1 /* 2 * emulator main execution loop 3 * 4 * Copyright (c) 2003-2005 Fabrice Bellard 5 * 6 * This library is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU Lesser General Public 8 * License as published by the Free Software Foundation; either 9 * version 2.1 of the License, or (at your option) any later version. 10 * 11 * This library is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 * Lesser General Public License for more details. 15 * 16 * You should have received a copy of the GNU Lesser General Public 17 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 18 */ 19 20 #include "qemu/osdep.h" 21 #include "qemu-common.h" 22 #include "qemu/qemu-print.h" 23 #include "cpu.h" 24 #include "hw/core/tcg-cpu-ops.h" 25 #include "trace.h" 26 #include "disas/disas.h" 27 #include "exec/exec-all.h" 28 #include "tcg/tcg.h" 29 #include "qemu/atomic.h" 30 #include "qemu/compiler.h" 31 #include "qemu/timer.h" 32 #include "qemu/rcu.h" 33 #include "exec/tb-hash.h" 34 #include "exec/tb-lookup.h" 35 #include "exec/log.h" 36 #include "qemu/main-loop.h" 37 #if defined(TARGET_I386) && !defined(CONFIG_USER_ONLY) 38 #include "hw/i386/apic.h" 39 #endif 40 #include "sysemu/cpus.h" 41 #include "exec/cpu-all.h" 42 #include "sysemu/cpu-timers.h" 43 #include "sysemu/replay.h" 44 #include "internal.h" 45 46 /* -icount align implementation. */ 47 48 typedef struct SyncClocks { 49 int64_t diff_clk; 50 int64_t last_cpu_icount; 51 int64_t realtime_clock; 52 } SyncClocks; 53 54 #if !defined(CONFIG_USER_ONLY) 55 /* Allow the guest to have a max 3ms advance. 56 * The difference between the 2 clocks could therefore 57 * oscillate around 0. 58 */ 59 #define VM_CLOCK_ADVANCE 3000000 60 #define THRESHOLD_REDUCE 1.5 61 #define MAX_DELAY_PRINT_RATE 2000000000LL 62 #define MAX_NB_PRINTS 100 63 64 static int64_t max_delay; 65 static int64_t max_advance; 66 67 static void align_clocks(SyncClocks *sc, CPUState *cpu) 68 { 69 int64_t cpu_icount; 70 71 if (!icount_align_option) { 72 return; 73 } 74 75 cpu_icount = cpu->icount_extra + cpu_neg(cpu)->icount_decr.u16.low; 76 sc->diff_clk += icount_to_ns(sc->last_cpu_icount - cpu_icount); 77 sc->last_cpu_icount = cpu_icount; 78 79 if (sc->diff_clk > VM_CLOCK_ADVANCE) { 80 #ifndef _WIN32 81 struct timespec sleep_delay, rem_delay; 82 sleep_delay.tv_sec = sc->diff_clk / 1000000000LL; 83 sleep_delay.tv_nsec = sc->diff_clk % 1000000000LL; 84 if (nanosleep(&sleep_delay, &rem_delay) < 0) { 85 sc->diff_clk = rem_delay.tv_sec * 1000000000LL + rem_delay.tv_nsec; 86 } else { 87 sc->diff_clk = 0; 88 } 89 #else 90 Sleep(sc->diff_clk / SCALE_MS); 91 sc->diff_clk = 0; 92 #endif 93 } 94 } 95 96 static void print_delay(const SyncClocks *sc) 97 { 98 static float threshold_delay; 99 static int64_t last_realtime_clock; 100 static int nb_prints; 101 102 if (icount_align_option && 103 sc->realtime_clock - last_realtime_clock >= MAX_DELAY_PRINT_RATE && 104 nb_prints < MAX_NB_PRINTS) { 105 if ((-sc->diff_clk / (float)1000000000LL > threshold_delay) || 106 (-sc->diff_clk / (float)1000000000LL < 107 (threshold_delay - THRESHOLD_REDUCE))) { 108 threshold_delay = (-sc->diff_clk / 1000000000LL) + 1; 109 qemu_printf("Warning: The