xref: /openbmc/qemu/linux-user/main.c (revision 2bfe11c8)
1 /*
2  *  qemu user main
3  *
4  *  Copyright (c) 2003-2008 Fabrice Bellard
5  *
6  *  This program is free software; you can redistribute it and/or modify
7  *  it under the terms of the GNU General Public License as published by
8  *  the Free Software Foundation; either version 2 of the License, or
9  *  (at your option) any later version.
10  *
11  *  This program is distributed in the hope that it will be useful,
12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  *  GNU General Public License for more details.
15  *
16  *  You should have received a copy of the GNU General Public License
17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
18  */
19 #include "qemu/osdep.h"
20 #include "qemu-version.h"
21 #include <sys/syscall.h>
22 #include <sys/resource.h>
23 
24 #include "qapi/error.h"
25 #include "qemu.h"
26 #include "qemu/path.h"
27 #include "qemu/config-file.h"
28 #include "qemu/cutils.h"
29 #include "qemu/help_option.h"
30 #include "cpu.h"
31 #include "exec/exec-all.h"
32 #include "tcg.h"
33 #include "qemu/timer.h"
34 #include "qemu/envlist.h"
35 #include "elf.h"
36 #include "exec/log.h"
37 #include "trace/control.h"
38 #include "glib-compat.h"
39 
40 char *exec_path;
41 
42 int singlestep;
43 static const char *filename;
44 static const char *argv0;
45 static int gdbstub_port;
46 static envlist_t *envlist;
47 static const char *cpu_model;
48 unsigned long mmap_min_addr;
49 unsigned long guest_base;
50 int have_guest_base;
51 
52 #define EXCP_DUMP(env, fmt, ...)                                        \
53 do {                                                                    \
54     CPUState *cs = ENV_GET_CPU(env);                                    \
55     fprintf(stderr, fmt , ## __VA_ARGS__);                              \
56     cpu_dump_state(cs, stderr, fprintf, 0);                             \
57     if (qemu_log_separate()) {                                          \
58         qemu_log(fmt, ## __VA_ARGS__);                                  \
59         log_cpu_state(cs, 0);                                           \
60     }                                                                   \
61 } while (0)
62 
63 #if (TARGET_LONG_BITS == 32) && (HOST_LONG_BITS == 64)
64 /*
65  * When running 32-on-64 we should make sure we can fit all of the possible
66  * guest address space into a contiguous chunk of virtual host memory.
67  *
68  * This way we will never overlap with our own libraries or binaries or stack
69  * or anything else that QEMU maps.
70  */
71 # ifdef TARGET_MIPS
72 /* MIPS only supports 31 bits of virtual address space for user space */
73 unsigned long reserved_va = 0x77000000;
74 # else
75 unsigned long reserved_va = 0xf7000000;
76 # endif
77 #else
78 unsigned long reserved_va;
79 #endif
80 
81 static void usage(int exitcode);
82 
83 static const char *interp_prefix = CONFIG_QEMU_INTERP_PREFIX;
84 const char *qemu_uname_release;
85 
86 /* XXX: on x86 MAP_GROWSDOWN only works if ESP <= address + 32, so
87    we allocate a bigger stack. Need a better solution, for example
88    by remapping the process stack directly at the right place */
89 unsigned long guest_stack_size = 8 * 1024 * 1024UL;
90 
91 void gemu_log(const char *fmt, ...)
92 {
93     va_list ap;
94 
95     va_start(ap, fmt);
96     vfprintf(stderr, fmt, ap);
97     va_end(ap);
98 }
99 
100 #if defined(TARGET_I386)
101 int cpu_get_pic_interrupt(CPUX86State *env)
102 {
103     return -1;
104 }
105 #endif
106 
107 /***********************************************************/
108 /* Helper routines for implementing atomic operations.  */
109 
110 /* To implement exclusive operations we force all cpus to syncronise.
111    We don't require a full sync, only that no cpus are executing guest code.
112    The alternative is to map target atomic ops onto host equivalents,
113    which requires quite a lot of per host/target work.  */
114 static pthread_mutex_t cpu_list_mutex = PTHREAD_MUTEX_INITIALIZER;
115 static pthread_mutex_t exclusive_lock = PTHREAD_MUTEX_INITIALIZER;
116 static pthread_cond_t exclusive_cond = PTHREAD_COND_INITIALIZER;
117 static pthread_cond_t exclusive_resume = PTHREAD_COND_INITIALIZER;
118 static int pending_cpus;
119 
120 /* Make sure everything is in a consistent state for calling fork().  */
121 void fork_start(void)
122 {
123     qemu_mutex_lock(&tcg_ctx.tb_ctx.tb_lock);
124     pthread_mutex_lock(&exclusive_lock);
125     mmap_fork_start();
126 }
127 
128 void fork_end(int child)
129 {
130     mmap_fork_end(child);
131     if (child) {
132         CPUState *cpu, *next_cpu;
133         /* Child processes created by fork() only have a single thread.
134            Discard information about the parent threads.  */
135         CPU_FOREACH_SAFE(cpu, next_cpu) {
136             if (cpu != thread_cpu) {
137                 QTAILQ_REMOVE(&cpus, cpu, node);
138             }
139         }
140         pending_cpus = 0;
141         pthread_mutex_init(&exclusive_lock, NULL);
142         pthread_mutex_init(&cpu_list_mutex, NULL);
143         pthread_cond_init(&exclusive_cond, NULL);
144         pthread_cond_init(&exclusive_resume, NULL);
145         qemu_mutex_init(&tcg_ctx.tb_ctx.tb_lock);
146         gdbserver_fork(thread_cpu);
147     } else {
148         pthread_mutex_unlock(&exclusive_lock);
149         qemu_mutex_unlock(&tcg_ctx.tb_ctx.tb_lock);
150     }
151 }
152 
153 /* Wait for pending exclusive operations to complete.  The exclusive lock
154    must be held.  */
155 static inline void exclusive_idle(void)
156 {
157     while (pending_cpus) {
158         pthread_cond_wait(&exclusive_resume, &exclusive_lock);
159     }
160 }
161 
162 /* Start an exclusive operation.
163    Must only be called from outside cpu_exec.   */
164 static inline void start_exclusive(void)
165 {
166     CPUState *other_cpu;
167 
168     pthread_mutex_lock(&exclusive_lock);
169     exclusive_idle();
170 
171     pending_cpus = 1;
172     /* Make all other cpus stop executing.  */
173     CPU_FOREACH(other_cpu) {
174         if (other_cpu->running) {
175             pending_cpus++;
176             cpu_exit(other_cpu);
177         }
178     }
179     if (pending_cpus > 1) {
180         pthread_cond_wait(&exclusive_cond, &exclusive_lock);
181     }
182 }
183 
184 /* Finish an exclusive operation.  */
185 static inline void __attribute__((unused)) end_exclusive(void)
186 {
187     pending_cpus = 0;
188     pthread_cond_broadcast(&exclusive_resume);
189     pthread_mutex_unlock(&exclusive_lock);
190 }
191 
192 /* Wait for exclusive ops to finish, and begin cpu execution.  */
193 static inline void cpu_exec_start(CPUState *cpu)
194 {
195     pthread_mutex_lock(&exclusive_lock);
196     exclusive_idle();
197     cpu->running = true;
198     pthread_mutex_unlock(&exclusive_lock);
199 }
200 
201 /* Mark cpu as not executing, and release pending exclusive ops.  */
202 static inline void cpu_exec_end(CPUState *cpu)
203 {
204     pthread_mutex_lock(&exclusive_lock);
205     cpu->running = false;
206     if (pending_cpus > 1) {
207         pending_cpus--;
208         if (pending_cpus == 1) {
209             pthread_cond_signal(&exclusive_cond);
210         }
211     }
212     exclusive_idle();
213     pthread_mutex_unlock(&exclusive_lock);
214 }
215 
216 void cpu_list_lock(void)
217 {
218     pthread_mutex_lock(&cpu_list_mutex);
219 }
220 
221 void cpu_list_unlock(void)
222 {
223     pthread_mutex_unlock(&cpu_list_mutex);
224 }
225 
226 
227 #ifdef TARGET_I386
228 /***********************************************************/
229 /* CPUX86 core interface */
230 
231 uint64_t cpu_get_tsc(CPUX86State *env)
232 {
233     return cpu_get_host_ticks();
234 }
235 
236 static void write_dt(void *ptr, unsigned long addr, unsigned long limit,
237                      int flags)
238 {
239     unsigned int e1, e2;
240     uint32_t *p;
241     e1 = (addr << 16) | (limit & 0xffff);
242     e2 = ((addr >> 16) & 0xff) | (addr & 0xff000000) | (limit & 0x000f0000);
243     e2 |= flags;
244     p = ptr;
245     p[0] = tswap32(e1);
246     p[1] = tswap32(e2);
247 }
248 
249 static uint64_t *idt_table;
250 #ifdef TARGET_X86_64
251 static void set_gate64(void *ptr, unsigned int type, unsigned int dpl,
252                        uint64_t addr, unsigned int sel)
253 {
254     uint32_t *p, e1, e2;
255     e1 = (addr & 0xffff) | (sel << 16);
256     e2 = (addr & 0xffff0000) | 0x8000 | (dpl << 13) | (type << 8);
257     p = ptr;
258     p[0] = tswap32(e1);
259     p[1] = tswap32(e2);
260     p[2] = tswap32(addr >> 32);
261     p[3] = 0;
262 }
263 /* only dpl matters as we do only user space emulation */
264 static void set_idt(int n, unsigned int dpl)
265 {
266     set_gate64(idt_table + n * 2, 0, dpl, 0, 0);
267 }
268 #else
269 static void set_gate(void *ptr, unsigned int type, unsigned int dpl,
270                      uint32_t addr, unsigned int sel)
271 {
272     uint32_t *p, e1, e2;
273     e1 = (addr & 0xffff) | (sel << 16);
274     e2 = (addr & 0xffff0000) | 0x8000 | (dpl << 13) | (type << 8);
275     p = ptr;
276     p[0] = tswap32(e1);
277     p[1] = tswap32(e2);
278 }
279 
280 /* only dpl matters as we do only user space emulation */
281 static void set_idt(int n, unsigned int dpl)
282 {
283     set_gate(idt_table + n, 0, dpl, 0, 0);
