[PULL 0/3] tcg patch queue
[PULL 00/20] tcg patch queue
1
The following changes since commit 2ecfc0657afa5d29a373271b342f704a1a3c6737:
1
The following changes since commit e93ded1bf6c94ab95015b33e188bc8b0b0c32670:
2
2
3
Merge remote-tracking branch 'remotes/armbru/tags/pull-misc-2020-12-10' into staging (2020-12-10 17:01:05 +0000)
3
Merge tag 'testing-pull-request-2022-08-30' of https://gitlab.com/thuth/qemu into staging (2022-08-31 18:19:03 -0400)
4
4
5
are available in the Git repository at:
5
are available in the Git repository at:
6
6
7
https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20201210
7
https://gitlab.com/rth7680/qemu.git tags/pull-tcg-20220901
8
8
9
for you to fetch changes up to 9e2658d62ebc23efe7df43fc0e306f129510d874:
9
for you to fetch changes up to 20011be2e30b8aa8ef1fc258485f00c688703deb:
10
10
11
accel/tcg: rename tcg-cpus functions to match module name (2020-12-10 17:44:10 -0600)
11
target/riscv: Make translator stop before the end of a page (2022-09-01 07:43:08 +0100)
12
12
13
----------------------------------------------------------------
13
----------------------------------------------------------------
14
Split CpusAccel for tcg variants
14
Respect PROT_EXEC in user-only mode.
15
Fix s390x, i386 and riscv for translations crossing a page.
15
16
16
----------------------------------------------------------------
17
----------------------------------------------------------------
17
Claudio Fontana (3):
18
Ilya Leoshkevich (4):
18
accel/tcg: split CpusAccel into three TCG variants
19
linux-user: Clear translations on mprotect()
19
accel/tcg: split tcg_start_vcpu_thread
20
accel/tcg: Introduce is_same_page()
20
accel/tcg: rename tcg-cpus functions to match module name
21
target/s390x: Make translator stop before the end of a page
22
target/i386: Make translator stop before the end of a page
21
23
22
accel/tcg/tcg-cpus-icount.h | 17 ++
24
Richard Henderson (16):
23
accel/tcg/tcg-cpus-rr.h | 21 ++
25
linux-user/arm: Mark the commpage executable
24
accel/tcg/tcg-cpus.h | 12 +-
26
linux-user/hppa: Allocate page zero as a commpage
25
accel/tcg/tcg-all.c | 13 +-
27
linux-user/x86_64: Allocate vsyscall page as a commpage
26
accel/tcg/tcg-cpus-icount.c | 147 +++++++++++++
28
linux-user: Honor PT_GNU_STACK
27
accel/tcg/tcg-cpus-mttcg.c | 140 ++++++++++++
29
tests/tcg/i386: Move smc_code2 to an executable section
28
accel/tcg/tcg-cpus-rr.c | 305 ++++++++++++++++++++++++++
30
accel/tcg: Properly implement get_page_addr_code for user-only
29
accel/tcg/tcg-cpus.c | 506 +-------------------------------------------
31
accel/tcg: Unlock mmap_lock after longjmp
30
softmmu/icount.c | 2 +-
32
accel/tcg: Make tb_htable_lookup static
31
accel/tcg/meson.build | 9 +-
33
accel/tcg: Move qemu_ram_addr_from_host_nofail to physmem.c
32
10 files changed, 670 insertions(+), 502 deletions(-)
34
accel/tcg: Use probe_access_internal for softmmu get_page_addr_code_hostp
33
create mode 100644 accel/tcg/tcg-cpus-icount.h
35
accel/tcg: Document the faulting lookup in tb_lookup_cmp
34
create mode 100644 accel/tcg/tcg-cpus-rr.h
36
accel/tcg: Remove translator_ldsw
35
create mode 100644 accel/tcg/tcg-cpus-icount.c
37
accel/tcg: Add pc and host_pc params to gen_intermediate_code
36
create mode 100644 accel/tcg/tcg-cpus-mttcg.c
38
accel/tcg: Add fast path for translator_ld*
37
create mode 100644 accel/tcg/tcg-cpus-rr.c
39
target/riscv: Add MAX_INSN_LEN and insn_len
40
target/riscv: Make translator stop before the end of a page
38
41
42
include/elf.h | 1 +
43
include/exec/cpu-common.h | 1 +
44
include/exec/exec-all.h | 89 ++++++++----------------
45
include/exec/translator.h | 96 ++++++++++++++++---------
46
linux-user/arm/target_cpu.h | 4 +-
47
linux-user/qemu.h | 1 +
48
accel/tcg/cpu-exec.c | 143 ++++++++++++++++++++------------------
49
accel/tcg/cputlb.c | 93 +++++++------------------
50
accel/tcg/translate-all.c | 29 ++++----
51
accel/tcg/translator.c | 135 ++++++++++++++++++++++++++---------
52
accel/tcg/user-exec.c | 17 ++++-
53
linux-user/elfload.c | 82 ++++++++++++++++++++--
54
linux-user/mmap.c | 6 +-
55
softmmu/physmem.c | 12 ++++
56
target/alpha/translate.c | 5 +-
57
target/arm/translate.c | 5 +-
58
target/avr/translate.c | 5 +-
59
target/cris/translate.c | 5 +-
60
target/hexagon/translate.c | 6 +-
61
target/hppa/translate.c | 5 +-
62
target/i386/tcg/translate.c | 71 +++++++++++--------
63
target/loongarch/translate.c | 6 +-
64
target/m68k/translate.c | 5 +-
65
target/microblaze/translate.c | 5 +-
66
target/mips/tcg/translate.c | 5 +-
67
target/nios2/translate.c | 5 +-
68
target/openrisc/translate.c | 6 +-
69
target/ppc/translate.c | 5 +-
70
target/riscv/translate.c | 32 +++++++--
71
target/rx/translate.c | 5 +-
72
target/s390x/tcg/translate.c | 20 ++++--
73
target/sh4/translate.c | 5 +-
74
target/sparc/translate.c | 5 +-
75
target/tricore/translate.c | 6 +-
76
target/xtensa/translate.c | 6 +-
77
tests/tcg/i386/test-i386.c | 2 +-
78
tests/tcg/riscv64/noexec.c | 79 +++++++++++++++++++++
79
tests/tcg/s390x/noexec.c | 106 ++++++++++++++++++++++++++++
80
tests/tcg/x86_64/noexec.c | 75 ++++++++++++++++++++
81
tests/tcg/multiarch/noexec.c.inc | 139 ++++++++++++++++++++++++++++++++++++
82
tests/tcg/riscv64/Makefile.target | 1 +
83
tests/tcg/s390x/Makefile.target | 1 +
84
tests/tcg/x86_64/Makefile.target | 3 +-
85
43 files changed, 966 insertions(+), 367 deletions(-)
86
create mode 100644 tests/tcg/riscv64/noexec.c
87
create mode 100644 tests/tcg/s390x/noexec.c
88
create mode 100644 tests/tcg/x86_64/noexec.c
89
create mode 100644 tests/tcg/multiarch/noexec.c.inc
diff view generated by jsdifflib
New patch
[PULL 01/20] linux-user/arm: Mark the commpage executable
1
We're about to start validating PAGE_EXEC, which means
2
that we've got to mark the commpage executable. We had
3
been placing the commpage outside of reserved_va, which
4
was incorrect and lead to an abort.
1
5
6
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
7
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
8
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
9
---
10
linux-user/arm/target_cpu.h | 4 ++--
11
linux-user/elfload.c | 6 +++++-
12
2 files changed, 7 insertions(+), 3 deletions(-)
13
14
diff --git a/linux-user/arm/target_cpu.h b/linux-user/arm/target_cpu.h
15
index XXXXXXX..XXXXXXX 100644
16
--- a/linux-user/arm/target_cpu.h
17
+++ b/linux-user/arm/target_cpu.h
18
@@ -XXX,XX +XXX,XX @@ static inline unsigned long arm_max_reserved_va(CPUState *cs)
19
} else {
20
/*
21
* We need to be able to map the commpage.
22
- * See validate_guest_space in linux-user/elfload.c.
23
+ * See init_guest_commpage in linux-user/elfload.c.
24
*/
25
- return 0xffff0000ul;
26
+ return 0xfffffffful;
27
}
28
}
29
#define MAX_RESERVED_VA arm_max_reserved_va
30
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
31
index XXXXXXX..XXXXXXX 100644
32
--- a/linux-user/elfload.c
33
+++ b/linux-user/elfload.c
34
@@ -XXX,XX +XXX,XX @@ enum {
35
36
static bool init_guest_commpage(void)
37
{
38
- void *want = g2h_untagged(HI_COMMPAGE & -qemu_host_page_size);
39
+ abi_ptr commpage = HI_COMMPAGE & -qemu_host_page_size;
40
+ void *want = g2h_untagged(commpage);
41
void *addr = mmap(want, qemu_host_page_size, PROT_READ | PROT_WRITE,
42
MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
43
44
@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
45
perror("Protecting guest commpage");
46
exit(EXIT_FAILURE);
47
}
48
+
49
+ page_set_flags(commpage, commpage + qemu_host_page_size,
50
+ PAGE_READ | PAGE_EXEC | PAGE_VALID);
51
return true;
52
}
53
54
--
55
2.34.1
diff view generated by jsdifflib
New patch
[PULL 1/4] target/avr: Support probe argument to tlb_fill
1
While there are no target-specific nonfaulting probes,
2
generic code may grow some uses at some point.
1
3
4
Note that the attrs argument was incorrect -- it should have
5
been MEMTXATTRS_UNSPECIFIED. Just use the simpler interface.
6
7
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
8
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
9
---
10
target/avr/helper.c | 46 ++++++++++++++++++++++++++++-----------------
11
1 file changed, 29 insertions(+), 17 deletions(-)
12
13
diff --git a/target/avr/helper.c b/target/avr/helper.c
14
index XXXXXXX..XXXXXXX 100644
15
--- a/target/avr/helper.c
16
+++ b/target/avr/helper.c
17
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
18
MMUAccessType access_type, int mmu_idx,
19
bool probe, uintptr_t retaddr)
20
{
21
- int prot = 0;
22
- MemTxAttrs attrs = {};
23
+ int prot, page_size = TARGET_PAGE_SIZE;
24
uint32_t paddr;
25
26
address &= TARGET_PAGE_MASK;
27
28
if (mmu_idx == MMU_CODE_IDX) {
29
- /* access to code in flash */
30
+ /* Access to code in flash. */
31
paddr = OFFSET_CODE + address;
32
prot = PAGE_READ | PAGE_EXEC;
33
- if (paddr + TARGET_PAGE_SIZE > OFFSET_DATA) {
34
+ if (paddr >= OFFSET_DATA) {
35
+ /*
36
+ * This should not be possible via any architectural operations.
37
+ * There is certainly not an exception that we can deliver.
38
+ * Accept probing that might come from generic code.
39
+ */
40
+ if (probe) {
41
+ return false;
42
+ }
43
error_report("execution left flash memory");
44
abort();
45
}
46
- } else if (address < NUMBER_OF_CPU_REGISTERS + NUMBER_OF_IO_REGISTERS) {
47
- /*
48
- * access to CPU registers, exit and rebuilt this TB to use full access
49
- * incase it touches specially handled registers like SREG or SP
50
- */
51
- AVRCPU *cpu = AVR_CPU(cs);
52
- CPUAVRState *env = &cpu->env;
53
- env->fullacc = 1;
54
- cpu_loop_exit_restore(cs, retaddr);
55
} else {
56
- /* access to memory. nothing special */
57
+ /* Access to memory. */
58
paddr = OFFSET_DATA + address;
59
prot = PAGE_READ | PAGE_WRITE;
60
+ if (address < NUMBER_OF_CPU_REGISTERS + NUMBER_OF_IO_REGISTERS) {
61
+ /*
62
+ * Access to CPU registers, exit and rebuilt this TB to use
63
+ * full access in case it touches specially handled registers
64
+ * like SREG or SP. For probing, set page_size = 1, in order
65
+ * to force tlb_fill to be called for the next access.
66
+ */
67
+ if (probe) {
68
+ page_size = 1;
69
+ } else {
70
+ AVRCPU *cpu = AVR_CPU(cs);
71
+ CPUAVRState *env = &cpu->env;
72
+ env->fullacc = 1;
73
+ cpu_loop_exit_restore(cs, retaddr);
74
+ }
75
+ }
76
}
77
78
- tlb_set_page_with_attrs(cs, address, paddr, attrs, prot,
79
- mmu_idx, TARGET_PAGE_SIZE);
80
-
81
+ tlb_set_page(cs, address, paddr, prot, mmu_idx, page_size);
82
return true;
83
}
84
85
--
86
2.34.1
87
88
diff view generated by jsdifflib
New patch
[PULL 2/4] target/avr: Call avr_cpu_do_interrupt directly
1
There is no need to go through cc->tcg_ops when
2
we know what value that must have.
1
3
4
Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
5
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
6
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7
---
8
target/avr/helper.c | 5 ++---
9
1 file changed, 2 insertions(+), 3 deletions(-)
10
11
diff --git a/target/avr/helper.c b/target/avr/helper.c
12
index XXXXXXX..XXXXXXX 100644
13
--- a/target/avr/helper.c
14
+++ b/target/avr/helper.c
15
@@ -XXX,XX +XXX,XX @@
16
bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
17
{
18
bool ret = false;
19
- CPUClass *cc = CPU_GET_CLASS(cs);
20
AVRCPU *cpu = AVR_CPU(cs);
21
CPUAVRState *env = &cpu->env;
22
23
if (interrupt_request & CPU_INTERRUPT_RESET) {
24
if (cpu_interrupts_enabled(env)) {
25
cs->exception_index = EXCP_RESET;
26
- cc->tcg_ops->do_interrupt(cs);
27
+ avr_cpu_do_interrupt(cs);
28
29
cs->interrupt_request &= ~CPU_INTERRUPT_RESET;
30
31
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
32
if (cpu_interrupts_enabled(env) && env->intsrc != 0) {
33
int index = ctz32(env->intsrc);
34
cs->exception_index = EXCP_INT(index);
35
- cc->tcg_ops->do_interrupt(cs);
36
+ avr_cpu_do_interrupt(cs);
37
38
env->intsrc &= env->intsrc - 1; /* clear the interrupt */
39
if (!env->intsrc) {
40
--
41
2.34.1
42
43
diff view generated by jsdifflib
New patch
[PULL 02/20] linux-user/hppa: Allocate page zero as a commpage
1
We're about to start validating PAGE_EXEC, which means that we've
2
got to mark page zero executable. We had been special casing this
3
entirely within translate.
1
4
5
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
6
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
7
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
8
---
9
linux-user/elfload.c | 34 +++++++++++++++++++++++++++++++---
10
1 file changed, 31 insertions(+), 3 deletions(-)
11
12
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
13
index XXXXXXX..XXXXXXX 100644
14
--- a/linux-user/elfload.c
15
+++ b/linux-user/elfload.c
16
@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,
17
regs->gr[31] = infop->entry;
18
}
19
20
+#define LO_COMMPAGE 0
21
+
22
+static bool init_guest_commpage(void)
23
+{
24
+ void *want = g2h_untagged(LO_COMMPAGE);
25
+ void *addr = mmap(want, qemu_host_page_size, PROT_NONE,
26
+ MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
27
+
28
+ if (addr == MAP_FAILED) {
29
+ perror("Allocating guest commpage");
30
+ exit(EXIT_FAILURE);
31
+ }
32
+ if (addr != want) {
33
+ return false;
34
+ }
35
+
36
+ /*
37
+ * On Linux, page zero is normally marked execute only + gateway.
38
+ * Normal read or write is supposed to fail (thus PROT_NONE above),
39
+ * but specific offsets have kernel code mapped to raise permissions
40
+ * and implement syscalls. Here, simply mark the page executable.
41
+ * Special case the entry points during translation (see do_page_zero).
42
+ */
43
+ page_set_flags(LO_COMMPAGE, LO_COMMPAGE + TARGET_PAGE_SIZE,
44
+ PAGE_EXEC | PAGE_VALID);
45
+ return true;
46
+}
47
+
48
#endif /* TARGET_HPPA */
49
50
#ifdef TARGET_XTENSA
51
@@ -XXX,XX +XXX,XX @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
52
}
53
54
#if defined(HI_COMMPAGE)
55
-#define LO_COMMPAGE 0
56
+#define LO_COMMPAGE -1
57
#elif defined(LO_COMMPAGE)
58
#define HI_COMMPAGE 0
59
#else
60
#define HI_COMMPAGE 0
61
-#define LO_COMMPAGE 0
62
+#define LO_COMMPAGE -1
63
#define init_guest_commpage() true
64
#endif
65
66
@@ -XXX,XX +XXX,XX @@ static void pgb_static(const char *image_name, abi_ulong orig_loaddr,
67
} else {
68
offset = -(HI_COMMPAGE & -align);
69
}
70
- } else if (LO_COMMPAGE != 0) {
71
+ } else if (LO_COMMPAGE != -1) {
72
loaddr = MIN(loaddr, LO_COMMPAGE & -align);
73
}
74
75
--
76
2.34.1
diff view generated by jsdifflib
New patch
[PULL 03/20] linux-user/x86_64: Allocate vsyscall page as a commpage
1
We're about to start validating PAGE_EXEC, which means that we've
2
got to mark the vsyscall page executable. We had been special
3
casing this entirely within translate.
1
4
5
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
6
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
7
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
8
---
9
linux-user/elfload.c | 23 +++++++++++++++++++++++
10
1 file changed, 23 insertions(+)
11
12
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
13
index XXXXXXX..XXXXXXX 100644
14
--- a/linux-user/elfload.c
15
+++ b/linux-user/elfload.c
16
@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *en
17
(*regs)[26] = tswapreg(env->segs[R_GS].selector & 0xffff);
18
}
19
20
+#if ULONG_MAX >= TARGET_VSYSCALL_PAGE
21
+#define INIT_GUEST_COMMPAGE
22
+static bool init_guest_commpage(void)
23
+{
24
+ /*
25
+ * The vsyscall page is at a high negative address aka kernel space,
26
+ * which means that we cannot actually allocate it with target_mmap.
27
+ * We still should be able to use page_set_flags, unless the user
28
+ * has specified -R reserved_va, which would trigger an assert().
29
+ */
30
+ if (reserved_va != 0 &&
31
+ TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE >= reserved_va) {
32
+ error_report("Cannot allocate vsyscall page");
33
+ exit(EXIT_FAILURE);
34
+ }
35
+ page_set_flags(TARGET_VSYSCALL_PAGE,
36
+ TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE,
37
+ PAGE_EXEC | PAGE_VALID);
38
+ return true;
39
+}
40
+#endif
41
#else
42
43
#define ELF_START_MMAP 0x80000000
44
@@ -XXX,XX +XXX,XX @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
45
#else
46
#define HI_COMMPAGE 0
47
#define LO_COMMPAGE -1
48
+#ifndef INIT_GUEST_COMMPAGE
49
#define init_guest_commpage() true
50
#endif
51
+#endif
52
53
static void pgb_fail_in_use(const char *image_name)
54
{
55
--
56
2.34.1
diff view generated by jsdifflib
[PULL 3/3] accel/tcg: rename tcg-cpus functions to match module name
[PULL 3/4] target/avr: Only execute one interrupt at a time
1
From: Claudio Fontana <cfontana@suse.de>
1
We cannot deliver two interrupts simultaneously;
2
the first interrupt handler must execute first.
2
3
3
Signed-off-by: Claudio Fontana <cfontana@suse.de>
4
Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
4
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
5
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
5
Message-Id: <20201015143217.29337-4-cfontana@suse.de>
6
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
6
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7
---
7
---
8
accel/tcg/tcg-cpus-icount.h | 6 +--
8
target/avr/helper.c | 9 +++------
9
accel/tcg/tcg-cpus-rr.h | 2 +-
9
1 file changed, 3 insertions(+), 6 deletions(-)
10
accel/tcg/tcg-cpus.h | 6 +--
11
accel/tcg/tcg-cpus-icount.c | 24 ++++++------
12
accel/tcg/tcg-cpus-mttcg.c | 10 ++---
13
accel/tcg/tcg-cpus-rr.c | 74 ++++++++++++++++++-------------------
14
accel/tcg/tcg-cpus.c | 6 +--
15
7 files changed, 64 insertions(+), 64 deletions(-)
16
10
17
diff --git a/accel/tcg/tcg-cpus-icount.h b/accel/tcg/tcg-cpus-icount.h
11
diff --git a/target/avr/helper.c b/target/avr/helper.c
18
index XXXXXXX..XXXXXXX 100644
12
index XXXXXXX..XXXXXXX 100644
19
--- a/accel/tcg/tcg-cpus-icount.h
13
--- a/target/avr/helper.c
20
+++ b/accel/tcg/tcg-cpus-icount.h
14
+++ b/target/avr/helper.c
21
@@ -XXX,XX +XXX,XX @@
15
@@ -XXX,XX +XXX,XX @@
22
#ifndef TCG_CPUS_ICOUNT_H
16
23
#define TCG_CPUS_ICOUNT_H
17
bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
24
25
-void handle_icount_deadline(void);
26
-void prepare_icount_for_run(CPUState *cpu);
27
-void process_icount_data(CPUState *cpu);
28
+void icount_handle_deadline(void);
29
+void icount_prepare_for_run(CPUState *cpu);
30
+void icount_process_data(CPUState *cpu);
31
32
#endif /* TCG_CPUS_ICOUNT_H */
33
diff --git a/accel/tcg/tcg-cpus-rr.h b/accel/tcg/tcg-cpus-rr.h
34
index XXXXXXX..XXXXXXX 100644
35
--- a/accel/tcg/tcg-cpus-rr.h
36
+++ b/accel/tcg/tcg-cpus-rr.h
37
@@ -XXX,XX +XXX,XX @@
38
#define TCG_KICK_PERIOD (NANOSECONDS_PER_SECOND / 10)
39
40
/* Kick all RR vCPUs. */
41
-void qemu_cpu_kick_rr_cpus(CPUState *unused);
42
+void rr_kick_vcpu_thread(CPUState *unused);
43
44
/* start the round robin vcpu thread */
45
void rr_start_vcpu_thread(CPUState *cpu);
46
diff --git a/accel/tcg/tcg-cpus.h b/accel/tcg/tcg-cpus.h
47
index XXXXXXX..XXXXXXX 100644
48
--- a/accel/tcg/tcg-cpus.h
49
+++ b/accel/tcg/tcg-cpus.h
50
@@ -XXX,XX +XXX,XX @@ extern const CpusAccel tcg_cpus_mttcg;
51
extern const CpusAccel tcg_cpus_icount;
52
extern const CpusAccel tcg_cpus_rr;
53
54
-void qemu_tcg_destroy_vcpu(CPUState *cpu);
55
-int tcg_cpu_exec(CPUState *cpu);
56
-void tcg_handle_interrupt(CPUState *cpu, int mask);
57
+void tcg_cpus_destroy(CPUState *cpu);
58
+int tcg_cpus_exec(CPUState *cpu);
59
+void tcg_cpus_handle_interrupt(CPUState *cpu, int mask);
60
61
#endif /* TCG_CPUS_H */
62
diff --git a/accel/tcg/tcg-cpus-icount.c b/accel/tcg/tcg-cpus-icount.c
63
index XXXXXXX..XXXXXXX 100644
64
--- a/accel/tcg/tcg-cpus-icount.c
65
+++ b/accel/tcg/tcg-cpus-icount.c
66
@@ -XXX,XX +XXX,XX @@
67
#include "tcg-cpus-icount.h"
68
#include "tcg-cpus-rr.h"
69
70
-static int64_t tcg_get_icount_limit(void)
71
+static int64_t icount_get_limit(void)
72
{
18
{
73
int64_t deadline;
19
- bool ret = false;
74
20
AVRCPU *cpu = AVR_CPU(cs);
75
@@ -XXX,XX +XXX,XX @@ static int64_t tcg_get_icount_limit(void)
21
CPUAVRState *env = &cpu->env;
76
}
22
77
}
23
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
78
24
avr_cpu_do_interrupt(cs);
79
-static void notify_aio_contexts(void)
25
80
+static void icount_notify_aio_contexts(void)
26
cs->interrupt_request &= ~CPU_INTERRUPT_RESET;
81
{
27
-
82
/* Wake up other AioContexts. */
28
- ret = true;
83
qemu_clock_notify(QEMU_CLOCK_VIRTUAL);
29
+ return true;
84
qemu_clock_run_timers(QEMU_CLOCK_VIRTUAL);
85
}
86
87
-void handle_icount_deadline(void)
88
+void icount_handle_deadline(void)
89
{
90
assert(qemu_in_vcpu_thread());
91
int64_t deadline = qemu_clock_deadline_ns_all(QEMU_CLOCK_VIRTUAL,
92
QEMU_TIMER_ATTR_ALL);
93
94
if (deadline == 0) {
95
- notify_aio_contexts();
96
+ icount_notify_aio_contexts();
97
}
98
}
99
100
-void prepare_icount_for_run(CPUState *cpu)
101
+void icount_prepare_for_run(CPUState *cpu)
102
{
103
int insns_left;
104
105
/*
106
- * These should always be cleared by process_icount_data after
107
+ * These should always be cleared by icount_process_data after
108
* each vCPU execution. However u16.high can be raised
109
- * asynchronously by cpu_exit/cpu_interrupt/tcg_handle_interrupt
110
+ * asynchronously by cpu_exit/cpu_interrupt/tcg_cpus_handle_interrupt
111
*/
112
g_assert(cpu_neg(cpu)->icount_decr.u16.low == 0);
113
g_assert(cpu->icount_extra == 0);
114
115
- cpu->icount_budget = tcg_get_icount_limit();
116
+ cpu->icount_budget = icount_get_limit();
117
insns_left = MIN(0xffff, cpu->icount_budget);
118
cpu_neg(cpu)->icount_decr.u16.low = insns_left;
119
cpu->icount_extra = cpu->icount_budget - insns_left;
120
@@ -XXX,XX +XXX,XX @@ void prepare_icount_for_run(CPUState *cpu)
121
replay_mutex_lock();
122
123
if (cpu->icount_budget == 0 && replay_has_checkpoint()) {
124
- notify_aio_contexts();
125
+ icount_notify_aio_contexts();
126
}
127
}
128
129
-void process_icount_data(CPUState *cpu)
130
+void icount_process_data(CPUState *cpu)
131
{
132
/* Account for executed instructions */
133
icount_update(cpu);
134
@@ -XXX,XX +XXX,XX @@ static void icount_handle_interrupt(CPUState *cpu, int mask)
135
{
136
int old_mask = cpu->interrupt_request;
137
138
- tcg_handle_interrupt(cpu, mask);
139
+ tcg_cpus_handle_interrupt(cpu, mask);
140
if (qemu_cpu_is_self(cpu) &&
141
!cpu->can_do_io
142
&& (mask & ~old_mask) != 0) {
143
@@ -XXX,XX +XXX,XX @@ static void icount_handle_interrupt(CPUState *cpu, int mask)
144
145
const CpusAccel tcg_cpus_icount = {
146
.create_vcpu_thread = rr_start_vcpu_thread,
147
- .kick_vcpu_thread = qemu_cpu_kick_rr_cpus,
148
+ .kick_vcpu_thread = rr_kick_vcpu_thread,
149
150
.handle_interrupt = icount_handle_interrupt,
151
.get_virtual_clock = icount_get,
152
diff --git a/accel/tcg/tcg-cpus-mttcg.c b/accel/tcg/tcg-cpus-mttcg.c
153
index XXXXXXX..XXXXXXX 100644
154
--- a/accel/tcg/tcg-cpus-mttcg.c
155
+++ b/accel/tcg/tcg-cpus-mttcg.c
156
@@ -XXX,XX +XXX,XX @@
157
* current CPUState for a given thread.