guest is now late by %.1f to %.1f seconds\n", 110 threshold_delay - 1, 111 threshold_delay); 112 nb_prints++; 113 last_realtime_clock = sc->realtime_clock; 114 } 115 } 116 } 117 118 static void init_delay_params(SyncClocks *sc, CPUState *cpu) 119 { 120 if (!icount_align_option) { 121 return; 122 } 123 sc->realtime_clock = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL_RT); 124 sc->diff_clk = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) - sc->realtime_clock; 125 sc->last_cpu_icount 126 = cpu->icount_extra + cpu_neg(cpu)->icount_decr.u16.low; 127 if (sc->diff_clk < max_delay) { 128 max_delay = sc->diff_clk; 129 } 130 if (sc->diff_clk > max_advance) { 131 max_advance = sc->diff_clk; 132 } 133 134 /* Print every 2s max if the guest is late. We limit the number 135 of printed messages to NB_PRINT_MAX(currently 100) */ 136 print_delay(sc); 137 } 138 #else 139 static void align_clocks(SyncClocks *sc, const CPUState *cpu) 140 { 141 } 142 143 static void init_delay_params(SyncClocks *sc, const CPUState *cpu) 144 { 145 } 146 #endif /* CONFIG USER ONLY */ 147 148 /* Execute a TB, and fix up the CPU state afterwards if necessary */ 149 /* 150 * Disable CFI checks. 151 * TCG creates binary blobs at runtime, with the transformed code. 152 * A TB is a blob of binary code, created at runtime and called with an 153 * indirect function call. Since such function did not exist at compile time, 154 * the CFI runtime has no way to verify its signature and would fail. 155 * TCG is not considered a security-sensitive part of QEMU so this does not 156 * affect the impact of CFI in environment with high security requirements 157 */ 158 static inline TranslationBlock * QEMU_DISABLE_CFI 159 cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit) 160 { 161 CPUArchState *env = cpu->env_ptr; 162 uintptr_t ret; 163 TranslationBlock *last_tb; 164 const void *tb_ptr = itb->tc.ptr; 165 166 qemu_log_mask_and_addr(CPU_LOG_EXEC, itb->pc, 167 "Trace %d: %p [" 168 TARGET_FMT_lx "/" TARGET_FMT_lx "/%#x] %s\n", 169 cpu->cpu_index, itb->tc.ptr, 170 itb->cs_base, itb->pc, itb->flags, 171 lookup_symbol(itb->pc)); 172 173 #if defined(DEBUG_DISAS) 174 if (qemu_loglevel_mask(CPU_LOG_TB_CPU) 175 && qemu_log_in_addr_range(itb->pc)) { 176 FILE *logfile = qemu_log_lock(); 177 int flags = 0; 178 if (qemu_loglevel_mask(CPU_LOG_TB_FPU)) { 179 flags |= CPU_DUMP_FPU; 180 } 181 #if defined(TARGET_I386) 182 flags |= CPU_DUMP_CCOP; 183 #endif 184 log_cpu_state(cpu, flags); 185 qemu_log_unlock(logfile); 186 } 187 #endif /* DEBUG_DISAS */ 188 189 qemu_thread_jit_execute(); 190 ret = tcg_qemu_tb_exec(env, tb_ptr); 191 cpu->can_do_io = 1; 192 /* 193 * TODO: Delay swapping back to the read-write region of the TB 194 * until we actually need to modify the TB. The read-only copy, 195 * coming from the rx region, shares the same host TLB entry as 196 * the code that executed the exit_tb opcode that arrived here. 197 * If we insist on touching both the RX and the RW pages, we 198 * double the host TLB pressure. 