284 }
285 #endif
286 
287 void cpu_loop(CPUX86State *env)
288 {
289     CPUState *cs = CPU(x86_env_get_cpu(env));
290     int trapnr;
291     abi_ulong pc;
292     abi_ulong ret;
293     target_siginfo_t info;
294 
295     for(;;) {
296         cpu_exec_start(cs);
297         trapnr = cpu_exec(cs);
298         cpu_exec_end(cs);
299         switch(trapnr) {
300         case 0x80:
301             /* linux syscall from int $0x80 */
302             ret = do_syscall(env,
303                              env->regs[R_EAX],
304                              env->regs[R_EBX],
305                              env->regs[R_ECX],
306                              env->regs[R_EDX],
307                              env->regs[R_ESI],
308                              env->regs[R_EDI],
309                              env->regs[R_EBP],
310                              0, 0);
311             if (ret == -TARGET_ERESTARTSYS) {
312                 env->eip -= 2;
313             } else if (ret != -TARGET_QEMU_ESIGRETURN) {
314                 env->regs[R_EAX] = ret;
315             }
316             break;
317 #ifndef TARGET_ABI32
318         case EXCP_SYSCALL:
319             /* linux syscall from syscall instruction */
320             ret = do_syscall(env,
321                              env->regs[R_EAX],
322                              env->regs[R_EDI],
323                              env->regs[R_ESI],
324                              env->regs[R_EDX],
325                              env->regs[10],
326                              env->regs[8],
327                              env->regs[9],
328                              0, 0);
329             if (ret == -TARGET_ERESTARTSYS) {
330                 env->eip -= 2;
331             } else if (ret != -TARGET_QEMU_ESIGRETURN) {
332                 env->regs[R_EAX] = ret;
333             }
334             break;
335 #endif
336         case EXCP0B_NOSEG:
337         case EXCP0C_STACK:
338             info.si_signo = TARGET_SIGBUS;
339             info.si_errno = 0;
340             info.si_code = TARGET_SI_KERNEL;
341             info._sifields._sigfault._addr = 0;
342             queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
343             break;
344         case EXCP0D_GPF:
345             /* XXX: potential problem if ABI32 */
346 #ifndef TARGET_X86_64
347             if (env->eflags & VM_MASK) {
348                 handle_vm86_fault(env);
349             } else
350 #endif
351             {
352                 info.si_signo = TARGET_SIGSEGV;
353                 info.si_errno = 0;
354                 info.si_code = TARGET_SI_KERNEL;
355                 info._sifields._sigfault._addr = 0;
356                 queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
357             }
358             break;
359         case EXCP0E_PAGE:
360             info.si_signo = TARGET_SIGSEGV;
361             info.si_errno = 0;
362             if (!(env->error_code & 1))
363                 info.si_code = TARGET_SEGV_MAPERR;
364             else
365                 info.si_code = TARGET_SEGV_ACCERR;
366             info._sifields._sigfault._addr = env->cr[2];
367             queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
368             break;
369         case EXCP00_DIVZ:
370 #ifndef TARGET_X86_64
371             if (env->eflags & VM_MASK) {
372                 handle_vm86_trap(env, trapnr);
373             } else
374 #endif
375             {
376                 /* division by zero */
377                 info.si_signo = TARGET_SIGFPE;
378                 info.si_errno = 0;
379                 info.si_code = TARGET_FPE_INTDIV;
380                 info._sifields._sigfault._addr = env->eip;
381                 queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
382             }
383             break;
384         case EXCP01_DB:
385         case EXCP03_INT3:
386 #ifndef TARGET_X86_64
387             if (env->eflags & VM_MASK) {
388                 handle_vm86_trap(env, trapnr);
389             } else
390 #endif
391             {
392                 info.si_signo = TARGET_SIGTRAP;
393                 info.si_errno = 0;
394                 if (trapnr == EXCP01_DB) {
395                     info.si_code = TARGET_TRAP_BRKPT;
396                     info._sifields._sigfault._addr = env->eip;
397                 } else {
398                     info.si_code = TARGET_SI_KERNEL;
399                     info._sifields._sigfault._addr = 0;
400                 }
401                 queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
402             }
403             break;
404         case EXCP04_INTO:
405         case EXCP05_BOUND:
406 #ifndef TARGET_X86_64
407             if (env->eflags & VM_MASK) {
408                 handle_vm86_trap(env, trapnr);
409             } else
410 #endif
411             {
412                 info.si_signo = TARGET_SIGSEGV;
413                 info.si_errno = 0;
414                 info.si_code = TARGET_SI_KERNEL;
415                 info._sifields._sigfault._addr = 0;
416                 queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
417             }
418             break;
419         case EXCP06_ILLOP:
420             info.si_signo = TARGET_SIGILL;
421             info.si_errno = 0;
422             info.si_code = TARGET_ILL_ILLOPN;
423             info._sifields._sigfault._addr = env->eip;
424             queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
425             break;
426         case EXCP_INTERRUPT:
427             /* just indicate that signals should be handled asap */
428             break;
429         case EXCP_DEBUG:
430             {
431                 int sig;
432 
433                 sig = gdb_handlesig(cs, TARGET_SIGTRAP);
434                 if (sig)
435                   {
436                     info.si_signo = sig;
437                     info.si_errno = 0;
438                     info.si_code = TARGET_TRAP_BRKPT;
439                     queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
440                   }
441             }
442             break;
443         default:
444             pc = env->segs[R_CS].base + env->eip;
445             EXCP_DUMP(env, "qemu: 0x%08lx: unhandled CPU exception 0x%x - aborting\n",
446                       (long)pc, trapnr);
447             abort();
448         }
449         process_pending_signals(env);
450     }
451 }
452 #endif
453 
454 #ifdef TARGET_ARM
455 
456 #define get_user_code_u32(x, gaddr, env)                \
457     ({ abi_long __r = get_user_u32((x), (gaddr));       \
458         if (!__r && bswap_code(arm_sctlr_b(env))) {     \
459             (x) = bswap32(x);                           \
460         }                                               \
461         __r;                                            \
462     })
463 
464 #define get_user_code_u16(x, gaddr, env)                \
465     ({ abi_long __r = get_user_u16((x), (gaddr));       \
466         if (!__r && bswap_code(arm_sctlr_b(env))) {     \
467             (x) = bswap16(x);                           \
468         }                                               \
469         __r;                                            \
470     })
471 
472 #define get_user_data_u32(x, gaddr, env)                \
473     ({ abi_long __r = get_user_u32((x), (gaddr));       \
474         if (!__r && arm_cpu_bswap_data(env)) {          \
475             (x) = bswap32(x);                           \
476         }                                               \
477         __r;                                            \
478     })
479 
480 #define get_user_data_u16(x, gaddr, env)                \
481     ({ abi_long __r = get_user_u16((x), (gaddr));       \
482         if (!__r && arm_cpu_bswap_data(env)) {          \
483             (x) = bswap16(x);                           \
484         }                                               \
485         __r;                                            \
486     })
487 
488 #define put_user_data_u32(x, gaddr, env)                \
489     ({ typeof(x) __x = (x);                             \
490         if (arm_cpu_bswap_data(env)) {                  \
491             __x = bswap32(__x);                         \
492         }                                               \
493         put_user_u32(__x, (gaddr));                     \
494     })
495 
496 #define put_user_data_u16(x, gaddr, env)                \
497     ({ typeof(x) __x = (x);                             \
498         if (arm_cpu_bswap_data(env)) {                  \
499             __x = bswap16(__x);                         \
500         }                                               \
501         put_user_u16(__x, (gaddr));                     \
502     })
503 
504 #ifdef TARGET_ABI32
505 /* Commpage handling -- there is no commpage for AArch64 */
506 
507 /*
508  * See the Linux kernel's Documentation/arm/kernel_user_helpers.txt
509  * Input:
510  * r0 = pointer to oldval
511  * r1 = pointer to newval
512  * r2 = pointer to target value
513  *
514  * Output:
515  * r0 = 0 if *ptr was changed, non-0 if no exchange happened
516  * C set if *ptr was changed, clear if no exchange happened
517  *
518  * Note segv's in kernel helpers are a bit tricky, we can set the
519  * data address sensibly but the PC address is just the entry point.
