691 printf("qemu: flush code_size=%ld nb_tbs=%d avg_tb_size=%ld\n",
692 (unsigned long)(tcg_ctx.code_gen_ptr - tcg_ctx.code_gen_buffer),
693 tcg_ctx.tb_ctx.nb_tbs, tcg_ctx.tb_ctx.nb_tbs > 0 ?
694 ((unsigned long)(tcg_ctx.code_gen_ptr - tcg_ctx.code_gen_buffer)) /
695 tcg_ctx.tb_ctx.nb_tbs : 0);
696#endif
697 if ((unsigned long)(tcg_ctx.code_gen_ptr - tcg_ctx.code_gen_buffer)
698 > tcg_ctx.code_gen_buffer_size) {
699 cpu_abort(env1, "Internal error: code buffer overflow\n");
700 }
701 tcg_ctx.tb_ctx.nb_tbs = 0;
702
703 CPU_FOREACH(cpu)for ((cpu) = ((&cpus)->tqh_first); (cpu); (cpu) = ((cpu
)->node.tqe_next)) {
704 CPUArchStatestruct CPUX86State *env = cpu->env_ptr;
705
706 memset(env->tb_jmp_cache, 0, sizeof(env->tb_jmp_cache));
707 }
708
709 memset(tcg_ctx.tb_ctx.tb_phys_hash, 0, sizeof(tcg_ctx.tb_ctx.tb_phys_hash));
710 page_flush_tb();
711
712 tcg_ctx.code_gen_ptr = tcg_ctx.code_gen_buffer;
713 /* XXX: flush processor icache at this point if cache flush is
714 expensive */
715 tcg_ctx.tb_ctx.tb_flush_count++;
716}
717
718#ifdef DEBUG_TB_CHECK
719
720static void tb_invalidate_check(target_ulong address)
721{
722 TranslationBlock *tb;
723 int i;
724
725 address &= TARGET_PAGE_MASK~((1 << 12) - 1);
726 for (i = 0; i < CODE_GEN_PHYS_HASH_SIZE(1 << 15); i++) {
727 for (tb = tb_ctx.tb_phys_hash[i]; tb != NULL((void*)0); tb = tb->phys_hash_next) {
728 if (!(address + TARGET_PAGE_SIZE(1 << 12) <= tb->pc ||
729 address >= tb->pc + tb->size)) {
730 printf("ERROR invalidate: address=" TARGET_FMT_lx"%016" "l" "x"
731 " PC=%08lx size=%04x\n",
732 address, (long)tb->pc, tb->size);
733 }
734 }
735 }
736}
737
738/* verify that all the pages have correct rights for code */
739static void tb_page_check(void)
740{
741 TranslationBlock *tb;
742 int i, flags1, flags2;
743
744 for (i = 0; i < CODE_GEN_PHYS_HASH_SIZE(1 << 15); i++) {
745 for (tb = tcg_ctx.tb_ctx.tb_phys_hash[i]; tb != NULL((void*)0);
746 tb = tb->phys_hash_next) {
747 flags1 = page_get_flags(tb->pc);
748 flags2 = page_get_flags(tb->pc + tb->size - 1);
749 if ((flags1 & PAGE_WRITE0x0002) || (flags2 & PAGE_WRITE0x0002)) {
750 printf("ERROR page flags: PC=%08lx size=%04x f1=%x f2=%x\n",
751 (long)tb->pc, tb->size, flags1, flags2);
752 }
753 }
754 }
755}
756
757#endif
758
759static inline void tb_hash_remove(TranslationBlock **ptb, TranslationBlock *tb)
760{
761 TranslationBlock *tb1;
762
763 for (;;) {
764 tb1 = *ptb;
765 if (tb1 == tb) {
766 *ptb = tb1->phys_hash_next;
767 break;
768 }
769 ptb = &tb1->phys_hash_next;
770 }
771}
772
773static inline void tb_page_remove(TranslationBlock **ptb, TranslationBlock *tb)
774{
775 TranslationBlock *tb1;
776 unsigned int n1;
777
778 for (;;) {
779 tb1 = *ptb;
780 n1 = (uintptr_t)tb1 & 3;
781 tb1 = (TranslationBlock *)((uintptr_t)tb1 & ~3);
782 if (tb1 == tb) {
783 *ptb = tb1->page_next[n1];
784 break;
785 }
786 ptb = &tb1->page_next[n1];
787 }
788}
789
790static inline void tb_jmp_remove(TranslationBlock *tb, int n)
791{
792 TranslationBlock *tb1, **ptb;
793 unsigned int n1;
794
795 ptb = &tb->jmp_next[n];
796 tb1 = *ptb;
797 if (tb1) {
798 /* find tb(n) in circular list */
799 for (;;) {
800 tb1 = *ptb;
801 n1 = (uintptr_t)tb1 & 3;
802 tb1 = (TranslationBlock *)((uintptr_t)tb1 & ~3);
803 if (n1 == n && tb1 == tb) {
804 break;
805 }
806 if (n1 == 2) {
807 ptb = &tb1->jmp_first;
808 } else {
809 ptb = &tb1->jmp_next[n1];
810 }
811 }
812 /* now we can suppress tb(n) from the list */
813 *ptb = tb->jmp_next[n];
814
815 tb->jmp_next[n] = NULL((void*)0);
816 }
817}
818
819/* reset the jump entry 'n' of a TB so that it is not chained to
820 another TB */
821static inline void tb_reset_jump(TranslationBlock *tb, int n)
822{
823 tb_set_jmp_target(tb, n, (uintptr_t)(tb->tc_ptr + tb->tb_next_offset[n]));
824}
825
826/* invalidate one TB */
827void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr)
828{
829 CPUState *cpu;
830 PageDesc *p;
831 unsigned int h, n1;
832 tb_page_addr_t phys_pc;
833 TranslationBlock *tb1, *tb2;
834
835 /* remove the TB from the hash list */
836 phys_pc = tb->page_addr[0] + (tb->pc & ~TARGET_PAGE_MASK~((1 << 12) - 1));
837 h = tb_phys_hash_func(phys_pc);
838 tb_hash_remove(&tcg_ctx.tb_ctx.tb_phys_hash[h], tb);
839
840 /* remove the TB from the page list */
841 if (tb->page_addr[0] != page_addr) {