158
*/
159
160
-static void *tcg_cpu_thread_fn(void *arg)
161
+static void *mttcg_cpu_thread_fn(void *arg)
162
{
163
CPUState *cpu = arg;
164
165
@@ -XXX,XX +XXX,XX @@ static void *tcg_cpu_thread_fn(void *arg)
166
if (cpu_can_run(cpu)) {
167
int r;
168
qemu_mutex_unlock_iothread();
169
- r = tcg_cpu_exec(cpu);
170
+ r = tcg_cpus_exec(cpu);
171
qemu_mutex_lock_iothread();
172
switch (r) {
173
case EXCP_DEBUG:
174
@@ -XXX,XX +XXX,XX @@ static void *tcg_cpu_thread_fn(void *arg)
175
qemu_wait_io_event(cpu);
176
} while (!cpu->unplug || cpu_can_run(cpu));
177
178
- qemu_tcg_destroy_vcpu(cpu);
179
+ tcg_cpus_destroy(cpu);
180
qemu_mutex_unlock_iothread();
181
rcu_unregister_thread();
182
return NULL;
183
@@ -XXX,XX +XXX,XX @@ static void mttcg_start_vcpu_thread(CPUState *cpu)
184
snprintf(thread_name, VCPU_THREAD_NAME_SIZE, "CPU %d/TCG",
185
cpu->cpu_index);
186
187
- qemu_thread_create(cpu->thread, thread_name, tcg_cpu_thread_fn,
188
+ qemu_thread_create(cpu->thread, thread_name, mttcg_cpu_thread_fn,
189
cpu, QEMU_THREAD_JOINABLE);
190
191
#ifdef _WIN32
192
@@ -XXX,XX +XXX,XX @@ const CpusAccel tcg_cpus_mttcg = {
193
.create_vcpu_thread = mttcg_start_vcpu_thread,
194
.kick_vcpu_thread = mttcg_kick_vcpu_thread,
195
196
- .handle_interrupt = tcg_handle_interrupt,
197
+ .handle_interrupt = tcg_cpus_handle_interrupt,
198
};
199
diff --git a/accel/tcg/tcg-cpus-rr.c b/accel/tcg/tcg-cpus-rr.c
200
index XXXXXXX..XXXXXXX 100644
201
--- a/accel/tcg/tcg-cpus-rr.c
202
+++ b/accel/tcg/tcg-cpus-rr.c
203
@@ -XXX,XX +XXX,XX @@
204
#include "tcg-cpus-icount.h"
205
206
/* Kick all RR vCPUs */
207
-void qemu_cpu_kick_rr_cpus(CPUState *unused)
208
+void rr_kick_vcpu_thread(CPUState *unused)
209
{
210
CPUState *cpu;
211
212
@@ -XXX,XX +XXX,XX @@ void qemu_cpu_kick_rr_cpus(CPUState *unused)
213
* idleness is complete.
214
*/
215
216
-static QEMUTimer *tcg_kick_vcpu_timer;
217
-static CPUState *tcg_current_rr_cpu;
218
+static QEMUTimer *rr_kick_vcpu_timer;
219
+static CPUState *rr_current_cpu;
220
221
#define TCG_KICK_PERIOD (NANOSECONDS_PER_SECOND / 10)
222
223
-static inline int64_t qemu_tcg_next_kick(void)
224
+static inline int64_t rr_next_kick_time(void)
225
{
226
return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + TCG_KICK_PERIOD;
227
}
228
229
/* Kick the currently round-robin scheduled vCPU to next */
230
-static void qemu_cpu_kick_rr_next_cpu(void)
231
+static void rr_kick_next_cpu(void)
232
{
233
CPUState *cpu;
234
do {
235
- cpu = qatomic_mb_read(&tcg_current_rr_cpu);
236
+ cpu = qatomic_mb_read(&rr_current_cpu);
237
if (cpu) {
238
cpu_exit(cpu);
239
}
240
- } while (cpu != qatomic_mb_read(&tcg_current_rr_cpu));
241
+ } while (cpu != qatomic_mb_read(&rr_current_cpu));
242
}
243
244
-static void kick_tcg_thread(void *opaque)
245
+static void rr_kick_thread(void *opaque)
246
{
247
- timer_mod(tcg_kick_vcpu_timer, qemu_tcg_next_kick());
248
- qemu_cpu_kick_rr_next_cpu();
249
+ timer_mod(rr_kick_vcpu_timer, rr_next_kick_time());
250
+ rr_kick_next_cpu();
251
}
252
253
-static void start_tcg_kick_timer(void)
254
+static void rr_start_kick_timer(void)
255
{
256
- if (!tcg_kick_vcpu_timer && CPU_NEXT(first_cpu)) {
257
- tcg_kick_vcpu_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
258
- kick_tcg_thread, NULL);
259
+ if (!rr_kick_vcpu_timer && CPU_NEXT(first_cpu)) {
260
+ rr_kick_vcpu_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
261
+ rr_kick_thread, NULL);
262
}
263
- if (tcg_kick_vcpu_timer && !timer_pending(tcg_kick_vcpu_timer)) {
264
- timer_mod(tcg_kick_vcpu_timer, qemu_tcg_next_kick());
265
+ if (rr_kick_vcpu_timer && !timer_pending(rr_kick_vcpu_timer)) {
266
+ timer_mod(rr_kick_vcpu_timer, rr_next_kick_time());
267
}
268
}
269
270
-static void stop_tcg_kick_timer(void)
271
+static void rr_stop_kick_timer(void)
272
{
273
- if (tcg_kick_vcpu_timer && timer_pending(tcg_kick_vcpu_timer)) {
274
- timer_del(tcg_kick_vcpu_timer);
275
+ if (rr_kick_vcpu_timer && timer_pending(rr_kick_vcpu_timer)) {
276
+ timer_del(rr_kick_vcpu_timer);
277
}
278
}
279
280
-static void qemu_tcg_rr_wait_io_event(void)
281
+static void rr_wait_io_event(void)
282
{
283
CPUState *cpu;
284
285
while (all_cpu_threads_idle()) {
286
- stop_tcg_kick_timer();
287
+ rr_stop_kick_timer();
288
qemu_cond_wait_iothread(first_cpu->halt_cond);
289
}
290
291
- start_tcg_kick_timer();
292
+ rr_start_kick_timer();
293
294
CPU_FOREACH(cpu) {
295
qemu_wait_io_event_common(cpu);
296
@@ -XXX,XX +XXX,XX @@ static void qemu_tcg_rr_wait_io_event(void)
297
* Destroy any remaining vCPUs which have been unplugged and have
298
* finished running
299
*/
300
-static void deal_with_unplugged_cpus(void)
301
+static void rr_deal_with_unplugged_cpus(void)
302
{
303
CPUState *cpu;
304
305
CPU_FOREACH(cpu) {
306
if (cpu->unplug && !cpu_can_run(cpu)) {
307
- qemu_tcg_destroy_vcpu(cpu);
308
+ tcg_cpus_destroy(cpu);
309
break;
310
}
30
}
311
}
31
}
312
@@ -XXX,XX +XXX,XX @@ static void deal_with_unplugged_cpus(void)
32
if (interrupt_request & CPU_INTERRUPT_HARD) {
313
* elsewhere.
33
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
314
*/
34
if (!env->intsrc) {
315
35
cs->interrupt_request &= ~CPU_INTERRUPT_HARD;
316
-static void *tcg_rr_cpu_thread_fn(void *arg)
36
}
317
+static void *rr_cpu_thread_fn(void *arg)
37
-
318
{
38
- ret = true;
319
CPUState *cpu = arg;
39
+ return true;
320
321
@@ -XXX,XX +XXX,XX @@ static void *tcg_rr_cpu_thread_fn(void *arg)
322
}
40
}
323
}
41
}
324
42
- return ret;
325
- start_tcg_kick_timer();
43
+ return false;
326
+ rr_start_kick_timer();
327
328
cpu = first_cpu;
329
330
@@ -XXX,XX +XXX,XX @@ static void *tcg_rr_cpu_thread_fn(void *arg)
331
* Run the timers here. This is much more efficient than
332
* waking up the I/O thread and waiting for completion.
333
*/
334
- handle_icount_deadline();
335
+ icount_handle_deadline();
336
}
337
338
replay_mutex_unlock();
339
@@ -XXX,XX +XXX,XX @@ static void *tcg_rr_cpu_thread_fn(void *arg)
340
341
while (cpu && cpu_work_list_empty(cpu) && !cpu->exit_request) {
342
343
- qatomic_mb_set(&tcg_current_rr_cpu, cpu);
344
+ qatomic_mb_set(&rr_current_cpu, cpu);
345
current_cpu = cpu;
346
347
qemu_clock_enable(QEMU_CLOCK_VIRTUAL,
348
@@ -XXX,XX +XXX,XX @@ static void *tcg_rr_cpu_thread_fn(void *arg)
349
350
qemu_mutex_unlock_iothread();
351
if (icount_enabled()) {
352
- prepare_icount_for_run(cpu);
353
+ icount_prepare_for_run(cpu);
354
}
355
- r = tcg_cpu_exec(cpu);
356
+ r = tcg_cpus_exec(cpu);
357
if (icount_enabled()) {
358
- process_icount_data(cpu);
359
+ icount_process_data(cpu);
360
}
361
qemu_mutex_lock_iothread();
362
363
@@ -XXX,XX +XXX,XX @@ static void *tcg_rr_cpu_thread_fn(void *arg)
364
} /* while (cpu && !cpu->exit_request).. */
365
366
/* Does not need qatomic_mb_set because a spurious wakeup is okay. */
367
- qatomic_set(&tcg_current_rr_cpu, NULL);
368
+ qatomic_set(&rr_current_cpu, NULL);
369
370
if (cpu && cpu->exit_request) {
371
qatomic_mb_set(&cpu->exit_request, 0);
372
@@ -XXX,XX +XXX,XX @@ static void *tcg_rr_cpu_thread_fn(void *arg)
373
qemu_notify_event();
374
}
375
376
- qemu_tcg_rr_wait_io_event();
377
- deal_with_unplugged_cpus();
378
+ rr_wait_io_event();
379
+ rr_deal_with_unplugged_cpus();
380
}
381
382
rcu_unregister_thread();
383
@@ -XXX,XX +XXX,XX @@ void rr_start_vcpu_thread(CPUState *cpu)
384
/* share a single thread for all cpus with TCG */
385
snprintf(thread_name, VCPU_THREAD_NAME_SIZE, "ALL CPUs/TCG");
386
qemu_thread_create(cpu->thread, thread_name,
387
- tcg_rr_cpu_thread_fn,
388
+ rr_cpu_thread_fn,
389
cpu, QEMU_THREAD_JOINABLE);
390
391
single_tcg_halt_cond = cpu->halt_cond;
392
@@ -XXX,XX +XXX,XX @@ void rr_start_vcpu_thread(CPUState *cpu)
393
394
const CpusAccel tcg_cpus_rr = {
395
.create_vcpu_thread = rr_start_vcpu_thread,
396
- .kick_vcpu_thread = qemu_cpu_kick_rr_cpus,
397
+ .kick_vcpu_thread = rr_kick_vcpu_thread,
398
399
- .handle_interrupt = tcg_handle_interrupt,
400
+ .handle_interrupt = tcg_cpus_handle_interrupt,
401
};
402
diff --git a/accel/tcg/tcg-cpus.c b/accel/tcg/tcg-cpus.c
403
index XXXXXXX..XXXXXXX 100644
404
--- a/accel/tcg/tcg-cpus.c
405
+++ b/accel/tcg/tcg-cpus.c
406
@@ -XXX,XX +XXX,XX @@
407
408
/* common functionality among all TCG variants */
409
410
-void qemu_tcg_destroy_vcpu(CPUState *cpu)
411
+void tcg_cpus_destroy(CPUState *cpu)
412
{
413
cpu_thread_signal_destroyed(cpu);
414
}
44
}
415
45
416
-int tcg_cpu_exec(CPUState *cpu)
46
void avr_cpu_do_interrupt(CPUState *cs)
417
+int tcg_cpus_exec(CPUState *cpu)
418
{
419
int ret;
420
#ifdef CONFIG_PROFILER
421
@@ -XXX,XX +XXX,XX @@ int tcg_cpu_exec(CPUState *cpu)
422
}
423
424
/* mask must never be zero, except for A20 change call */
425
-void tcg_handle_interrupt(CPUState *cpu, int mask)
426
+void tcg_cpus_handle_interrupt(CPUState *cpu, int mask)
427
{
428
g_assert(qemu_mutex_iothread_locked());
429
430
--
47
--
431
2.25.1
48
2.34.1
432
49
433
50
diff view generated by jsdifflib
New patch
[PULL 4/4] target/avr: Disable interrupts when env->skip set
1
This bit is not saved across interrupts, so we must
2
delay delivering the interrupt until the skip has
3
been processed.
1
4
5
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1118
6
Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
7
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
8
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
9
---
10
target/avr/helper.c | 9 +++++++++
11
target/avr/translate.c | 26 ++++++++++++++++++++++----
12
2 files changed, 31 insertions(+), 4 deletions(-)
13
14
diff --git a/target/avr/helper.c b/target/avr/helper.c
15
index XXXXXXX..XXXXXXX 100644
16
--- a/target/avr/helper.c
17
+++ b/target/avr/helper.c
18
@@ -XXX,XX +XXX,XX @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
19
AVRCPU *cpu = AVR_CPU(cs);
20
CPUAVRState *env = &cpu->env;
21
22
+ /*
23
+ * We cannot separate a skip from the next instruction,
24
+ * as the skip would not be preserved across the interrupt.
25
+ * Separating the two insn normally only happens at page boundaries.
26
+ */
27
+ if (env->skip) {
28
+ return false;
29
+ }
30
+
31
if (interrupt_request & CPU_INTERRUPT_RESET) {
32
if (cpu_interrupts_enabled(env)) {
33
cs->exception_index = EXCP_RESET;
34
diff --git a/target/avr/translate.c b/target/avr/translate.c
35
index XXXXXXX..XXXXXXX 100644
36
--- a/target/avr/translate.c
37
+++ b/target/avr/translate.c
38
@@ -XXX,XX +XXX,XX @@ static void avr_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
39
if (skip_label) {
40
canonicalize_skip(ctx);
41
gen_set_label(skip_label);
42
- if (ctx->base.is_jmp == DISAS_NORETURN) {
43
+
44
+ switch (ctx->base.is_jmp) {
45
+ case DISAS_NORETURN:
46
ctx->base.is_jmp = DISAS_CHAIN;
47
+ break;
48
+ case DISAS_NEXT:
49
+ if (ctx->base.tb->flags & TB_FLAGS_SKIP) {
50
+ ctx->base.is_jmp = DISAS_TOO_MANY;
51
+ }
52
+ break;
53
+ default:
54
+ break;
55
}
56
}
57
58
@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
59
{
60
DisasContext *ctx = container_of(dcbase, DisasContext, base);
61
bool nonconst_skip = canonicalize_skip(ctx);
62
+ /*
63
+ * Because we disable interrupts while env->skip is set,
64
+ * we must return to the main loop to re-evaluate afterward.
65
+ */
66
+ bool force_exit = ctx->base.tb->flags & TB_FLAGS_SKIP;
67
68
switch (ctx->base.is_jmp) {
69
case DISAS_NORETURN:
70
@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
71
case DISAS_NEXT:
72
case DISAS_TOO_MANY:
73
case DISAS_CHAIN:
74
- if (!nonconst_skip) {
75
+ if (!nonconst_skip && !force_exit) {
76
/* Note gen_goto_tb checks singlestep. */
77
gen_goto_tb(ctx, 1, ctx->npc);
78
break;
79
@@ -XXX,XX +XXX,XX @@ static void avr_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
80
tcg_gen_movi_tl(cpu_pc, ctx->npc);
81
/* fall through */
82
case DISAS_LOOKUP:
83
- tcg_gen_lookup_and_goto_ptr();
84
- break;
85
+ if (!force_exit) {
86
+ tcg_gen_lookup_and_goto_ptr();
87
+ break;
88
+ }
89
+ /* fall through */
90
case DISAS_EXIT:
91
tcg_gen_exit_tb(NULL, 0);
92
break;
93
--
94
2.34.1
95
96
diff view generated by jsdifflib
New patch
[PULL 04/20] linux-user: Honor PT_GNU_STACK
1
Map the stack executable if required by default or on demand.
1
2
3
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
4
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
5
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
6
---
7
include/elf.h | 1 +
8
linux-user/qemu.h | 1 +
9
linux-user/elfload.c | 19 ++++++++++++++++++-
10
3 files changed, 20 insertions(+), 1 deletion(-)
11
12
diff --git a/include/elf.h b/include/elf.h
13
index XXXXXXX..XXXXXXX 100644
14
--- a/include/elf.h
15
+++ b/include/elf.h
16
@@ -XXX,XX +XXX,XX @@ typedef int64_t Elf64_Sxword;
17
#define PT_LOPROC 0x70000000
18
#define PT_HIPROC 0x7fffffff
19
20
+#define PT_GNU_STACK (PT_LOOS + 0x474e551)
21
#define PT_GNU_PROPERTY (PT_LOOS + 0x474e553)
22
23
#define PT_MIPS_REGINFO 0x70000000
24
diff --git a/linux-user/qemu.h b/linux-user/qemu.h
25
index XXXXXXX..XXXXXXX 100644
26
--- a/linux-user/qemu.h
27
+++ b/linux-user/qemu.h
28
@@ -XXX,XX +XXX,XX @@ struct image_info {
29
uint32_t elf_flags;
30
int personality;
31
abi_ulong alignment;
32
+ bool exec_stack;
33
34
/* Generic semihosting knows about these pointers. */
35
abi_ulong arg_strings; /* strings for argv */
36
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
37
index XXXXXXX..XXXXXXX 100644
38
--- a/linux-user/elfload.c
39
+++ b/linux-user/elfload.c
40
@@ -XXX,XX +XXX,XX @@ static bool init_guest_commpage(void)
41
#define ELF_ARCH EM_386
42
43
#define ELF_PLATFORM get_elf_platform()
44
+#define EXSTACK_DEFAULT true
45
46
static const char *get_elf_platform(void)
47
{
48
@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *en
49
50
#define ELF_ARCH EM_ARM
51
#define ELF_CLASS ELFCLASS32
52
+#define EXSTACK_DEFAULT true
53
54
static inline void init_thread(struct target_pt_regs *regs,
55
struct image_info *infop)
56
@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,
57
#else
58
59
#define ELF_CLASS ELFCLASS32
60
+#define EXSTACK_DEFAULT true
61
62
#endif
63
64
@@ -XXX,XX +XXX,XX @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUPPCState *en
65
66
#define ELF_CLASS ELFCLASS64
67
#define ELF_ARCH EM_LOONGARCH
68
+#define EXSTACK_DEFAULT true
69
70
#define elf_check_arch(x) ((x) == EM_LOONGARCH)
71
72
@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap(void)
73
#define ELF_CLASS ELFCLASS32
74
#endif
75
#define ELF_ARCH EM_MIPS
76
+#define EXSTACK_DEFAULT true
77
78
#ifdef TARGET_ABI_MIPSN32
79
#define elf_check_abi(x) ((x) & EF_MIPS_ABI2)
80
@@ -XXX,XX +XXX,XX @@ static inline void init_thread(struct target_pt_regs *regs,
81
#define bswaptls(ptr) bswap32s(ptr)
82
#endif
83
84
+#ifndef EXSTACK_DEFAULT
85
+#define EXSTACK_DEFAULT false
86
+#endif
87
+
88
#include "elf.h"
89
90
/* We must delay the following stanzas until after "elf.h". */
91
@@ -XXX,XX +XXX,XX @@ static abi_ulong setup_arg_pages(struct linux_binprm *bprm,
92
struct image_info *info)
93
{
94
abi_ulong size, error, guard;
95
+ int prot;
96
97
size = guest_stack_size;
98
if (size < STACK_LOWER_LIMIT) {
99
@@ -XXX,XX +XXX,XX @@ static abi_ulong setup_arg_pages(struct linux_binprm *bprm,
100
guard = qemu_real_host_page_size();
101
}
102
103
- error = target_mmap(0, size + guard, PROT_READ | PROT_WRITE,
104
+ prot = PROT_READ | PROT_WRITE;
105
+ if (info->exec_stack) {
106
+ prot |= PROT_EXEC;
107
+ }
108
+ error = target_mmap(0, size + guard, prot,
109
MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
110
if (error == -1) {
111
perror("mmap stack");
112
@@ -XXX,XX +XXX,XX @@ static void load_elf_image(const char *image_name, int image_fd,
113
*/
114
loaddr = -1, hiaddr = 0;
115
info->alignment = 0;
116
+ info->exec_stack = EXSTACK_DEFAULT;
117
for (i = 0; i < ehdr->e_phnum; ++i) {
118
struct elf_phdr *eppnt = phdr + i;
119
if (eppnt->p_type == PT_LOAD) {
120
@@ -XXX,XX +XXX,XX @@ static void load_elf_image(const char *image_name, int image_fd,
121
if (!parse_elf_properties(image_fd, info, eppnt, bprm_buf, &err)) {
122
goto exit_errmsg;
123
}
124
+ } else if (eppnt->p_type == PT_GNU_STACK) {
125
+ info->exec_stack = eppnt->p_flags & PF_X;
126
}
127
}
128
129
--
130
2.34.1
diff view generated by jsdifflib
New patch
[PULL 05/20] linux-user: Clear translations on mprotect()
1
From: Ilya Leoshkevich <iii@linux.ibm.com>
1
2
3
Currently it's possible to execute pages that do not have PAGE_EXEC
4
if there is an existing translation block. Fix by invalidating TBs
5
that touch the affected pages.
6
7
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
8
Message-Id: <20220817150506.592862-2-iii@linux.ibm.com>
9
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
10
---
11
linux-user/mmap.c | 6 ++++--
12
1 file changed, 4 insertions(+), 2 deletions(-)
13
14
diff --git a/linux-user/mmap.c b/linux-user/mmap.c
15
index XXXXXXX..XXXXXXX 100644
16
--- a/linux-user/mmap.c
17
+++ b/linux-user/mmap.c
18
@@ -XXX,XX +XXX,XX @@ int target_mprotect(abi_ulong start, abi_ulong len, int target_prot)
19
goto error;
20
}
21
}
22
+
23
page_set_flags(start, start + len, page_flags);
24
- mmap_unlock();
25
- return 0;
26
+ tb_invalidate_phys_range(start, start + len);
27
+ ret = 0;
28
+
29
error:
30
mmap_unlock();
31
return ret;
32
--
33
2.34.1
diff view generated by jsdifflib
New patch
[PULL 06/20] tests/tcg/i386: Move smc_code2 to an executable section
1
We're about to start validating PAGE_EXEC, which means
2
that we've got to put this code into a section that is
3
both writable and executable.
1
4
5
Note that this test did not run on hardware beforehand either.