520  */
521 static void arm_kernel_cmpxchg64_helper(CPUARMState *env)
522 {
523     uint64_t oldval, newval, val;
524     uint32_t addr, cpsr;
525     target_siginfo_t info;
526 
527     /* Based on the 32 bit code in do_kernel_trap */
528 
529     /* XXX: This only works between threads, not between processes.
530        It's probably possible to implement this with native host
531        operations. However things like ldrex/strex are much harder so
532        there's not much point trying.  */
533     start_exclusive();
534     cpsr = cpsr_read(env);
535     addr = env->regs[2];
536 
537     if (get_user_u64(oldval, env->regs[0])) {
538         env->exception.vaddress = env->regs[0];
539         goto segv;
540     };
541 
542     if (get_user_u64(newval, env->regs[1])) {
543         env->exception.vaddress = env->regs[1];
544         goto segv;
545     };
546 
547     if (get_user_u64(val, addr)) {
548         env->exception.vaddress = addr;
549         goto segv;
550     }
551 
552     if (val == oldval) {
553         val = newval;
554 
555         if (put_user_u64(val, addr)) {
556             env->exception.vaddress = addr;
557             goto segv;
558         };
559 
560         env->regs[0] = 0;
561         cpsr |= CPSR_C;
562     } else {
563         env->regs[0] = -1;
564         cpsr &= ~CPSR_C;
565     }
566     cpsr_write(env, cpsr, CPSR_C, CPSRWriteByInstr);
567     end_exclusive();
568     return;
569 
570 segv:
571     end_exclusive();
572     /* We get the PC of the entry address - which is as good as anything,
573        on a real kernel what you get depends on which mode it uses. */
574     info.si_signo = TARGET_SIGSEGV;
575     info.si_errno = 0;
576     /* XXX: check env->error_code */
577     info.si_code = TARGET_SEGV_MAPERR;
578     info._sifields._sigfault._addr = env->exception.vaddress;
579     queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
580 }
581 
582 /* Handle a jump to the kernel code page.  */
583 static int
584 do_kernel_trap(CPUARMState *env)
585 {
586     uint32_t addr;
587     uint32_t cpsr;
588     uint32_t val;
589 
590     switch (env->regs[15]) {
591     case 0xffff0fa0: /* __kernel_memory_barrier */
592         /* ??? No-op. Will need to do better for SMP.  */
593         break;
594     case 0xffff0fc0: /* __kernel_cmpxchg */
595          /* XXX: This only works between threads, not between processes.
596             It's probably possible to implement this with native host
597             operations. However things like ldrex/strex are much harder so
598             there's not much point trying.  */
599         start_exclusive();
600         cpsr = cpsr_read(env);
601         addr = env->regs[2];
602         /* FIXME: This should SEGV if the access fails.  */
603         if (get_user_u32(val, addr))
604             val = ~env->regs[0];
605         if (val == env->regs[0]) {
606             val = env->regs[1];
607             /* FIXME: Check for segfaults.  */
608             put_user_u32(val, addr);
609             env->regs[0] = 0;
610             cpsr |= CPSR_C;
611         } else {
612             env->regs[0] = -1;
613             cpsr &= ~CPSR_C;
614         }
615         cpsr_write(env, cpsr, CPSR_C, CPSRWriteByInstr);
616         end_exclusive();
617         break;
618     case 0xffff0fe0: /* __kernel_get_tls */
619         env->regs[0] = cpu_get_tls(env);
620         break;
621     case 0xffff0f60: /* __kernel_cmpxchg64 */
622         arm_kernel_cmpxchg64_helper(env);
623         break;
624 
625     default:
626         return 1;
627     }
628     /* Jump back to the caller.  */
629     addr = env->regs[14];
630     if (addr & 1) {
631         env->thumb = 1;
632         addr &= ~1;
633     }
634     env->regs[15] = addr;
635 
636     return 0;
637 }
638 
639 /* Store exclusive handling for AArch32 */
640 static int do_strex(CPUARMState *env)
641 {
642     uint64_t val;
643     int size;
644     int rc = 1;
645     int segv = 0;
646     uint32_t addr;
647     start_exclusive();
648     if (env->exclusive_addr != env->exclusive_test) {
649         goto fail;
650     }
651     /* We know we're always AArch32 so the address is in uint32_t range
652      * unless it was the -1 exclusive-monitor-lost value (which won't
653      * match exclusive_test above).
654      */
655     assert(extract64(env->exclusive_addr, 32, 32) == 0);
656     addr = env->exclusive_addr;
657     size = env->exclusive_info & 0xf;
658     switch (size) {
659     case 0:
660         segv = get_user_u8(val, addr);
661         break;
662     case 1:
663         segv = get_user_data_u16(val, addr, env);
664         break;
665     case 2:
666     case 3:
667         segv = get_user_data_u32(val, addr, env);
668         break;
669     default:
670         abort();
671     }
672     if (segv) {
673         env->exception.vaddress = addr;
674         goto done;
675     }
676     if (size == 3) {
677         uint32_t valhi;
678         segv = get_user_data_u32(valhi, addr + 4, env);
679         if (segv) {
680             env->exception.vaddress = addr + 4;
681             goto done;
682         }
683         if (arm_cpu_bswap_data(env)) {
684             val = deposit64((uint64_t)valhi, 32, 32, val);
685         } else {
686             val = deposit64(val, 32, 32, valhi);
687         }
688     }
689     if (val != env->exclusive_val) {
690         goto fail;
691     }
692 
693     val = env->regs[(env->exclusive_info >> 8) & 0xf];
694     switch (size) {
695     case 0:
696         segv = put_user_u8(val, addr);
697         break;
698     case 1:
699         segv = put_user_data_u16(val, addr, env);
700         break;
701     case 2:
702     case 3:
703         segv = put_user_data_u32(val, addr, env);
704         break;
705     }
706     if (segv) {
707         env->exception.vaddress = addr;
708         goto done;
709     }
710     if (size == 3) {
711         val = env->regs[(env->exclusive_info >> 12) & 0xf];
712         segv = put_user_data_u32(val, addr + 4, env);
713         if (segv) {
714             env->exception.vaddress = addr + 4;
715             goto done;
716         }
717     }
718     rc = 0;
719 fail:
720     env->regs[15] += 4;
721     env->regs[(env->exclusive_info >> 4) & 0xf] = rc;
722 done:
723     end_exclusive();
724     return segv;
725 }
726 
727 void cpu_loop(CPUARMState *env)
728 {
729     CPUState *cs = CPU(arm_env_get_cpu(env));
730     int trapnr;
731     unsigned int n, insn;
732     target_siginfo_t info;
733     uint32_t addr;
734     abi_ulong ret;
735 
736     for(;;) {
737         cpu_exec_start(cs);
738         trapnr = cpu_exec(cs);
739         cpu_exec_end(cs);
740         switch(trapnr) {
741         case EXCP_UDEF:
742             {
743                 TaskState *ts = cs->opaque;
744                 uint32_t opcode;
745                 int rc;
746 
747                 /* we handle the FPU emulation here, as Linux */
748                 /* we get the opcode */
749                 /* FIXME - what to do if get_user() fails? */
750                 get_user_code_u32(opcode, env->regs[15], env);
751 
752                 rc = EmulateAll(opcode, &ts->fpa, env);
753                 if (rc == 0) { /* illegal instruction */
754                     info.si_signo = TARGET_SIGILL;
755                     info.si_errno = 0;
756                     info.si_code = TARGET_ILL_ILLOPN;
757                     info._sifields._sigfault._addr = env->regs[15];
758                     queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
759                 } else if (rc < 0) { /* FP exception */
760                     int arm_fpe=0;
761 
762                     /* translate softfloat flags to FPSR flags */
763                     if (-rc & float_flag_invalid)
764                       arm_fpe |= BIT_IOC;
765                     if (-rc & float_flag_divbyzero)
766                       arm_fpe |= BIT_DZC;
767                     if (-rc & float_flag_overflow)
768                       arm_fpe |= BIT_OFC;
769                     if (-rc & float_flag_underflow)
770                       arm_fpe |= BIT_UFC;
771                     if (-rc & float_flag_inexact)
772                       arm_fpe |= BIT_IXC;
773 
774                     FPSR fpsr = ts->fpa.fpsr;
775                     //printf("fpsr 0x%x, arm_fpe 0x%x\n",fpsr,arm_fpe);
776 
777                     if (fpsr & (arm_fpe << 16)) { /* exception enabled? */
778                       info.si_signo = TARGET_SIGFPE;
779                       info.si_errno = 0;
780 
781                       /* ordered by priority, least first */
782                       if (arm_fpe & BIT_IXC) info.si_code = TARGET_FPE_FLTRES;
783                       if (arm_fpe & BIT_UFC) info.si_code = TARGET_FPE_FLTUND;
784                       if (arm_fpe & BIT_OFC) info.si_code = TARGET_FPE_FLTOVF;
785                       if (arm_fpe & BIT_DZC) info.si_code = TARGET_FPE_FLTDIV;
786                       if (arm_fpe & BIT_IOC) info.si_code = TARGET_FPE_FLTINV;
787 
788                       info._sifields._sigfault._addr = env->regs[15];
789                       queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
790                     } else {
791                       env->regs[15] += 4;
792                     }
793 
794                     /* accumulate unenabled exceptions */
795                     if ((!(fpsr & BIT_IXE)) && (arm_fpe & BIT_IXC))
796                       fpsr |= BIT_IXC;