199 */ 200 last_tb = tcg_splitwx_to_rw((void *)(ret & ~TB_EXIT_MASK)); 201 *tb_exit = ret & TB_EXIT_MASK; 202 203 trace_exec_tb_exit(last_tb, *tb_exit); 204 205 if (*tb_exit > TB_EXIT_IDX1) { 206 /* We didn't start executing this TB (eg because the instruction 207 * counter hit zero); we must restore the guest PC to the address 208 * of the start of the TB. 209 */ 210 CPUClass *cc = CPU_GET_CLASS(cpu); 211 qemu_log_mask_and_addr(CPU_LOG_EXEC, last_tb->pc, 212 "Stopped execution of TB chain before %p [" 213 TARGET_FMT_lx "] %s\n", 214 last_tb->tc.ptr, last_tb->pc, 215 lookup_symbol(last_tb->pc)); 216 if (cc->tcg_ops->synchronize_from_tb) { 217 cc->tcg_ops->synchronize_from_tb(cpu, last_tb); 218 } else { 219 assert(cc->set_pc); 220 cc->set_pc(cpu, last_tb->pc); 221 } 222 } 223 return last_tb; 224 } 225 226 227 static void cpu_exec_enter(CPUState *cpu) 228 { 229 CPUClass *cc = CPU_GET_CLASS(cpu); 230 231 if (cc->tcg_ops->cpu_exec_enter) { 232 cc->tcg_ops->cpu_exec_enter(cpu); 233 } 234 } 235 236 static void cpu_exec_exit(CPUState *cpu) 237 { 238 CPUClass *cc = CPU_GET_CLASS(cpu); 239 240 if (cc->tcg_ops->cpu_exec_exit) { 241 cc->tcg_ops->cpu_exec_exit(cpu); 242 } 243 } 244 245 void cpu_exec_step_atomic(CPUState *cpu) 246 { 247 CPUArchState *env = (CPUArchState *)cpu->env_ptr; 248 TranslationBlock *tb; 249 target_ulong cs_base, pc; 250 uint32_t flags; 251 uint32_t cflags = (curr_cflags(cpu) & ~CF_PARALLEL) | 1; 252 int tb_exit; 253 254 if (sigsetjmp(cpu->jmp_env, 0) == 0) { 255 start_exclusive(); 256 g_assert(cpu == current_cpu); 257 g_assert(!cpu->running); 258 cpu->running = true; 259 260 cpu_get_tb_cpu_state(env, &pc, &cs_base, &flags); 261 tb = tb_lookup(cpu, pc, cs_base, flags, cflags); 262 263 if (tb == NULL) { 264 mmap_lock(); 265 tb = tb_gen_code(cpu, pc, cs_base, flags, cflags); 266 mmap_unlock(); 267 } 268 269 cpu_exec_enter(cpu); 270 /* execute the generated code */ 271 trace_exec_tb(tb, pc); 272 cpu_tb_exec(cpu, tb, &tb_exit); 273 cpu_exec_exit(cpu); 274 } else { 275 /* 276 * The mmap_lock is dropped by tb_gen_code if it runs out of 277 * memory. 278 */ 279 #ifndef CONFIG_SOFTMMU 280 tcg_debug_assert(!have_mmap_lock()); 281 #endif 282 if (qemu_mutex_iothread_locked()) { 283 qemu_mutex_unlock_iothread(); 284 } 285 assert_no_pages_locked(); 286 qemu_plugin_disable_mem_helpers(cpu); 287 } 288 289 290 /* 291 * As we start the exclusive region before codegen we must still 292 * be in the region if we longjump out of either the codegen or 293 * the execution. 294 */ 295 g_assert(cpu_in_exclusive_context(cpu)); 296 cpu->running = false; 297 end_exclusive(); 298 } 299 300 struct tb_desc { 301 target_ulong pc; 302 target_ulong cs_base; 303 CPUArchState *env; 304 tb_page_addr_t phys_page1; 305 uint32_t flags; 306 uint32_t cflags; 307 uint32_t trace_vcpu_dstate; 308 }; 309 310 static bool tb_lookup_cmp(const void *p, const void *d) 311 { 312 const TranslationBlock *tb = p; 313 const struct tb_desc *desc = d; 314 315 if (tb->pc == desc->pc && 316 tb->page_addr[0] == desc->phys_page1 && 317 tb->cs_base == desc->cs_base && 318 tb->flags == desc->flags && 319 tb->trace_vcpu_dstate == desc->trace_vcpu_dstate && 320 tb_cflags(tb) == desc->cflags) { 321 /* check next page if needed */ 322 if (tb->page_addr[1] == -1) { 323 return true; 324 } else { 325 tb_page_addr_t phys_page2; 