842 p = page_find(tb->page_addr[0] >> TARGET_PAGE_BITS12);
843 tb_page_remove(&p->first_tb, tb);
844 invalidate_page_bitmap(p);
845 }
846 if (tb->page_addr[1] != -1 && tb->page_addr[1] != page_addr) {
847 p = page_find(tb->page_addr[1] >> TARGET_PAGE_BITS12);
848 tb_page_remove(&p->first_tb, tb);
849 invalidate_page_bitmap(p);
850 }
851
852 tcg_ctx.tb_ctx.tb_invalidated_flag = 1;
853
854 /* remove the TB from the hash list */
855 h = tb_jmp_cache_hash_func(tb->pc);
856 CPU_FOREACH(cpu)for ((cpu) = ((&cpus)->tqh_first); (cpu); (cpu) = ((cpu
)->node.tqe_next)) {
857 CPUArchStatestruct CPUX86State *env = cpu->env_ptr;
858
859 if (env->tb_jmp_cache[h] == tb) {
860 env->tb_jmp_cache[h] = NULL((void*)0);
861 }
862 }
863
864 /* suppress this TB from the two jump lists */
865 tb_jmp_remove(tb, 0);
866 tb_jmp_remove(tb, 1);
867
868 /* suppress any remaining jumps to this TB */
869 tb1 = tb->jmp_first;
870 for (;;) {
871 n1 = (uintptr_t)tb1 & 3;
872 if (n1 == 2) {
873 break;
874 }
875 tb1 = (TranslationBlock *)((uintptr_t)tb1 & ~3);
876 tb2 = tb1->jmp_next[n1];
877 tb_reset_jump(tb1, n1);
878 tb1->jmp_next[n1] = NULL((void*)0);
879 tb1 = tb2;
880 }
881 tb->jmp_first = (TranslationBlock *)((uintptr_t)tb | 2); /* fail safe */
882
883 tcg_ctx.tb_ctx.tb_phys_invalidate_count++;
884}
885
886static inline void set_bits(uint8_t *tab, int start, int len)
887{
888 int end, mask, end1;
889
890 end = start + len;
891 tab += start >> 3;
892 mask = 0xff << (start & 7);
893 if ((start & ~7) == (end & ~7)) {
894 if (start < end) {
895 mask &= ~(0xff << (end & 7));
896 *tab |= mask;
897 }
898 } else {
899 *tab++ |= mask;
900 start = (start + 8) & ~7;
901 end1 = end & ~7;
902 while (start < end1) {
903 *tab++ = 0xff;
904 start += 8;
905 }
906 if (start < end) {
907 mask = ~(0xff << (end & 7));
908 *tab |= mask;
909 }
910 }
911}
912
913static void build_page_bitmap(PageDesc *p)
914{
915 int n, tb_start, tb_end;
916 TranslationBlock *tb;
917
918 p->code_bitmap = g_malloc0(TARGET_PAGE_SIZE(1 << 12) / 8);
919
920 tb = p->first_tb;
921 while (tb != NULL((void*)0)) {
922 n = (uintptr_t)tb & 3;
923 tb = (TranslationBlock *)((uintptr_t)tb & ~3);
924 /* NOTE: this is subtle as a TB may span two physical pages */
925 if (n == 0) {
926 /* NOTE: tb_end may be after the end of the page, but
927 it is not a problem */
928 tb_start = tb->pc & ~TARGET_PAGE_MASK~((1 << 12) - 1);
929 tb_end = tb_start + tb->size;
930 if (tb_end > TARGET_PAGE_SIZE(1 << 12)) {
931 tb_end = TARGET_PAGE_SIZE(1 << 12);
932 }
933 } else {
934 tb_start = 0;
935 tb_end = ((tb->pc + tb->size) & ~TARGET_PAGE_MASK~((1 << 12) - 1));
936 }
937 set_bits(p->code_bitmap, tb_start, tb_end - tb_start);
938 tb = tb->page_next[n];
939 }
940}
941
942TranslationBlock *tb_gen_code(CPUArchStatestruct CPUX86State *env,
943 target_ulong pc, target_ulong cs_base,
944 int flags, int cflags)
945{
946 TranslationBlock *tb;
947 uint8_t *tc_ptr;
948 tb_page_addr_t phys_pc, phys_page2;
949 target_ulong virt_page2;
950 int code_gen_size;
951
952 phys_pc = get_page_addr_code(env, pc);
953 tb = tb_alloc(pc);
954 if (!tb) {
955 /* flush must be done */
956 tb_flush(env);
957 /* cannot fail at this point */
958 tb = tb_alloc(pc);
959 /* Don't forget to invalidate previous TB info. */
960 tcg_ctx.tb_ctx.tb_invalidated_flag = 1;
961 }
962 tc_ptr = tcg_ctx.code_gen_ptr;
963 tb->tc_ptr = tc_ptr;
964 tb->cs_base = cs_base;
965 tb->flags = flags;
966 tb->cflags = cflags;
967 cpu_gen_codecpu_x86_gen_code(env, tb, &code_gen_size);
968 tcg_ctx.code_gen_ptr = (void *)(((uintptr_t)tcg_ctx.code_gen_ptr +
969 code_gen_size + CODE_GEN_ALIGN16 - 1) & ~(CODE_GEN_ALIGN16 - 1));
970
971 /* check next page if needed */
972 virt_page2 = (pc + tb->size - 1) & TARGET_PAGE_MASK~((1 << 12) - 1);
973 phys_page2 = -1;
974 if ((pc & TARGET_PAGE_MASK~((1 << 12) - 1)) != virt_page2) {
975 phys_page2 = get_page_addr_code(env, virt_page2);
976 }
977 tb_link_page(tb, phys_pc, phys_page2);
978 return tb;
979}
980
981/*
982 * Invalidate all TBs which intersect with the target physical address range
983 * [start;end[. NOTE: start and end may refer to *different* physical pages.
984 * 'is_cpu_write_access' should be true if called from a real cpu write
985 * access: the virtual CPU will exit the current TB if code is modified inside
986 * this TB.