6
7
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
8
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
9
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
10
---
11
tests/tcg/i386/test-i386.c | 2 +-
12
1 file changed, 1 insertion(+), 1 deletion(-)
13
14
diff --git a/tests/tcg/i386/test-i386.c b/tests/tcg/i386/test-i386.c
15
index XXXXXXX..XXXXXXX 100644
16
--- a/tests/tcg/i386/test-i386.c
17
+++ b/tests/tcg/i386/test-i386.c
18
@@ -XXX,XX +XXX,XX @@ uint8_t code[] = {
19
0xc3, /* ret */
20
};
21
22
-asm(".section \".data\"\n"
23
+asm(".section \".data_x\",\"awx\"\n"
24
"smc_code2:\n"
25
"movl 4(%esp), %eax\n"
26
"movl %eax, smc_patch_addr2 + 1\n"
27
--
28
2.34.1
diff view generated by jsdifflib
New patch
[PULL 07/20] accel/tcg: Introduce is_same_page()
1
From: Ilya Leoshkevich <iii@linux.ibm.com>
1
2
3
Introduce a function that checks whether a given address is on the same
4
page as where disassembly started. Having it improves readability of
5
the following patches.
6
7
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
8
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
9
Message-Id: <20220811095534.241224-3-iii@linux.ibm.com>
10
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
11
[rth: Make the DisasContextBase parameter const.]
12
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
13
---
14
include/exec/translator.h | 10 ++++++++++
15
1 file changed, 10 insertions(+)
16
17
diff --git a/include/exec/translator.h b/include/exec/translator.h
18
index XXXXXXX..XXXXXXX 100644
19
--- a/include/exec/translator.h
20
+++ b/include/exec/translator.h
21
@@ -XXX,XX +XXX,XX @@ FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
22
23
#undef GEN_TRANSLATOR_LD
24
25
+/*
26
+ * Return whether addr is on the same page as where disassembly started.
27
+ * Translators can use this to enforce the rule that only single-insn
28
+ * translation blocks are allowed to cross page boundaries.
29
+ */
30
+static inline bool is_same_page(const DisasContextBase *db, target_ulong addr)
31
+{
32
+ return ((addr ^ db->pc_first) & TARGET_PAGE_MASK) == 0;
33
+}
34
+
35
#endif /* EXEC__TRANSLATOR_H */
36
--
37
2.34.1
diff view generated by jsdifflib
New patch
[PULL 08/20] accel/tcg: Properly implement get_page_addr_code for user-only
1
The current implementation is a no-op, simply returning addr.
2
This is incorrect, because we ought to be checking the page
3
permissions for execution.
1
4
5
Make get_page_addr_code inline for both implementations.
6
7
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
8
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
9
Acked-by: Alistair Francis <alistair.francis@wdc.com>
10
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
11
---
12
include/exec/exec-all.h | 85 ++++++++++++++---------------------------
13
accel/tcg/cputlb.c | 5 ---
14
accel/tcg/user-exec.c | 14 +++++++
15
3 files changed, 42 insertions(+), 62 deletions(-)
16
17
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
18
index XXXXXXX..XXXXXXX 100644
19
--- a/include/exec/exec-all.h
20
+++ b/include/exec/exec-all.h
21
@@ -XXX,XX +XXX,XX @@ struct MemoryRegionSection *iotlb_to_section(CPUState *cpu,
22
hwaddr index, MemTxAttrs attrs);
23
#endif
24
25
-#if defined(CONFIG_USER_ONLY)
26
-void mmap_lock(void);
27
-void mmap_unlock(void);
28
-bool have_mmap_lock(void);
29
-
30
/**
31
- * get_page_addr_code() - user-mode version
32
+ * get_page_addr_code_hostp()
33
* @env: CPUArchState
34
* @addr: guest virtual address of guest code
35
*
36
- * Returns @addr.
37
+ * See get_page_addr_code() (full-system version) for documentation on the
38
+ * return value.
39
+ *
40
+ * Sets *@hostp (when @hostp is non-NULL) as follows.
41
+ * If the return value is -1, sets *@hostp to NULL. Otherwise, sets *@hostp
42
+ * to the host address where @addr's content is kept.
43
+ *
44
+ * Note: this function can trigger an exception.
45
+ */
46
+tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
47
+ void **hostp);
48
+
49
+/**
50
+ * get_page_addr_code()
51
+ * @env: CPUArchState
52
+ * @addr: guest virtual address of guest code
53
+ *
54
+ * If we cannot translate and execute from the entire RAM page, or if
55
+ * the region is not backed by RAM, returns -1. Otherwise, returns the
56
+ * ram_addr_t corresponding to the guest code at @addr.
57
+ *
58
+ * Note: this function can trigger an exception.
59
*/
60
static inline tb_page_addr_t get_page_addr_code(CPUArchState *env,
61
target_ulong addr)
62
{
63
- return addr;
64
+ return get_page_addr_code_hostp(env, addr, NULL);
65
}
66
67
-/**
68
- * get_page_addr_code_hostp() - user-mode version
69
- * @env: CPUArchState
70
- * @addr: guest virtual address of guest code
71
- *
72
- * Returns @addr.
73
- *
74
- * If @hostp is non-NULL, sets *@hostp to the host address where @addr's content
75
- * is kept.
76
- */
77
-static inline tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env,
78
- target_ulong addr,
79
- void **hostp)
80
-{
81
- if (hostp) {
82
- *hostp = g2h_untagged(addr);
83
- }
84
- return addr;
85
-}
86
+#if defined(CONFIG_USER_ONLY)
87
+void mmap_lock(void);
88
+void mmap_unlock(void);
89
+bool have_mmap_lock(void);
90
91
/**
92
* adjust_signal_pc:
93
@@ -XXX,XX +XXX,XX @@ G_NORETURN void cpu_loop_exit_sigbus(CPUState *cpu, target_ulong addr,
94
static inline void mmap_lock(void) {}
95
static inline void mmap_unlock(void) {}
96
97
-/**
98
- * get_page_addr_code() - full-system version
99
- * @env: CPUArchState
100
- * @addr: guest virtual address of guest code
101
- *
102
- * If we cannot translate and execute from the entire RAM page, or if
103
- * the region is not backed by RAM, returns -1. Otherwise, returns the
104
- * ram_addr_t corresponding to the guest code at @addr.
105
- *
106
- * Note: this function can trigger an exception.
107
- */
108
-tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr);
109
-
110
-/**
111
- * get_page_addr_code_hostp() - full-system version
112
- * @env: CPUArchState
113
- * @addr: guest virtual address of guest code
114
- *
115
- * See get_page_addr_code() (full-system version) for documentation on the
116
- * return value.
117
- *
118
- * Sets *@hostp (when @hostp is non-NULL) as follows.
119
- * If the return value is -1, sets *@hostp to NULL. Otherwise, sets *@hostp
120
- * to the host address where @addr's content is kept.
121
- *
122
- * Note: this function can trigger an exception.
123
- */
124
-tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
125
- void **hostp);
126
-
127
void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length);
128
void tlb_set_dirty(CPUState *cpu, target_ulong vaddr);
129
130
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
131
index XXXXXXX..XXXXXXX 100644
132
--- a/accel/tcg/cputlb.c
133
+++ b/accel/tcg/cputlb.c
134
@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
135
return qemu_ram_addr_from_host_nofail(p);
136
}
137
138
-tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)
139
-{
140
- return get_page_addr_code_hostp(env, addr, NULL);
141
-}
142
-
143
static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
144
CPUIOTLBEntry *iotlbentry, uintptr_t retaddr)
145
{
146
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
147
index XXXXXXX..XXXXXXX 100644
148
--- a/accel/tcg/user-exec.c
149
+++ b/accel/tcg/user-exec.c
150
@@ -XXX,XX +XXX,XX @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
151
return size ? g2h(env_cpu(env), addr) : NULL;
152
}
153
154
+tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
155
+ void **hostp)
156
+{
157
+ int flags;
158
+
159
+ flags = probe_access_internal(env, addr, 1, MMU_INST_FETCH, false, 0);
160
+ g_assert(flags == 0);
161
+
162
+ if (hostp) {
163
+ *hostp = g2h_untagged(addr);
164
+ }
165
+ return addr;
166
+}
167
+
168
/* The softmmu versions of these helpers are in cputlb.c. */
169
170
/*
171
--
172
2.34.1
diff view generated by jsdifflib
New patch
[PULL 09/20] accel/tcg: Unlock mmap_lock after longjmp
1
The mmap_lock is held around tb_gen_code. While the comment
2
is correct that the lock is dropped when tb_gen_code runs out
3
of memory, the lock is *not* dropped when an exception is
4
raised reading code for translation.
1
5
6
Acked-by: Alistair Francis <alistair.francis@wdc.com>
7
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
8
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
9
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
10
---
11
accel/tcg/cpu-exec.c | 12 ++++++------
12
accel/tcg/user-exec.c | 3 ---
13
2 files changed, 6 insertions(+), 9 deletions(-)
14
15
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
16
index XXXXXXX..XXXXXXX 100644
17
--- a/accel/tcg/cpu-exec.c
18
+++ b/accel/tcg/cpu-exec.c
19
@@ -XXX,XX +XXX,XX @@ void cpu_exec_step_atomic(CPUState *cpu)
20
cpu_tb_exec(cpu, tb, &tb_exit);
21
cpu_exec_exit(cpu);
22
} else {
23
- /*
24
- * The mmap_lock is dropped by tb_gen_code if it runs out of
25
- * memory.
26
- */
27
#ifndef CONFIG_SOFTMMU
28
clear_helper_retaddr();
29
- tcg_debug_assert(!have_mmap_lock());
30
+ if (have_mmap_lock()) {
31
+ mmap_unlock();
32
+ }
33
#endif
34
if (qemu_mutex_iothread_locked()) {
35
qemu_mutex_unlock_iothread();
36
@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)
37
38
#ifndef CONFIG_SOFTMMU
39
clear_helper_retaddr();
40
- tcg_debug_assert(!have_mmap_lock());
41
+ if (have_mmap_lock()) {
42
+ mmap_unlock();
43
+ }
44
#endif
45
if (qemu_mutex_iothread_locked()) {
46
qemu_mutex_unlock_iothread();
47
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
48
index XXXXXXX..XXXXXXX 100644
49
--- a/accel/tcg/user-exec.c
50
+++ b/accel/tcg/user-exec.c
51
@@ -XXX,XX +XXX,XX @@ MMUAccessType adjust_signal_pc(uintptr_t *pc, bool is_write)
52
* (and if the translator doesn't handle page boundaries correctly
53
* there's little we can do about that here). Therefore, do not
54
* trigger the unwinder.
55
- *
56
- * Like tb_gen_code, release the memory lock before cpu_loop_exit.
57
*/
58
- mmap_unlock();
59
*pc = 0;
60
return MMU_INST_FETCH;
61
}
62
--
63
2.34.1
diff view generated by jsdifflib
[PULL 2/3] accel/tcg: split tcg_start_vcpu_thread
[PULL 10/20] accel/tcg: Make tb_htable_lookup static
1
From: Claudio Fontana <cfontana@suse.de>
1
The function is not used outside of cpu-exec.c. Move it and
2
its subroutines up in the file, before the first use.
2
3
3
after the initial split into 3 tcg variants, we proceed to also
4
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
4
split tcg_start_vcpu_thread.
5
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
5
6
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
6
We actually split it in 2 this time, since the icount variant
7
just uses the round robin function.
8
9
Suggested-by: Richard Henderson <richard.henderson@linaro.org>
10
Signed-off-by: Claudio Fontana <cfontana@suse.de>
11
Message-Id: <20201015143217.29337-3-cfontana@suse.de>
12
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
13
---
8
---
14
accel/tcg/tcg-cpus-mttcg.h | 21 --------------
9
include/exec/exec-all.h | 3 -
15
accel/tcg/tcg-cpus-rr.h | 3 +-
10
accel/tcg/cpu-exec.c | 122 ++++++++++++++++++++--------------------
16
accel/tcg/tcg-cpus.h | 1 -
11
2 files changed, 61 insertions(+), 64 deletions(-)
17
accel/tcg/tcg-all.c | 5 ++++
18
accel/tcg/tcg-cpus-icount.c | 2 +-
19
accel/tcg/tcg-cpus-mttcg.c | 29 +++++++++++++++++--
20
accel/tcg/tcg-cpus-rr.c | 39 +++++++++++++++++++++++--
21
accel/tcg/tcg-cpus.c | 58 -------------------------------------
22
8 files changed, 71 insertions(+), 87 deletions(-)
23
delete mode 100644 accel/tcg/tcg-cpus-mttcg.h
24
12
25
diff --git a/accel/tcg/tcg-cpus-mttcg.h b/accel/tcg/tcg-cpus-mttcg.h
13
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
26
deleted file mode 100644
27
index XXXXXXX..XXXXXXX
28
--- a/accel/tcg/tcg-cpus-mttcg.h
29
+++ /dev/null
30
@@ -XXX,XX +XXX,XX @@
31
-/*
32
- * QEMU TCG Multi Threaded vCPUs implementation
33
- *
34
- * Copyright 2020 SUSE LLC
35
- *
36
- * This work is licensed under the terms of the GNU GPL, version 2 or later.
37
- * See the COPYING file in the top-level directory.
38
- */
39
-
40
-#ifndef TCG_CPUS_MTTCG_H
41
-#define TCG_CPUS_MTTCG_H
42
-
43
-/*
44
- * In the multi-threaded case each vCPU has its own thread. The TLS
45
- * variable current_cpu can be used deep in the code to find the
46
- * current CPUState for a given thread.
47
- */
48
-
49
-void *tcg_cpu_thread_fn(void *arg);
50
-
51
-#endif /* TCG_CPUS_MTTCG_H */
52
diff --git a/accel/tcg/tcg-cpus-rr.h b/accel/tcg/tcg-cpus-rr.h
53
index XXXXXXX..XXXXXXX 100644
14
index XXXXXXX..XXXXXXX 100644
54
--- a/accel/tcg/tcg-cpus-rr.h
15
--- a/include/exec/exec-all.h
55
+++ b/accel/tcg/tcg-cpus-rr.h
16
+++ b/include/exec/exec-all.h
56
@@ -XXX,XX +XXX,XX @@
17
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs);
57
/* Kick all RR vCPUs. */
18
#endif
58
void qemu_cpu_kick_rr_cpus(CPUState *unused);
19
void tb_flush(CPUState *cpu);
59
20
void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr);
60
-void *tcg_rr_cpu_thread_fn(void *arg);
21
-TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
61
+/* start the round robin vcpu thread */
22
- target_ulong cs_base, uint32_t flags,
62
+void rr_start_vcpu_thread(CPUState *cpu);
23
- uint32_t cflags);
63
24
void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr);
64
#endif /* TCG_CPUS_RR_H */
25
65
diff --git a/accel/tcg/tcg-cpus.h b/accel/tcg/tcg-cpus.h
26
/* GETPC is the true target of the return instruction that we'll execute. */
27
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
66
index XXXXXXX..XXXXXXX 100644
28
index XXXXXXX..XXXXXXX 100644
67
--- a/accel/tcg/tcg-cpus.h
29
--- a/accel/tcg/cpu-exec.c
68
+++ b/accel/tcg/tcg-cpus.h
30
+++ b/accel/tcg/cpu-exec.c
69
@@ -XXX,XX +XXX,XX @@ extern const CpusAccel tcg_cpus_mttcg;
31
@@ -XXX,XX +XXX,XX @@ uint32_t curr_cflags(CPUState *cpu)
70
extern const CpusAccel tcg_cpus_icount;
32
return cflags;
71
extern const CpusAccel tcg_cpus_rr;
33
}
72
34
73
-void tcg_start_vcpu_thread(CPUState *cpu);
35
+struct tb_desc {
74
void qemu_tcg_destroy_vcpu(CPUState *cpu);
36
+ target_ulong pc;
75
int tcg_cpu_exec(CPUState *cpu);
37
+ target_ulong cs_base;
76
void tcg_handle_interrupt(CPUState *cpu, int mask);
38
+ CPUArchState *env;
77
diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
39
+ tb_page_addr_t phys_page1;
78
index XXXXXXX..XXXXXXX 100644
40
+ uint32_t flags;
79
--- a/accel/tcg/tcg-all.c
41
+ uint32_t cflags;
80
+++ b/accel/tcg/tcg-all.c
42
+ uint32_t trace_vcpu_dstate;
81
@@ -XXX,XX +XXX,XX @@ static int tcg_init(MachineState *ms)
43
+};
82
tcg_exec_init(s->tb_size * 1024 * 1024);
83
mttcg_enabled = s->mttcg_enabled;
84
85
+ /*
86
+ * Initialize TCG regions
87
+ */
88
+ tcg_region_init();
89
+
44
+
90
if (mttcg_enabled) {
45
+static bool tb_lookup_cmp(const void *p, const void *d)
91
cpus_register_accel(&tcg_cpus_mttcg);
92
} else if (icount_enabled()) {
93
diff --git a/accel/tcg/tcg-cpus-icount.c b/accel/tcg/tcg-cpus-icount.c
94
index XXXXXXX..XXXXXXX 100644
95
--- a/accel/tcg/tcg-cpus-icount.c
96
+++ b/accel/tcg/tcg-cpus-icount.c
97
@@ -XXX,XX +XXX,XX @@ static void icount_handle_interrupt(CPUState *cpu, int mask)
98
}
99
100
const CpusAccel tcg_cpus_icount = {
101
- .create_vcpu_thread = tcg_start_vcpu_thread,
102
+ .create_vcpu_thread = rr_start_vcpu_thread,
103
.kick_vcpu_thread = qemu_cpu_kick_rr_cpus,
104
105
.handle_interrupt = icount_handle_interrupt,
106
diff --git a/accel/tcg/tcg-cpus-mttcg.c b/accel/tcg/tcg-cpus-mttcg.c
107
index XXXXXXX..XXXXXXX 100644
108
--- a/accel/tcg/tcg-cpus-mttcg.c
109
+++ b/accel/tcg/tcg-cpus-mttcg.c
110
@@ -XXX,XX +XXX,XX @@
111
#include "hw/boards.h"
112
113
#include "tcg-cpus.h"
114
-#include "tcg-cpus-mttcg.h"
115
116
/*
117
* In the multi-threaded case each vCPU has its own thread. The TLS
118
@@ -XXX,XX +XXX,XX @@
119
* current CPUState for a given thread.
120
*/
121
122
-void *tcg_cpu_thread_fn(void *arg)
123
+static void *tcg_cpu_thread_fn(void *arg)
124
{
125
CPUState *cpu = arg;
126
127
@@ -XXX,XX +XXX,XX @@ static void mttcg_kick_vcpu_thread(CPUState *cpu)
128
cpu_exit(cpu);
129
}
130
131
+static void mttcg_start_vcpu_thread(CPUState *cpu)
132
+{
46
+{
133
+ char thread_name[VCPU_THREAD_NAME_SIZE];
47
+ const TranslationBlock *tb = p;
48
+ const struct tb_desc *desc = d;
134
+
49
+
135
+ g_assert(tcg_enabled());
50
+ if (tb->pc == desc->pc &&
51
+ tb->page_addr[0] == desc->phys_page1 &&
52
+ tb->cs_base == desc->cs_base &&
53
+ tb->flags == desc->flags &&
54
+ tb->trace_vcpu_dstate == desc->trace_vcpu_dstate &&
55
+ tb_cflags(tb) == desc->cflags) {
56
+ /* check next page if needed */
57
+ if (tb->page_addr[1] == -1) {
58
+ return true;
59
+ } else {
60
+ tb_page_addr_t phys_page2;
61
+ target_ulong virt_page2;
136
+
62
+
137
+ parallel_cpus = (current_machine->smp.max_cpus > 1);
63
+ virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
138
+
64
+ phys_page2 = get_page_addr_code(desc->env, virt_page2);
139
+ cpu->thread = g_malloc0(sizeof(QemuThread));
65
+ if (tb->page_addr[1] == phys_page2) {
140
+ cpu->halt_cond = g_malloc0(sizeof(QemuCond));
66
+ return true;
141
+ qemu_cond_init(cpu->halt_cond);
67
+ }
142
+
68
+ }
143
+ /* create a thread per vCPU with TCG (MTTCG) */
69
+ }
144
+ snprintf(thread_name, VCPU_THREAD_NAME_SIZE, "CPU %d/TCG",
70
+ return false;
145
+ cpu->cpu_index);
146
+
147
+ qemu_thread_create(cpu->thread, thread_name, tcg_cpu_thread_fn,
148
+ cpu, QEMU_THREAD_JOINABLE);
149
+
150
+#ifdef _WIN32
151
+ cpu->hThread = qemu_thread_get_handle(cpu->thread);
152
+#endif
153
+}
71
+}
154
+
72
+
155
const CpusAccel tcg_cpus_mttcg = {
73
+static TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
156
- .create_vcpu_thread = tcg_start_vcpu_thread,
74
+ target_ulong cs_base, uint32_t flags,
157
+ .create_vcpu_thread = mttcg_start_vcpu_thread,
75
+ uint32_t cflags)
158
.kick_vcpu_thread = mttcg_kick_vcpu_thread,
159
160
.handle_interrupt = tcg_handle_interrupt,
161
diff --git a/accel/tcg/tcg-cpus-rr.c b/accel/tcg/tcg-cpus-rr.c
162
index XXXXXXX..XXXXXXX 100644
163
--- a/accel/tcg/tcg-cpus-rr.c
164
+++ b/accel/tcg/tcg-cpus-rr.c
165
@@ -XXX,XX +XXX,XX @@ static void deal_with_unplugged_cpus(void)
166
* elsewhere.
167
*/
168
169
-void *tcg_rr_cpu_thread_fn(void *arg)
170
+static void *tcg_rr_cpu_thread_fn(void *arg)
171
{
172
CPUState *cpu = arg;
173
174
@@ -XXX,XX +XXX,XX @@ void *tcg_rr_cpu_thread_fn(void *arg)
175
return NULL;
176
}
177
178
+void rr_start_vcpu_thread(CPUState *cpu)
179
+{
76
+{
180
+ char thread_name[VCPU_THREAD_NAME_SIZE];
77
+ tb_page_addr_t phys_pc;
181
+ static QemuCond *single_tcg_halt_cond;
78
+ struct tb_desc desc;
182
+ static QemuThread *single_tcg_cpu_thread;
79
+ uint32_t h;
183
+
80
+
184
+ g_assert(tcg_enabled());
81
+ desc.env = cpu->env_ptr;
185
+ parallel_cpus = false;
82
+ desc.cs_base = cs_base;
186
+
83
+ desc.flags = flags;
187
+ if (!single_tcg_cpu_thread) {
84
+ desc.cflags = cflags;
188
+ cpu->thread = g_malloc0(sizeof(QemuThread));
85
+ desc.trace_vcpu_dstate = *cpu->trace_dstate;
189
+ cpu->halt_cond = g_malloc0(sizeof(QemuCond));
86
+ desc.pc = pc;
190
+ qemu_cond_init(cpu->halt_cond);
87
+ phys_pc = get_page_addr_code(desc.env, pc);
191
+
88
+ if (phys_pc == -1) {
192
+ /* share a single thread for all cpus with TCG */
89
+ return NULL;
193
+ snprintf(thread_name, VCPU_THREAD_NAME_SIZE, "ALL CPUs/TCG");
194
+ qemu_thread_create(cpu->thread, thread_name,
195
+ tcg_rr_cpu_thread_fn,
196
+ cpu, QEMU_THREAD_JOINABLE);
197
+
198
+ single_tcg_halt_cond = cpu->halt_cond;
199
+ single_tcg_cpu_thread = cpu->thread;
200
+#ifdef _WIN32
201
+ cpu->hThread = qemu_thread_get_handle(cpu->thread);
202
+#endif
203
+ } else {
204
+ /* we share the thread */
205
+ cpu->thread = single_tcg_cpu_thread;
206
+ cpu->halt_cond = single_tcg_halt_cond;
207
+ cpu->thread_id = first_cpu->thread_id;
208
+ cpu->can_do_io = 1;
209
+ cpu->created = true;
210
+ }
90
+ }
91
+ desc.phys_page1 = phys_pc & TARGET_PAGE_MASK;
92
+ h = tb_hash_func(phys_pc, pc, flags, cflags, *cpu->trace_dstate);
93
+ return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
211
+}
94
+}
212
+
95
+
213
const CpusAccel tcg_cpus_rr = {
96
/* Might cause an exception, so have a longjmp destination ready */
214
- .create_vcpu_thread = tcg_start_vcpu_thread,
97
static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
215
+ .create_vcpu_thread = rr_start_vcpu_thread,
98
target_ulong cs_base,
216
.kick_vcpu_thread = qemu_cpu_kick_rr_cpus,
99
@@ -XXX,XX +XXX,XX @@ void cpu_exec_step_atomic(CPUState *cpu)
217
100
end_exclusive();
218
.handle_interrupt = tcg_handle_interrupt,
101
}
219
diff --git a/accel/tcg/tcg-cpus.c b/accel/tcg/tcg-cpus.c
102
220
index XXXXXXX..XXXXXXX 100644
103
-struct tb_desc {
221
--- a/accel/tcg/tcg-cpus.c
104
- target_ulong pc;
222
+++ b/accel/tcg/tcg-cpus.c
105
- target_ulong cs_base;
223
@@ -XXX,XX +XXX,XX @@
106
- CPUArchState *env;
224
#include "hw/boards.h"
107
- tb_page_addr_t phys_page1;
225
108
- uint32_t flags;
226
#include "tcg-cpus.h"
109
- uint32_t cflags;
227
-#include "tcg-cpus-mttcg.h"
110
- uint32_t trace_vcpu_dstate;
228
-#include "tcg-cpus-rr.h"
111
-};
229
112
-
230
/* common functionality among all TCG variants */
113
-static bool tb_lookup_cmp(const void *p, const void *d)
231
232
-void tcg_start_vcpu_thread(CPUState *cpu)
233
-{
114
-{
234
- char thread_name[VCPU_THREAD_NAME_SIZE];
115
- const TranslationBlock *tb = p;
235
- static QemuCond *single_tcg_halt_cond;
116
- const struct tb_desc *desc = d;
236
- static QemuThread *single_tcg_cpu_thread;
237
- static int tcg_region_inited;
238
-
117
-
239
- assert(tcg_enabled());
118
- if (tb->pc == desc->pc &&
240
- /*
119
- tb->page_addr[0] == desc->phys_page1 &&
241
- * Initialize TCG regions--once. Now is a good time, because:
120
- tb->cs_base == desc->cs_base &&
242
- * (1) TCG's init context, prologue and target globals have been set up.