326 target_ulong virt_page2; 327 328 virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE; 329 phys_page2 = get_page_addr_code(desc->env, virt_page2); 330 if (tb->page_addr[1] == phys_page2) { 331 return true; 332 } 333 } 334 } 335 return false; 336 } 337 338 TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc, 339 target_ulong cs_base, uint32_t flags, 340 uint32_t cflags) 341 { 342 tb_page_addr_t phys_pc; 343 struct tb_desc desc; 344 uint32_t h; 345 346 desc.env = (CPUArchState *)cpu->env_ptr; 347 desc.cs_base = cs_base; 348 desc.flags = flags; 349 desc.cflags = cflags; 350 desc.trace_vcpu_dstate = *cpu->trace_dstate; 351 desc.pc = pc; 352 phys_pc = get_page_addr_code(desc.env, pc); 353 if (phys_pc == -1) { 354 return NULL; 355 } 356 desc.phys_page1 = phys_pc & TARGET_PAGE_MASK; 357 h = tb_hash_func(phys_pc, pc, flags, cflags, *cpu->trace_dstate); 358 return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp); 359 } 360 361 void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr) 362 { 363 if (TCG_TARGET_HAS_direct_jump) { 364 uintptr_t offset = tb->jmp_target_arg[n]; 365 uintptr_t tc_ptr = (uintptr_t)tb->tc.ptr; 366 uintptr_t jmp_rx = tc_ptr + offset; 367 uintptr_t jmp_rw = jmp_rx - tcg_splitwx_diff; 368 tb_target_set_jmp_target(tc_ptr, jmp_rx, jmp_rw, addr); 369 } else { 370 tb->jmp_target_arg[n] = addr; 371 } 372 } 373 374 static inline void tb_add_jump(TranslationBlock *tb, int n, 375 TranslationBlock *tb_next) 376 { 377 uintptr_t old; 378 379 qemu_thread_jit_write(); 380 assert(n < ARRAY_SIZE(tb->jmp_list_next)); 381 qemu_spin_lock(&tb_next->jmp_lock); 382 383 /* make sure the destination TB is valid */ 384 if (tb_next->cflags & CF_INVALID) { 385 goto out_unlock_next; 386 } 387 /* Atomically claim the jump destination slot only if it was NULL */ 388 old = qatomic_cmpxchg(&tb->jmp_dest[n], (uintptr_t)NULL, 389 (uintptr_t)tb_next); 390 if (old) { 391 goto out_unlock_next; 392 } 393 394 /* patch the native jump address */ 395 tb_set_jmp_target(tb, n, (uintptr_t)tb_next->tc.ptr); 396 397 /* add in TB jmp list */ 398 tb->jmp_list_next[n] = tb_next->jmp_list_head; 399 tb_next->jmp_list_head = (uintptr_t)tb | n; 400 401 qemu_spin_unlock(&tb_next->jmp_lock); 402 403 qemu_log_mask_and_addr(CPU_LOG_EXEC, tb->pc, 404 "Linking TBs %p [" TARGET_FMT_lx 405 "] index %d -> %p [" TARGET_FMT_lx "]\n", 406 tb->tc.ptr, tb->pc, n, 407 tb_next->tc.ptr, tb_next->pc); 408 return; 409 410 out_unlock_next: 411 qemu_spin_unlock(&tb_next->jmp_lock); 412 return; 413 } 414 415 static inline TranslationBlock *tb_find(CPUState *cpu, 416 TranslationBlock *last_tb, 417 int tb_exit, uint32_t cflags) 418 { 419 CPUArchState *env = (CPUArchState *)cpu->env_ptr; 420 TranslationBlock *tb; 421 target_ulong cs_base, pc; 422 uint32_t flags; 423 424 cpu_get_tb_cpu_state(env, &pc, &cs_base, &flags); 425 426 tb = tb_lookup(cpu, pc, cs_base, flags, cflags); 427 if (tb == NULL) { 428 mmap_lock(); 429 tb = tb_gen_code(cpu, pc, cs_base, flags, cflags); 430 mmap_unlock(); 431 /* We add the TB in the virtual pc hash table for the fast lookup */ 432 qatomic_set(&cpu->tb_jmp_cache[tb_jmp_cache_hash_func(pc)], tb); 433 } 434 #ifndef CONFIG_USER_ONLY 435 /* We don't take care of direct jumps when address mapping changes in 436 * system emulation. So it's not safe to make a direct jump to a TB 437 * spanning two pages because the mapping for the second page can change. 