987 */
988void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t end,
989 int is_cpu_write_access)
990{
991 while (start < end) {
992 tb_invalidate_phys_page_range(start, end, is_cpu_write_access);
993 start &= TARGET_PAGE_MASK~((1 << 12) - 1);
994 start += TARGET_PAGE_SIZE(1 << 12);
995 }
996}
997
998/*
999 * Invalidate all TBs which intersect with the target physical address range
1000 * [start;end[. NOTE: start and end must refer to the *same* physical page.
1001 * 'is_cpu_write_access' should be true if called from a real cpu write
1002 * access: the virtual CPU will exit the current TB if code is modified inside
1003 * this TB.
1004 */
1005void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end,
1006 int is_cpu_write_access)
1007{
1008 TranslationBlock *tb, *tb_next, *saved_tb;
1009 CPUState *cpu = current_cputls__current_cpu;
1010#if defined(TARGET_HAS_PRECISE_SMC) || !defined(CONFIG_USER_ONLY1)
1011 CPUArchStatestruct CPUX86State *env = NULL((void*)0);
1012#endif
1013 tb_page_addr_t tb_start, tb_end;
1014 PageDesc *p;
1015 int n;
1016#ifdef TARGET_HAS_PRECISE_SMC
1017 int current_tb_not_found = is_cpu_write_access;
1018 TranslationBlock *current_tb = NULL((void*)0);
1019 int current_tb_modified = 0;
1020 target_ulong current_pc = 0;
1021 target_ulong current_cs_base = 0;
1022 int current_flags = 0;
1023#endif /* TARGET_HAS_PRECISE_SMC */
1024
1025 p = page_find(start >> TARGET_PAGE_BITS12);
1026 if (!p) {
1027 return;
1028 }
1029 if (!p->code_bitmap &&
1030 ++p->code_write_count >= SMC_BITMAP_USE_THRESHOLD10 &&
1031 is_cpu_write_access) {
1032 /* build code bitmap */
1033 build_page_bitmap(p);
1034 }
1035#if defined(TARGET_HAS_PRECISE_SMC) || !defined(CONFIG_USER_ONLY1)
1036 if (cpu != NULL((void*)0)) {
1037 env = cpu->env_ptr;
1038 }
1039#endif
1040
1041 /* we remove all the TBs in the range [start, end[ */
1042 /* XXX: see if in some cases it could be faster to invalidate all
1043 the code */
1044 tb = p->first_tb;
1045 while (tb != NULL((void*)0)) {
1046 n = (uintptr_t)tb & 3;
1047 tb = (TranslationBlock *)((uintptr_t)tb & ~3);
1048 tb_next = tb->page_next[n];
1049 /* NOTE: this is subtle as a TB may span two physical pages */
1050 if (n == 0) {
1051 /* NOTE: tb_end may be after the end of the page, but
1052 it is not a problem */
1053 tb_start = tb->page_addr[0] + (tb->pc & ~TARGET_PAGE_MASK~((1 << 12) - 1));
1054 tb_end = tb_start + tb->size;
1055 } else {
1056 tb_start = tb->page_addr[1];
1057 tb_end = tb_start + ((tb->pc + tb->size) & ~TARGET_PAGE_MASK~((1 << 12) - 1));
1058 }
1059 if (!(tb_end <= start || tb_start >= end)) {
1060#ifdef TARGET_HAS_PRECISE_SMC
1061 if (current_tb_not_found) {
1062 current_tb_not_found = 0;
1063 current_tb = NULL((void*)0);
1064 if (env->mem_io_pc) {
1065 /* now we have a real cpu fault */
1066 current_tb = tb_find_pc(env->mem_io_pc);
1067 }
1068 }
1069 if (current_tb == tb &&
1070 (current_tb->cflags & CF_COUNT_MASK0x7fff) != 1) {
1071 /* If we are modifying the current TB, we must stop
1072 its execution. We could be more precise by checking
1073 that the modification is after the current PC, but it
1074 would require a specialized function to partially
1075 restore the CPU state */
1076
1077 current_tb_modified = 1;
1078 cpu_restore_state_from_tb(current_tb, env, env->mem_io_pc);
1079 cpu_get_tb_cpu_state(env, &current_pc, &current_cs_base,
1080 &current_flags);
1081 }
1082#endif /* TARGET_HAS_PRECISE_SMC */
1083 /* we need to do that to handle the case where a signal
1084 occurs while doing tb_phys_invalidate() */
1085 saved_tb = NULL((void*)0);
1086 if (cpu != NULL((void*)0)) {
1087 saved_tb = cpu->current_tb;
1088 cpu->current_tb = NULL((void*)0);
1089 }
1090 tb_phys_invalidate(tb, -1);
1091 if (cpu != NULL((void*)0)) {
1092 cpu->current_tb = saved_tb;
1093 if (cpu->interrupt_request && cpu->current_tb) {
1094 cpu_interrupt(cpu, cpu->interrupt_request);
1095 }
1096 }
1097 }
1098 tb = tb_next;
1099 }
1100#if !defined(CONFIG_USER_ONLY1)
1101 /* if no code remaining, no need to continue to use slow writes */
1102 if (!p->first_tb) {
1103 invalidate_page_bitmap(p);
1104 if (is_cpu_write_access) {
1105 tlb_unprotect_code_phys(env, start, env->mem_io_vaddr);
1106 }
1107 }
1108#endif
1109#ifdef TARGET_HAS_PRECISE_SMC
1110 if (current_tb_modified) {
1111 /* we generate a block containing just the instruction
1112 modifying the memory. It will ensure that it cannot modify
1113 itself */
1114 cpu->current_tb = NULL((void*)0);