797                     if ((!(fpsr & BIT_UFE)) && (arm_fpe & BIT_UFC))
798                       fpsr |= BIT_UFC;
799                     if ((!(fpsr & BIT_OFE)) && (arm_fpe & BIT_OFC))
800                       fpsr |= BIT_OFC;
801                     if ((!(fpsr & BIT_DZE)) && (arm_fpe & BIT_DZC))
802                       fpsr |= BIT_DZC;
803                     if ((!(fpsr & BIT_IOE)) && (arm_fpe & BIT_IOC))
804                       fpsr |= BIT_IOC;
805                     ts->fpa.fpsr=fpsr;
806                 } else { /* everything OK */
807                     /* increment PC */
808                     env->regs[15] += 4;
809                 }
810             }
811             break;
812         case EXCP_SWI:
813         case EXCP_BKPT:
814             {
815                 env->eabi = 1;
816                 /* system call */
817                 if (trapnr == EXCP_BKPT) {
818                     if (env->thumb) {
819                         /* FIXME - what to do if get_user() fails? */
820                         get_user_code_u16(insn, env->regs[15], env);
821                         n = insn & 0xff;
822                         env->regs[15] += 2;
823                     } else {
824                         /* FIXME - what to do if get_user() fails? */
825                         get_user_code_u32(insn, env->regs[15], env);
826                         n = (insn & 0xf) | ((insn >> 4) & 0xff0);
827                         env->regs[15] += 4;
828                     }
829                 } else {
830                     if (env->thumb) {
831                         /* FIXME - what to do if get_user() fails? */
832                         get_user_code_u16(insn, env->regs[15] - 2, env);
833                         n = insn & 0xff;
834                     } else {
835                         /* FIXME - what to do if get_user() fails? */
836                         get_user_code_u32(insn, env->regs[15] - 4, env);
837                         n = insn & 0xffffff;
838                     }
839                 }
840 
841                 if (n == ARM_NR_cacheflush) {
842                     /* nop */
843                 } else if (n == ARM_NR_semihosting
844                            || n == ARM_NR_thumb_semihosting) {
845                     env->regs[0] = do_arm_semihosting (env);
846                 } else if (n == 0 || n >= ARM_SYSCALL_BASE || env->thumb) {
847                     /* linux syscall */
848                     if (env->thumb || n == 0) {
849                         n = env->regs[7];
850                     } else {
851                         n -= ARM_SYSCALL_BASE;
852                         env->eabi = 0;
853                     }
854                     if ( n > ARM_NR_BASE) {
855                         switch (n) {
856                         case ARM_NR_cacheflush:
857                             /* nop */
858                             break;
859                         case ARM_NR_set_tls:
860                             cpu_set_tls(env, env->regs[0]);
861                             env->regs[0] = 0;
862                             break;
863                         case ARM_NR_breakpoint:
864                             env->regs[15] -= env->thumb ? 2 : 4;
865                             goto excp_debug;
866                         default:
867                             gemu_log("qemu: Unsupported ARM syscall: 0x%x\n",
868                                      n);
869                             env->regs[0] = -TARGET_ENOSYS;
870                             break;
871                         }
872                     } else {
873                         ret = do_syscall(env,
874                                          n,
875                                          env->regs[0],
876                                          env->regs[1],
877                                          env->regs[2],
878                                          env->regs[3],
879                                          env->regs[4],
880                                          env->regs[5],
881                                          0, 0);
882                         if (ret == -TARGET_ERESTARTSYS) {
883                             env->regs[15] -= env->thumb ? 2 : 4;
884                         } else if (ret != -TARGET_QEMU_ESIGRETURN) {
885                             env->regs[0] = ret;
886                         }
887                     }
888                 } else {
889                     goto error;
890                 }
891             }
892             break;
893         case EXCP_INTERRUPT:
894             /* just indicate that signals should be handled asap */
895             break;
896         case EXCP_STREX:
897             if (!do_strex(env)) {
898                 break;
899             }
900             /* fall through for segv */
901         case EXCP_PREFETCH_ABORT:
902         case EXCP_DATA_ABORT:
903             addr = env->exception.vaddress;
904             {
905                 info.si_signo = TARGET_SIGSEGV;
906                 info.si_errno = 0;
907                 /* XXX: check env->error_code */
908                 info.si_code = TARGET_SEGV_MAPERR;
909                 info._sifields._sigfault._addr = addr;
910                 queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
911             }
912             break;
913         case EXCP_DEBUG:
914         excp_debug:
915             {
916                 int sig;
917 
918                 sig = gdb_handlesig(cs, TARGET_SIGTRAP);
919                 if (sig)
920                   {
921                     info.si_signo = sig;
922                     info.si_errno = 0;
923                     info.si_code = TARGET_TRAP_BRKPT;
924                     queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
925                   }
926             }
927             break;
928         case EXCP_KERNEL_TRAP:
929             if (do_kernel_trap(env))
930               goto error;
931             break;
932         case EXCP_YIELD:
933             /* nothing to do here for user-mode, just resume guest code */
934             break;
935         default:
936         error:
937             EXCP_DUMP(env, "qemu: unhandled CPU exception 0x%x - aborting\n", trapnr);
938             abort();
939         }
940         process_pending_signals(env);
941     }
942 }
943 
944 #else
945 
946 /*
947  * Handle AArch64 store-release exclusive
948  *
949  * rs = gets the status result of store exclusive
950  * rt = is the register that is stored
951  * rt2 = is the second register store (in STP)
952  *
953  */
954 static int do_strex_a64(CPUARMState *env)
955 {
956     uint64_t val;
957     int size;
958     bool is_pair;
959     int rc = 1;
960     int segv = 0;
961     uint64_t addr;
962     int rs, rt, rt2;
963 
964     start_exclusive();
965     /* size | is_pair << 2 | (rs << 4) | (rt << 9) | (rt2 << 14)); */
966     size = extract32(env->exclusive_info, 0, 2);
967     is_pair = extract32(env->exclusive_info, 2, 1);
968     rs = extract32(env->exclusive_info, 4, 5);
969     rt = extract32(env->exclusive_info, 9, 5);
970     rt2 = extract32(env->exclusive_info, 14, 5);
971 
972     addr = env->exclusive_addr;
973 
974     if (addr != env->exclusive_test) {
975         goto finish;
976     }
977 
978     switch (size) {
979     case 0:
980         segv = get_user_u8(val, addr);
981         break;
982     case 1:
983         segv = get_user_u16(val, addr);
984         break;
985     case 2:
986         segv = get_user_u32(val, addr);
987         break;
988     case 3:
989         segv = get_user_u64(val, addr);
990         break;
991     default:
992         abort();
993     }
994     if (segv) {
995         env->exception.vaddress = addr;
996         goto error;
997     }
998     if (val != env->exclusive_val) {
999         goto finish;
1000     }
1001     if (is_pair) {
1002         if (size == 2) {
1003             segv = get_user_u32(val, addr + 4);
1004         } else {
1005             segv = get_user_u64(val, addr + 8);
1006         }
1007         if (segv) {
1008             env->exception.vaddress = addr + (size == 2 ? 4 : 8);
1009             goto error;
1010         }
1011         if (val != env->exclusive_high) {
1012             goto finish;
1013         }
1014     }
1015     /* handle the zero register */
1016     val = rt == 31 ? 0 : env->xregs[rt];
1017     switch (size) {
1018     case 0:
1019         segv = put_user_u8(val, addr);
1020         break;
1021     case 1:
1022         segv = put_user_u16(val, addr);
1023         break;
1024     case 2:
1025         segv = put_user_u32(val, addr);
1026         break;
1027     case 3:
1028         segv = put_user_u64(val, addr);
1029         break;
1030     }
1031     if (segv) {
1032         goto error;
1033     }
1034     if (is_pair) {
1035         /* handle the zero register */
1036         val = rt2 == 31 ? 0 : env->xregs[rt2];
1037         if (size == 2) {
1038             segv = put_user_u32(val, addr + 4);
1039         } else {
1040             segv = put_user_u64(val, addr + 8);
1041         }
1042         if (segv) {
1043             env->exception.vaddress = addr + (size == 2 ? 4 : 8);
1044             goto error;
1045         }
1046     }
1047     rc = 0;
1048 finish:
1049     env->pc += 4;
1050     /* rs == 31 encodes a write to the ZR, thus throwing away
1051      * the status return. This is rather silly but valid.