438 */ 439 if (tb->page_addr[1] != -1) { 440 last_tb = NULL; 441 } 442 #endif 443 /* See if we can patch the calling TB. */ 444 if (last_tb) { 445 tb_add_jump(last_tb, tb_exit, tb); 446 } 447 return tb; 448 } 449 450 static inline bool cpu_handle_halt(CPUState *cpu) 451 { 452 if (cpu->halted) { 453 #if defined(TARGET_I386) && !defined(CONFIG_USER_ONLY) 454 if (cpu->interrupt_request & CPU_INTERRUPT_POLL) { 455 X86CPU *x86_cpu = X86_CPU(cpu); 456 qemu_mutex_lock_iothread(); 457 apic_poll_irq(x86_cpu->apic_state); 458 cpu_reset_interrupt(cpu, CPU_INTERRUPT_POLL); 459 qemu_mutex_unlock_iothread(); 460 } 461 #endif 462 if (!cpu_has_work(cpu)) { 463 return true; 464 } 465 466 cpu->halted = 0; 467 } 468 469 return false; 470 } 471 472 static inline void cpu_handle_debug_exception(CPUState *cpu) 473 { 474 CPUClass *cc = CPU_GET_CLASS(cpu); 475 CPUWatchpoint *wp; 476 477 if (!cpu->watchpoint_hit) { 478 QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) { 479 wp->flags &= ~BP_WATCHPOINT_HIT; 480 } 481 } 482 483 if (cc->tcg_ops->debug_excp_handler) { 484 cc->tcg_ops->debug_excp_handler(cpu); 485 } 486 } 487 488 static inline bool cpu_handle_exception(CPUState *cpu, int *ret) 489 { 490 if (cpu->exception_index < 0) { 491 #ifndef CONFIG_USER_ONLY 492 if (replay_has_exception() 493 && cpu_neg(cpu)->icount_decr.u16.low + cpu->icount_extra == 0) { 494 /* Execute just one insn to trigger exception pending in the log */ 495 cpu->cflags_next_tb = (curr_cflags(cpu) & ~CF_USE_ICOUNT) | 1; 496 } 497 #endif 498 return false; 499 } 500 if (cpu->exception_index >= EXCP_INTERRUPT) { 501 /* exit request from the cpu execution loop */ 502 *ret = cpu->exception_index; 503 if (*ret == EXCP_DEBUG) { 504 cpu_handle_debug_exception(cpu); 505 } 506 cpu->exception_index = -1; 507 return true; 508 } else { 509 #if defined(CONFIG_USER_ONLY) 510 /* if user mode only, we simulate a fake exception 511 which will be handled outside the cpu execution 512 loop */ 513 #if defined(TARGET_I386) 514 CPUClass *cc = CPU_GET_CLASS(cpu); 515 cc->tcg_ops->do_interrupt(cpu); 516 #endif 517 *ret = cpu->exception_index; 518 cpu->exception_index = -1; 519 return true; 520 #else 521 if (replay_exception()) { 522 CPUClass *cc = CPU_GET_CLASS(cpu); 523 qemu_mutex_lock_iothread(); 524 cc->tcg_ops->do_interrupt(cpu); 525 qemu_mutex_unlock_iothread(); 526 cpu->exception_index = -1; 527 528 if (unlikely(cpu->singlestep_enabled)) { 529 /* 530 * After processing the exception, ensure an EXCP_DEBUG is 531 * raised when single-stepping so that GDB doesn't miss the 532 * next instruction. 533 */ 534 *ret = EXCP_DEBUG; 535 cpu_handle_debug_exception(cpu); 536 return true; 537 } 538 } else if (!replay_has_interrupt()) { 539 /* give a chance to iothread in replay mode */ 540 *ret = EXCP_INTERRUPT; 541 return true; 542 } 543 #endif 544 } 545 546 return false; 547 } 548 549 /* 550 * CPU_INTERRUPT_POLL is a virtual event which gets converted into a 551 * "real" interrupt event later. It does not need to be recorded for 552 * replay purposes. 