1115 tb_gen_code(env, current_pc, current_cs_base, current_flags, 1);
1116 cpu_resume_from_signal(env, NULL((void*)0));
1117 }
1118#endif
1119}
1120
1121/* len must be <= 8 and start must be a multiple of len */
1122void tb_invalidate_phys_page_fast(tb_page_addr_t start, int len)
1123{
1124 PageDesc *p;
1125 int offset, b;
1126
1127#if 0
1128 if (1) {
1129 qemu_log("modifying code at 0x%x size=%d EIP=%x PC=%08x\n",
1130 cpu_single_env->mem_io_vaddr, len,
1131 cpu_single_env->eip,
1132 cpu_single_env->eip +
1133 (intptr_t)cpu_single_env->segs[R_CS1].base);
1134 }
1135#endif
1136 p = page_find(start >> TARGET_PAGE_BITS12);
1137 if (!p) {
1138 return;
1139 }
1140 if (p->code_bitmap) {
1141 offset = start & ~TARGET_PAGE_MASK~((1 << 12) - 1);
1142 b = p->code_bitmap[offset >> 3] >> (offset & 7);
1143 if (b & ((1 << len) - 1)) {
1144 goto do_invalidate;
1145 }
1146 } else {
1147 do_invalidate:
1148 tb_invalidate_phys_page_range(start, start + len, 1);
1149 }
1150}
1151
1152#if !defined(CONFIG_SOFTMMU)
1153static void tb_invalidate_phys_page(tb_page_addr_t addr,
1154 uintptr_t pc, void *puc,
1155 bool_Bool locked)
1156{
1157 TranslationBlock *tb;
1158 PageDesc *p;
1159 int n;
1160#ifdef TARGET_HAS_PRECISE_SMC
1161 TranslationBlock *current_tb = NULL((void*)0);
5
←
'current_tb' initialized to a null pointer value
→
1162 CPUState *cpu = current_cputls__current_cpu;
1163 CPUArchStatestruct CPUX86State *env = NULL((void*)0);
1164 int current_tb_modified = 0;
1165 target_ulong current_pc = 0;
1166 target_ulong current_cs_base = 0;
1167 int current_flags = 0;
1168#endif
1169
1170 addr &= TARGET_PAGE_MASK~((1 << 12) - 1);
1171 p = page_find(addr >> TARGET_PAGE_BITS12);
1172 if (!p) {
6
←
Taking false branch
→
1173 return;
1174 }
1175 tb = p->first_tb;
1176#ifdef TARGET_HAS_PRECISE_SMC
1177 if (tb && pc != 0) {
7
←
Assuming 'pc' is equal to 0
→
8
←
Taking false branch
→
1178 current_tb = tb_find_pc(pc);
1179 }
1180 if (cpu != NULL((void*)0)) {
9
←
Assuming 'cpu' is equal to null
→
10
←
Taking false branch
→
1181 env = cpu->env_ptr;
1182 }
1183#endif
1184 while (tb != NULL((void*)0)) {
11
←
Loop condition is true. Entering loop body
→
1185 n = (uintptr_t)tb & 3;
1186 tb = (TranslationBlock *)((uintptr_t)tb & ~3);
1187#ifdef TARGET_HAS_PRECISE_SMC
1188 if (current_tb == tb &&
12
←
Assuming 'current_tb' is equal to 'tb'
→
1189 (current_tb->cflags & CF_COUNT_MASK0x7fff) != 1) {
13
←
Access to field 'cflags' results in a dereference of a null pointer (loaded from variable 'current_tb')
1190 /* If we are modifying the current TB, we must stop
1191 its execution. We could be more precise by checking
1192 that the modification is after the current PC, but it
1193 would require a specialized function to partially
1194 restore the CPU state */
1195
1196 current_tb_modified = 1;
1197 cpu_restore_state_from_tb(current_tb, env, pc);
1198 cpu_get_tb_cpu_state(env, &current_pc, &current_cs_base,
1199 &current_flags);
1200 }
1201#endif /* TARGET_HAS_PRECISE_SMC */
1202 tb_phys_invalidate(tb, addr);
1203 tb = tb->page_next[n];
1204 }
1205 p->first_tb = NULL((void*)0);
1206#ifdef TARGET_HAS_PRECISE_SMC
1207 if (current_tb_modified) {
1208 /* we generate a block containing just the instruction
1209 modifying the memory. It will ensure that it cannot modify
1210 itself */
1211 cpu->current_tb = NULL((void*)0);
1212 tb_gen_code(env, current_pc, current_cs_base, current_flags, 1);
1213 if (locked) {
1214 mmap_unlock();
1215 }
1216 cpu_resume_from_signal(env, puc);
1217 }
1218#endif
1219}
1220#endif
1221
1222/* add the tb in the target page and protect it if necessary */
1223static inline void tb_alloc_page(TranslationBlock *tb,
1224 unsigned int n, tb_page_addr_t page_addr)
1225{
1226 PageDesc *p;
1227#ifndef CONFIG_USER_ONLY1
1228 bool_Bool page_already_protected;
1229#endif
1230
1231 tb->page_addr[n] = page_addr;
1232 p = page_find_alloc(page_addr >> TARGET_PAGE_BITS12, 1);
1233 tb->page_next[n] = p->first_tb;
1234#ifndef CONFIG_USER_ONLY1
1235 page_already_protected = p->first_tb != NULL((void*)0);
1236#endif
1237 p->first_tb = (TranslationBlock *)((uintptr_t)tb | n);
1238 invalidate_page_bitmap(p);
1239
1240#if defined(TARGET_HAS_SMC) || 1
1241
1242#if defined(CONFIG_USER_ONLY1)
1243 if (p->flags & PAGE_WRITE0x0002) {
1244 target_ulong addr;
1245 PageDesc *p2;
1246 int prot;
1247
1248 /* force the host page as non writable (writes will have a
1249 page fault + mprotect overhead) */