1052      */
1053     if (rs < 31) {
1054         env->xregs[rs] = rc;
1055     }
1056 error:
1057     /* instruction faulted, PC does not advance */
1058     /* either way a strex releases any exclusive lock we have */
1059     env->exclusive_addr = -1;
1060     end_exclusive();
1061     return segv;
1062 }
1063 
1064 /* AArch64 main loop */
1065 void cpu_loop(CPUARMState *env)
1066 {
1067     CPUState *cs = CPU(arm_env_get_cpu(env));
1068     int trapnr, sig;
1069     abi_long ret;
1070     target_siginfo_t info;
1071 
1072     for (;;) {
1073         cpu_exec_start(cs);
1074         trapnr = cpu_exec(cs);
1075         cpu_exec_end(cs);
1076 
1077         switch (trapnr) {
1078         case EXCP_SWI:
1079             ret = do_syscall(env,
1080                              env->xregs[8],
1081                              env->xregs[0],
1082                              env->xregs[1],
1083                              env->xregs[2],
1084                              env->xregs[3],
1085                              env->xregs[4],
1086                              env->xregs[5],
1087                              0, 0);
1088             if (ret == -TARGET_ERESTARTSYS) {
1089                 env->pc -= 4;
1090             } else if (ret != -TARGET_QEMU_ESIGRETURN) {
1091                 env->xregs[0] = ret;
1092             }
1093             break;
1094         case EXCP_INTERRUPT:
1095             /* just indicate that signals should be handled asap */
1096             break;
1097         case EXCP_UDEF:
1098             info.si_signo = TARGET_SIGILL;
1099             info.si_errno = 0;
1100             info.si_code = TARGET_ILL_ILLOPN;
1101             info._sifields._sigfault._addr = env->pc;
1102             queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
1103             break;
1104         case EXCP_STREX:
1105             if (!do_strex_a64(env)) {
1106                 break;
1107             }
1108             /* fall through for segv */
1109         case EXCP_PREFETCH_ABORT:
1110         case EXCP_DATA_ABORT:
1111             info.si_signo = TARGET_SIGSEGV;
1112             info.si_errno = 0;
1113             /* XXX: check env->error_code */
1114             info.si_code = TARGET_SEGV_MAPERR;
1115             info._sifields._sigfault._addr = env->exception.vaddress;
1116             queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
1117             break;
1118         case EXCP_DEBUG:
1119         case EXCP_BKPT:
1120             sig = gdb_handlesig(cs, TARGET_SIGTRAP);
1121             if (sig) {
1122                 info.si_signo = sig;
1123                 info.si_errno = 0;
1124                 info.si_code = TARGET_TRAP_BRKPT;
1125                 queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
1126             }
1127             break;
1128         case EXCP_SEMIHOST:
1129             env->xregs[0] = do_arm_semihosting(env);
1130             break;
1131         case EXCP_YIELD:
1132             /* nothing to do here for user-mode, just resume guest code */
1133             break;
1134         default:
1135             EXCP_DUMP(env, "qemu: unhandled CPU exception 0x%x - aborting\n", trapnr);
1136             abort();
1137         }
1138         process_pending_signals(env);
1139         /* Exception return on AArch64 always clears the exclusive monitor,
1140          * so any return to running guest code implies this.
1141          * A strex (successful or otherwise) also clears the monitor, so
1142          * we don't need to specialcase EXCP_STREX.
1143          */
1144         env->exclusive_addr = -1;
1145     }
1146 }
1147 #endif /* ndef TARGET_ABI32 */
1148 
1149 #endif
1150 
1151 #ifdef TARGET_UNICORE32
1152 
1153 void cpu_loop(CPUUniCore32State *env)
1154 {
1155     CPUState *cs = CPU(uc32_env_get_cpu(env));
1156     int trapnr;
1157     unsigned int n, insn;
1158     target_siginfo_t info;
1159 
1160     for (;;) {
1161         cpu_exec_start(cs);
1162         trapnr = cpu_exec(cs);
1163         cpu_exec_end(cs);
1164         switch (trapnr) {
1165         case UC32_EXCP_PRIV:
1166             {
1167                 /* system call */
1168                 get_user_u32(insn, env->regs[31] - 4);
1169                 n = insn & 0xffffff;
1170 
1171                 if (n >= UC32_SYSCALL_BASE) {
1172                     /* linux syscall */
1173                     n -= UC32_SYSCALL_BASE;
1174                     if (n == UC32_SYSCALL_NR_set_tls) {
1175                             cpu_set_tls(env, env->regs[0]);
1176                             env->regs[0] = 0;
1177                     } else {
1178                         abi_long ret = do_syscall(env,
1179                                                   n,
1180                                                   env->regs[0],
1181                                                   env->regs[1],
1182                                                   env->regs[2],
1183                                                   env->regs[3],
1184                                                   env->regs[4],
1185                                                   env->regs[5],
1186                                                   0, 0);
1187                         if (ret == -TARGET_ERESTARTSYS) {
1188                             env->regs[31] -= 4;
1189                         } else if (ret != -TARGET_QEMU_ESIGRETURN) {
1190                             env->regs[0] = ret;
1191                         }
1192                     }
1193                 } else {
1194                     goto error;
1195                 }
1196             }
1197             break;
1198         case UC32_EXCP_DTRAP:
1199         case UC32_EXCP_ITRAP:
1200             info.si_signo = TARGET_SIGSEGV;
1201             info.si_errno = 0;
1202             /* XXX: check env->error_code */
1203             info.si_code = TARGET_SEGV_MAPERR;
1204             info._sifields._sigfault._addr = env->cp0.c4_faultaddr;
1205             queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
1206             break;
1207         case EXCP_INTERRUPT:
1208             /* just indicate that signals should be handled asap */
1209             break;
1210         case EXCP_DEBUG:
1211             {
1212                 int sig;
1213 
1214                 sig = gdb_handlesig(cs, TARGET_SIGTRAP);
1215                 if (sig) {
1216                     info.si_signo = sig;
1217                     info.si_errno = 0;
1218                     info.si_code = TARGET_TRAP_BRKPT;
1219                     queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
1220                 }
1221             }
1222             break;
1223         default:
1224             goto error;
1225         }
1226         process_pending_signals(env);
1227     }
1228 
1229 error:
1230     EXCP_DUMP(env, "qemu: unhandled CPU exception 0x%x - aborting\n", trapnr);
1231     abort();
1232 }
1233 #endif
1234 
1235 #ifdef TARGET_SPARC
1236 #define SPARC64_STACK_BIAS 2047
1237 
1238 //#define DEBUG_WIN
1239 
1240 /* WARNING: dealing with register windows _is_ complicated. More info
1241    can be found at http://www.sics.se/~psm/sparcstack.html */
1242 static inline int get_reg_index(CPUSPARCState *env, int cwp, int index)
1243 {
1244     index = (index + cwp * 16) % (16 * env->nwindows);
1245     /* wrap handling : if cwp is on the last window, then we use the
1246        registers 'after' the end */
1247     if (index < 8 && env->cwp == env->nwindows - 1)
1248         index += 16 * env->nwindows;
1249     return index;
1250 }
1251 
1252 /* save the register window 'cwp1' */
1253 static inline void save_window_offset(CPUSPARCState *env, int cwp1)
1254 {
1255     unsigned int i;
1256     abi_ulong sp_ptr;
1257 
1258     sp_ptr = env->regbase[get_reg_index(env, cwp1, 6)];
1259 #ifdef TARGET_SPARC64
1260     if (sp_ptr & 3)
1261         sp_ptr += SPARC64_STACK_BIAS;
1262 #endif
1263 #if defined(DEBUG_WIN)
1264     printf("win_overflow: sp_ptr=0x" TARGET_ABI_FMT_lx " save_cwp=%d\n",
1265            sp_ptr, cwp1);
1266 #endif
1267     for(i = 0; i < 16; i++) {
1268         /* FIXME - what to do if put_user() fails? */
1269         put_user_ual(env->regbase[get_reg_index(env, cwp1, 8 + i)], sp_ptr);
1270         sp_ptr += sizeof(abi_ulong);
1271     }
1272 }
1273 
1274 static void save_window(CPUSPARCState *env)
1275 {
1276 #ifndef TARGET_SPARC64
1277     unsigned int new_wim;
1278     new_wim = ((env->wim >> 1) | (env->wim << (env->nwindows - 1))) &
1279         ((1LL << env->nwindows) - 1);
1280     save_window_offset(env, cpu_cwp_dec(env, env->cwp - 2));
1281     env->wim = new_wim;