553 */ 554 static inline bool need_replay_interrupt(int interrupt_request) 555 { 556 #if defined(TARGET_I386) 557 return !(interrupt_request & CPU_INTERRUPT_POLL); 558 #else 559 return true; 560 #endif 561 } 562 563 static inline bool cpu_handle_interrupt(CPUState *cpu, 564 TranslationBlock **last_tb) 565 { 566 CPUClass *cc = CPU_GET_CLASS(cpu); 567 568 /* Clear the interrupt flag now since we're processing 569 * cpu->interrupt_request and cpu->exit_request. 570 * Ensure zeroing happens before reading cpu->exit_request or 571 * cpu->interrupt_request (see also smp_wmb in cpu_exit()) 572 */ 573 qatomic_mb_set(&cpu_neg(cpu)->icount_decr.u16.high, 0); 574 575 if (unlikely(qatomic_read(&cpu->interrupt_request))) { 576 int interrupt_request; 577 qemu_mutex_lock_iothread(); 578 interrupt_request = cpu->interrupt_request; 579 if (unlikely(cpu->singlestep_enabled & SSTEP_NOIRQ)) { 580 /* Mask out external interrupts for this step. */ 581 interrupt_request &= ~CPU_INTERRUPT_SSTEP_MASK; 582 } 583 if (interrupt_request & CPU_INTERRUPT_DEBUG) { 584 cpu->interrupt_request &= ~CPU_INTERRUPT_DEBUG; 585 cpu->exception_index = EXCP_DEBUG; 586 qemu_mutex_unlock_iothread(); 587 return true; 588 } 589 if (replay_mode == REPLAY_MODE_PLAY && !replay_has_interrupt()) { 590 /* Do nothing */ 591 } else if (interrupt_request & CPU_INTERRUPT_HALT) { 592 replay_interrupt(); 593 cpu->interrupt_request &= ~CPU_INTERRUPT_HALT; 594 cpu->halted = 1; 595 cpu->exception_index = EXCP_HLT; 596 qemu_mutex_unlock_iothread(); 597 return true; 598 } 599 #if defined(TARGET_I386) 600 else if (interrupt_request & CPU_INTERRUPT_INIT) { 601 X86CPU *x86_cpu = X86_CPU(cpu); 602 CPUArchState *env = &x86_cpu->env; 603 replay_interrupt(); 604 cpu_svm_check_intercept_param(env, SVM_EXIT_INIT, 0, 0); 605 do_cpu_init(x86_cpu); 606 cpu->exception_index = EXCP_HALTED; 607 qemu_mutex_unlock_iothread(); 608 return true; 609 } 610 #else 611 else if (interrupt_request & CPU_INTERRUPT_RESET) { 612 replay_interrupt(); 613 cpu_reset(cpu); 614 qemu_mutex_unlock_iothread(); 615 return true; 616 } 617 #endif 618 /* The target hook has 3 exit conditions: 619 False when the interrupt isn't processed, 620 True when it is, and we should restart on a new TB, 621 and via longjmp via cpu_loop_exit. */ 622 else { 623 if (cc->tcg_ops->cpu_exec_interrupt && 624 cc->tcg_ops->cpu_exec_interrupt(cpu, interrupt_request)) { 625 if (need_replay_interrupt(interrupt_request)) { 626 replay_interrupt(); 627 } 628 /* 629 * After processing the interrupt, ensure an EXCP_DEBUG is 630 * raised when single-stepping so that GDB doesn't miss the 631 * next instruction. 