1250 page_addr &= qemu_host_page_mask;
1251 prot = 0;
1252 for (addr = page_addr; addr < page_addr + qemu_host_page_size;
1253 addr += TARGET_PAGE_SIZE(1 << 12)) {
1254
1255 p2 = page_find(addr >> TARGET_PAGE_BITS12);
1256 if (!p2) {
1257 continue;
1258 }
1259 prot |= p2->flags;
1260 p2->flags &= ~PAGE_WRITE0x0002;
1261 }
1262 mprotect(g2h(page_addr)((void *)((unsigned long)(target_ulong)(page_addr) + guest_base
)), qemu_host_page_size,
1263 (prot & PAGE_BITS(0x0001 | 0x0002 | 0x0004)) & ~PAGE_WRITE0x0002);
1264#ifdef DEBUG_TB_INVALIDATE
1265 printf("protecting code page: 0x" TARGET_FMT_lx"%016" "l" "x" "\n",
1266 page_addr);
1267#endif
1268 }
1269#else
1270 /* if some code is already present, then the pages are already
1271 protected. So we handle the case where only the first TB is
1272 allocated in a physical page */
1273 if (!page_already_protected) {
1274 tlb_protect_code(page_addr);
1275 }
1276#endif
1277
1278#endif /* TARGET_HAS_SMC */
1279}
1280
1281/* add a new TB and link it to the physical page tables. phys_page2 is
1282 (-1) to indicate that only one page contains the TB. */
1283static void tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
1284 tb_page_addr_t phys_page2)
1285{
1286 unsigned int h;
1287 TranslationBlock **ptb;
1288
1289 /* Grab the mmap lock to stop another thread invalidating this TB
1290 before we are done. */
1291 mmap_lock();
1292 /* add in the physical hash table */
1293 h = tb_phys_hash_func(phys_pc);
1294 ptb = &tcg_ctx.tb_ctx.tb_phys_hash[h];
1295 tb->phys_hash_next = *ptb;
1296 *ptb = tb;
1297
1298 /* add in the page list */
1299 tb_alloc_page(tb, 0, phys_pc & TARGET_PAGE_MASK~((1 << 12) - 1));
1300 if (phys_page2 != -1) {
1301 tb_alloc_page(tb, 1, phys_page2);
1302 } else {
1303 tb->page_addr[1] = -1;
1304 }
1305
1306 tb->jmp_first = (TranslationBlock *)((uintptr_t)tb | 2);
1307 tb->jmp_next[0] = NULL((void*)0);
1308 tb->jmp_next[1] = NULL((void*)0);
1309
1310 /* init original jump addresses */
1311 if (tb->tb_next_offset[0] != 0xffff) {
1312 tb_reset_jump(tb, 0);
1313 }
1314 if (tb->tb_next_offset[1] != 0xffff) {
1315 tb_reset_jump(tb, 1);
1316 }
1317
1318#ifdef DEBUG_TB_CHECK
1319 tb_page_check();
1320#endif
1321 mmap_unlock();
1322}
1323
1324/* find the TB 'tb' such that tb[0].tc_ptr <= tc_ptr <
1325 tb[1].tc_ptr. Return NULL if not found */
1326static TranslationBlock *tb_find_pc(uintptr_t tc_ptr)
1327{
1328 int m_min, m_max, m;
1329 uintptr_t v;
1330 TranslationBlock *tb;
1331
1332 if (tcg_ctx.tb_ctx.nb_tbs <= 0) {
1333 return NULL((void*)0);
1334 }
1335 if (tc_ptr < (uintptr_t)tcg_ctx.code_gen_buffer ||
1336 tc_ptr >= (uintptr_t)tcg_ctx.code_gen_ptr) {
1337 return NULL((void*)0);
1338 }
1339 /* binary search (cf Knuth) */
1340 m_min = 0;
1341 m_max = tcg_ctx.tb_ctx.nb_tbs - 1;
1342 while (m_min <= m_max) {
1343 m = (m_min + m_max) >> 1;
1344 tb = &tcg_ctx.tb_ctx.tbs[m];
1345 v = (uintptr_t)tb->tc_ptr;
1346 if (v == tc_ptr) {
1347 return tb;
1348 } else if (tc_ptr < v) {
1349 m_max = m - 1;
1350 } else {
1351 m_min = m + 1;
1352 }
1353 }
1354 return &tcg_ctx.tb_ctx.tbs[m_max];
1355}
1356
1357#if defined(TARGET_HAS_ICE1) && !defined(CONFIG_USER_ONLY1)
1358void tb_invalidate_phys_addr(hwaddr addr)
1359{
1360 ram_addr_t ram_addr;
1361 MemoryRegion *mr;
1362 hwaddr l = 1;
1363
1364 mr = address_space_translate(&address_space_memory, addr, &addr, &l, false0);
1365 if (!(memory_region_is_ram(mr)
1366 || memory_region_is_romd(mr))) {
1367 return;
1368 }
1369 ram_addr = (memory_region_get_ram_addr(mr) & TARGET_PAGE_MASK~((1 << 12) - 1))
1370 + addr;
1371 tb_invalidate_phys_page_range(ram_addr, ram_addr + 1, 0);
1372}
1373#endif /* TARGET_HAS_ICE && !defined(CONFIG_USER_ONLY) */
1374
1375void tb_check_watchpoint(CPUArchStatestruct CPUX86State *env)
1376{
1377 TranslationBlock *tb;
1378
1379 tb = tb_find_pc(env->mem_io_pc);
1380 if (!tb) {
1381 cpu_abort(env, "check_watchpoint: could not find TB for pc=%p",
1382 (void *)env->mem_io_pc);
1383 }
1384 cpu_restore_state_from_tb(tb, env, env->mem_io_pc);
1385 tb_phys_invalidate(tb, -1);
1386}
1387
1388#ifndef CONFIG_USER_ONLY1
1389/* mask must never be zero, except for A20 change call */
1390static void tcg_handle_interrupt(CPUState *cpu, int mask)
1391{
1392 CPUArchStatestruct CPUX86State *env = cpu->env_ptr;
1393 int old_mask;
1394
1395 old_mask = cpu->interrupt_request;
1396 cpu->interrupt_request |= mask;
1397
1398 /*
1399 * If called from iothread context, wake the target cpu in
1400 * case its halted.