1282 #else
1283     save_window_offset(env, cpu_cwp_dec(env, env->cwp - 2));
1284     env->cansave++;
1285     env->canrestore--;
1286 #endif
1287 }
1288 
1289 static void restore_window(CPUSPARCState *env)
1290 {
1291 #ifndef TARGET_SPARC64
1292     unsigned int new_wim;
1293 #endif
1294     unsigned int i, cwp1;
1295     abi_ulong sp_ptr;
1296 
1297 #ifndef TARGET_SPARC64
1298     new_wim = ((env->wim << 1) | (env->wim >> (env->nwindows - 1))) &
1299         ((1LL << env->nwindows) - 1);
1300 #endif
1301 
1302     /* restore the invalid window */
1303     cwp1 = cpu_cwp_inc(env, env->cwp + 1);
1304     sp_ptr = env->regbase[get_reg_index(env, cwp1, 6)];
1305 #ifdef TARGET_SPARC64
1306     if (sp_ptr & 3)
1307         sp_ptr += SPARC64_STACK_BIAS;
1308 #endif
1309 #if defined(DEBUG_WIN)
1310     printf("win_underflow: sp_ptr=0x" TARGET_ABI_FMT_lx " load_cwp=%d\n",
1311            sp_ptr, cwp1);
1312 #endif
1313     for(i = 0; i < 16; i++) {
1314         /* FIXME - what to do if get_user() fails? */
1315         get_user_ual(env->regbase[get_reg_index(env, cwp1, 8 + i)], sp_ptr);
1316         sp_ptr += sizeof(abi_ulong);
1317     }
1318 #ifdef TARGET_SPARC64
1319     env->canrestore++;
1320     if (env->cleanwin < env->nwindows - 1)
1321         env->cleanwin++;
1322     env->cansave--;
1323 #else
1324     env->wim = new_wim;
1325 #endif
1326 }
1327 
1328 static void flush_windows(CPUSPARCState *env)
1329 {
1330     int offset, cwp1;
1331 
1332     offset = 1;
1333     for(;;) {
1334         /* if restore would invoke restore_window(), then we can stop */
1335         cwp1 = cpu_cwp_inc(env, env->cwp + offset);
1336 #ifndef TARGET_SPARC64
1337         if (env->wim & (1 << cwp1))
1338             break;
1339 #else
1340         if (env->canrestore == 0)
1341             break;
1342         env->cansave++;
1343         env->canrestore--;
1344 #endif
1345         save_window_offset(env, cwp1);
1346         offset++;
1347     }
1348     cwp1 = cpu_cwp_inc(env, env->cwp + 1);
1349 #ifndef TARGET_SPARC64
1350     /* set wim so that restore will reload the registers */
1351     env->wim = 1 << cwp1;
1352 #endif
1353 #if defined(DEBUG_WIN)
1354     printf("flush_windows: nb=%d\n", offset - 1);
1355 #endif
1356 }
1357 
1358 void cpu_loop (CPUSPARCState *env)
1359 {
1360     CPUState *cs = CPU(sparc_env_get_cpu(env));
1361     int trapnr;
1362     abi_long ret;
1363     target_siginfo_t info;
1364 
1365     while (1) {
1366         cpu_exec_start(cs);
1367         trapnr = cpu_exec(cs);
1368         cpu_exec_end(cs);
1369 
1370         /* Compute PSR before exposing state.  */
1371         if (env->cc_op != CC_OP_FLAGS) {
1372             cpu_get_psr(env);
1373         }
1374 
1375         switch (trapnr) {
1376 #ifndef TARGET_SPARC64
1377         case 0x88:
1378         case 0x90:
1379 #else
1380         case 0x110:
1381         case 0x16d:
1382 #endif
1383             ret = do_syscall (env, env->gregs[1],
1384                               env->regwptr[0], env->regwptr[1],
1385                               env->regwptr[2], env->regwptr[3],
1386                               env->regwptr[4], env->regwptr[5],
1387                               0, 0);
1388             if (ret == -TARGET_ERESTARTSYS || ret == -TARGET_QEMU_ESIGRETURN) {
1389                 break;
1390             }
1391             if ((abi_ulong)ret >= (abi_ulong)(-515)) {
1392 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
1393                 env->xcc |= PSR_CARRY;
1394 #else
1395                 env->psr |= PSR_CARRY;
1396 #endif
1397                 ret = -ret;
1398             } else {
1399 #if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
1400                 env->xcc &= ~PSR_CARRY;
1401 #else
1402                 env->psr &= ~PSR_CARRY;
1403 #endif
1404             }
1405             env->regwptr[0] = ret;
1406             /* next instruction */
1407             env->pc = env->npc;
1408             env->npc = env->npc + 4;
1409             break;
1410         case 0x83: /* flush windows */
1411 #ifdef TARGET_ABI32
1412         case 0x103:
1413 #endif
1414             flush_windows(env);
1415             /* next instruction */
1416             env->pc = env->npc;
1417             env->npc = env->npc + 4;
1418             break;
1419 #ifndef TARGET_SPARC64
1420         case TT_WIN_OVF: /* window overflow */
1421             save_window(env);
1422             break;
1423         case TT_WIN_UNF: /* window underflow */
1424             restore_window(env);
1425             break;
1426         case TT_TFAULT:
1427         case TT_DFAULT:
1428             {
1429                 info.si_signo = TARGET_SIGSEGV;
1430                 info.si_errno = 0;
1431                 /* XXX: check env->error_code */
1432                 info.si_code = TARGET_SEGV_MAPERR;
1433                 info._sifields._sigfault._addr = env->mmuregs[4];
1434                 queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
1435             }
1436             break;
1437 #else
1438         case TT_SPILL: /* window overflow */
1439             save_window(env);
1440             break;
1441         case TT_FILL: /* window underflow */
1442             restore_window(env);
1443             break;
1444         case TT_TFAULT:
1445         case TT_DFAULT:
1446             {
1447                 info.si_signo = TARGET_SIGSEGV;
1448                 info.si_errno = 0;
1449                 /* XXX: check env->error_code */
1450                 info.si_code = TARGET_SEGV_MAPERR;
1451                 if (trapnr == TT_DFAULT)
1452                     info._sifields._sigfault._addr = env->dmmuregs[4];
1453                 else
1454                     info._sifields._sigfault._addr = cpu_tsptr(env)->tpc;
1455                 queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
1456             }
1457             break;
1458 #ifndef TARGET_ABI32
1459         case 0x16e:
1460             flush_windows(env);
1461             sparc64_get_context(env);
1462             break;
1463         case 0x16f:
1464             flush_windows(env);
1465             sparc64_set_context(env);
1466             break;
1467 #endif
1468 #endif
1469         case EXCP_INTERRUPT:
1470             /* just indicate that signals should be handled asap */
1471             break;
1472         case TT_ILL_INSN:
1473             {
1474                 info.si_signo = TARGET_SIGILL;
1475                 info.si_errno = 0;
1476                 info.si_code = TARGET_ILL_ILLOPC;
1477                 info._sifields._sigfault._addr = env->pc;
1478                 queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
1479             }
1480             break;
1481         case EXCP_DEBUG:
1482             {
1483                 int sig;
1484 
1485                 sig = gdb_handlesig(cs, TARGET_SIGTRAP);
1486                 if (sig)
1487                   {
1488                     info.si_signo = sig;
1489                     info.si_errno = 0;
1490                     info.si_code = TARGET_TRAP_BRKPT;
1491                     queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
1492                   }
1493             }
1494             break;
1495         default:
1496             printf ("Unhandled trap: 0x%x\n", trapnr);
1497             cpu_dump_state(cs, stderr, fprintf, 0);
1498             exit(EXIT_FAILURE);
1499         }
1500         process_pending_signals (env);
1501     }
1502 }
1503 
1504 #endif
1505 
1506 #ifdef TARGET_PPC
1507 static inline uint64_t cpu_ppc_get_tb(CPUPPCState *env)
1508 {
1509     return cpu_get_host_ticks();
1510 }
1511 
1512 uint64_t cpu_ppc_load_tbl(CPUPPCState *env)
1513 {
1514     return cpu_ppc_get_tb(env);
1515 }
1516 
1517 uint32_t cpu_ppc_load_tbu(CPUPPCState *env)
1518 {
1519     return cpu_ppc_get_tb(env) >> 32;
1520 }
1521 
1522 uint64_t cpu_ppc_load_atbl(CPUPPCState *env)
1523 {
1524     return cpu_ppc_get_tb(env);
1525 }
1526 
1527 uint32_t cpu_ppc_load_atbu(CPUPPCState *env)
1528 {
1529     return cpu_ppc_get_tb(env) >> 32;
1530 }
1531 
1532 uint32_t cpu_ppc601_load_rtcu(CPUPPCState *env)
1533 __attribute__ (( alias ("cpu_ppc_load_tbu") ));
1534 
1535 uint32_t cpu_ppc601_load_rtcl(CPUPPCState *env)
1536 {
1537     return cpu_ppc_load_tbl(env) & 0x3FFFFF80;
1538 }
1539 
1540 /* XXX: to be fixed */
1541 int ppc_dcr_read (ppc_dcr_t *dcr_env, int dcrn, uint32_t *valp)
1542 {
1543     return -1;
1544 }
1545 
1546 int ppc_dcr_write (ppc_dcr_t *dcr_env, int dcrn, uint32_t val)
1547 {
1548     return -1;
1549 }
1550 
1551 static int do_store_exclusive(CPUPPCState *env)
1552 {
1553     target_ulong addr;
1554     target_ulong page_addr;