121
- tb->flags == desc->flags &&
243
- * (2) qemu_tcg_mttcg_enabled() works now (TCG init code runs before the
122
- tb->trace_vcpu_dstate == desc->trace_vcpu_dstate &&
244
- * -accel flag is processed, so the check doesn't work then).
123
- tb_cflags(tb) == desc->cflags) {
245
- */
124
- /* check next page if needed */
246
- if (!tcg_region_inited) {
125
- if (tb->page_addr[1] == -1) {
247
- tcg_region_inited = 1;
126
- return true;
248
- tcg_region_init();
127
- } else {
249
- parallel_cpus = qemu_tcg_mttcg_enabled() && current_machine->smp.max_cpus > 1;
128
- tb_page_addr_t phys_page2;
129
- target_ulong virt_page2;
130
-
131
- virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
132
- phys_page2 = get_page_addr_code(desc->env, virt_page2);
133
- if (tb->page_addr[1] == phys_page2) {
134
- return true;
135
- }
136
- }
250
- }
137
- }
251
-
138
- return false;
252
- if (qemu_tcg_mttcg_enabled() || !single_tcg_cpu_thread) {
253
- cpu->thread = g_malloc0(sizeof(QemuThread));
254
- cpu->halt_cond = g_malloc0(sizeof(QemuCond));
255
- qemu_cond_init(cpu->halt_cond);
256
-
257
- if (qemu_tcg_mttcg_enabled()) {
258
- /* create a thread per vCPU with TCG (MTTCG) */
259
- snprintf(thread_name, VCPU_THREAD_NAME_SIZE, "CPU %d/TCG",
260
- cpu->cpu_index);
261
-
262
- qemu_thread_create(cpu->thread, thread_name, tcg_cpu_thread_fn,
263
- cpu, QEMU_THREAD_JOINABLE);
264
-
265
- } else {
266
- /* share a single thread for all cpus with TCG */
267
- snprintf(thread_name, VCPU_THREAD_NAME_SIZE, "ALL CPUs/TCG");
268
- qemu_thread_create(cpu->thread, thread_name,
269
- tcg_rr_cpu_thread_fn,
270
- cpu, QEMU_THREAD_JOINABLE);
271
-
272
- single_tcg_halt_cond = cpu->halt_cond;
273
- single_tcg_cpu_thread = cpu->thread;
274
- }
275
-#ifdef _WIN32
276
- cpu->hThread = qemu_thread_get_handle(cpu->thread);
277
-#endif
278
- } else {
279
- /* For non-MTTCG cases we share the thread */
280
- cpu->thread = single_tcg_cpu_thread;
281
- cpu->halt_cond = single_tcg_halt_cond;
282
- cpu->thread_id = first_cpu->thread_id;
283
- cpu->can_do_io = 1;
284
- cpu->created = true;
285
- }
286
-}
139
-}
287
-
140
-
288
void qemu_tcg_destroy_vcpu(CPUState *cpu)
141
-TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
142
- target_ulong cs_base, uint32_t flags,
143
- uint32_t cflags)
144
-{
145
- tb_page_addr_t phys_pc;
146
- struct tb_desc desc;
147
- uint32_t h;
148
-
149
- desc.env = cpu->env_ptr;
150
- desc.cs_base = cs_base;
151
- desc.flags = flags;
152
- desc.cflags = cflags;
153
- desc.trace_vcpu_dstate = *cpu->trace_dstate;
154
- desc.pc = pc;
155
- phys_pc = get_page_addr_code(desc.env, pc);
156
- if (phys_pc == -1) {
157
- return NULL;
158
- }
159
- desc.phys_page1 = phys_pc & TARGET_PAGE_MASK;
160
- h = tb_hash_func(phys_pc, pc, flags, cflags, *cpu->trace_dstate);
161
- return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
162
-}
163
-
164
void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr)
289
{
165
{
290
cpu_thread_signal_destroyed(cpu);
166
if (TCG_TARGET_HAS_direct_jump) {
291
--
167
--
292
2.25.1
168
2.34.1
293
294
diff view generated by jsdifflib
New patch
[PULL 11/20] accel/tcg: Move qemu_ram_addr_from_host_nofail to physmem.c
1
The base qemu_ram_addr_from_host function is already in
2
softmmu/physmem.c; move the nofail version to be adjacent.
1
3
4
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
5
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
6
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
7
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
8
---
9
include/exec/cpu-common.h | 1 +
10
accel/tcg/cputlb.c | 12 ------------
11
softmmu/physmem.c | 12 ++++++++++++
12
3 files changed, 13 insertions(+), 12 deletions(-)
13
14
diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
15
index XXXXXXX..XXXXXXX 100644
16
--- a/include/exec/cpu-common.h
17
+++ b/include/exec/cpu-common.h
18
@@ -XXX,XX +XXX,XX @@ typedef uintptr_t ram_addr_t;
19
void qemu_ram_remap(ram_addr_t addr, ram_addr_t length);
20
/* This should not be used by devices. */
21
ram_addr_t qemu_ram_addr_from_host(void *ptr);
22
+ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr);
23
RAMBlock *qemu_ram_block_by_name(const char *name);
24
RAMBlock *qemu_ram_block_from_host(void *ptr, bool round_offset,
25
ram_addr_t *offset);
26
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
27
index XXXXXXX..XXXXXXX 100644
28
--- a/accel/tcg/cputlb.c
29
+++ b/accel/tcg/cputlb.c
30
@@ -XXX,XX +XXX,XX @@ void tlb_set_page(CPUState *cpu, target_ulong vaddr,
31
prot, mmu_idx, size);
32
}
33
34
-static inline ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr)
35
-{
36
- ram_addr_t ram_addr;
37
-
38
- ram_addr = qemu_ram_addr_from_host(ptr);
39
- if (ram_addr == RAM_ADDR_INVALID) {
40
- error_report("Bad ram pointer %p", ptr);
41
- abort();
42
- }
43
- return ram_addr;
44
-}
45
-
46
/*
47
* Note: tlb_fill() can trigger a resize of the TLB. This means that all of the
48
* caller's prior references to the TLB table (e.g. CPUTLBEntry pointers) must
49
diff --git a/softmmu/physmem.c b/softmmu/physmem.c
50
index XXXXXXX..XXXXXXX 100644
51
--- a/softmmu/physmem.c
52
+++ b/softmmu/physmem.c
53
@@ -XXX,XX +XXX,XX @@ ram_addr_t qemu_ram_addr_from_host(void *ptr)
54
return block->offset + offset;
55
}
56
57
+ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr)
58
+{
59
+ ram_addr_t ram_addr;
60
+
61
+ ram_addr = qemu_ram_addr_from_host(ptr);
62
+ if (ram_addr == RAM_ADDR_INVALID) {
63
+ error_report("Bad ram pointer %p", ptr);
64
+ abort();
65
+ }
66
+ return ram_addr;
67
+}
68
+
69
static MemTxResult flatview_read(FlatView *fv, hwaddr addr,
70
MemTxAttrs attrs, void *buf, hwaddr len);
71
static MemTxResult flatview_write(FlatView *fv, hwaddr addr, MemTxAttrs attrs,
72
--
73
2.34.1
diff view generated by jsdifflib
New patch
[PULL 12/20] accel/tcg: Use probe_access_internal for softmmu get_page_addr_code_hostp
1
Simplify the implementation of get_page_addr_code_hostp
2
by reusing the existing probe_access infrastructure.
1
3
4
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
5
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
6
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7
---
8
accel/tcg/cputlb.c | 76 ++++++++++++++++------------------------------
9
1 file changed, 26 insertions(+), 50 deletions(-)
10
11
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
12
index XXXXXXX..XXXXXXX 100644
13
--- a/accel/tcg/cputlb.c
14
+++ b/accel/tcg/cputlb.c
15
@@ -XXX,XX +XXX,XX @@ static bool victim_tlb_hit(CPUArchState *env, size_t mmu_idx, size_t index,
16
victim_tlb_hit(env, mmu_idx, index, offsetof(CPUTLBEntry, TY), \
17
(ADDR) & TARGET_PAGE_MASK)
18
19
-/*
20
- * Return a ram_addr_t for the virtual address for execution.
21
- *
22
- * Return -1 if we can't translate and execute from an entire page
23
- * of RAM. This will force us to execute by loading and translating
24
- * one insn at a time, without caching.
25
- *
26
- * NOTE: This function will trigger an exception if the page is
27
- * not executable.
28
- */
29
-tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
30
- void **hostp)
31
-{
32
- uintptr_t mmu_idx = cpu_mmu_index(env, true);
33
- uintptr_t index = tlb_index(env, mmu_idx, addr);
34
- CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
35
- void *p;
36
-
37
- if (unlikely(!tlb_hit(entry->addr_code, addr))) {
38
- if (!VICTIM_TLB_HIT(addr_code, addr)) {
39
- tlb_fill(env_cpu(env), addr, 0, MMU_INST_FETCH, mmu_idx, 0);
40
- index = tlb_index(env, mmu_idx, addr);
41
- entry = tlb_entry(env, mmu_idx, addr);
42
-
43
- if (unlikely(entry->addr_code & TLB_INVALID_MASK)) {
44
- /*
45
- * The MMU protection covers a smaller range than a target
46
- * page, so we must redo the MMU check for every insn.
47
- */
48
- return -1;
49
- }
50
- }
51
- assert(tlb_hit(entry->addr_code, addr));
52
- }
53
-
54
- if (unlikely(entry->addr_code & TLB_MMIO)) {
55
- /* The region is not backed by RAM. */
56
- if (hostp) {
57
- *hostp = NULL;
58
- }
59
- return -1;
60
- }
61
-
62
- p = (void *)((uintptr_t)addr + entry->addend);
63
- if (hostp) {
64
- *hostp = p;
65
- }
66
- return qemu_ram_addr_from_host_nofail(p);
67
-}
68
-
69
static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
70
CPUIOTLBEntry *iotlbentry, uintptr_t retaddr)
71
{
72
@@ -XXX,XX +XXX,XX @@ void *tlb_vaddr_to_host(CPUArchState *env, abi_ptr addr,
73
return flags ? NULL : host;
74
}
75
76
+/*
77
+ * Return a ram_addr_t for the virtual address for execution.
78
+ *
79
+ * Return -1 if we can't translate and execute from an entire page
80
+ * of RAM. This will force us to execute by loading and translating
81
+ * one insn at a time, without caching.
82
+ *
83
+ * NOTE: This function will trigger an exception if the page is
84
+ * not executable.
85
+ */
86
+tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
87
+ void **hostp)
88
+{
89
+ void *p;
90
+
91
+ (void)probe_access_internal(env, addr, 1, MMU_INST_FETCH,
92
+ cpu_mmu_index(env, true), false, &p, 0);
93
+ if (p == NULL) {
94
+ return -1;
95
+ }
96
+ if (hostp) {
97
+ *hostp = p;
98
+ }
99
+ return qemu_ram_addr_from_host_nofail(p);
100
+}
101
+
102
#ifdef CONFIG_PLUGIN
103
/*
104
* Perform a TLB lookup and populate the qemu_plugin_hwaddr structure.
105
--
106
2.34.1
diff view generated by jsdifflib
New patch
[PULL 13/20] accel/tcg: Document the faulting lookup in tb_lookup_cmp
1
It was non-obvious to me why we can raise an exception in
2
the middle of a comparison function, but it works.
3
While nearby, use TARGET_PAGE_ALIGN instead of open-coding.
1
4
5
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
6
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7
---
8
accel/tcg/cpu-exec.c | 11 ++++++++++-
9
1 file changed, 10 insertions(+), 1 deletion(-)
10
11
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
12
index XXXXXXX..XXXXXXX 100644
13
--- a/accel/tcg/cpu-exec.c
14
+++ b/accel/tcg/cpu-exec.c
15
@@ -XXX,XX +XXX,XX @@ static bool tb_lookup_cmp(const void *p, const void *d)
16
tb_page_addr_t phys_page2;
17
target_ulong virt_page2;
18
19
- virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
20
+ /*
21
+ * We know that the first page matched, and an otherwise valid TB
22
+ * encountered an incomplete instruction at the end of that page,
23
+ * therefore we know that generating a new TB from the current PC
24
+ * must also require reading from the next page -- even if the
25
+ * second pages do not match, and therefore the resulting insn
26
+ * is different for the new TB. Therefore any exception raised
27
+ * here by the faulting lookup is not premature.
28
+ */
29
+ virt_page2 = TARGET_PAGE_ALIGN(desc->pc);
30
phys_page2 = get_page_addr_code(desc->env, virt_page2);
31
if (tb->page_addr[1] == phys_page2) {
32
return true;
33
--
34
2.34.1
diff view generated by jsdifflib
New patch
[PULL 14/20] accel/tcg: Remove translator_ldsw
1
The only user can easily use translator_lduw and
2
adjust the type to signed during the return.
1
3
4
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
5
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
6
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
7
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
8
---
9
include/exec/translator.h | 1 -
10
target/i386/tcg/translate.c | 2 +-
11
2 files changed, 1 insertion(+), 2 deletions(-)
12
13
diff --git a/include/exec/translator.h b/include/exec/translator.h
14
index XXXXXXX..XXXXXXX 100644
15
--- a/include/exec/translator.h
16
+++ b/include/exec/translator.h
17
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
18
19
#define FOR_EACH_TRANSLATOR_LD(F) \
20
F(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */) \
21
- F(translator_ldsw, int16_t, cpu_ldsw_code, bswap16) \
22
F(translator_lduw, uint16_t, cpu_lduw_code, bswap16) \
23
F(translator_ldl, uint32_t, cpu_ldl_code, bswap32) \
24
F(translator_ldq, uint64_t, cpu_ldq_code, bswap64)
25
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
26
index XXXXXXX..XXXXXXX 100644
27
--- a/target/i386/tcg/translate.c
28
+++ b/target/i386/tcg/translate.c
29
@@ -XXX,XX +XXX,XX @@ static inline uint8_t x86_ldub_code(CPUX86State *env, DisasContext *s)
30
31
static inline int16_t x86_ldsw_code(CPUX86State *env, DisasContext *s)
32
{
33
- return translator_ldsw(env, &s->base, advance_pc(env, s, 2));
34
+ return translator_lduw(env, &s->base, advance_pc(env, s, 2));
35
}
36
37
static inline uint16_t x86_lduw_code(CPUX86State *env, DisasContext *s)
38
--
39
2.34.1
diff view generated by jsdifflib
New patch
[PULL 15/20] accel/tcg: Add pc and host_pc params to gen_intermediate_code
1
Pass these along to translator_loop -- pc may be used instead
2
of tb->pc, and host_pc is currently unused. Adjust all targets
3
at one time.
1
4
5
Acked-by: Alistair Francis <alistair.francis@wdc.com>
6
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
7
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
8
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
9
---
10
include/exec/exec-all.h | 1 -
11
include/exec/translator.h | 24 ++++++++++++++++++++----
12
accel/tcg/translate-all.c | 6 ++++--
13
accel/tcg/translator.c | 9 +++++----
14
target/alpha/translate.c | 5 +++--
15
target/arm/translate.c | 5 +++--
16
target/avr/translate.c | 5 +++--
17
target/cris/translate.c | 5 +++--
18
target/hexagon/translate.c | 6 ++++--
19
target/hppa/translate.c | 5 +++--
20
target/i386/tcg/translate.c | 5 +++--
21
target/loongarch/translate.c | 6 ++++--
22
target/m68k/translate.c | 5 +++--
23
target/microblaze/translate.c | 5 +++--
24
target/mips/tcg/translate.c | 5 +++--
25
target/nios2/translate.c | 5 +++--
26
target/openrisc/translate.c | 6 ++++--
27
target/ppc/translate.c | 5 +++--
28
target/riscv/translate.c | 5 +++--
29
target/rx/translate.c | 5 +++--
30
target/s390x/tcg/translate.c | 5 +++--
31
target/sh4/translate.c | 5 +++--
32
target/sparc/translate.c | 5 +++--
33
target/tricore/translate.c | 6 ++++--
34
target/xtensa/translate.c | 6 ++++--
35
25 files changed, 97 insertions(+), 53 deletions(-)
36
37
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
38
index XXXXXXX..XXXXXXX 100644
39
--- a/include/exec/exec-all.h
40
+++ b/include/exec/exec-all.h
41
@@ -XXX,XX +XXX,XX @@ typedef ram_addr_t tb_page_addr_t;
42
#define TB_PAGE_ADDR_FMT RAM_ADDR_FMT
43
#endif
44
45
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns);
46
void restore_state_to_opc(CPUArchState *env, TranslationBlock *tb,
47
target_ulong *data);
48
49
diff --git a/include/exec/translator.h b/include/exec/translator.h
50
index XXXXXXX..XXXXXXX 100644
51
--- a/include/exec/translator.h
52
+++ b/include/exec/translator.h
53
@@ -XXX,XX +XXX,XX @@
54
#include "exec/translate-all.h"
55
#include "tcg/tcg.h"
56
57
+/**
58
+ * gen_intermediate_code
59
+ * @cpu: cpu context
60
+ * @tb: translation block
61
+ * @max_insns: max number of instructions to translate
62
+ * @pc: guest virtual program counter address
63
+ * @host_pc: host physical program counter address
64
+ *
65
+ * This function must be provided by the target, which should create
66
+ * the target-specific DisasContext, and then invoke translator_loop.
67
+ */
68
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
69
+ target_ulong pc, void *host_pc);
70
71
/**
72
* DisasJumpType:
73
@@ -XXX,XX +XXX,XX @@ typedef struct TranslatorOps {
74
75
/**
76
* translator_loop:
77
- * @ops: Target-specific operations.
78
- * @db: Disassembly context.
79
* @cpu: Target vCPU.
80
* @tb: Translation block.
81
* @max_insns: Maximum number of insns to translate.
82
+ * @pc: guest virtual program counter address
83
+ * @host_pc: host physical program counter address
84
+ * @ops: Target-specific operations.
85
+ * @db: Disassembly context.
86
*
87
* Generic translator loop.
88
*
89
@@ -XXX,XX +XXX,XX @@ typedef struct TranslatorOps {
90
* - When single-stepping is enabled (system-wide or on the current vCPU).
91
* - When too many instructions have been translated.