1401 */
1402 if (!qemu_cpu_is_self(cpu)) {
1403 qemu_cpu_kick(cpu);
1404 return;
1405 }
1406
1407 if (use_icount) {
1408 env->icount_decr.u16.high = 0xffff;
1409 if (!can_do_io(env)
1410 && (mask & ~old_mask) != 0) {
1411 cpu_abort(env, "Raised interrupt while not in I/O function");
1412 }
1413 } else {
1414 cpu->tcg_exit_req = 1;
1415 }
1416}
1417
1418CPUInterruptHandler cpu_interrupt_handler = tcg_handle_interrupt;
1419
1420/* in deterministic execution mode, instructions doing device I/Os
1421 must be at the end of the TB */
1422void cpu_io_recompile(CPUArchStatestruct CPUX86State *env, uintptr_t retaddr)
1423{
1424 TranslationBlock *tb;
1425 uint32_t n, cflags;
1426 target_ulong pc, cs_base;
1427 uint64_t flags;
1428
1429 tb = tb_find_pc(retaddr);
1430 if (!tb) {
1431 cpu_abort(env, "cpu_io_recompile: could not find TB for pc=%p",
1432 (void *)retaddr);
1433 }
1434 n = env->icount_decr.u16.low + tb->icount;
1435 cpu_restore_state_from_tb(tb, env, retaddr);
1436 /* Calculate how many instructions had been executed before the fault
1437 occurred. */
1438 n = n - env->icount_decr.u16.low;
1439 /* Generate a new TB ending on the I/O insn. */
1440 n++;
1441 /* On MIPS and SH, delay slot instructions can only be restarted if
1442 they were already the first instruction in the TB. If this is not
1443 the first instruction in a TB then re-execute the preceding
1444 branch. */
1445#if defined(TARGET_MIPS)
1446 if ((env->hflags & MIPS_HFLAG_BMASK) != 0 && n > 1) {
1447 env->active_tc.PC -= 4;
1448 env->icount_decr.u16.low++;
1449 env->hflags &= ~MIPS_HFLAG_BMASK;
1450 }
1451#elif defined(TARGET_SH4)
1452 if ((env->flags & ((DELAY_SLOT | DELAY_SLOT_CONDITIONAL))) != 0
1453 && n > 1) {
1454 env->pc -= 2;
1455 env->icount_decr.u16.low++;
1456 env->flags &= ~(DELAY_SLOT | DELAY_SLOT_CONDITIONAL);
1457 }
1458#endif
1459 /* This should never happen. */
1460 if (n > CF_COUNT_MASK0x7fff) {
1461 cpu_abort(env, "TB too big during recompile");
1462 }
1463
1464 cflags = n | CF_LAST_IO0x8000;
1465 pc = tb->pc;
1466 cs_base = tb->cs_base;
1467 flags = tb->flags;
1468 tb_phys_invalidate(tb, -1);
1469 /* FIXME: In theory this could raise an exception. In practice
1470 we have already translated the block once so it's probably ok. */
1471 tb_gen_code(env, pc, cs_base, flags, cflags);
1472 /* TODO: If env->pc != tb->pc (i.e. the faulting instruction was not
1473 the first in the TB) then we end up generating a whole new TB and
1474 repeating the fault, which is horribly inefficient.
1475 Better would be to execute just this insn uncached, or generate a
1476 second new TB. */
1477 cpu_resume_from_signal(env, NULL((void*)0));
1478}
1479
1480void tb_flush_jmp_cache(CPUArchStatestruct CPUX86State *env, target_ulong addr)
1481{
1482 unsigned int i;
1483
1484 /* Discard jump cache entries for any tb which might potentially
1485 overlap the flushed page. */
1486 i = tb_jmp_cache_hash_page(addr - TARGET_PAGE_SIZE(1 << 12));
1487 memset(&env->tb_jmp_cache[i], 0,
1488 TB_JMP_PAGE_SIZE(1 << (12 / 2)) * sizeof(TranslationBlock *));
1489
1490 i = tb_jmp_cache_hash_page(addr);
1491 memset(&env->tb_jmp_cache[i], 0,
1492 TB_JMP_PAGE_SIZE(1 << (12 / 2)) * sizeof(TranslationBlock *));
1493}
1494
1495void dump_exec_info(FILE *f, fprintf_function cpu_fprintf)
1496{
1497 int i, target_code_size, max_target_code_size;
1498 int direct_jmp_count, direct_jmp2_count, cross_page;
1499 TranslationBlock *tb;
1500
1501 target_code_size = 0;
1502 max_target_code_size = 0;
1503 cross_page = 0;
1504 direct_jmp_count = 0;
1505 direct_jmp2_count = 0;
1506 for (i = 0; i < tcg_ctx.tb_ctx.nb_tbs; i++) {
1507 tb = &tcg_ctx.tb_ctx.tbs[i];
1508 target_code_size += tb->size;
1509 if (tb->size > max_target_code_size) {
1510 max_target_code_size = tb->size;
1511 }
1512 if (tb->page_addr[1] != -1) {
1513 cross_page++;
1514 }
1515 if (tb->tb_next_offset[0] != 0xffff) {
1516 direct_jmp_count++;
1517 if (tb->tb_next_offset[1] != 0xffff) {
1518 direct_jmp2_count++;
1519 }
1520 }
1521 }
1522 /* XXX: avoid using doubles ? */
1523 cpu_fprintf(f, "Translation buffer state:\n");
1524 cpu_fprintf(f, "gen code size %td/%zd\n",
1525 tcg_ctx.code_gen_ptr - tcg_ctx.code_gen_buffer,
1526 tcg_ctx.code_gen_buffer_max_size);
1527 cpu_fprintf(f, "TB count %d/%d\n",
1528 tcg_ctx.tb_ctx.nb_tbs, tcg_ctx.code_gen_max_blocks);
1529 cpu_fprintf(f, "TB avg target size %d max=%d bytes\n",
1530 tcg_ctx.tb_ctx.nb_tbs ? target_code_size /
1531 tcg_ctx.tb_ctx.nb_tbs : 0,
1532 max_target_code_size);
1533 cpu_fprintf(f, "TB avg host size %td bytes (expansion ratio: %0.1f)\n",
1534 tcg_ctx.tb_ctx.nb_tbs ? (tcg_ctx.code_gen_ptr -
1535 tcg_ctx.code_gen_buffer) /
1536 tcg_ctx.tb_ctx.nb_tbs : 0,
1537 target_code_size ? (double) (tcg_ctx.code_gen_ptr -
1538 tcg_ctx.code_gen_buffer) /
1539 target_code_size : 0);
1540 cpu_fprintf(f, "cross page TB count %d (%d%%)\n", cross_page,
1541 tcg_ctx.tb_ctx.nb_tbs ? (cross_page * 100) /
1542 tcg_ctx.tb_ctx.nb_tbs : 0);
1543 cpu_fprintf(f, "direct jump count %d (%d%%) (2 jumps=%d %d%%)\n",
1544 direct_jmp_count,
1545 tcg_ctx.tb_ctx.nb_tbs ? (direct_jmp_count * 100) /
1546 tcg_ctx.tb_ctx.nb_tbs : 0,
1547 direct_jmp2_count,
1548 tcg_ctx.tb_ctx.nb_tbs ? (direct_jmp2_count * 100) /
1549 tcg_ctx.tb_ctx.nb_tbs : 0);
1550 cpu_fprintf(f, "\nStatistics:\n");
1551 cpu_fprintf(f, "TB flush count %d\n", tcg_ctx.tb_ctx.tb_flush_count);
1552 cpu_fprintf(f, "TB invalidate count %d\n",
1553 tcg_ctx.tb_ctx.tb_phys_invalidate_count);
1554 cpu_fprintf(f, "TLB flush count %d\n", tlb_flush_count);
1555 tcg_dump_info(f, cpu_fprintf);
1556}
1557
1558#else /* CONFIG_USER_ONLY */
1559
1560void cpu_interrupt(CPUState *cpu, int mask)
1561{
1562 cpu->interrupt_request |= mask;
1563 cpu->tcg_exit_req = 1;
1564}
1565
1566/*
1567 * Walks guest process memory "regions" one by one
1568 * and calls callback function 'fn' for each region.