632 */ 633 cpu->exception_index = 634 (cpu->singlestep_enabled ? EXCP_DEBUG : -1); 635 *last_tb = NULL; 636 } 637 /* The target hook may have updated the 'cpu->interrupt_request'; 638 * reload the 'interrupt_request' value */ 639 interrupt_request = cpu->interrupt_request; 640 } 641 if (interrupt_request & CPU_INTERRUPT_EXITTB) { 642 cpu->interrupt_request &= ~CPU_INTERRUPT_EXITTB; 643 /* ensure that no TB jump will be modified as 644 the program flow was changed */ 645 *last_tb = NULL; 646 } 647 648 /* If we exit via cpu_loop_exit/longjmp it is reset in cpu_exec */ 649 qemu_mutex_unlock_iothread(); 650 } 651 652 /* Finally, check if we need to exit to the main loop. */ 653 if (unlikely(qatomic_read(&cpu->exit_request)) 654 || (icount_enabled() 655 && (cpu->cflags_next_tb == -1 || cpu->cflags_next_tb & CF_USE_ICOUNT) 656 && cpu_neg(cpu)->icount_decr.u16.low + cpu->icount_extra == 0)) { 657 qatomic_set(&cpu->exit_request, 0); 658 if (cpu->exception_index == -1) { 659 cpu->exception_index = EXCP_INTERRUPT; 660 } 661 return true; 662 } 663 664 return false; 665 } 666 667 static inline void cpu_loop_exec_tb(CPUState *cpu, TranslationBlock *tb, 668 TranslationBlock **last_tb, int *tb_exit) 669 { 670 int32_t insns_left; 671 672 trace_exec_tb(tb, tb->pc); 673 tb = cpu_tb_exec(cpu, tb, tb_exit); 674 if (*tb_exit != TB_EXIT_REQUESTED) { 675 *last_tb = tb; 676 return; 677 } 678 679 *last_tb = NULL; 680 insns_left = qatomic_read(&cpu_neg(cpu)->icount_decr.u32); 681 if (insns_left < 0) { 682 /* Something asked us to stop executing chained TBs; just 683 * continue round the main loop. Whatever requested the exit 684 * will also have set something else (eg exit_request or 685 * interrupt_request) which will be handled by 686 * cpu_handle_interrupt. cpu_handle_interrupt will also 687 * clear cpu->icount_decr.u16.high. 688 */ 689 return; 690 } 691 692 /* Instruction counter expired. */ 693 assert(icount_enabled()); 694 #ifndef CONFIG_USER_ONLY 695 /* Ensure global icount has gone forward */ 696 icount_update(cpu); 697 /* Refill decrementer and continue execution. */ 698 insns_left = MIN(CF_COUNT_MASK, cpu->icount_budget); 699 cpu_neg(cpu)->icount_decr.u16.low = insns_left; 700 cpu->icount_extra = cpu->icount_budget - insns_left; 701 702 /* 703 * If the next tb has more instructions than we have left to 704 * execute we need to ensure we find/generate a TB with exactly 705 * insns_left instructions in it. 706 */ 707 if (!cpu->icount_extra && insns_left > 0 && insns_left < tb->icount) { 708 cpu->cflags_next_tb = (tb->cflags & ~CF_COUNT_MASK) | insns_left; 709 } 710 #endif 711 } 712 713 /* main execution loop */ 714 715 int cpu_exec(CPUState *cpu) 716 { 717 CPUClass *cc = CPU_GET_CLASS(cpu); 718 int ret; 719 SyncClocks sc = { 0 }; 720 721 /* replay_interrupt may need current_cpu */ 722 current_cpu = cpu; 723 724 if (cpu_handle_halt(cpu)) { 725 return EXCP_HALTED; 726 } 727 728 rcu_read_lock(); 729 730 cpu_exec_enter(cpu); 731 732 /* Calculate difference between guest clock and host clock. 733 * This delay includes the delay of the last cycle, so 734 * what we have to do is sleep until it is 0. As for the 735 * advance/delay we gain here, we try to fix it next time. 736 */ 737 init_delay_params(&sc, cpu); 738 739 /* prepare setjmp context for exception handling */ 740 if (sigsetjmp(cpu->jmp_env, 0) != 0) { 741 #if defined(__clang__) 742 /* 743 * Some compilers wrongly smash all local variables after 744 * siglongjmp (the spec requires that only non-volatile locals 745 * which are changed between the sigsetjmp and siglongjmp are 746 * permitted to be trashed). There were bug reports for gcc 747 * 4.5.0 and clang. The bug is fixed in all versions of gcc 748 * that we support, but is still unfixed in clang: 749 * https://bugs.llvm.org/show_bug.cgi?id=21183 750 * 751 * Reload essential local variables here for those compilers. 