92
*/
93
-void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
94
- CPUState *cpu, TranslationBlock *tb, int max_insns);
95
+void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
96
+ target_ulong pc, void *host_pc,
97
+ const TranslatorOps *ops, DisasContextBase *db);
98
99
void translator_loop_temp_check(DisasContextBase *db);
100
101
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
102
index XXXXXXX..XXXXXXX 100644
103
--- a/accel/tcg/translate-all.c
104
+++ b/accel/tcg/translate-all.c
105
@@ -XXX,XX +XXX,XX @@
106
107
#include "exec/cputlb.h"
108
#include "exec/translate-all.h"
109
+#include "exec/translator.h"
110
#include "qemu/bitmap.h"
111
#include "qemu/qemu-print.h"
112
#include "qemu/timer.h"
113
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
114
TCGProfile *prof = &tcg_ctx->prof;
115
int64_t ti;
116
#endif
117
+ void *host_pc;
118
119
assert_memory_lock();
120
qemu_thread_jit_write();
121
122
- phys_pc = get_page_addr_code(env, pc);
123
+ phys_pc = get_page_addr_code_hostp(env, pc, &host_pc);
124
125
if (phys_pc == -1) {
126
/* Generate a one-shot TB with 1 insn in it */
127
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
128
tcg_func_start(tcg_ctx);
129
130
tcg_ctx->cpu = env_cpu(env);
131
- gen_intermediate_code(cpu, tb, max_insns);
132
+ gen_intermediate_code(cpu, tb, max_insns, pc, host_pc);
133
assert(tb->size != 0);
134
tcg_ctx->cpu = NULL;
135
max_insns = tb->icount;
136
diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
137
index XXXXXXX..XXXXXXX 100644
138
--- a/accel/tcg/translator.c
139
+++ b/accel/tcg/translator.c
140
@@ -XXX,XX +XXX,XX @@ static inline void translator_page_protect(DisasContextBase *dcbase,
141
#endif
142
}
143
144
-void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
145
- CPUState *cpu, TranslationBlock *tb, int max_insns)
146
+void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
147
+ target_ulong pc, void *host_pc,
148
+ const TranslatorOps *ops, DisasContextBase *db)
149
{
150
uint32_t cflags = tb_cflags(tb);
151
bool plugin_enabled;
152
153
/* Initialize DisasContext */
154
db->tb = tb;
155
- db->pc_first = tb->pc;
156
- db->pc_next = db->pc_first;
157
+ db->pc_first = pc;
158
+ db->pc_next = pc;
159
db->is_jmp = DISAS_NEXT;
160
db->num_insns = 0;
161
db->max_insns = max_insns;
162
diff --git a/target/alpha/translate.c b/target/alpha/translate.c
163
index XXXXXXX..XXXXXXX 100644
164
--- a/target/alpha/translate.c
165
+++ b/target/alpha/translate.c
166
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps alpha_tr_ops = {
167
.disas_log = alpha_tr_disas_log,
168
};
169
170
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
171
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
172
+ target_ulong pc, void *host_pc)
173
{
174
DisasContext dc;
175
- translator_loop(&alpha_tr_ops, &dc.base, cpu, tb, max_insns);
176
+ translator_loop(cpu, tb, max_insns, pc, host_pc, &alpha_tr_ops, &dc.base);
177
}
178
179
void restore_state_to_opc(CPUAlphaState *env, TranslationBlock *tb,
180
diff --git a/target/arm/translate.c b/target/arm/translate.c
181
index XXXXXXX..XXXXXXX 100644
182
--- a/target/arm/translate.c
183
+++ b/target/arm/translate.c
184
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps thumb_translator_ops = {
185
};
186
187
/* generate intermediate code for basic block 'tb'. */
188
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
189
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
190
+ target_ulong pc, void *host_pc)
191
{
192
DisasContext dc = { };
193
const TranslatorOps *ops = &arm_translator_ops;
194
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
195
}
196
#endif
197
198
- translator_loop(ops, &dc.base, cpu, tb, max_insns);
199
+ translator_loop(cpu, tb, max_insns, pc, host_pc, ops, &dc.base);
200
}
201
202
void restore_state_to_opc(CPUARMState *env, TranslationBlock *tb,
203
diff --git a/target/avr/translate.c b/target/avr/translate.c
204
index XXXXXXX..XXXXXXX 100644
205
--- a/target/avr/translate.c
206
+++ b/target/avr/translate.c
207
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps avr_tr_ops = {
208
.disas_log = avr_tr_disas_log,
209
};
210
211
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
212
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
213
+ target_ulong pc, void *host_pc)
214
{
215
DisasContext dc = { };
216
- translator_loop(&avr_tr_ops, &dc.base, cs, tb, max_insns);
217
+ translator_loop(cs, tb, max_insns, pc, host_pc, &avr_tr_ops, &dc.base);
218
}
219
220
void restore_state_to_opc(CPUAVRState *env, TranslationBlock *tb,
221
diff --git a/target/cris/translate.c b/target/cris/translate.c
222
index XXXXXXX..XXXXXXX 100644
223
--- a/target/cris/translate.c
224
+++ b/target/cris/translate.c
225
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps cris_tr_ops = {
226
.disas_log = cris_tr_disas_log,
227
};
228
229
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
230
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
231
+ target_ulong pc, void *host_pc)
232
{
233
DisasContext dc;
234
- translator_loop(&cris_tr_ops, &dc.base, cs, tb, max_insns);
235
+ translator_loop(cs, tb, max_insns, pc, host_pc, &cris_tr_ops, &dc.base);
236
}
237
238
void cris_cpu_dump_state(CPUState *cs, FILE *f, int flags)
239
diff --git a/target/hexagon/translate.c b/target/hexagon/translate.c
240
index XXXXXXX..XXXXXXX 100644
241
--- a/target/hexagon/translate.c
242
+++ b/target/hexagon/translate.c
243
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps hexagon_tr_ops = {
244
.disas_log = hexagon_tr_disas_log,
245
};
246
247
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
248
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
249
+ target_ulong pc, void *host_pc)
250
{
251
DisasContext ctx;
252
253
- translator_loop(&hexagon_tr_ops, &ctx.base, cs, tb, max_insns);
254
+ translator_loop(cs, tb, max_insns, pc, host_pc,
255
+ &hexagon_tr_ops, &ctx.base);
256
}
257
258
#define NAME_LEN 64
259
diff --git a/target/hppa/translate.c b/target/hppa/translate.c
260
index XXXXXXX..XXXXXXX 100644
261
--- a/target/hppa/translate.c
262
+++ b/target/hppa/translate.c
263
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps hppa_tr_ops = {
264
.disas_log = hppa_tr_disas_log,
265
};
266
267
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
268
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
269
+ target_ulong pc, void *host_pc)
270
{
271
DisasContext ctx;
272
- translator_loop(&hppa_tr_ops, &ctx.base, cs, tb, max_insns);
273
+ translator_loop(cs, tb, max_insns, pc, host_pc, &hppa_tr_ops, &ctx.base);
274
}
275
276
void restore_state_to_opc(CPUHPPAState *env, TranslationBlock *tb,
277
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
278
index XXXXXXX..XXXXXXX 100644
279
--- a/target/i386/tcg/translate.c
280
+++ b/target/i386/tcg/translate.c
281
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps i386_tr_ops = {
282
};
283
284
/* generate intermediate code for basic block 'tb'. */
285
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
286
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
287
+ target_ulong pc, void *host_pc)
288
{
289
DisasContext dc;
290
291
- translator_loop(&i386_tr_ops, &dc.base, cpu, tb, max_insns);
292
+ translator_loop(cpu, tb, max_insns, pc, host_pc, &i386_tr_ops, &dc.base);
293
}
294
295
void restore_state_to_opc(CPUX86State *env, TranslationBlock *tb,
296
diff --git a/target/loongarch/translate.c b/target/loongarch/translate.c
297
index XXXXXXX..XXXXXXX 100644
298
--- a/target/loongarch/translate.c
299
+++ b/target/loongarch/translate.c
300
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps loongarch_tr_ops = {
301
.disas_log = loongarch_tr_disas_log,
302
};
303
304
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
305
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
306
+ target_ulong pc, void *host_pc)
307
{
308
DisasContext ctx;
309
310
- translator_loop(&loongarch_tr_ops, &ctx.base, cs, tb, max_insns);
311
+ translator_loop(cs, tb, max_insns, pc, host_pc,
312
+ &loongarch_tr_ops, &ctx.base);
313
}
314
315
void loongarch_translate_init(void)
316
diff --git a/target/m68k/translate.c b/target/m68k/translate.c
317
index XXXXXXX..XXXXXXX 100644
318
--- a/target/m68k/translate.c
319
+++ b/target/m68k/translate.c
320
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps m68k_tr_ops = {
321
.disas_log = m68k_tr_disas_log,
322
};
323
324
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
325
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
326
+ target_ulong pc, void *host_pc)
327
{
328
DisasContext dc;
329
- translator_loop(&m68k_tr_ops, &dc.base, cpu, tb, max_insns);
330
+ translator_loop(cpu, tb, max_insns, pc, host_pc, &m68k_tr_ops, &dc.base);
331
}
332
333
static double floatx80_to_double(CPUM68KState *env, uint16_t high, uint64_t low)
334
diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
335
index XXXXXXX..XXXXXXX 100644
336
--- a/target/microblaze/translate.c
337
+++ b/target/microblaze/translate.c
338
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps mb_tr_ops = {
339
.disas_log = mb_tr_disas_log,
340
};
341
342
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
343
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
344
+ target_ulong pc, void *host_pc)
345
{
346
DisasContext dc;
347
- translator_loop(&mb_tr_ops, &dc.base, cpu, tb, max_insns);
348
+ translator_loop(cpu, tb, max_insns, pc, host_pc, &mb_tr_ops, &dc.base);
349
}
350
351
void mb_cpu_dump_state(CPUState *cs, FILE *f, int flags)
352
diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
353
index XXXXXXX..XXXXXXX 100644
354
--- a/target/mips/tcg/translate.c
355
+++ b/target/mips/tcg/translate.c
356
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps mips_tr_ops = {
357
.disas_log = mips_tr_disas_log,
358
};
359
360
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
361
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
362
+ target_ulong pc, void *host_pc)
363
{
364
DisasContext ctx;
365
366
- translator_loop(&mips_tr_ops, &ctx.base, cs, tb, max_insns);
367
+ translator_loop(cs, tb, max_insns, pc, host_pc, &mips_tr_ops, &ctx.base);
368
}
369
370
void mips_tcg_init(void)
371
diff --git a/target/nios2/translate.c b/target/nios2/translate.c
372
index XXXXXXX..XXXXXXX 100644
373
--- a/target/nios2/translate.c
374
+++ b/target/nios2/translate.c
375
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps nios2_tr_ops = {
376
.disas_log = nios2_tr_disas_log,
377
};
378
379
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
380
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
381
+ target_ulong pc, void *host_pc)
382
{
383
DisasContext dc;
384
- translator_loop(&nios2_tr_ops, &dc.base, cs, tb, max_insns);
385
+ translator_loop(cs, tb, max_insns, pc, host_pc, &nios2_tr_ops, &dc.base);
386
}
387
388
void nios2_cpu_dump_state(CPUState *cs, FILE *f, int flags)
389
diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
390
index XXXXXXX..XXXXXXX 100644
391
--- a/target/openrisc/translate.c
392
+++ b/target/openrisc/translate.c
393
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps openrisc_tr_ops = {
394
.disas_log = openrisc_tr_disas_log,
395
};
396
397
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
398
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
399
+ target_ulong pc, void *host_pc)
400
{
401
DisasContext ctx;
402
403
- translator_loop(&openrisc_tr_ops, &ctx.base, cs, tb, max_insns);
404
+ translator_loop(cs, tb, max_insns, pc, host_pc,
405
+ &openrisc_tr_ops, &ctx.base);
406
}
407
408
void openrisc_cpu_dump_state(CPUState *cs, FILE *f, int flags)
409
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
410
index XXXXXXX..XXXXXXX 100644
411
--- a/target/ppc/translate.c
412
+++ b/target/ppc/translate.c
413
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps ppc_tr_ops = {
414
.disas_log = ppc_tr_disas_log,
415
};
416
417
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
418
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
419
+ target_ulong pc, void *host_pc)
420
{
421
DisasContext ctx;
422
423
- translator_loop(&ppc_tr_ops, &ctx.base, cs, tb, max_insns);
424
+ translator_loop(cs, tb, max_insns, pc, host_pc, &ppc_tr_ops, &ctx.base);
425
}
426
427
void restore_state_to_opc(CPUPPCState *env, TranslationBlock *tb,
428
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
429
index XXXXXXX..XXXXXXX 100644
430
--- a/target/riscv/translate.c
431
+++ b/target/riscv/translate.c
432
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps riscv_tr_ops = {
433
.disas_log = riscv_tr_disas_log,
434
};
435
436
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
437
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
438
+ target_ulong pc, void *host_pc)
439
{
440
DisasContext ctx;
441
442
- translator_loop(&riscv_tr_ops, &ctx.base, cs, tb, max_insns);
443
+ translator_loop(cs, tb, max_insns, pc, host_pc, &riscv_tr_ops, &ctx.base);
444
}
445
446
void riscv_translate_init(void)
447
diff --git a/target/rx/translate.c b/target/rx/translate.c
448
index XXXXXXX..XXXXXXX 100644
449
--- a/target/rx/translate.c
450
+++ b/target/rx/translate.c
451
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps rx_tr_ops = {
452
.disas_log = rx_tr_disas_log,
453
};
454
455
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
456
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
457
+ target_ulong pc, void *host_pc)
458
{
459
DisasContext dc;
460
461
- translator_loop(&rx_tr_ops, &dc.base, cs, tb, max_insns);
462
+ translator_loop(cs, tb, max_insns, pc, host_pc, &rx_tr_ops, &dc.base);
463
}
464
465
void restore_state_to_opc(CPURXState *env, TranslationBlock *tb,
466
diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
467
index XXXXXXX..XXXXXXX 100644
468
--- a/target/s390x/tcg/translate.c
469
+++ b/target/s390x/tcg/translate.c
470
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps s390x_tr_ops = {
471
.disas_log = s390x_tr_disas_log,
472
};
473
474
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
475
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
476
+ target_ulong pc, void *host_pc)
477
{
478
DisasContext dc;
479
480
- translator_loop(&s390x_tr_ops, &dc.base, cs, tb, max_insns);
481
+ translator_loop(cs, tb, max_insns, pc, host_pc, &s390x_tr_ops, &dc.base);
482
}
483
484
void restore_state_to_opc(CPUS390XState *env, TranslationBlock *tb,
485
diff --git a/target/sh4/translate.c b/target/sh4/translate.c
486
index XXXXXXX..XXXXXXX 100644
487
--- a/target/sh4/translate.c
488
+++ b/target/sh4/translate.c
489
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sh4_tr_ops = {
490
.disas_log = sh4_tr_disas_log,
491
};
492
493
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
494
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
495
+ target_ulong pc, void *host_pc)
496
{
497
DisasContext ctx;
498
499
- translator_loop(&sh4_tr_ops, &ctx.base, cs, tb, max_insns);
500
+ translator_loop(cs, tb, max_insns, pc, host_pc, &sh4_tr_ops, &ctx.base);
501
}
502
503
void restore_state_to_opc(CPUSH4State *env, TranslationBlock *tb,
504
diff --git a/target/sparc/translate.c b/target/sparc/translate.c
505
index XXXXXXX..XXXXXXX 100644
506
--- a/target/sparc/translate.c
507
+++ b/target/sparc/translate.c
508
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps sparc_tr_ops = {
509
.disas_log = sparc_tr_disas_log,
510
};
511
512
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
513
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
514
+ target_ulong pc, void *host_pc)
515
{
516
DisasContext dc = {};
517
518
- translator_loop(&sparc_tr_ops, &dc.base, cs, tb, max_insns);
519
+ translator_loop(cs, tb, max_insns, pc, host_pc, &sparc_tr_ops, &dc.base);
520
}
521
522
void sparc_tcg_init(void)
523
diff --git a/target/tricore/translate.c b/target/tricore/translate.c
524
index XXXXXXX..XXXXXXX 100644
525
--- a/target/tricore/translate.c
526
+++ b/target/tricore/translate.c
527
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps tricore_tr_ops = {
528
};
529
530
531
-void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
532
+void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns,
533
+ target_ulong pc, void *host_pc)
534
{
535
DisasContext ctx;
536
- translator_loop(&tricore_tr_ops, &ctx.base, cs, tb, max_insns);
537
+ translator_loop(cs, tb, max_insns, pc, host_pc,
538
+ &tricore_tr_ops, &ctx.base);
539
}
540
541
void
542
diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
543
index XXXXXXX..XXXXXXX 100644
544
--- a/target/xtensa/translate.c
545
+++ b/target/xtensa/translate.c
546
@@ -XXX,XX +XXX,XX @@ static const TranslatorOps xtensa_translator_ops = {
547
.disas_log = xtensa_tr_disas_log,
548
};
549
550
-void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns)
551
+void gen_intermediate_code(CPUState *cpu, TranslationBlock *tb, int max_insns,
552
+ target_ulong pc, void *host_pc)
553
{
554
DisasContext dc = {};
555
- translator_loop(&xtensa_translator_ops, &dc.base, cpu, tb, max_insns);
556
+ translator_loop(cpu, tb, max_insns, pc, host_pc,
557
+ &xtensa_translator_ops, &dc.base);
558
}
559
560
void xtensa_cpu_dump_state(CPUState *cs, FILE *f, int flags)
561
--
562
2.34.1
diff view generated by jsdifflib
New patch
[PULL 16/20] accel/tcg: Add fast path for translator_ld*
1
Cache the translation from guest to host address, so we may
2
use direct loads when we hit on the primary translation page.
1
3
4
Look up the second translation page only once, during translation.
5
This obviates another lookup of the second page within tb_gen_code
6
after translation.
7
8
Fixes a bug in that plugin_insn_append should be passed the bytes
9
in the original memory order, not bswapped by pieces.
10
11
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
12
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
13
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
14
---
15
include/exec/translator.h | 63 +++++++++++--------
16
accel/tcg/translate-all.c | 23 +++----
17
accel/tcg/translator.c | 126 +++++++++++++++++++++++++++++---------
18
3 files changed, 141 insertions(+), 71 deletions(-)
19
20
diff --git a/include/exec/translator.h b/include/exec/translator.h
21
index XXXXXXX..XXXXXXX 100644
22
--- a/include/exec/translator.h
23
+++ b/include/exec/translator.h
24
@@ -XXX,XX +XXX,XX @@ typedef enum DisasJumpType {
25
* Architecture-agnostic disassembly context.
26
*/
27
typedef struct DisasContextBase {
28
- const TranslationBlock *tb;
29
+ TranslationBlock *tb;
30
target_ulong pc_first;
31
target_ulong pc_next;
32
DisasJumpType is_jmp;
33
int num_insns;
34
int max_insns;
35
bool singlestep_enabled;
36
-#ifdef CONFIG_USER_ONLY
37
- /*
38
- * Guest address of the last byte of the last protected page.
39
- *
40
- * Pages containing the translated instructions are made non-writable in
41
- * order to achieve consistency in case another thread is modifying the
42
- * code while translate_insn() fetches the instruction bytes piecemeal.
43
- * Such writer threads are blocked on mmap_lock() in page_unprotect().
44
- */
45
- target_ulong page_protect_end;
46
-#endif
47
+ void *host_addr[2];
48
} DisasContextBase;
49
50
/**
51
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
52
* the relevant information at translation time.
53
*/
54
55
-#define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn) \
56
- type fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase, \
57
- abi_ptr pc, bool do_swap); \
58
- static inline type fullname(CPUArchState *env, \
59
- DisasContextBase *dcbase, abi_ptr pc) \
60
- { \
61
- return fullname ## _swap(env, dcbase, pc, false); \
62
+uint8_t translator_ldub(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
63
+uint16_t translator_lduw(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
64
+uint32_t translator_ldl(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
65
+uint64_t translator_ldq(CPUArchState *env, DisasContextBase *db, abi_ptr pc);
66
+
67
+static inline uint16_t
68
+translator_lduw_swap(CPUArchState *env, DisasContextBase *db,
69
+ abi_ptr pc, bool do_swap)
70
+{
71
+ uint16_t ret = translator_lduw(env, db, pc);
72
+ if (do_swap) {
73
+ ret = bswap16(ret);
74
}
75
+ return ret;
76
+}
77
78
-#define FOR_EACH_TRANSLATOR_LD(F) \
79
- F(translator_ldub, uint8_t, cpu_ldub_code, /* no swap */) \
80
- F(translator_lduw, uint16_t, cpu_lduw_code, bswap16) \
81
- F(translator_ldl, uint32_t, cpu_ldl_code, bswap32) \
82
- F(translator_ldq, uint64_t, cpu_ldq_code, bswap64)
83
+static inline uint32_t
84
+translator_ldl_swap(CPUArchState *env, DisasContextBase *db,
85
+ abi_ptr pc, bool do_swap)
86
+{
87
+ uint32_t ret = translator_ldl(env, db, pc);
88
+ if (do_swap) {
89
+ ret = bswap32(ret);
90
+ }
91
+ return ret;
92
+}
93
94
-FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
95
-
96
-#undef GEN_TRANSLATOR_LD
97
+static inline uint64_t
98
+translator_ldq_swap(CPUArchState *env, DisasContextBase *db,
99
+ abi_ptr pc, bool do_swap)
100
+{
101
+ uint64_t ret = translator_ldq_swap(env, db, pc, false);
102
+ if (do_swap) {
103
+ ret = bswap64(ret);
104
+ }
105
+ return ret;
106
+}
107
108
/*
109
* Return whether addr is on the same page as where disassembly started.
110
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
111
index XXXXXXX..XXXXXXX 100644
112
--- a/accel/tcg/translate-all.c
113
+++ b/accel/tcg/translate-all.c
114
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
115
{
116
CPUArchState *env = cpu->env_ptr;
117
TranslationBlock *tb, *existing_tb;
118
- tb_page_addr_t phys_pc, phys_page2;
119
- target_ulong virt_page2;
120
+ tb_page_addr_t phys_pc;
121
tcg_insn_unit *gen_code_buf;
122
int gen_code_size, search_size, max_insns;
123
#ifdef CONFIG_PROFILER
124
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
125
tb->flags = flags;
126
tb->cflags = cflags;
127
tb->trace_vcpu_dstate = *cpu->trace_dstate;
128
+ tb->page_addr[0] = phys_pc;
129
+ tb->page_addr[1] = -1;
130
tcg_ctx->tb_cflags = cflags;
131
tb_overflow:
132
133
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
134
}
135
136
/*
137
- * If the TB is not associated with a physical RAM page then
138
- * it must be a temporary one-insn TB, and we have nothing to do
139
- * except fill in the page_addr[] fields. Return early before
140
- * attempting to link to other TBs or add to the lookup table.
141
+ * If the TB is not associated with a physical RAM page then it must be
142
+ * a temporary one-insn TB, and we have nothing left to do. Return early
143
+ * before attempting to link to other TBs or add to the lookup table.
144
*/
145
- if (phys_pc == -1) {
146
- tb->page_addr[0] = tb->page_addr[1] = -1;
147
+ if (tb->page_addr[0] == -1) {
148
return tb;
149
}
150
151
@@ -XXX,XX +XXX,XX @@ TranslationBlock *tb_gen_code(CPUState *cpu,
152
*/
153
tcg_tb_insert(tb);
154
155
- /* check next page if needed */
156
- virt_page2 = (pc + tb->size - 1) & TARGET_PAGE_MASK;
157
- phys_page2 = -1;
158
- if ((pc & TARGET_PAGE_MASK) != virt_page2) {
159
- phys_page2 = get_page_addr_code(env, virt_page2);
160
- }
161
/*
162
* No explicit memory barrier is required -- tb_link_page() makes the
163
* TB visible in a consistent state.
164
*/
165
- existing_tb = tb_link_page(tb, phys_pc, phys_page2);
166
+ existing_tb = tb_link_page(tb, tb->page_addr[0], tb->page_addr[1]);
167
/* if the TB already exists, discard what we just translated */
168
if (unlikely(existing_tb != tb)) {
169
uintptr_t orig_aligned = (uintptr_t)gen_code_buf;
170
diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
171
index XXXXXXX..XXXXXXX 100644
172
--- a/accel/tcg/translator.c
173
+++ b/accel/tcg/translator.c
174
@@ -XXX,XX +XXX,XX @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest)
175
return ((db->pc_first ^ dest) & TARGET_PAGE_MASK) == 0;
176
}
177
178
-static inline void translator_page_protect(DisasContextBase *dcbase,
179
- target_ulong pc)
180
-{
181
-#ifdef CONFIG_USER_ONLY
182
- dcbase->page_protect_end = pc | ~TARGET_PAGE_MASK;
183
- page_protect(pc);
184
-#endif
185
-}
186
-
187
void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
188
target_ulong pc, void *host_pc,
189
const TranslatorOps *ops, DisasContextBase *db)
190
@@ -XXX,XX +XXX,XX @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
191
db->num_insns = 0;
192
db->max_insns = max_insns;
193
db->singlestep_enabled = cflags & CF_SINGLE_STEP;
194
- translator_page_protect(db, db->pc_next);
195
+ db->host_addr[0] = host_pc;
196
+ db->host_addr[1] = NULL;
197
+
198
+#ifdef CONFIG_USER_ONLY
199
+ page_protect(pc);
200
+#endif
201
202
ops->init_disas_context(db, cpu);
203
tcg_debug_assert(db->is_jmp == DISAS_NEXT); /* no early exit */
204
@@ -XXX,XX +XXX,XX @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int max_insns,
205
#endif
206
}
207
208
-static inline void translator_maybe_page_protect(DisasContextBase *dcbase,
209
- target_ulong pc, size_t len)
210
+static void *translator_access(CPUArchState *env, DisasContextBase *db,
211
+ target_ulong pc, size_t len)
212
{
213
-#ifdef CONFIG_USER_ONLY
214
- target_ulong end = pc + len - 1;
215
+ void *host;
216
+ target_ulong base, end;
217
+ TranslationBlock *tb;
218
219
- if (end > dcbase->page_protect_end) {
220
- translator_page_protect(dcbase, end);
221
+ tb = db->tb;
222
+
223
+ /* Use slow path if first page is MMIO. */
224
+ if (unlikely(tb->page_addr[0] == -1)) {
225
+ return NULL;
226
}
227
+
228
+ end = pc + len - 1;
229
+ if (likely(is_same_page(db, end))) {
230
+ host = db->host_addr[0];
231
+ base = db->pc_first;
232
+ } else {
233
+ host = db->host_addr[1];
234
+ base = TARGET_PAGE_ALIGN(db->pc_first);
235
+ if (host == NULL) {
236
+ tb->page_addr[1] =
237
+ get_page_addr_code_hostp(env, base, &db->host_addr[1]);
238
+#ifdef CONFIG_USER_ONLY
239
+ page_protect(end);
240
#endif
241
+ /* We cannot handle MMIO as second page. */
242
+ assert(tb->page_addr[1] != -1);
243
+ host = db->host_addr[1];
244
+ }
245
+
246
+ /* Use slow path when crossing pages. */
247
+ if (is_same_page(db, pc)) {
248
+ return NULL;
249
+ }
250
+ }
251
+
252
+ tcg_debug_assert(pc >= base);
253
+ return host + (pc - base);
254
}
255
256
-#define GEN_TRANSLATOR_LD(fullname, type, load_fn, swap_fn) \
257
- type fullname ## _swap(CPUArchState *env, DisasContextBase *dcbase, \
258
- abi_ptr pc, bool do_swap) \
259
- { \
260
- translator_maybe_page_protect(dcbase, pc, sizeof(type)); \
261
- type ret = load_fn(env, pc); \
262
- if (do_swap) { \
263
- ret = swap_fn(ret); \
264
- } \
265
- plugin_insn_append(pc, &ret, sizeof(ret)); \
266
- return ret; \
267
+uint8_t translator_ldub(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
268
+{
269
+ uint8_t ret;
270
+ void *p = translator_access(env, db, pc, sizeof(ret));
271
+
272
+ if (p) {
273
+ plugin_insn_append(pc, p, sizeof(ret));
274
+ return ldub_p(p);
275
}
276
+ ret = cpu_ldub_code(env, pc);
277
+ plugin_insn_append(pc, &ret, sizeof(ret));
278
+ return ret;
279
+}
280
281
-FOR_EACH_TRANSLATOR_LD(GEN_TRANSLATOR_LD)
282
+uint16_t translator_lduw(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
283
+{
284
+ uint16_t ret, plug;
285
+ void *p = translator_access(env, db, pc, sizeof(ret));
286
287
-#undef GEN_TRANSLATOR_LD
288
+ if (p) {
289
+ plugin_insn_append(pc, p, sizeof(ret));
290
+ return lduw_p(p);
291
+ }
292
+ ret = cpu_lduw_code(env, pc);
293
+ plug = tswap16(ret);
294
+ plugin_insn_append(pc, &plug, sizeof(ret));
295
+ return ret;
296
+}
297
+
298
+uint32_t translator_ldl(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
299
+{
300
+ uint32_t ret, plug;
301
+ void *p = translator_access(env, db, pc, sizeof(ret));
302
+
303
+ if (p) {
304
+ plugin_insn_append(pc, p, sizeof(ret));
305
+ return ldl_p(p);
306
+ }
307
+ ret = cpu_ldl_code(env, pc);
308
+ plug = tswap32(ret);
309
+ plugin_insn_append(pc, &plug, sizeof(ret));
310
+ return ret;
311
+}
312
+
313
+uint64_t translator_ldq(CPUArchState *env, DisasContextBase *db, abi_ptr pc)
314
+{
315
+ uint64_t ret, plug;
316
+ void *p = translator_access(env, db, pc, sizeof(ret));
317
+
318
+ if (p) {
319
+ plugin_insn_append(pc, p, sizeof(ret));
320
+ return ldq_p(p);
321
+ }
322
+ ret = cpu_ldq_code(env, pc);
323
+ plug = tswap64(ret);
324
+ plugin_insn_append(pc, &plug, sizeof(ret));
325
+ return ret;
326
+}
327
--
328
2.34.1
diff view generated by jsdifflib
[PULL 1/3] accel/tcg: split CpusAccel into three TCG variants
[PULL 17/20] target/s390x: Make translator stop before the end of a page
1
From: Claudio Fontana <cfontana@suse.de>
1
From: Ilya Leoshkevich <iii@linux.ibm.com>
2
2
3
split up the CpusAccel tcg_cpus into three TCG variants:
3
Right now translator stops right *after* the end of a page, which
4
breaks reporting of fault locations when the last instruction of a
5
multi-insn translation block crosses a page boundary.