1569 */
1570struct walk_memory_regions_data {
1571 walk_memory_regions_fn fn;
1572 void *priv;
1573 uintptr_t start;
1574 int prot;
1575};
1576
1577static int walk_memory_regions_end(struct walk_memory_regions_data *data,
1578 abi_ulong end, int new_prot)
1579{
1580 if (data->start != -1ul) {
1581 int rc = data->fn(data->priv, data->start, end, data->prot);
1582 if (rc != 0) {
1583 return rc;
1584 }
1585 }
1586
1587 data->start = (new_prot ? end : -1ul);
1588 data->prot = new_prot;
1589
1590 return 0;
1591}
1592
1593static int walk_memory_regions_1(struct walk_memory_regions_data *data,
1594 abi_ulong base, int level, void **lp)
1595{
1596 abi_ulong pa;
1597 int i, rc;
1598
1599 if (*lp == NULL((void*)0)) {
1600 return walk_memory_regions_end(data, base, 0);
1601 }
1602
1603 if (level == 0) {
1604 PageDesc *pd = *lp;
1605
1606 for (i = 0; i < V_L2_SIZE(1 << 10); ++i) {
1607 int prot = pd[i].flags;
1608
1609 pa = base | (i << TARGET_PAGE_BITS12);
1610 if (prot != data->prot) {
1611 rc = walk_memory_regions_end(data, pa, prot);
1612 if (rc != 0) {
1613 return rc;
1614 }
1615 }
1616 }
1617 } else {
1618 void **pp = *lp;
1619
1620 for (i = 0; i < V_L2_SIZE(1 << 10); ++i) {
1621 pa = base | ((abi_ulong)i <<
1622 (TARGET_PAGE_BITS12 + V_L2_BITS10 * level));
1623 rc = walk_memory_regions_1(data, pa, level - 1, pp + i);
1624 if (rc != 0) {
1625 return rc;
1626 }
1627 }
1628 }
1629
1630 return 0;
1631}
1632
1633int walk_memory_regions(void *priv, walk_memory_regions_fn fn)
1634{
1635 struct walk_memory_regions_data data;
1636 uintptr_t i;
1637
1638 data.fn = fn;
1639 data.priv = priv;
1640 data.start = -1ul;
1641 data.prot = 0;
1642
1643 for (i = 0; i < V_L1_SIZE((target_ulong)1 << ((47 - 12) % 10)); i++) {
1644 int rc = walk_memory_regions_1(&data, (abi_ulong)i << V_L1_SHIFT(47 - 12 - ((47 - 12) % 10)),
1645 V_L1_SHIFT(47 - 12 - ((47 - 12) % 10)) / V_L2_BITS10 - 1, l1_map + i);
1646
1647 if (rc != 0) {
1648 return rc;
1649 }
1650 }
1651
1652 return walk_memory_regions_end(&data, 0, 0);
1653}
1654
1655static int dump_region(void *priv, abi_ulong start,
1656 abi_ulong end, unsigned long prot)
1657{
1658 FILE *f = (FILE *)priv;
1659
1660 (void) fprintf(f, TARGET_ABI_FMT_lx"%016" "l" "x""-"TARGET_ABI_FMT_lx"%016" "l" "x"
1661 " "TARGET_ABI_FMT_lx"%016" "l" "x"" %c%c%c\n",
1662 start, end, end - start,
1663 ((prot & PAGE_READ0x0001) ? 'r' : '-'),
1664 ((prot & PAGE_WRITE0x0002) ? 'w' : '-'),
1665 ((prot & PAGE_EXEC0x0004) ? 'x' : '-'));
1666
1667 return 0;
1668}
1669
1670/* dump memory mappings */
1671void page_dump(FILE *f)
1672{
1673 const int length = sizeof(abi_ulong) * 2;
1674 (void) fprintf(f, "%-*s %-*s %-*s %s\n",
1675 length, "start", length, "end", length, "size", "prot");
1676 walk_memory_regions(f, dump_region);
1677}
1678
1679int page_get_flags(target_ulong address)
1680{
1681 PageDesc *p;
1682
1683 p = page_find(address >> TARGET_PAGE_BITS12);
1684 if (!p) {
1685 return 0;
1686 }
1687 return p->flags;
1688}
1689
1690/* Modify the flags of a page and invalidate the code if necessary.