1555     target_ulong val, val2 __attribute__((unused)) = 0;
1556     int flags;
1557     int segv = 0;
1558 
1559     addr = env->reserve_ea;
1560     page_addr = addr & TARGET_PAGE_MASK;
1561     start_exclusive();
1562     mmap_lock();
1563     flags = page_get_flags(page_addr);
1564     if ((flags & PAGE_READ) == 0) {
1565         segv = 1;
1566     } else {
1567         int reg = env->reserve_info & 0x1f;
1568         int size = env->reserve_info >> 5;
1569         int stored = 0;
1570 
1571         if (addr == env->reserve_addr) {
1572             switch (size) {
1573             case 1: segv = get_user_u8(val, addr); break;
1574             case 2: segv = get_user_u16(val, addr); break;
1575             case 4: segv = get_user_u32(val, addr); break;
1576 #if defined(TARGET_PPC64)
1577             case 8: segv = get_user_u64(val, addr); break;
1578             case 16: {
1579                 segv = get_user_u64(val, addr);
1580                 if (!segv) {
1581                     segv = get_user_u64(val2, addr + 8);
1582                 }
1583                 break;
1584             }
1585 #endif
1586             default: abort();
1587             }
1588             if (!segv && val == env->reserve_val) {
1589                 val = env->gpr[reg];
1590                 switch (size) {
1591                 case 1: segv = put_user_u8(val, addr); break;
1592                 case 2: segv = put_user_u16(val, addr); break;
1593                 case 4: segv = put_user_u32(val, addr); break;
1594 #if defined(TARGET_PPC64)
1595                 case 8: segv = put_user_u64(val, addr); break;
1596                 case 16: {
1597                     if (val2 == env->reserve_val2) {
1598                         if (msr_le) {
1599                             val2 = val;
1600                             val = env->gpr[reg+1];
1601                         } else {
1602                             val2 = env->gpr[reg+1];
1603                         }
1604                         segv = put_user_u64(val, addr);
1605                         if (!segv) {
1606                             segv = put_user_u64(val2, addr + 8);
1607                         }
1608                     }
1609                     break;
1610                 }
1611 #endif
1612                 default: abort();
1613                 }
1614                 if (!segv) {
1615                     stored = 1;
1616                 }
1617             }
1618         }
1619         env->crf[0] = (stored << 1) | xer_so;
1620         env->reserve_addr = (target_ulong)-1;
1621     }
1622     if (!segv) {
1623         env->nip += 4;
1624     }
1625     mmap_unlock();
1626     end_exclusive();
1627     return segv;
1628 }
1629 
1630 void cpu_loop(CPUPPCState *env)
1631 {
1632     CPUState *cs = CPU(ppc_env_get_cpu(env));
1633     target_siginfo_t info;
1634     int trapnr;
1635     target_ulong ret;
1636 
1637     for(;;) {
1638         cpu_exec_start(cs);
1639         trapnr = cpu_exec(cs);
1640         cpu_exec_end(cs);
1641         switch(trapnr) {
1642         case POWERPC_EXCP_NONE:
1643             /* Just go on */
1644             break;
1645         case POWERPC_EXCP_CRITICAL: /* Critical input                        */
1646             cpu_abort(cs, "Critical interrupt while in user mode. "
1647                       "Aborting\n");
1648             break;
1649         case POWERPC_EXCP_MCHECK:   /* Machine check exception               */
1650             cpu_abort(cs, "Machine check exception while in user mode. "
1651                       "Aborting\n");
1652             break;
1653         case POWERPC_EXCP_DSI:      /* Data storage exception                */
1654             /* XXX: check this. Seems bugged */
1655             switch (env->error_code & 0xFF000000) {
1656             case 0x40000000:
1657             case 0x42000000:
1658                 info.si_signo = TARGET_SIGSEGV;
1659                 info.si_errno = 0;
1660                 info.si_code = TARGET_SEGV_MAPERR;
1661                 break;
1662             case 0x04000000:
1663                 info.si_signo = TARGET_SIGILL;
1664                 info.si_errno = 0;
1665                 info.si_code = TARGET_ILL_ILLADR;
1666                 break;
1667             case 0x08000000:
1668                 info.si_signo = TARGET_SIGSEGV;
1669                 info.si_errno = 0;
1670                 info.si_code = TARGET_SEGV_ACCERR;
1671                 break;
1672             default:
1673                 /* Let's send a regular segfault... */
1674                 EXCP_DUMP(env, "Invalid segfault errno (%02x)\n",
1675                           env->error_code);
1676                 info.si_signo = TARGET_SIGSEGV;
1677                 info.si_errno = 0;
1678                 info.si_code = TARGET_SEGV_MAPERR;
1679                 break;
1680             }
1681             info._sifields._sigfault._addr = env->nip;
1682             queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
1683             break;
1684         case POWERPC_EXCP_ISI:      /* Instruction storage exception         */
1685             /* XXX: check this */
1686             switch (env->error_code & 0xFF000000) {
1687             case 0x40000000:
1688                 info.si_signo = TARGET_SIGSEGV;
1689             info.si_errno = 0;
1690                 info.si_code = TARGET_SEGV_MAPERR;
1691                 break;
1692             case 0x10000000:
1693             case 0x08000000:
1694                 info.si_signo = TARGET_SIGSEGV;
1695                 info.si_errno = 0;
1696                 info.si_code = TARGET_SEGV_ACCERR;
1697                 break;
1698             default:
1699                 /* Let's send a regular segfault... */
1700                 EXCP_DUMP(env, "Invalid segfault errno (%02x)\n",
1701                           env->error_code);
1702                 info.si_signo = TARGET_SIGSEGV;
1703                 info.si_errno = 0;
1704                 info.si_code = TARGET_SEGV_MAPERR;
1705                 break;
1706             }
1707             info._sifields._sigfault._addr = env->nip - 4;
1708             queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
1709             break;
1710         case POWERPC_EXCP_EXTERNAL: /* External input                        */
1711             cpu_abort(cs, "External interrupt while in user mode. "
1712                       "Aborting\n");
1713             break;
1714         case POWERPC_EXCP_ALIGN:    /* Alignment exception                   */
1715             /* XXX: check this */
1716             info.si_signo = TARGET_SIGBUS;
1717             info.si_errno = 0;
1718             info.si_code = TARGET_BUS_ADRALN;
1719             info._sifields._sigfault._addr = env->nip;
1720             queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
1721             break;
1722         case POWERPC_EXCP_PROGRAM:  /* Program exception                     */
1723         case POWERPC_EXCP_HV_EMU:   /* HV emulation                          */
1724             /* XXX: check this */
1725             switch (env->error_code & ~0xF) {
1726             case POWERPC_EXCP_FP:
1727                 info.si_signo = TARGET_SIGFPE;
1728                 info.si_errno = 0;
1729                 switch (env->error_code & 0xF) {
1730                 case POWERPC_EXCP_FP_OX:
1731                     info.si_code = TARGET_FPE_FLTOVF;
1732                     break;
1733                 case POWERPC_EXCP_FP_UX:
1734                     info.si_code = TARGET_FPE_FLTUND;
1735                     break;
1736                 case POWERPC_EXCP_FP_ZX:
1737                 case POWERPC_EXCP_FP_VXZDZ:
1738                     info.si_code = TARGET_FPE_FLTDIV;
1739                     break;
1740                 case POWERPC_EXCP_FP_XX:
1741                     info.si_code = TARGET_FPE_FLTRES;
1742                     break;
1743                 case POWERPC_EXCP_FP_VXSOFT:
1744                     info.si_code = TARGET_FPE_FLTINV;
1745                     break;
1746                 case POWERPC_EXCP_FP_VXSNAN:
1747                 case POWERPC_EXCP_FP_VXISI:
1748                 case POWERPC_EXCP_FP_VXIDI:
1749                 case POWERPC_EXCP_FP_VXIMZ:
1750                 case POWERPC_EXCP_FP_VXVC:
1751                 case POWERPC_EXCP_FP_VXSQRT:
1752                 case POWERPC_EXCP_FP_VXCVI:
1753                     info.si_code = TARGET_FPE_FLTSUB;
1754                     break;
1755                 default:
1756                     EXCP_DUMP(env, "Unknown floating point exception (%02x)\n",
1757                               env->error_code);