4
6
5
tcg_cpus_rr (single threaded, round robin cpus)
7
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
6
tcg_cpus_icount (same as rr, but with instruction counting enabled)
7
tcg_cpus_mttcg (multi-threaded cpus)
8
9
Suggested-by: Richard Henderson <richard.henderson@linaro.org>
10
Signed-off-by: Claudio Fontana <cfontana@suse.de>
11
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
8
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
12
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
9
Message-Id: <20220817150506.592862-3-iii@linux.ibm.com>
13
Message-Id: <20201015143217.29337-2-cfontana@suse.de>
14
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
10
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
15
---
11
---
16
accel/tcg/tcg-cpus-icount.h | 17 ++
12
target/s390x/tcg/translate.c | 15 +++-
17
accel/tcg/tcg-cpus-mttcg.h | 21 ++
13
tests/tcg/s390x/noexec.c | 106 +++++++++++++++++++++++
18
accel/tcg/tcg-cpus-rr.h | 20 ++
14
tests/tcg/multiarch/noexec.c.inc | 139 +++++++++++++++++++++++++++++++
19
accel/tcg/tcg-cpus.h | 13 +-
15
tests/tcg/s390x/Makefile.target | 1 +
20
accel/tcg/tcg-all.c | 8 +-
16
4 files changed, 257 insertions(+), 4 deletions(-)
21
accel/tcg/tcg-cpus-icount.c | 147 +++++++++++
17
create mode 100644 tests/tcg/s390x/noexec.c
22
accel/tcg/tcg-cpus-mttcg.c | 117 +++++++++
18
create mode 100644 tests/tcg/multiarch/noexec.c.inc
23
accel/tcg/tcg-cpus-rr.c | 270 ++++++++++++++++++++
24
accel/tcg/tcg-cpus.c | 484 ++----------------------------------
25
softmmu/icount.c | 2 +-
26
accel/tcg/meson.build | 9 +-
27
11 files changed, 646 insertions(+), 462 deletions(-)
28
create mode 100644 accel/tcg/tcg-cpus-icount.h
29
create mode 100644 accel/tcg/tcg-cpus-mttcg.h
30
create mode 100644 accel/tcg/tcg-cpus-rr.h
31
create mode 100644 accel/tcg/tcg-cpus-icount.c
32
create mode 100644 accel/tcg/tcg-cpus-mttcg.c
33
create mode 100644 accel/tcg/tcg-cpus-rr.c
34
19
35
diff --git a/accel/tcg/tcg-cpus-icount.h b/accel/tcg/tcg-cpus-icount.h
20
diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
21
index XXXXXXX..XXXXXXX 100644
22
--- a/target/s390x/tcg/translate.c
23
+++ b/target/s390x/tcg/translate.c
24
@@ -XXX,XX +XXX,XX @@ static void s390x_tr_insn_start(DisasContextBase *dcbase, CPUState *cs)
25
dc->insn_start = tcg_last_op();
26
}
27
28
+static target_ulong get_next_pc(CPUS390XState *env, DisasContext *s,
29
+ uint64_t pc)
30
+{
31
+ uint64_t insn = ld_code2(env, s, pc);
32
+
33
+ return pc + get_ilen((insn >> 8) & 0xff);
34
+}
35
+
36
static void s390x_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
37
{
38
CPUS390XState *env = cs->env_ptr;
39
@@ -XXX,XX +XXX,XX @@ static void s390x_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
40
41
dc->base.is_jmp = translate_one(env, dc);
42
if (dc->base.is_jmp == DISAS_NEXT) {
43
- uint64_t page_start;
44
-
45
- page_start = dc->base.pc_first & TARGET_PAGE_MASK;
46
- if (dc->base.pc_next - page_start >= TARGET_PAGE_SIZE || dc->ex_value) {
47
+ if (!is_same_page(dcbase, dc->base.pc_next) ||
48
+ !is_same_page(dcbase, get_next_pc(env, dc, dc->base.pc_next)) ||
49
+ dc->ex_value) {
50
dc->base.is_jmp = DISAS_TOO_MANY;
51
}
52
}
53
diff --git a/tests/tcg/s390x/noexec.c b/tests/tcg/s390x/noexec.c
36
new file mode 100644
54
new file mode 100644
37
index XXXXXXX..XXXXXXX
55
index XXXXXXX..XXXXXXX
38
--- /dev/null
56
--- /dev/null
39
+++ b/accel/tcg/tcg-cpus-icount.h
57
+++ b/tests/tcg/s390x/noexec.c
40
@@ -XXX,XX +XXX,XX @@
58
@@ -XXX,XX +XXX,XX @@
41
+/*
59
+#include "../multiarch/noexec.c.inc"
42
+ * QEMU TCG Single Threaded vCPUs implementation using instruction counting
60
+
43
+ *
61
+static void *arch_mcontext_pc(const mcontext_t *ctx)
44
+ * Copyright 2020 SUSE LLC
62
+{
45
+ *
63
+ return (void *)ctx->psw.addr;
46
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
64
+}
47
+ * See the COPYING file in the top-level directory.
65
+
48
+ */
66
+static int arch_mcontext_arg(const mcontext_t *ctx)
49
+
67
+{
50
+#ifndef TCG_CPUS_ICOUNT_H
68
+ return ctx->gregs[2];
51
+#define TCG_CPUS_ICOUNT_H
69
+}
52
+
70
+
53
+void handle_icount_deadline(void);
71
+static void arch_flush(void *p, int len)
54
+void prepare_icount_for_run(CPUState *cpu);
72
+{
55
+void process_icount_data(CPUState *cpu);
73
+}
56
+
74
+
57
+#endif /* TCG_CPUS_ICOUNT_H */
75
+extern char noexec_1[];
58
diff --git a/accel/tcg/tcg-cpus-mttcg.h b/accel/tcg/tcg-cpus-mttcg.h
76
+extern char noexec_2[];
77
+extern char noexec_end[];
78
+
79
+asm("noexec_1:\n"
80
+ " lgfi %r2,1\n" /* %r2 is 0 on entry, set 1. */
81
+ "noexec_2:\n"
82
+ " lgfi %r2,2\n" /* %r2 is 0/1; set 2. */
83
+ " br %r14\n" /* return */
84
+ "noexec_end:");
85
+
86
+extern char exrl_1[];
87
+extern char exrl_2[];
88
+extern char exrl_end[];
89
+
90
+asm("exrl_1:\n"
91
+ " exrl %r0, exrl_2\n"
92
+ " br %r14\n"
93
+ "exrl_2:\n"
94
+ " lgfi %r2,2\n"
95
+ "exrl_end:");
96
+
97
+int main(void)
98
+{
99
+ struct noexec_test noexec_tests[] = {
100
+ {
101
+ .name = "fallthrough",
102
+ .test_code = noexec_1,
103
+ .test_len = noexec_end - noexec_1,
104
+ .page_ofs = noexec_1 - noexec_2,
105
+ .entry_ofs = noexec_1 - noexec_2,
106
+ .expected_si_ofs = 0,
107
+ .expected_pc_ofs = 0,
108
+ .expected_arg = 1,
109
+ },
110
+ {
111
+ .name = "jump",
112
+ .test_code = noexec_1,
113
+ .test_len = noexec_end - noexec_1,
114
+ .page_ofs = noexec_1 - noexec_2,
115
+ .entry_ofs = 0,
116
+ .expected_si_ofs = 0,
117
+ .expected_pc_ofs = 0,
118
+ .expected_arg = 0,
119
+ },
120
+ {
121
+ .name = "exrl",
122
+ .test_code = exrl_1,
123
+ .test_len = exrl_end - exrl_1,
124
+ .page_ofs = exrl_1 - exrl_2,
125
+ .entry_ofs = exrl_1 - exrl_2,
126
+ .expected_si_ofs = 0,
127
+ .expected_pc_ofs = exrl_1 - exrl_2,
128
+ .expected_arg = 0,
129
+ },
130
+ {
131
+ .name = "fallthrough [cross]",
132
+ .test_code = noexec_1,
133
+ .test_len = noexec_end - noexec_1,
134
+ .page_ofs = noexec_1 - noexec_2 - 2,
135
+ .entry_ofs = noexec_1 - noexec_2 - 2,
136
+ .expected_si_ofs = 0,
137
+ .expected_pc_ofs = -2,
138
+ .expected_arg = 1,
139
+ },
140
+ {
141
+ .name = "jump [cross]",
142
+ .test_code = noexec_1,
143
+ .test_len = noexec_end - noexec_1,
144
+ .page_ofs = noexec_1 - noexec_2 - 2,
145
+ .entry_ofs = -2,
146
+ .expected_si_ofs = 0,
147
+ .expected_pc_ofs = -2,
148
+ .expected_arg = 0,
149
+ },
150
+ {
151
+ .name = "exrl [cross]",
152
+ .test_code = exrl_1,
153
+ .test_len = exrl_end - exrl_1,
154
+ .page_ofs = exrl_1 - exrl_2 - 2,
155
+ .entry_ofs = exrl_1 - exrl_2 - 2,
156
+ .expected_si_ofs = 0,
157
+ .expected_pc_ofs = exrl_1 - exrl_2 - 2,
158
+ .expected_arg = 0,
159
+ },
160
+ };
161
+
162
+ return test_noexec(noexec_tests,
163
+ sizeof(noexec_tests) / sizeof(noexec_tests[0]));
164
+}
165
diff --git a/tests/tcg/multiarch/noexec.c.inc b/tests/tcg/multiarch/noexec.c.inc
59
new file mode 100644
166
new file mode 100644
60
index XXXXXXX..XXXXXXX
167
index XXXXXXX..XXXXXXX
61
--- /dev/null
168
--- /dev/null
62
+++ b/accel/tcg/tcg-cpus-mttcg.h
169
+++ b/tests/tcg/multiarch/noexec.c.inc
63
@@ -XXX,XX +XXX,XX @@
170
@@ -XXX,XX +XXX,XX @@
64
+/*
171
+/*
65
+ * QEMU TCG Multi Threaded vCPUs implementation
172
+ * Common code for arch-specific MMU_INST_FETCH fault testing.
66
+ *
67
+ * Copyright 2020 SUSE LLC
68
+ *
69
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
70
+ * See the COPYING file in the top-level directory.
71
+ */
173
+ */
72
+
174
+
73
+#ifndef TCG_CPUS_MTTCG_H
175
+#define _GNU_SOURCE
74
+#define TCG_CPUS_MTTCG_H
176
+
75
+
177
+#include <assert.h>
76
+/*
178
+#include <signal.h>
77
+ * In the multi-threaded case each vCPU has its own thread. The TLS
179
+#include <stdio.h>
78
+ * variable current_cpu can be used deep in the code to find the
180
+#include <stdlib.h>
79
+ * current CPUState for a given thread.
181
+#include <string.h>
80
+ */
182
+#include <errno.h>
81
+
183
+#include <unistd.h>
82
+void *tcg_cpu_thread_fn(void *arg);
184
+#include <sys/mman.h>
83
+
185
+#include <sys/ucontext.h>
84
+#endif /* TCG_CPUS_MTTCG_H */
186
+
85
diff --git a/accel/tcg/tcg-cpus-rr.h b/accel/tcg/tcg-cpus-rr.h
187
+/* Forward declarations. */
86
new file mode 100644
188
+
87
index XXXXXXX..XXXXXXX
189
+static void *arch_mcontext_pc(const mcontext_t *ctx);
88
--- /dev/null
190
+static int arch_mcontext_arg(const mcontext_t *ctx);
89
+++ b/accel/tcg/tcg-cpus-rr.h
191
+static void arch_flush(void *p, int len);
90
@@ -XXX,XX +XXX,XX @@
192
+
91
+/*
193
+/* Testing infrastructure. */
92
+ * QEMU TCG Single Threaded vCPUs implementation
194
+
93
+ *
195
+struct noexec_test {
94
+ * Copyright 2020 SUSE LLC
196
+ const char *name;
95
+ *
197
+ const char *test_code;
96
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
198
+ int test_len;
97
+ * See the COPYING file in the top-level directory.
199
+ int page_ofs;
98
+ */
200
+ int entry_ofs;
99
+
201
+ int expected_si_ofs;
100
+#ifndef TCG_CPUS_RR_H
202
+ int expected_pc_ofs;
101
+#define TCG_CPUS_RR_H
203
+ int expected_arg;
102
+
204
+};
103
+#define TCG_KICK_PERIOD (NANOSECONDS_PER_SECOND / 10)
205
+
104
+
206
+static void *page_base;
105
+/* Kick all RR vCPUs. */
207
+static int page_size;
106
+void qemu_cpu_kick_rr_cpus(CPUState *unused);
208
+static const struct noexec_test *current_noexec_test;
107
+
209
+
108
+void *tcg_rr_cpu_thread_fn(void *arg);
210
+static void handle_err(const char *syscall)
109
+
211
+{
110
+#endif /* TCG_CPUS_RR_H */
212
+ printf("[ FAILED ] %s: %s\n", syscall, strerror(errno));
111
diff --git a/accel/tcg/tcg-cpus.h b/accel/tcg/tcg-cpus.h
213
+ exit(EXIT_FAILURE);
214
+}
215
+
216
+static void handle_segv(int sig, siginfo_t *info, void *ucontext)
217
+{
218
+ const struct noexec_test *test = current_noexec_test;
219
+ const mcontext_t *mc = &((ucontext_t *)ucontext)->uc_mcontext;
220
+ void *expected_si;
221
+ void *expected_pc;
222
+ void *pc;
223
+ int arg;
224
+
225
+ if (test == NULL) {
226
+ printf("[ FAILED ] unexpected SEGV\n");
227
+ exit(EXIT_FAILURE);
228
+ }
229
+ current_noexec_test = NULL;
230
+
231
+ expected_si = page_base + test->expected_si_ofs;
232
+ if (info->si_addr != expected_si) {
233
+ printf("[ FAILED ] wrong si_addr (%p != %p)\n",
234
+ info->si_addr, expected_si);
235
+ exit(EXIT_FAILURE);
236
+ }
237
+
238
+ pc = arch_mcontext_pc(mc);
239
+ expected_pc = page_base + test->expected_pc_ofs;
240
+ if (pc != expected_pc) {
241
+ printf("[ FAILED ] wrong pc (%p != %p)\n", pc, expected_pc);
242
+ exit(EXIT_FAILURE);
243
+ }
244
+
245
+ arg = arch_mcontext_arg(mc);
246
+ if (arg != test->expected_arg) {
247
+ printf("[ FAILED ] wrong arg (%d != %d)\n", arg, test->expected_arg);
248
+ exit(EXIT_FAILURE);
249
+ }
250
+
251
+ if (mprotect(page_base, page_size,
252
+ PROT_READ | PROT_WRITE | PROT_EXEC) < 0) {
253
+ handle_err("mprotect");
254
+ }
255
+}
256
+
257
+static void test_noexec_1(const struct noexec_test *test)
258
+{
259
+ void *start = page_base + test->page_ofs;
260
+ void (*fn)(int arg) = page_base + test->entry_ofs;
261
+
262
+ memcpy(start, test->test_code, test->test_len);
263
+ arch_flush(start, test->test_len);
264
+
265
+ /* Trigger TB creation in order to test invalidation. */
266
+ fn(0);
267
+
268
+ if (mprotect(page_base, page_size, PROT_NONE) < 0) {
269
+ handle_err("mprotect");
270
+ }
271
+
272
+ /* Trigger SEGV and check that handle_segv() ran. */
273
+ current_noexec_test = test;
274
+ fn(0);
275
+ assert(current_noexec_test == NULL);
276
+}
277
+
278
+static int test_noexec(struct noexec_test *tests, size_t n_tests)
279
+{
280
+ struct sigaction act;
281
+ size_t i;
282
+
283
+ memset(&act, 0, sizeof(act));
284
+ act.sa_sigaction = handle_segv;
285
+ act.sa_flags = SA_SIGINFO;
286
+ if (sigaction(SIGSEGV, &act, NULL) < 0) {
287
+ handle_err("sigaction");
288
+ }
289
+
290
+ page_size = getpagesize();
291
+ page_base = mmap(NULL, 2 * page_size,
292
+ PROT_READ | PROT_WRITE | PROT_EXEC,
293
+ MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
294
+ if (page_base == MAP_FAILED) {
295
+ handle_err("mmap");
296
+ }
297
+ page_base += page_size;
298
+
299
+ for (i = 0; i < n_tests; i++) {
300
+ struct noexec_test *test = &tests[i];
301
+
302
+ printf("[ RUN ] %s\n", test->name);
303
+ test_noexec_1(test);
304
+ printf("[ OK ]\n");
305
+ }
306
+
307
+ printf("[ PASSED ]\n");
308
+ return EXIT_SUCCESS;
309
+}
310
diff --git a/tests/tcg/s390x/Makefile.target b/tests/tcg/s390x/Makefile.target
112
index XXXXXXX..XXXXXXX 100644
311
index XXXXXXX..XXXXXXX 100644
113
--- a/accel/tcg/tcg-cpus.h
312
--- a/tests/tcg/s390x/Makefile.target
114
+++ b/accel/tcg/tcg-cpus.h
313
+++ b/tests/tcg/s390x/Makefile.target
115
@@ -XXX,XX +XXX,XX @@
314
@@ -XXX,XX +XXX,XX @@ TESTS+=shift
116
/*
315
TESTS+=trap
117
- * Accelerator CPUS Interface
316
TESTS+=signals-s390x
118
+ * QEMU TCG vCPU common functionality
317
TESTS+=branch-relative-long
119
+ *
318
+TESTS+=noexec
120
+ * Functionality common to all TCG vcpu variants: mttcg, rr and icount.
319
121
*
320
Z14_TESTS=vfminmax
122
* Copyright 2020 SUSE LLC
321
vfminmax: LDFLAGS+=-lm
123
*
124
@@ -XXX,XX +XXX,XX @@
125
126
#include "sysemu/cpus.h"
127
128
-extern const CpusAccel tcg_cpus;
129
+extern const CpusAccel tcg_cpus_mttcg;
130
+extern const CpusAccel tcg_cpus_icount;
131
+extern const CpusAccel tcg_cpus_rr;
132
+
133
+void tcg_start_vcpu_thread(CPUState *cpu);
134
+void qemu_tcg_destroy_vcpu(CPUState *cpu);
135
+int tcg_cpu_exec(CPUState *cpu);
136
+void tcg_handle_interrupt(CPUState *cpu, int mask);
137
138
#endif /* TCG_CPUS_H */
139
diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
140
index XXXXXXX..XXXXXXX 100644
141
--- a/accel/tcg/tcg-all.c
142
+++ b/accel/tcg/tcg-all.c
143
@@ -XXX,XX +XXX,XX @@ static int tcg_init(MachineState *ms)
144
145
tcg_exec_init(s->tb_size * 1024 * 1024);
146
mttcg_enabled = s->mttcg_enabled;
147
- cpus_register_accel(&tcg_cpus);
148
149
+ if (mttcg_enabled) {
150
+ cpus_register_accel(&tcg_cpus_mttcg);
151
+ } else if (icount_enabled()) {
152
+ cpus_register_accel(&tcg_cpus_icount);
153
+ } else {
154
+ cpus_register_accel(&tcg_cpus_rr);
155
+ }
156
return 0;
157
}
158
159
diff --git a/accel/tcg/tcg-cpus-icount.c b/accel/tcg/tcg-cpus-icount.c
160
new file mode 100644
161
index XXXXXXX..XXXXXXX
162
--- /dev/null
163
+++ b/accel/tcg/tcg-cpus-icount.c
164
@@ -XXX,XX +XXX,XX @@
165
+/*
166
+ * QEMU TCG Single Threaded vCPUs implementation using instruction counting
167
+ *
168
+ * Copyright (c) 2003-2008 Fabrice Bellard
169
+ * Copyright (c) 2014 Red Hat Inc.
170
+ *
171
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
172
+ * of this software and associated documentation files (the "Software"), to deal
173
+ * in the Software without restriction, including without limitation the rights
174
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
175
+ * copies of the Software, and to permit persons to whom the Software is
176
+ * furnished to do so, subject to the following conditions:
177
+ *
178
+ * The above copyright notice and this permission notice shall be included in
179
+ * all copies or substantial portions of the Software.
180
+ *
181
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
182
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
183
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
184
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
185
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
186
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
187
+ * THE SOFTWARE.
188
+ */
189
+
190
+#include "qemu/osdep.h"
191
+#include "qemu-common.h"
192
+#include "sysemu/tcg.h"
193
+#include "sysemu/replay.h"
194
+#include "qemu/main-loop.h"
195
+#include "qemu/guest-random.h"
196
+#include "exec/exec-all.h"
197
+#include "hw/boards.h"
198
+
199
+#include "tcg-cpus.h"
200
+#include "tcg-cpus-icount.h"
201
+#include "tcg-cpus-rr.h"
202
+
203
+static int64_t tcg_get_icount_limit(void)
204
+{
205
+ int64_t deadline;
206
+
207
+ if (replay_mode != REPLAY_MODE_PLAY) {
208
+ /*
209
+ * Include all the timers, because they may need an attention.
210
+ * Too long CPU execution may create unnecessary delay in UI.
211
+ */
212
+ deadline = qemu_clock_deadline_ns_all(QEMU_CLOCK_VIRTUAL,
213
+ QEMU_TIMER_ATTR_ALL);
214
+ /* Check realtime timers, because they help with input processing */
215
+ deadline = qemu_soonest_timeout(deadline,
216
+ qemu_clock_deadline_ns_all(QEMU_CLOCK_REALTIME,
217
+ QEMU_TIMER_ATTR_ALL));
218
+
219
+ /*
220
+ * Maintain prior (possibly buggy) behaviour where if no deadline
221
+ * was set (as there is no QEMU_CLOCK_VIRTUAL timer) or it is more than
222
+ * INT32_MAX nanoseconds ahead, we still use INT32_MAX
223
+ * nanoseconds.
224
+ */
225
+ if ((deadline < 0) || (deadline > INT32_MAX)) {
226
+ deadline = INT32_MAX;
227
+ }
228
+
229
+ return icount_round(deadline);
230
+ } else {
231
+ return replay_get_instructions();
232
+ }
233
+}
234
+
235
+static void notify_aio_contexts(void)
236
+{
237
+ /* Wake up other AioContexts. */
238
+ qemu_clock_notify(QEMU_CLOCK_VIRTUAL);
239
+ qemu_clock_run_timers(QEMU_CLOCK_VIRTUAL);
240
+}
241
+
242
+void handle_icount_deadline(void)
243
+{
244
+ assert(qemu_in_vcpu_thread());
245
+ int64_t deadline = qemu_clock_deadline_ns_all(QEMU_CLOCK_VIRTUAL,
246
+ QEMU_TIMER_ATTR_ALL);
247
+
248
+ if (deadline == 0) {
249
+ notify_aio_contexts();
250
+ }
251
+}
252
+
253
+void prepare_icount_for_run(CPUState *cpu)
254
+{
255
+ int insns_left;
256
+
257
+ /*
258
+ * These should always be cleared by process_icount_data after
259
+ * each vCPU execution. However u16.high can be raised
260
+ * asynchronously by cpu_exit/cpu_interrupt/tcg_handle_interrupt
261
+ */
262
+ g_assert(cpu_neg(cpu)->icount_decr.u16.low == 0);
263
+ g_assert(cpu->icount_extra == 0);
264
+
265
+ cpu->icount_budget = tcg_get_icount_limit();
266
+ insns_left = MIN(0xffff, cpu->icount_budget);
267
+ cpu_neg(cpu)->icount_decr.u16.low = insns_left;
268
+ cpu->icount_extra = cpu->icount_budget - insns_left;
269
+
270
+ replay_mutex_lock();
271
+
272
+ if (cpu->icount_budget == 0 && replay_has_checkpoint()) {
273
+ notify_aio_contexts();
274
+ }
275
+}
276
+
277
+void process_icount_data(CPUState *cpu)
278
+{
279
+ /* Account for executed instructions */
280
+ icount_update(cpu);
281
+
282
+ /* Reset the counters */
283
+ cpu_neg(cpu)->icount_decr.u16.low = 0;
284
+ cpu->icount_extra = 0;
285
+ cpu->icount_budget = 0;
286
+
287
+ replay_account_executed_instructions();
288
+
289
+ replay_mutex_unlock();
290
+}
291
+
292
+static void icount_handle_interrupt(CPUState *cpu, int mask)
293
+{
294
+ int old_mask = cpu->interrupt_request;
295
+
296
+ tcg_handle_interrupt(cpu, mask);
297
+ if (qemu_cpu_is_self(cpu) &&
298
+ !cpu->can_do_io
299
+ && (mask & ~old_mask) != 0) {
300
+ cpu_abort(cpu, "Raised interrupt while not in I/O function");
301
+ }
302
+}
303
+
304
+const CpusAccel tcg_cpus_icount = {
305
+ .create_vcpu_thread = tcg_start_vcpu_thread,
306
+ .kick_vcpu_thread = qemu_cpu_kick_rr_cpus,
307
+
308
+ .handle_interrupt = icount_handle_interrupt,
309
+ .get_virtual_clock = icount_get,
310
+ .get_elapsed_ticks = icount_get,
311
+};
312
diff --git a/accel/tcg/tcg-cpus-mttcg.c b/accel/tcg/tcg-cpus-mttcg.c
313
new file mode 100644
314
index XXXXXXX..XXXXXXX
315
--- /dev/null
316
+++ b/accel/tcg/tcg-cpus-mttcg.c
317
@@ -XXX,XX +XXX,XX @@
318
+/*
319
+ * QEMU TCG Multi Threaded vCPUs implementation
320
+ *
321
+ * Copyright (c) 2003-2008 Fabrice Bellard
322
+ * Copyright (c) 2014 Red Hat Inc.
323
+ *
324
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
325
+ * of this software and associated documentation files (the "Software"), to deal
326
+ * in the Software without restriction, including without limitation the rights
327
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
328
+ * copies of the Software, and to permit persons to whom the Software is
329
+ * furnished to do so, subject to the following conditions:
330
+ *
331
+ * The above copyright notice and this permission notice shall be included in
332
+ * all copies or substantial portions of the Software.
333
+ *
334
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
335
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
336
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
337
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
338
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
339
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
340
+ * THE SOFTWARE.
341
+ */
342
+
343
+#include "qemu/osdep.h"
344
+#include "qemu-common.h"
345
+#include "sysemu/tcg.h"
346
+#include "sysemu/replay.h"
347
+#include "qemu/main-loop.h"
348
+#include "qemu/guest-random.h"
349
+#include "exec/exec-all.h"
350
+#include "hw/boards.h"
351
+
352
+#include "tcg-cpus.h"
353
+#include "tcg-cpus-mttcg.h"
354
+
355
+/*
356
+ * In the multi-threaded case each vCPU has its own thread. The TLS
357
+ * variable current_cpu can be used deep in the code to find the
358
+ * current CPUState for a given thread.