1691 The flag PAGE_WRITE_ORG is positioned automatically depending
1692 on PAGE_WRITE. The mmap_lock should already be held. */
1693void page_set_flags(target_ulong start, target_ulong end, int flags)
1694{
1695 target_ulong addr, len;
1696
1697 /* This function should never be called with addresses outside the
1698 guest address space. If this assert fires, it probably indicates
1699 a missing call to h2g_valid. */
1700#if TARGET_ABI_BITS64 > L1_MAP_ADDR_SPACE_BITS47
1701 assert(end < ((abi_ulong)1 << L1_MAP_ADDR_SPACE_BITS))((end < ((abi_ulong)1 << 47)) ? (void) (0) : __assert_fail
("end < ((abi_ulong)1 << 47)", "/home/stefan/src/qemu/qemu.org/qemu/translate-all.c"
, 1701, __PRETTY_FUNCTION__));
1702#endif
1703 assert(start < end)((start < end) ? (void) (0) : __assert_fail ("start < end"
, "/home/stefan/src/qemu/qemu.org/qemu/translate-all.c", 1703
, __PRETTY_FUNCTION__));
1704
1705 start = start & TARGET_PAGE_MASK~((1 << 12) - 1);
1706 end = TARGET_PAGE_ALIGN(end)(((end) + (1 << 12) - 1) & ~((1 << 12) - 1));
1707
1708 if (flags & PAGE_WRITE0x0002) {
1709 flags |= PAGE_WRITE_ORG0x0010;
1710 }
1711
1712 for (addr = start, len = end - start;
1713 len != 0;
1714 len -= TARGET_PAGE_SIZE(1 << 12), addr += TARGET_PAGE_SIZE(1 << 12)) {
1715 PageDesc *p = page_find_alloc(addr >> TARGET_PAGE_BITS12, 1);
1716
1717 /* If the write protection bit is set, then we invalidate
1718 the code inside. */
1719 if (!(p->flags & PAGE_WRITE0x0002) &&
1720 (flags & PAGE_WRITE0x0002) &&
1721 p->first_tb) {
1722 tb_invalidate_phys_page(addr, 0, NULL((void*)0), false0);
1723 }
1724 p->flags = flags;
1725 }
1726}
1727
1728int page_check_range(target_ulong start, target_ulong len, int flags)
1729{
1730 PageDesc *p;
1731 target_ulong end;
1732 target_ulong addr;
1733
1734 /* This function should never be called with addresses outside the
1735 guest address space. If this assert fires, it probably indicates
1736 a missing call to h2g_valid. */
1737#if TARGET_ABI_BITS64 > L1_MAP_ADDR_SPACE_BITS47
1738 assert(start < ((abi_ulong)1 << L1_MAP_ADDR_SPACE_BITS))((start < ((abi_ulong)1 << 47)) ? (void) (0) : __assert_fail
("start < ((abi_ulong)1 << 47)", "/home/stefan/src/qemu/qemu.org/qemu/translate-all.c"
, 1738, __PRETTY_FUNCTION__));
1739#endif
1740
1741 if (len == 0) {
1742 return 0;
1743 }
1744 if (start + len - 1 < start) {
1745 /* We've wrapped around. */
1746 return -1;
1747 }
1748
1749 /* must do before we loose bits in the next step */
1750 end = TARGET_PAGE_ALIGN(start + len)(((start + len) + (1 << 12) - 1) & ~((1 << 12
) - 1));
1751 start = start & TARGET_PAGE_MASK~((1 << 12) - 1);
1752
1753 for (addr = start, len = end - start;
1754 len != 0;
1755 len -= TARGET_PAGE_SIZE(1 << 12), addr += TARGET_PAGE_SIZE(1 << 12)) {
1756 p = page_find(addr >> TARGET_PAGE_BITS12);
1757 if (!p) {
1758 return -1;
1759 }
1760 if (!(p->flags & PAGE_VALID0x0008)) {
1761 return -1;
1762 }
1763
1764 if ((flags & PAGE_READ0x0001) && !(p->flags & PAGE_READ0x0001)) {
1765 return -1;
1766 }
1767 if (flags & PAGE_WRITE0x0002) {
1768 if (!(p->flags & PAGE_WRITE_ORG0x0010)) {
1769 return -1;
1770 }
1771 /* unprotect the page if it was put read-only because it
1772 contains translated code */
1773 if (!(p->flags & PAGE_WRITE0x0002)) {
1774 if (!page_unprotect(addr, 0, NULL((void*)0))) {
1775 return -1;
1776 }
1777 }
1778 return 0;
1779 }
1780 }
1781 return 0;
1782}
1783
1784/* called from signal handler: invalidate the code and unprotect the
1785 page. Return TRUE if the fault was successfully handled. */
1786int page_unprotect(target_ulong address, uintptr_t pc, void *puc)
1787{
1788 unsigned int prot;
1789 PageDesc *p;
1790 target_ulong host_start, host_end, addr;
1791
1792 /* Technically this isn't safe inside a signal handler. However we
1793 know this only ever happens in a synchronous SEGV handler, so in
1794 practice it seems to be ok. */
1795 mmap_lock();
1796
1797 p = page_find(address >> TARGET_PAGE_BITS12);
1798 if (!p) {
1
Taking false branch
→
1799 mmap_unlock();
1800 return 0;
1801 }
1802
1803 /* if the page was really writable, then we change its
1804 protection back to writable */
1805 if ((p->flags & PAGE_WRITE_ORG0x0010) && !(p->flags & PAGE_WRITE0x0002)) {
2
←
Taking true branch
→
1806 host_start = address & qemu_host_page_mask;
1807 host_end = host_start + qemu_host_page_size;
1808
1809 prot = 0;
1810 for (addr = host_start ; addr < host_end ; addr += TARGET_PAGE_SIZE(1 << 12)) {
3
←
Loop condition is true. Entering loop body
→
1811 p = page_find(addr >> TARGET_PAGE_BITS12);
1812 p->flags |= PAGE_WRITE0x0002;
1813 prot |= p->flags;
1814
1815 /* and since the content will be modified, we must invalidate
1816 the corresponding translated code. */
1817 tb_invalidate_phys_page(addr, pc, puc, true1);
4
←
Calling 'tb_invalidate_phys_page'
→
1818#ifdef DEBUG_TB_CHECK
1819 tb_invalidate_check(addr);
1820#endif
1821 }
1822 mprotect((void *)g2h(host_start)((void *)((unsigned long)(target_ulong)(host_start) + guest_base
)), qemu_host_page_size,
1823 prot & PAGE_BITS(0x0001 | 0x0002 | 0x0004));
1824
1825 mmap_unlock();
1826 return 1;
1827 }
1828 mmap_unlock();
1829 return 0;
1830}
1831#endif /* CONFIG_USER_ONLY */