752 * Newer versions of gcc would complain about this code (-Wclobbered), 753 * so we only perform the workaround for clang. 754 */ 755 cpu = current_cpu; 756 cc = CPU_GET_CLASS(cpu); 757 #else 758 /* 759 * Non-buggy compilers preserve these locals; assert that 760 * they have the correct value. 761 */ 762 g_assert(cpu == current_cpu); 763 g_assert(cc == CPU_GET_CLASS(cpu)); 764 #endif 765 766 #ifndef CONFIG_SOFTMMU 767 tcg_debug_assert(!have_mmap_lock()); 768 #endif 769 if (qemu_mutex_iothread_locked()) { 770 qemu_mutex_unlock_iothread(); 771 } 772 qemu_plugin_disable_mem_helpers(cpu); 773 774 assert_no_pages_locked(); 775 } 776 777 /* if an exception is pending, we execute it here */ 778 while (!cpu_handle_exception(cpu, &ret)) { 779 TranslationBlock *last_tb = NULL; 780 int tb_exit = 0; 781 782 while (!cpu_handle_interrupt(cpu, &last_tb)) { 783 uint32_t cflags = cpu->cflags_next_tb; 784 TranslationBlock *tb; 785 786 /* When requested, use an exact setting for cflags for the next 787 execution. This is used for icount, precise smc, and stop- 788 after-access watchpoints. Since this request should never 789 have CF_INVALID set, -1 is a convenient invalid value that 790 does not require tcg headers for cpu_common_reset. */ 791 if (cflags == -1) { 792 cflags = curr_cflags(cpu); 793 } else { 794 cpu->cflags_next_tb = -1; 795 } 796 797 tb = tb_find(cpu, last_tb, tb_exit, cflags); 798 cpu_loop_exec_tb(cpu, tb, &last_tb, &tb_exit); 799 /* Try to align the host and virtual clocks 800 if the guest is in advance */ 801 align_clocks(&sc, cpu); 802 } 803 } 804 805 cpu_exec_exit(cpu); 806 rcu_read_unlock(); 807 808 return ret; 809 } 810 811 void tcg_exec_realizefn(CPUState *cpu, Error **errp) 812 { 813 static bool tcg_target_initialized; 814 CPUClass *cc = CPU_GET_CLASS(cpu); 815 816 if (!tcg_target_initialized) { 817 cc->tcg_ops->initialize(); 818 tcg_target_initialized = true; 819 } 820 tlb_init(cpu); 821 qemu_plugin_vcpu_init_hook(cpu); 822 823 #ifndef CONFIG_USER_ONLY 824 tcg_iommu_init_notifier_list(cpu); 825 #endif /* !CONFIG_USER_ONLY */ 826 } 827 828 /* undo the initializations in reverse order */ 829 void tcg_exec_unrealizefn(CPUState *cpu) 830 { 831 #ifndef CONFIG_USER_ONLY 832 tcg_iommu_free_notifier_list(cpu); 833 #endif /* !CONFIG_USER_ONLY */ 834 835 qemu_plugin_vcpu_exit_hook(cpu); 836 tlb_destroy(cpu); 837 } 838 839 #ifndef CONFIG_USER_ONLY 840 841 void dump_drift_info(void) 842 { 843 if (!icount_enabled()) { 844 return; 845 } 846 847 qemu_printf("Host - Guest clock %"PRIi64" ms\n", 848 (cpu_get_clock() - icount_get()) / SCALE_MS); 849 if (icount_align_option) { 850 qemu_printf("Max guest delay %"PRIi64" ms\n", 851 -max_delay / SCALE_MS); 852 qemu_printf("Max guest advance %"PRIi64" ms\n", 853 max_advance / SCALE_MS); 854 } else { 855 qemu_printf("Max guest delay NA\n"); 856 qemu_printf("Max guest advance NA\n"); 857 } 858 } 859 860 #endif /* !CONFIG_USER_ONLY */ 861