359
+ */
360
+
361
+void *tcg_cpu_thread_fn(void *arg)
362
+{
363
+ CPUState *cpu = arg;
364
+
365
+ assert(tcg_enabled());
366
+ g_assert(!icount_enabled());
367
+
368
+ rcu_register_thread();
369
+ tcg_register_thread();
370
+
371
+ qemu_mutex_lock_iothread();
372
+ qemu_thread_get_self(cpu->thread);
373
+
374
+ cpu->thread_id = qemu_get_thread_id();
375
+ cpu->can_do_io = 1;
376
+ current_cpu = cpu;
377
+ cpu_thread_signal_created(cpu);
378
+ qemu_guest_random_seed_thread_part2(cpu->random_seed);
379
+
380
+ /* process any pending work */
381
+ cpu->exit_request = 1;
382
+
383
+ do {
384
+ if (cpu_can_run(cpu)) {
385
+ int r;
386
+ qemu_mutex_unlock_iothread();
387
+ r = tcg_cpu_exec(cpu);
388
+ qemu_mutex_lock_iothread();
389
+ switch (r) {
390
+ case EXCP_DEBUG:
391
+ cpu_handle_guest_debug(cpu);
392
+ break;
393
+ case EXCP_HALTED:
394
+ /*
395
+ * during start-up the vCPU is reset and the thread is
396
+ * kicked several times. If we don't ensure we go back
397
+ * to sleep in the halted state we won't cleanly
398
+ * start-up when the vCPU is enabled.
399
+ *
400
+ * cpu->halted should ensure we sleep in wait_io_event
401
+ */
402
+ g_assert(cpu->halted);
403
+ break;
404
+ case EXCP_ATOMIC:
405
+ qemu_mutex_unlock_iothread();
406
+ cpu_exec_step_atomic(cpu);
407
+ qemu_mutex_lock_iothread();
408
+ default:
409
+ /* Ignore everything else? */
410
+ break;
411
+ }
412
+ }
413
+
414
+ qatomic_mb_set(&cpu->exit_request, 0);
415
+ qemu_wait_io_event(cpu);
416
+ } while (!cpu->unplug || cpu_can_run(cpu));
417
+
418
+ qemu_tcg_destroy_vcpu(cpu);
419
+ qemu_mutex_unlock_iothread();
420
+ rcu_unregister_thread();
421
+ return NULL;
422
+}
423
+
424
+static void mttcg_kick_vcpu_thread(CPUState *cpu)
425
+{
426
+ cpu_exit(cpu);
427
+}
428
+
429
+const CpusAccel tcg_cpus_mttcg = {
430
+ .create_vcpu_thread = tcg_start_vcpu_thread,
431
+ .kick_vcpu_thread = mttcg_kick_vcpu_thread,
432
+
433
+ .handle_interrupt = tcg_handle_interrupt,
434
+};
435
diff --git a/accel/tcg/tcg-cpus-rr.c b/accel/tcg/tcg-cpus-rr.c
436
new file mode 100644
437
index XXXXXXX..XXXXXXX
438
--- /dev/null
439
+++ b/accel/tcg/tcg-cpus-rr.c
440
@@ -XXX,XX +XXX,XX @@
441
+/*
442
+ * QEMU TCG Single Threaded vCPUs implementation
443
+ *
444
+ * Copyright (c) 2003-2008 Fabrice Bellard
445
+ * Copyright (c) 2014 Red Hat Inc.
446
+ *
447
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
448
+ * of this software and associated documentation files (the "Software"), to deal
449
+ * in the Software without restriction, including without limitation the rights
450
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
451
+ * copies of the Software, and to permit persons to whom the Software is
452
+ * furnished to do so, subject to the following conditions:
453
+ *
454
+ * The above copyright notice and this permission notice shall be included in
455
+ * all copies or substantial portions of the Software.
456
+ *
457
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
458
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
459
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
460
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
461
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
462
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
463
+ * THE SOFTWARE.
464
+ */
465
+
466
+#include "qemu/osdep.h"
467
+#include "qemu-common.h"
468
+#include "sysemu/tcg.h"
469
+#include "sysemu/replay.h"
470
+#include "qemu/main-loop.h"
471
+#include "qemu/guest-random.h"
472
+#include "exec/exec-all.h"
473
+#include "hw/boards.h"
474
+
475
+#include "tcg-cpus.h"
476
+#include "tcg-cpus-rr.h"
477
+#include "tcg-cpus-icount.h"
478
+
479
+/* Kick all RR vCPUs */
480
+void qemu_cpu_kick_rr_cpus(CPUState *unused)
481
+{
482
+ CPUState *cpu;
483
+
484
+ CPU_FOREACH(cpu) {
485
+ cpu_exit(cpu);
486
+ };
487
+}
488
+
489
+/*
490
+ * TCG vCPU kick timer
491
+ *
492
+ * The kick timer is responsible for moving single threaded vCPU
493
+ * emulation on to the next vCPU. If more than one vCPU is running a
494
+ * timer event with force a cpu->exit so the next vCPU can get
495
+ * scheduled.
496
+ *
497
+ * The timer is removed if all vCPUs are idle and restarted again once
498
+ * idleness is complete.
499
+ */
500
+
501
+static QEMUTimer *tcg_kick_vcpu_timer;
502
+static CPUState *tcg_current_rr_cpu;
503
+
504
+#define TCG_KICK_PERIOD (NANOSECONDS_PER_SECOND / 10)
505
+
506
+static inline int64_t qemu_tcg_next_kick(void)
507
+{
508
+ return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + TCG_KICK_PERIOD;
509
+}
510
+
511
+/* Kick the currently round-robin scheduled vCPU to next */
512
+static void qemu_cpu_kick_rr_next_cpu(void)
513
+{
514
+ CPUState *cpu;
515
+ do {
516
+ cpu = qatomic_mb_read(&tcg_current_rr_cpu);
517
+ if (cpu) {
518
+ cpu_exit(cpu);
519
+ }
520
+ } while (cpu != qatomic_mb_read(&tcg_current_rr_cpu));
521
+}
522
+
523
+static void kick_tcg_thread(void *opaque)
524
+{
525
+ timer_mod(tcg_kick_vcpu_timer, qemu_tcg_next_kick());
526
+ qemu_cpu_kick_rr_next_cpu();
527
+}
528
+
529
+static void start_tcg_kick_timer(void)
530
+{
531
+ if (!tcg_kick_vcpu_timer && CPU_NEXT(first_cpu)) {
532
+ tcg_kick_vcpu_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
533
+ kick_tcg_thread, NULL);
534
+ }
535
+ if (tcg_kick_vcpu_timer && !timer_pending(tcg_kick_vcpu_timer)) {
536
+ timer_mod(tcg_kick_vcpu_timer, qemu_tcg_next_kick());
537
+ }
538
+}
539
+
540
+static void stop_tcg_kick_timer(void)
541
+{
542
+ if (tcg_kick_vcpu_timer && timer_pending(tcg_kick_vcpu_timer)) {
543
+ timer_del(tcg_kick_vcpu_timer);
544
+ }
545
+}
546
+
547
+static void qemu_tcg_rr_wait_io_event(void)
548
+{
549
+ CPUState *cpu;
550
+
551
+ while (all_cpu_threads_idle()) {
552
+ stop_tcg_kick_timer();
553
+ qemu_cond_wait_iothread(first_cpu->halt_cond);
554
+ }
555
+
556
+ start_tcg_kick_timer();
557
+
558
+ CPU_FOREACH(cpu) {
559
+ qemu_wait_io_event_common(cpu);
560
+ }
561
+}
562
+
563
+/*
564
+ * Destroy any remaining vCPUs which have been unplugged and have
565
+ * finished running
566
+ */
567
+static void deal_with_unplugged_cpus(void)
568
+{
569
+ CPUState *cpu;
570
+
571
+ CPU_FOREACH(cpu) {
572
+ if (cpu->unplug && !cpu_can_run(cpu)) {
573
+ qemu_tcg_destroy_vcpu(cpu);
574
+ break;
575
+ }
576
+ }
577
+}
578
+
579
+/*
580
+ * In the single-threaded case each vCPU is simulated in turn. If
581
+ * there is more than a single vCPU we create a simple timer to kick
582
+ * the vCPU and ensure we don't get stuck in a tight loop in one vCPU.
583
+ * This is done explicitly rather than relying on side-effects
584
+ * elsewhere.
585
+ */
586
+
587
+void *tcg_rr_cpu_thread_fn(void *arg)
588
+{
589
+ CPUState *cpu = arg;
590
+
591
+ assert(tcg_enabled());
592
+ rcu_register_thread();
593
+ tcg_register_thread();
594
+
595
+ qemu_mutex_lock_iothread();
596
+ qemu_thread_get_self(cpu->thread);
597
+
598
+ cpu->thread_id = qemu_get_thread_id();
599
+ cpu->can_do_io = 1;
600
+ cpu_thread_signal_created(cpu);
601
+ qemu_guest_random_seed_thread_part2(cpu->random_seed);
602
+
603
+ /* wait for initial kick-off after machine start */
604
+ while (first_cpu->stopped) {
605
+ qemu_cond_wait_iothread(first_cpu->halt_cond);
606
+
607
+ /* process any pending work */
608
+ CPU_FOREACH(cpu) {
609
+ current_cpu = cpu;
610
+ qemu_wait_io_event_common(cpu);
611
+ }
612
+ }
613
+
614
+ start_tcg_kick_timer();
615
+
616
+ cpu = first_cpu;
617
+
618
+ /* process any pending work */
619
+ cpu->exit_request = 1;
620
+
621
+ while (1) {
622
+ qemu_mutex_unlock_iothread();
623
+ replay_mutex_lock();
624
+ qemu_mutex_lock_iothread();
625
+
626
+ if (icount_enabled()) {
627
+ /* Account partial waits to QEMU_CLOCK_VIRTUAL. */
628
+ icount_account_warp_timer();
629
+ /*
630
+ * Run the timers here. This is much more efficient than
631
+ * waking up the I/O thread and waiting for completion.
632
+ */
633
+ handle_icount_deadline();
634
+ }
635
+
636
+ replay_mutex_unlock();
637
+
638
+ if (!cpu) {
639
+ cpu = first_cpu;
640
+ }
641
+
642
+ while (cpu && cpu_work_list_empty(cpu) && !cpu->exit_request) {
643
+
644
+ qatomic_mb_set(&tcg_current_rr_cpu, cpu);
645
+ current_cpu = cpu;
646
+
647
+ qemu_clock_enable(QEMU_CLOCK_VIRTUAL,
648
+ (cpu->singlestep_enabled & SSTEP_NOTIMER) == 0);
649
+
650
+ if (cpu_can_run(cpu)) {
651
+ int r;
652
+
653
+ qemu_mutex_unlock_iothread();
654
+ if (icount_enabled()) {
655
+ prepare_icount_for_run(cpu);
656
+ }
657
+ r = tcg_cpu_exec(cpu);
658
+ if (icount_enabled()) {
659
+ process_icount_data(cpu);
660
+ }
661
+ qemu_mutex_lock_iothread();
662
+
663
+ if (r == EXCP_DEBUG) {
664
+ cpu_handle_guest_debug(cpu);
665
+ break;
666
+ } else if (r == EXCP_ATOMIC) {
667
+ qemu_mutex_unlock_iothread();
668
+ cpu_exec_step_atomic(cpu);
669
+ qemu_mutex_lock_iothread();
670
+ break;
671
+ }
672
+ } else if (cpu->stop) {
673
+ if (cpu->unplug) {
674
+ cpu = CPU_NEXT(cpu);
675
+ }
676
+ break;
677
+ }
678
+
679
+ cpu = CPU_NEXT(cpu);
680
+ } /* while (cpu && !cpu->exit_request).. */
681
+
682
+ /* Does not need qatomic_mb_set because a spurious wakeup is okay. */
683
+ qatomic_set(&tcg_current_rr_cpu, NULL);
684
+
685
+ if (cpu && cpu->exit_request) {
686
+ qatomic_mb_set(&cpu->exit_request, 0);
687
+ }
688
+
689
+ if (icount_enabled() && all_cpu_threads_idle()) {
690
+ /*
691
+ * When all cpus are sleeping (e.g in WFI), to avoid a deadlock
692
+ * in the main_loop, wake it up in order to start the warp timer.
693
+ */
694
+ qemu_notify_event();
695
+ }
696
+
697
+ qemu_tcg_rr_wait_io_event();
698
+ deal_with_unplugged_cpus();
699
+ }
700
+
701
+ rcu_unregister_thread();
702
+ return NULL;
703
+}
704
+
705
+const CpusAccel tcg_cpus_rr = {
706
+ .create_vcpu_thread = tcg_start_vcpu_thread,
707
+ .kick_vcpu_thread = qemu_cpu_kick_rr_cpus,
708
+
709
+ .handle_interrupt = tcg_handle_interrupt,
710
+};
711
diff --git a/accel/tcg/tcg-cpus.c b/accel/tcg/tcg-cpus.c
712
index XXXXXXX..XXXXXXX 100644
713
--- a/accel/tcg/tcg-cpus.c
714
+++ b/accel/tcg/tcg-cpus.c
715
@@ -XXX,XX +XXX,XX @@
716
/*
717
- * QEMU System Emulator
718
+ * QEMU TCG vCPU common functionality
719
+ *
720
+ * Functionality common to all TCG vCPU variants: mttcg, rr and icount.
721
*
722
* Copyright (c) 2003-2008 Fabrice Bellard
723
* Copyright (c) 2014 Red Hat Inc.
724
@@ -XXX,XX +XXX,XX @@
725
#include "hw/boards.h"
726
727
#include "tcg-cpus.h"
728
+#include "tcg-cpus-mttcg.h"
729
+#include "tcg-cpus-rr.h"
730
731
-/* Kick all RR vCPUs */
732
-static void qemu_cpu_kick_rr_cpus(void)
733
-{
734
- CPUState *cpu;
735
+/* common functionality among all TCG variants */
736
737
- CPU_FOREACH(cpu) {
738
- cpu_exit(cpu);
739
- };
740
-}
741
-
742
-static void tcg_kick_vcpu_thread(CPUState *cpu)
743
-{
744
- if (qemu_tcg_mttcg_enabled()) {
745
- cpu_exit(cpu);
746
- } else {
747
- qemu_cpu_kick_rr_cpus();
748
- }
749
-}
750
-
751
-/*
752
- * TCG vCPU kick timer
753
- *
754
- * The kick timer is responsible for moving single threaded vCPU
755
- * emulation on to the next vCPU. If more than one vCPU is running a
756
- * timer event with force a cpu->exit so the next vCPU can get
757
- * scheduled.
758
- *
759
- * The timer is removed if all vCPUs are idle and restarted again once
760
- * idleness is complete.
761
- */
762
-
763
-static QEMUTimer *tcg_kick_vcpu_timer;
764
-static CPUState *tcg_current_rr_cpu;
765
-
766
-#define TCG_KICK_PERIOD (NANOSECONDS_PER_SECOND / 10)
767
-
768
-static inline int64_t qemu_tcg_next_kick(void)
769
-{
770
- return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + TCG_KICK_PERIOD;
771
-}
772
-
773
-/* Kick the currently round-robin scheduled vCPU to next */
774
-static void qemu_cpu_kick_rr_next_cpu(void)
775
-{
776
- CPUState *cpu;
777
- do {
778
- cpu = qatomic_mb_read(&tcg_current_rr_cpu);
779
- if (cpu) {
780
- cpu_exit(cpu);
781
- }
782
- } while (cpu != qatomic_mb_read(&tcg_current_rr_cpu));
783
-}
784
-
785
-static void kick_tcg_thread(void *opaque)
786
-{
787
- timer_mod(tcg_kick_vcpu_timer, qemu_tcg_next_kick());
788
- qemu_cpu_kick_rr_next_cpu();
789
-}
790
-
791
-static void start_tcg_kick_timer(void)
792
-{
793
- assert(!mttcg_enabled);
794
- if (!tcg_kick_vcpu_timer && CPU_NEXT(first_cpu)) {
795
- tcg_kick_vcpu_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
796
- kick_tcg_thread, NULL);
797
- }
798
- if (tcg_kick_vcpu_timer && !timer_pending(tcg_kick_vcpu_timer)) {
799
- timer_mod(tcg_kick_vcpu_timer, qemu_tcg_next_kick());
800
- }
801
-}
802
-
803
-static void stop_tcg_kick_timer(void)
804
-{
805
- assert(!mttcg_enabled);
806
- if (tcg_kick_vcpu_timer && timer_pending(tcg_kick_vcpu_timer)) {
807
- timer_del(tcg_kick_vcpu_timer);
808
- }
809
-}
810
-
811
-static void qemu_tcg_destroy_vcpu(CPUState *cpu)
812
-{
813
-}
814
-
815
-static void qemu_tcg_rr_wait_io_event(void)
816
-{
817
- CPUState *cpu;
818
-
819
- while (all_cpu_threads_idle()) {
820
- stop_tcg_kick_timer();
821
- qemu_cond_wait_iothread(first_cpu->halt_cond);
822
- }
823
-
824
- start_tcg_kick_timer();
825
-
826
- CPU_FOREACH(cpu) {
827
- qemu_wait_io_event_common(cpu);
828
- }
829
-}
830
-
831
-static int64_t tcg_get_icount_limit(void)
832
-{
833
- int64_t deadline;
834
-
835
- if (replay_mode != REPLAY_MODE_PLAY) {
836
- /*
837
- * Include all the timers, because they may need an attention.
838
- * Too long CPU execution may create unnecessary delay in UI.
839
- */
840
- deadline = qemu_clock_deadline_ns_all(QEMU_CLOCK_VIRTUAL,
841
- QEMU_TIMER_ATTR_ALL);
842
- /* Check realtime timers, because they help with input processing */
843
- deadline = qemu_soonest_timeout(deadline,
844
- qemu_clock_deadline_ns_all(QEMU_CLOCK_REALTIME,
845
- QEMU_TIMER_ATTR_ALL));
846
-
847
- /*
848
- * Maintain prior (possibly buggy) behaviour where if no deadline
849
- * was set (as there is no QEMU_CLOCK_VIRTUAL timer) or it is more than
850
- * INT32_MAX nanoseconds ahead, we still use INT32_MAX
851
- * nanoseconds.
852
- */
853
- if ((deadline < 0) || (deadline > INT32_MAX)) {
854
- deadline = INT32_MAX;
855
- }
856
-
857
- return icount_round(deadline);
858
- } else {
859
- return replay_get_instructions();
860
- }
861
-}
862
-
863
-static void notify_aio_contexts(void)
864
-{
865
- /* Wake up other AioContexts. */
866
- qemu_clock_notify(QEMU_CLOCK_VIRTUAL);
867
- qemu_clock_run_timers(QEMU_CLOCK_VIRTUAL);
868
-}
869
-
870
-static void handle_icount_deadline(void)
871
-{
872
- assert(qemu_in_vcpu_thread());
873
- if (icount_enabled()) {
874
- int64_t deadline = qemu_clock_deadline_ns_all(QEMU_CLOCK_VIRTUAL,
875
- QEMU_TIMER_ATTR_ALL);
876
-
877
- if (deadline == 0) {
878
- notify_aio_contexts();
879
- }
880
- }
881
-}
882
-
883
-static void prepare_icount_for_run(CPUState *cpu)
884
-{
885
- if (icount_enabled()) {
886
- int insns_left;
887
-
888
- /*
889
- * These should always be cleared by process_icount_data after
890
- * each vCPU execution. However u16.high can be raised
891
- * asynchronously by cpu_exit/cpu_interrupt/tcg_handle_interrupt
892
- */
893
- g_assert(cpu_neg(cpu)->icount_decr.u16.low == 0);
894
- g_assert(cpu->icount_extra == 0);
895
-
896
- cpu->icount_budget = tcg_get_icount_limit();
897
- insns_left = MIN(0xffff, cpu->icount_budget);
898
- cpu_neg(cpu)->icount_decr.u16.low = insns_left;
899
- cpu->icount_extra = cpu->icount_budget - insns_left;
900
-
901
- replay_mutex_lock();
902
-
903
- if (cpu->icount_budget == 0 && replay_has_checkpoint()) {
904
- notify_aio_contexts();
905
- }
906
- }
907
-}
908
-
909
-static void process_icount_data(CPUState *cpu)
910
-{
911
- if (icount_enabled()) {
912
- /* Account for executed instructions */
913
- icount_update(cpu);
914
-
915
- /* Reset the counters */
916
- cpu_neg(cpu)->icount_decr.u16.low = 0;
917
- cpu->icount_extra = 0;
918
- cpu->icount_budget = 0;
919
-
920
- replay_account_executed_instructions();
921
-
922
- replay_mutex_unlock();
923
- }
924
-}
925
-
926
-static int tcg_cpu_exec(CPUState *cpu)
927
-{
928
- int ret;
929
-#ifdef CONFIG_PROFILER
930
- int64_t ti;
931
-#endif
932
-
933
- assert(tcg_enabled());
934
-#ifdef CONFIG_PROFILER
935
- ti = profile_getclock();
936
-#endif
937
- cpu_exec_start(cpu);
938
- ret = cpu_exec(cpu);
939
- cpu_exec_end(cpu);
940
-#ifdef CONFIG_PROFILER
941
- qatomic_set(&tcg_ctx->prof.cpu_exec_time,
942
- tcg_ctx->prof.cpu_exec_time + profile_getclock() - ti);
943
-#endif
944
- return ret;
945
-}
946
-
947
-/*
948
- * Destroy any remaining vCPUs which have been unplugged and have
949
- * finished running
950
- */
951
-static void deal_with_unplugged_cpus(void)
952
-{
953
- CPUState *cpu;
954
-
955
- CPU_FOREACH(cpu) {
956
- if (cpu->unplug && !cpu_can_run(cpu)) {
957
- qemu_tcg_destroy_vcpu(cpu);
958
- cpu_thread_signal_destroyed(cpu);
959
- break;
960
- }
961
- }
962
-}
963
-
964
-/*
965
- * Single-threaded TCG
966
- *
967
- * In the single-threaded case each vCPU is simulated in turn. If
968
- * there is more than a single vCPU we create a simple timer to kick
969
- * the vCPU and ensure we don't get stuck in a tight loop in one vCPU.
970
- * This is done explicitly rather than relying on side-effects
971
- * elsewhere.
972
- */
973
-
974
-static void *tcg_rr_cpu_thread_fn(void *arg)
975
-{
976
- CPUState *cpu = arg;
977
-
978
- assert(tcg_enabled());
979
- rcu_register_thread();
980
- tcg_register_thread();
981
-
982
- qemu_mutex_lock_iothread();
983
- qemu_thread_get_self(cpu->thread);
984
-
985
- cpu->thread_id = qemu_get_thread_id();
986
- cpu->can_do_io = 1;
987
- cpu_thread_signal_created(cpu);
988
- qemu_guest_random_seed_thread_part2(cpu->random_seed);
989
-
990
- /* wait for initial kick-off after machine start */
991
- while (first_cpu->stopped) {
992
- qemu_cond_wait_iothread(first_cpu->halt_cond);
993
-
994
- /* process any pending work */
995
- CPU_FOREACH(cpu) {
996
- current_cpu = cpu;
997
- qemu_wait_io_event_common(cpu);
998
- }
999
- }
1000
-
1001
- start_tcg_kick_timer();
1002
-
1003
- cpu = first_cpu;
1004
-
1005
- /* process any pending work */
1006
- cpu->exit_request = 1;
1007
-
1008
- while (1) {
1009
- qemu_mutex_unlock_iothread();
1010
- replay_mutex_lock();
1011
- qemu_mutex_lock_iothread();
1012
- /* Account partial waits to QEMU_CLOCK_VIRTUAL. */
1013
- icount_account_warp_timer();
1014
-
1015
- /*
1016
- * Run the timers here. This is much more efficient than
1017
- * waking up the I/O thread and waiting for completion.
1018
- */
1019
- handle_icount_deadline();
1020
-
1021
- replay_mutex_unlock();
1022
-
1023
- if (!cpu) {
1024
- cpu = first_cpu;
1025
- }
1026
-
1027
- while (cpu && cpu_work_list_empty(cpu) && !cpu->exit_request) {
1028
-
1029
- qatomic_mb_set(&tcg_current_rr_cpu, cpu);
1030
- current_cpu = cpu;
1031
-
1032
- qemu_clock_enable(QEMU_CLOCK_VIRTUAL,
1033
- (cpu->singlestep_enabled & SSTEP_NOTIMER) == 0);
1034
-
1035
- if (cpu_can_run(cpu)) {
1036
- int r;
1037
-
1038
- qemu_mutex_unlock_iothread();
1039
- prepare_icount_for_run(cpu);
1040
-
1041
- r = tcg_cpu_exec(cpu);
1042
-
1043
- process_icount_data(cpu);
1044
- qemu_mutex_lock_iothread();
1045
-
1046
- if (r == EXCP_DEBUG) {
1047
- cpu_handle_guest_debug(cpu);
1048
- break;
1049
- } else if (r == EXCP_ATOMIC) {
1050
- qemu_mutex_unlock_iothread();
1051
- cpu_exec_step_atomic(cpu);
1052
- qemu_mutex_lock_iothread();
1053
- break;
1054
- }
1055
- } else if (cpu->stop) {
1056
- if (cpu->unplug) {
1057
- cpu = CPU_NEXT(cpu);
1058
- }
1059
- break;
1060
- }
1061
-
1062
- cpu = CPU_NEXT(cpu);
1063
- } /* while (cpu && !cpu->exit_request).. */
1064
-
1065
- /* Does not need qatomic_mb_set because a spurious wakeup is okay. */
1066
- qatomic_set(&tcg_current_rr_cpu, NULL);
1067
-
1068
- if (cpu && cpu->exit_request) {
1069
- qatomic_mb_set(&cpu->exit_request, 0);
1070
- }
1071
-
1072
- if (icount_enabled() && all_cpu_threads_idle()) {
1073
- /*
1074
- * When all cpus are sleeping (e.g in WFI), to avoid a deadlock
1075
- * in the main_loop, wake it up in order to start the warp timer.
1076
- */
1077
- qemu_notify_event();
1078
- }
1079
-
1080
- qemu_tcg_rr_wait_io_event();
1081
- deal_with_unplugged_cpus();
1082
- }
1083
-
1084
- rcu_unregister_thread();
1085
- return NULL;
1086
-}
1087
-
1088
-/*
1089
- * Multi-threaded TCG
1090
- *
1091
- * In the multi-threaded case each vCPU has its own thread. The TLS
1092
- * variable current_cpu can be used deep in the code to find the
1093
- * current CPUState for a given thread.
1094
- */
1095
-
1096
-static void *tcg_cpu_thread_fn(void *arg)
1097
-{
1098
- CPUState *cpu = arg;
1099
-
1100
- assert(tcg_enabled());
1101
- g_assert(!icount_enabled());
1102
-
1103
- rcu_register_thread();
1104
- tcg_register_thread();
1105
-
1106
- qemu_mutex_lock_iothread();
1107
- qemu_thread_get_self(cpu->thread);
1108
-
1109
- cpu->thread_id = qemu_get_thread_id();
1110
- cpu->can_do_io = 1;
1111
- current_cpu = cpu;
1112
- cpu_thread_signal_created(cpu);
1113
- qemu_guest_random_seed_thread_part2(cpu->random_seed);
1114
-
1115
- /* process any pending work */
1116
- cpu->exit_request = 1;
1117
-
1118
- do {
1119
- if (cpu_can_run(cpu)) {
1120
- int r;
1121
- qemu_mutex_unlock_iothread();
1122
- r = tcg_cpu_exec(cpu);
1123
- qemu_mutex_lock_iothread();
1124
- switch (r) {
1125
- case EXCP_DEBUG:
1126
- cpu_handle_guest_debug(cpu);
1127
- break;
1128
- case EXCP_HALTED:
1129
- /*
1130
- * during start-up the vCPU is reset and the thread is
1131
- * kicked several times. If we don't ensure we go back
1132
- * to sleep in the halted state we won't cleanly
1133
- * start-up when the vCPU is enabled.
1134
- *
1135
- * cpu->halted should ensure we sleep in wait_io_event
1136
- */
1137
- g_assert(cpu->halted);
1138
- break;
1139
- case EXCP_ATOMIC:
1140
- qemu_mutex_unlock_iothread();
1141
- cpu_exec_step_atomic(cpu);
1142
- qemu_mutex_lock_iothread();
1143
- default:
1144
- /* Ignore everything else? */
1145
- break;
1146
- }
1147
- }
1148
-
1149
- qatomic_mb_set(&cpu->exit_request, 0);
1150
- qemu_wait_io_event(cpu);
1151
- } while (!cpu->unplug || cpu_can_run(cpu));
1152
-
1153
- qemu_tcg_destroy_vcpu(cpu);
1154
- cpu_thread_signal_destroyed(cpu);
1155
- qemu_mutex_unlock_iothread();
1156
- rcu_unregister_thread();
1157
- return NULL;
1158
-}
1159
-
1160
-static void tcg_start_vcpu_thread(CPUState *cpu)
1161
+void tcg_start_vcpu_thread(CPUState *cpu)
1162
{
1163
char thread_name[VCPU_THREAD_NAME_SIZE];
1164
static QemuCond *single_tcg_halt_cond;
1165
@@ -XXX,XX +XXX,XX @@ static void tcg_start_vcpu_thread(CPUState *cpu)
1166
}
1167
}
1168
1169
-static int64_t tcg_get_virtual_clock(void)
1170
+void qemu_tcg_destroy_vcpu(CPUState *cpu)
1171
{
1172
- if (icount_enabled()) {
1173
- return icount_get();
1174
- }
1175
- return cpu_get_clock();
1176
+ cpu_thread_signal_destroyed(cpu);
1177
}
1178
1179
-static int64_t tcg_get_elapsed_ticks(void)
1180
+int tcg_cpu_exec(CPUState *cpu)
1181
{
1182
- if (icount_enabled()) {
1183
- return icount_get();
1184
- }
1185
- return cpu_get_ticks();
1186
+ int ret;
1187
+#ifdef CONFIG_PROFILER
1188
+ int64_t ti;
1189
+#endif
1190
+ assert(tcg_enabled());
1191
+#ifdef CONFIG_PROFILER
1192
+ ti = profile_getclock();
1193
+#endif
1194
+ cpu_exec_start(cpu);
1195
+ ret = cpu_exec(cpu);
1196
+ cpu_exec_end(cpu);
1197
+#ifdef CONFIG_PROFILER
1198
+ qatomic_set(&tcg_ctx->prof.cpu_exec_time,
1199
+ tcg_ctx->prof.cpu_exec_time + profile_getclock() - ti);
1200
+#endif
1201
+ return ret;
1202
}
1203
1204
/* mask must never be zero, except for A20 change call */
1205
-static void tcg_handle_interrupt(CPUState *cpu, int mask)
1206
+void tcg_handle_interrupt(CPUState *cpu, int mask)
1207
{
1208
- int old_mask;
1209
g_assert(qemu_mutex_iothread_locked());
1210
1211
- old_mask = cpu->interrupt_request;
1212
cpu->interrupt_request |= mask;
1213
1214
/*
1215
@@ -XXX,XX +XXX,XX @@ static void tcg_handle_interrupt(CPUState *cpu, int mask)
1216
qemu_cpu_kick(cpu);
1217
} else {
1218
qatomic_set(&cpu_neg(cpu)->icount_decr.u16.high, -1);
1219
- if (icount_enabled() &&
1220
- !cpu->can_do_io
1221
- && (mask & ~old_mask) != 0) {
1222
- cpu_abort(cpu, "Raised interrupt while not in I/O function");
1223
- }
1224
}
1225
}
1226
-
1227
-const CpusAccel tcg_cpus = {
1228
- .create_vcpu_thread = tcg_start_vcpu_thread,
1229
- .kick_vcpu_thread = tcg_kick_vcpu_thread,
1230
-
1231
- .handle_interrupt = tcg_handle_interrupt,
1232
-
1233
- .get_virtual_clock = tcg_get_virtual_clock,
1234
- .get_elapsed_ticks = tcg_get_elapsed_ticks,
1235
-};
1236
diff --git a/softmmu/icount.c b/softmmu/icount.c
1237
index XXXXXXX..XXXXXXX 100644
1238
--- a/softmmu/icount.c
1239
+++ b/softmmu/icount.c
1240
@@ -XXX,XX +XXX,XX @@ void icount_start_warp_timer(void)
1241
1242
void icount_account_warp_timer(void)
1243
{
1244
- if (!icount_enabled() || !icount_sleep) {
1245
+ if (!icount_sleep) {
1246
return;
1247
}
1248
1249
diff --git a/accel/tcg/meson.build b/accel/tcg/meson.build
1250
index XXXXXXX..XXXXXXX 100644
1251
--- a/accel/tcg/meson.build
1252
+++ b/accel/tcg/meson.build
1253
@@ -XXX,XX +XXX,XX @@ tcg_ss.add(when: 'CONFIG_SOFTMMU', if_false: files('user-exec-stub.c'))
1254
tcg_ss.add(when: 'CONFIG_PLUGIN', if_true: [files('plugin-gen.c'), libdl])
1255
specific_ss.add_all(when: 'CONFIG_TCG', if_true: tcg_ss)
1256
1257
-specific_ss.add(when: ['CONFIG_SOFTMMU', 'CONFIG_TCG'], if_true: files('tcg-all.c', 'cputlb.c', 'tcg-cpus.c'))
1258
+specific_ss.add(when: ['CONFIG_SOFTMMU', 'CONFIG_TCG'], if_true: files(
1259
+ 'tcg-all.c',
1260
+ 'cputlb.c',
1261
+ 'tcg-cpus.c',
1262
+ 'tcg-cpus-mttcg.c',
1263
+ 'tcg-cpus-icount.c',
1264
+ 'tcg-cpus-rr.c'
1265
+))
1266
--
322
--
1267
2.25.1
323
2.34.1
1268
1269
diff view generated by jsdifflib
New patch
[PULL 18/20] target/i386: Make translator stop before the end of a page
1
1
From: Ilya Leoshkevich <iii@linux.ibm.com>
2
3
Right now translator stops right *after* the end of a page, which
4
breaks reporting of fault locations when the last instruction of a
5
multi-insn translation block crosses a page boundary.
6
7
An implementation, like the one arm and s390x have, would require an
8
i386 length disassembler, which is burdensome to maintain. Another
9
alternative would be to single-step at the end of a guest page, but
10
this may come with a performance impact.
11
12
Fix by snapshotting disassembly state and restoring it after we figure
13
out we crossed a page boundary. This includes rolling back cc_op
14
updates and emitted ops.
15
16
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
17
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
18
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1143
19
Message-Id: <20220817150506.592862-4-iii@linux.ibm.com>
20
[rth: Simplify end-of-insn cross-page checks.]
21
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
22
---
23
target/i386/tcg/translate.c | 64 ++++++++++++++++-----------
24
tests/tcg/x86_64/noexec.c | 75 ++++++++++++++++++++++++++++++++
25
tests/tcg/x86_64/Makefile.target | 3 +-
26
3 files changed, 116 insertions(+), 26 deletions(-)
27
create mode 100644 tests/tcg/x86_64/noexec.c
28
29
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
30
index XXXXXXX..XXXXXXX 100644
31
--- a/target/i386/tcg/translate.c
32
+++ b/target/i386/tcg/translate.c
33
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
34
TCGv_i64 tmp1_i64;
35
36
sigjmp_buf jmpbuf;
37
+ TCGOp *prev_insn_end;
38
} DisasContext;
39
40
/* The environment in which user-only runs is constrained. */
41
@@ -XXX,XX +XXX,XX @@ static uint64_t advance_pc(CPUX86State *env, DisasContext *s, int num_bytes)
42
{
43
uint64_t pc = s->pc;
44
45
+ /* This is a subsequent insn that crosses a page boundary. */
46
+ if (s->base.num_insns > 1 &&
47
+ !is_same_page(&s->base, s->pc + num_bytes - 1)) {
48
+ siglongjmp(s->jmpbuf, 2);
49
+ }
50
+
51
s->pc += num_bytes;
52
if (unlikely(s->pc - s->pc_start > X86_MAX_INSN_LENGTH)) {
53
/* If the instruction's 16th byte is on a different page than the 1st, a
54
@@ -XXX,XX +XXX,XX @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu)
55
int modrm, reg, rm, mod, op, opreg, val;
56
target_ulong next_eip, tval;
57
target_ulong pc_start = s->base.pc_next;
58
+ bool orig_cc_op_dirty = s->cc_op_dirty;
59
+ CCOp orig_cc_op = s->cc_op;
60
61
s->pc_start = s->pc = pc_start;
62
s->override = -1;
63
@@ -XXX,XX +XXX,XX @@ static target_ulong disas_insn(DisasContext *s, CPUState *cpu)
64
s->rip_offset = 0; /* for relative ip address */
65
s->vex_l = 0;
66
s->vex_v = 0;
67
- if (sigsetjmp(s->jmpbuf, 0) != 0) {
68
+ switch (sigsetjmp(s->jmpbuf, 0)) {
69
+ case 0:
70
+ break;
71
+ case 1:
72
gen_exception_gpf(s);
73
return s->pc;
74
+ case 2:
75
+ /* Restore state that may affect the next instruction. */
76
+ s->cc_op_dirty = orig_cc_op_dirty;
77
+ s->cc_op = orig_cc_op;
78
+ s->base.num_insns--;
79
+ tcg_remove_ops_after(s->prev_insn_end);
80
+ s->base.is_jmp = DISAS_TOO_MANY;
81
+ return pc_start;
82
+ default:
83
+ g_assert_not_reached();
84
}
85
86
prefixes = 0;
87
@@ -XXX,XX +XXX,XX @@ static void i386_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)
88
{
89
DisasContext *dc = container_of(dcbase, DisasContext, base);
90
91
+ dc->prev_insn_end = tcg_last_op();
92
tcg_gen_insn_start(dc->base.pc_next, dc->cc_op);
93
}
94
95
@@ -XXX,XX +XXX,XX @@ static void i386_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
96
#endif
97
98
pc_next = disas_insn(dc, cpu);
99
-
100
- if (dc->flags & (HF_TF_MASK | HF_INHIBIT_IRQ_MASK)) {
101
- /* if single step mode, we generate only one instruction and
102
- generate an exception */
103
- /* if irq were inhibited with HF_INHIBIT_IRQ_MASK, we clear
104
- the flag and abort the translation to give the irqs a
105
- chance to happen */
106
- dc->base.is_jmp = DISAS_TOO_MANY;
107
- } else if ((tb_cflags(dc->base.tb) & CF_USE_ICOUNT)
108
- && ((pc_next & TARGET_PAGE_MASK)
109
- != ((pc_next + TARGET_MAX_INSN_SIZE - 1)
110
- & TARGET_PAGE_MASK)
111
- || (pc_next & ~TARGET_PAGE_MASK) == 0)) {
112
- /* Do not cross the boundary of the pages in icount mode,
113
- it can cause an exception. Do it only when boundary is
114
- crossed by the first instruction in the block.
115
- If current instruction already crossed the bound - it's ok,
116
- because an exception hasn't stopped this code.
117
- */
118
- dc->base.is_jmp = DISAS_TOO_MANY;
119
- } else if ((pc_next - dc->base.pc_first) >= (TARGET_PAGE_SIZE - 32)) {
120
- dc->base.is_jmp = DISAS_TOO_MANY;
121
- }
122
-
123
dc->base.pc_next = pc_next;
124
+
125
+ if (dc->base.is_jmp == DISAS_NEXT) {
126
+ if (dc->flags & (HF_TF_MASK | HF_INHIBIT_IRQ_MASK)) {
127
+ /*
128
+ * If single step mode, we generate only one instruction and
129
+ * generate an exception.
130
+ * If irq were inhibited with HF_INHIBIT_IRQ_MASK, we clear
131
+ * the flag and abort the translation to give the irqs a
132
+ * chance to happen.
133
+ */
134
+ dc->base.is_jmp = DISAS_TOO_MANY;
135
+ } else if (!is_same_page(&dc->base, pc_next)) {
136
+ dc->base.is_jmp = DISAS_TOO_MANY;
137
+ }
138
+ }
139
}
140
141
static void i386_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
142
diff --git a/tests/tcg/x86_64/noexec.c b/tests/tcg/x86_64/noexec.c
143
new file mode 100644
144
index XXXXXXX..XXXXXXX
145
--- /dev/null
146
+++ b/tests/tcg/x86_64/noexec.c
147
@@ -XXX,XX +XXX,XX @@
148
+#include "../multiarch/noexec.c.inc"
149
+
150
+static void *arch_mcontext_pc(const mcontext_t *ctx)
151
+{
152
+ return (void *)ctx->gregs[REG_RIP];
153
+}
154
+
155
+int arch_mcontext_arg(const mcontext_t *ctx)
156
+{
157
+ return ctx->gregs[REG_RDI];
158
+}
159
+
160
+static void arch_flush(void *p, int len)
161
+{
162
+}
163
+
164
+extern char noexec_1[];
165
+extern char noexec_2[];
166
+extern char noexec_end[];
167
+
168
+asm("noexec_1:\n"
169
+ " movq $1,%rdi\n" /* %rdi is 0 on entry, set 1. */
170
+ "noexec_2:\n"
171
+ " movq $2,%rdi\n" /* %rdi is 0/1; set 2. */
172
+ " ret\n"
173
+ "noexec_end:");
174
+
175
+int main(void)
176
+{
177
+ struct noexec_test noexec_tests[] = {
178
+ {
179
+ .name = "fallthrough",
180
+ .test_code = noexec_1,
181
+ .test_len = noexec_end - noexec_1,
182
+ .page_ofs = noexec_1 - noexec_2,
183
+ .entry_ofs = noexec_1 - noexec_2,
184
+ .expected_si_ofs = 0,
185
+ .expected_pc_ofs = 0,
186
+ .expected_arg = 1,
187
+ },
188
+ {
189
+ .name = "jump",
190
+ .test_code = noexec_1,
191
+ .test_len = noexec_end - noexec_1,
192
+ .page_ofs = noexec_1 - noexec_2,
193
+ .entry_ofs = 0,
194
+ .expected_si_ofs = 0,
195
+ .expected_pc_ofs = 0,
196
+ .expected_arg = 0,
197
+ },
198
+ {
199
+ .name = "fallthrough [cross]",
200
+ .test_code = noexec_1,
201
+ .test_len = noexec_end - noexec_1,
202
+ .page_ofs = noexec_1 - noexec_2 - 2,
203
+ .entry_ofs = noexec_1 - noexec_2 - 2,
204
+ .expected_si_ofs = 0,
205
+ .expected_pc_ofs = -2,
206
+ .expected_arg = 1,
207
+ },
208
+ {
209
+ .name = "jump [cross]",
210
+ .test_code = noexec_1,
211
+ .test_len = noexec_end - noexec_1,
212
+ .page_ofs = noexec_1 - noexec_2 - 2,
213
+ .entry_ofs = -2,
214
+ .expected_si_ofs = 0,
215
+ .expected_pc_ofs = -2,
216
+ .expected_arg = 0,
217
+ },
218
+ };
219
+
220
+ return test_noexec(noexec_tests,
221
+ sizeof(noexec_tests) / sizeof(noexec_tests[0]));
222
+}
223
diff --git a/tests/tcg/x86_64/Makefile.target b/tests/tcg/x86_64/Makefile.target
224
index XXXXXXX..XXXXXXX 100644
225
--- a/tests/tcg/x86_64/Makefile.target
226
+++ b/tests/tcg/x86_64/Makefile.target
227
@@ -XXX,XX +XXX,XX @@ include $(SRC_PATH)/tests/tcg/i386/Makefile.target
228
229
ifeq ($(filter %-linux-user, $(TARGET)),$(TARGET))
230
X86_64_TESTS += vsyscall
231
+X86_64_TESTS += noexec
232
TESTS=$(MULTIARCH_TESTS) $(X86_64_TESTS) test-x86_64
233
else
234
TESTS=$(MULTIARCH_TESTS)
235
@@ -XXX,XX +XXX,XX @@ test-x86_64: LDFLAGS+=-lm -lc
236
test-x86_64: test-i386.c test-i386.h test-i386-shift.h test-i386-muldiv.h
237
    $(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
238
239
-vsyscall: $(SRC_PATH)/tests/tcg/x86_64/vsyscall.c
240
+%: $(SRC_PATH)/tests/tcg/x86_64/%.c
241
    $(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
242
--
243
2.34.1
diff view generated by jsdifflib
New patch
[PULL 19/20] target/riscv: Add MAX_INSN_LEN and insn_len
1
These will be useful in properly ending the TB.
1
2
3
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
4
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
5
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
6
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7
---
8
target/riscv/translate.c | 10 +++++++++-
9
1 file changed, 9 insertions(+), 1 deletion(-)
10
11
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
12
index XXXXXXX..XXXXXXX 100644
13
--- a/target/riscv/translate.c
14
+++ b/target/riscv/translate.c
15
@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
16
/* Include decoders for factored-out extensions */
17
#include "decode-XVentanaCondOps.c.inc"
18
19
+/* The specification allows for longer insns, but not supported by qemu. */
20
+#define MAX_INSN_LEN 4
21
+
22
+static inline int insn_len(uint16_t first_word)
23
+{
24
+ return (first_word & 3) == 3 ? 4 : 2;
25
+}
26
+
27
static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
28
{
29
/*
30
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
31
};
32
33
/* Check for compressed insn */
34
- if (extract16(opcode, 0, 2) != 3) {
35
+ if (insn_len(opcode) == 2) {
36
if (!has_ext(ctx, RVC)) {
37
gen_exception_illegal(ctx);
38
} else {
39
--
40
2.34.1
diff view generated by jsdifflib
New patch
[PULL 20/20] target/riscv: Make translator stop before the end of a page
1
Right now the translator stops right *after* the end of a page, which
2
breaks reporting of fault locations when the last instruction of a
3
multi-insn translation block crosses a page boundary.
1
4
5
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1155
6
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
7
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
8
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
9
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
10
---
11
target/riscv/translate.c | 17 +++++--
12
tests/tcg/riscv64/noexec.c | 79 +++++++++++++++++++++++++++++++
13
tests/tcg/riscv64/Makefile.target | 1 +
14
3 files changed, 93 insertions(+), 4 deletions(-)
15
create mode 100644 tests/tcg/riscv64/noexec.c
16
17
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
18
index XXXXXXX..XXXXXXX 100644
19
--- a/target/riscv/translate.c
20
+++ b/target/riscv/translate.c
21
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
22
}
23
ctx->nftemp = 0;
24
25
+ /* Only the first insn within a TB is allowed to cross a page boundary. */
26
if (ctx->base.is_jmp == DISAS_NEXT) {
27
- target_ulong page_start;
28
-
29
- page_start = ctx->base.pc_first & TARGET_PAGE_MASK;
30
- if (ctx->base.pc_next - page_start >= TARGET_PAGE_SIZE) {
31
+ if (!is_same_page(&ctx->base, ctx->base.pc_next)) {
32
ctx->base.is_jmp = DISAS_TOO_MANY;
33
+ } else {
34
+ unsigned page_ofs = ctx->base.pc_next & ~TARGET_PAGE_MASK;
35
+
36
+ if (page_ofs > TARGET_PAGE_SIZE - MAX_INSN_LEN) {
37
+ uint16_t next_insn = cpu_lduw_code(env, ctx->base.pc_next);
38
+ int len = insn_len(next_insn);
39
+
40
+ if (!is_same_page(&ctx->base, ctx->base.pc_next + len)) {
41
+ ctx->base.is_jmp = DISAS_TOO_MANY;
42
+ }
43
+ }
44
}
45
}
46
}
47
diff --git a/tests/tcg/riscv64/noexec.c b/tests/tcg/riscv64/noexec.c
48
new file mode 100644
49
index XXXXXXX..XXXXXXX
50
--- /dev/null
51
+++ b/tests/tcg/riscv64/noexec.c
52
@@ -XXX,XX +XXX,XX @@
53
+#include "../multiarch/noexec.c.inc"
54
+
55
+static void *arch_mcontext_pc(const mcontext_t *ctx)
56
+{
57
+ return (void *)ctx->__gregs[REG_PC];
58
+}
59
+
60
+static int arch_mcontext_arg(const mcontext_t *ctx)
61
+{
62
+ return ctx->__gregs[REG_A0];
63
+}
64
+
65
+static void arch_flush(void *p, int len)
66
+{
67
+ __builtin___clear_cache(p, p + len);
68
+}
69
+
70
+extern char noexec_1[];
71
+extern char noexec_2[];
72
+extern char noexec_end[];
73
+
74
+asm(".option push\n"
75
+ ".option norvc\n"
76
+ "noexec_1:\n"
77
+ " li a0,1\n" /* a0 is 0 on entry, set 1. */
78
+ "noexec_2:\n"
79
+ " li a0,2\n" /* a0 is 0/1; set 2. */
80
+ " ret\n"
81
+ "noexec_end:\n"
82
+ ".option pop");
83
+
84
+int main(void)
85
+{
86
+ struct noexec_test noexec_tests[] = {
87
+ {
88
+ .name = "fallthrough",
89
+ .test_code = noexec_1,
90
+ .test_len = noexec_end - noexec_1,
91
+ .page_ofs = noexec_1 - noexec_2,
92
+ .entry_ofs = noexec_1 - noexec_2,
93
+ .expected_si_ofs = 0,
94
+ .expected_pc_ofs = 0,
95
+ .expected_arg = 1,
96
+ },
97
+ {
98
+ .name = "jump",
99
+ .test_code = noexec_1,
100
+ .test_len = noexec_end - noexec_1,
101
+ .page_ofs = noexec_1 - noexec_2,
102
+ .entry_ofs = 0,
103
+ .expected_si_ofs = 0,
104
+ .expected_pc_ofs = 0,
105
+ .expected_arg = 0,
106
+ },
107
+ {
108
+ .name = "fallthrough [cross]",
109
+ .test_code = noexec_1,
110
+ .test_len = noexec_end - noexec_1,
111
+ .page_ofs = noexec_1 - noexec_2 - 2,
112
+ .entry_ofs = noexec_1 - noexec_2 - 2,
113
+ .expected_si_ofs = 0,
114
+ .expected_pc_ofs = -2,
115
+ .expected_arg = 1,
116
+ },
117
+ {
118
+ .name = "jump [cross]",
119
+ .test_code = noexec_1,
120
+ .test_len = noexec_end - noexec_1,
121
+ .page_ofs = noexec_1 - noexec_2 - 2,
122
+ .entry_ofs = -2,
123
+ .expected_si_ofs = 0,
124
+ .expected_pc_ofs = -2,
125
+ .expected_arg = 0,
126
+ },
127
+ };
128
+
129
+ return test_noexec(noexec_tests,
130
+ sizeof(noexec_tests) / sizeof(noexec_tests[0]));
131
+}
132
diff --git a/tests/tcg/riscv64/Makefile.target b/tests/tcg/riscv64/Makefile.target
133
index XXXXXXX..XXXXXXX 100644
134
--- a/tests/tcg/riscv64/Makefile.target
135
+++ b/tests/tcg/riscv64/Makefile.target
136
@@ -XXX,XX +XXX,XX @@
137
138
VPATH += $(SRC_PATH)/tests/tcg/riscv64
139
TESTS += test-div
140
+TESTS += noexec
141
--
142
2.34.1
diff view generated by jsdifflib

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.