1758                     break;
1759                 }
1760                 break;
1761             case POWERPC_EXCP_INVAL:
1762                 info.si_signo = TARGET_SIGILL;
1763                 info.si_errno = 0;
1764                 switch (env->error_code & 0xF) {
1765                 case POWERPC_EXCP_INVAL_INVAL:
1766                     info.si_code = TARGET_ILL_ILLOPC;
1767                     break;
1768                 case POWERPC_EXCP_INVAL_LSWX:
1769                     info.si_code = TARGET_ILL_ILLOPN;
1770                     break;
1771                 case POWERPC_EXCP_INVAL_SPR:
1772                     info.si_code = TARGET_ILL_PRVREG;
1773                     break;
1774                 case POWERPC_EXCP_INVAL_FP:
1775                     info.si_code = TARGET_ILL_COPROC;
1776                     break;
1777                 default:
1778                     EXCP_DUMP(env, "Unknown invalid operation (%02x)\n",
1779                               env->error_code & 0xF);
1780                     info.si_code = TARGET_ILL_ILLADR;
1781                     break;
1782                 }
1783                 break;
1784             case POWERPC_EXCP_PRIV:
1785                 info.si_signo = TARGET_SIGILL;
1786                 info.si_errno = 0;
1787                 switch (env->error_code & 0xF) {
1788                 case POWERPC_EXCP_PRIV_OPC:
1789                     info.si_code = TARGET_ILL_PRVOPC;
1790                     break;
1791                 case POWERPC_EXCP_PRIV_REG:
1792                     info.si_code = TARGET_ILL_PRVREG;
1793                     break;
1794                 default:
1795                     EXCP_DUMP(env, "Unknown privilege violation (%02x)\n",
1796                               env->error_code & 0xF);
1797                     info.si_code = TARGET_ILL_PRVOPC;
1798                     break;
1799                 }
1800                 break;
1801             case POWERPC_EXCP_TRAP:
1802                 cpu_abort(cs, "Tried to call a TRAP\n");
1803                 break;
1804             default:
1805                 /* Should not happen ! */
1806                 cpu_abort(cs, "Unknown program exception (%02x)\n",
1807                           env->error_code);
1808                 break;
1809             }
1810             info._sifields._sigfault._addr = env->nip;
1811             queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
1812             break;
1813         case POWERPC_EXCP_FPU:      /* Floating-point unavailable exception  */
1814             info.si_signo = TARGET_SIGILL;
1815             info.si_errno = 0;
1816             info.si_code = TARGET_ILL_COPROC;
1817             info._sifields._sigfault._addr = env->nip;
1818             queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
1819             break;
1820         case POWERPC_EXCP_SYSCALL:  /* System call exception                 */
1821             cpu_abort(cs, "Syscall exception while in user mode. "
1822                       "Aborting\n");
1823             break;
1824         case POWERPC_EXCP_APU:      /* Auxiliary processor unavailable       */
1825             info.si_signo = TARGET_SIGILL;
1826             info.si_errno = 0;
1827             info.si_code = TARGET_ILL_COPROC;
1828             info._sifields._sigfault._addr = env->nip;
1829             queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
1830             break;
1831         case POWERPC_EXCP_DECR:     /* Decrementer exception                 */
1832             cpu_abort(cs, "Decrementer interrupt while in user mode. "
1833                       "Aborting\n");
1834             break;
1835         case POWERPC_EXCP_FIT:      /* Fixed-interval timer interrupt        */
1836             cpu_abort(cs, "Fix interval timer interrupt while in user mode. "
1837                       "Aborting\n");
1838             break;
1839         case POWERPC_EXCP_WDT:      /* Watchdog timer interrupt              */
1840             cpu_abort(cs, "Watchdog timer interrupt while in user mode. "
1841                       "Aborting\n");
1842             break;
1843         case POWERPC_EXCP_DTLB:     /* Data TLB error                        */
1844             cpu_abort(cs, "Data TLB exception while in user mode. "
1845                       "Aborting\n");
1846             break;
1847         case POWERPC_EXCP_ITLB:     /* Instruction TLB error                 */
1848             cpu_abort(cs, "Instruction TLB exception while in user mode. "
1849                       "Aborting\n");
1850             break;
1851         case POWERPC_EXCP_SPEU:     /* SPE/embedded floating-point unavail.  */
1852             info.si_signo = TARGET_SIGILL;
1853             info.si_errno = 0;
1854             info.si_code = TARGET_ILL_COPROC;
1855             info._sifields._sigfault._addr = env->nip;
1856             queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
1857             break;
1858         case POWERPC_EXCP_EFPDI:    /* Embedded floating-point data IRQ      */
1859             cpu_abort(cs, "Embedded floating-point data IRQ not handled\n");
1860             break;
1861         case POWERPC_EXCP_EFPRI:    /* Embedded floating-point round IRQ     */
1862             cpu_abort(cs, "Embedded floating-point round IRQ not handled\n");
1863             break;
1864         case POWERPC_EXCP_EPERFM:   /* Embedded performance monitor IRQ      */
1865             cpu_abort(cs, "Performance monitor exception not handled\n");
1866             break;
1867         case POWERPC_EXCP_DOORI:    /* Embedded doorbell interrupt           */
1868             cpu_abort(cs, "Doorbell interrupt while in user mode. "
1869                        "Aborting\n");
1870             break;
1871         case POWERPC_EXCP_DOORCI:   /* Embedded doorbell critical interrupt  */
1872             cpu_abort(cs, "Doorbell critical interrupt while in user mode. "
1873                       "Aborting\n");
1874             break;
1875         case POWERPC_EXCP_RESET:    /* System reset exception                */
1876             cpu_abort(cs, "Reset interrupt while in user mode. "
1877                       "Aborting\n");
1878             break;
1879         case POWERPC_EXCP_DSEG:     /* Data segment exception                */
1880             cpu_abort(cs, "Data segment exception while in user mode. "
1881                       "Aborting\n");
1882             break;
1883         case POWERPC_EXCP_ISEG:     /* Instruction segment exception         */
1884             cpu_abort(cs, "Instruction segment exception "
1885                       "while in user mode. Aborting\n");
1886             break;
1887         /* PowerPC 64 with hypervisor mode support */
1888         case POWERPC_EXCP_HDECR:    /* Hypervisor decrementer exception      */
1889             cpu_abort(cs, "Hypervisor decrementer interrupt "
1890                       "while in user mode. Aborting\n");
1891             break;
1892         case POWERPC_EXCP_TRACE:    /* Trace exception                       */
1893             /* Nothing to do:
1894              * we use this exception to emulate step-by-step execution mode.
1895              */
1896             break;
1897         /* PowerPC 64 with hypervisor mode support */
1898         case POWERPC_EXCP_HDSI:     /* Hypervisor data storage exception     */
1899             cpu_abort(cs, "Hypervisor data storage exception "
1900                       "while in user mode. Aborting\n");
1901             break;
1902         case POWERPC_EXCP_HISI:     /* Hypervisor instruction storage excp   */
1903             cpu_abort(cs, "Hypervisor instruction storage exception "
1904                       "while in user mode. Aborting\n");
1905             break;
1906         case POWERPC_EXCP_HDSEG:    /* Hypervisor data segment exception     */
1907             cpu_abort(cs, "Hypervisor data segment exception "
1908                       "while in user mode. Aborting\n");
1909             break;
1910         case POWERPC_EXCP_HISEG:    /* Hypervisor instruction segment excp   */
1911             cpu_abort(cs, "Hypervisor instruction segment exception "
1912                       "while in user mode. Aborting\n");
1913             break;
1914         case POWERPC_EXCP_VPU:      /* Vector unavailable exception          */
1915             info.si_signo = TARGET_SIGILL;
1916             info.si_errno = 0;
1917             info.si_code = TARGET_ILL_COPROC;
1918             info._sifields._sigfault._addr = env->nip;
1919             queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
1920             break;
1921         case POWERPC_EXCP_PIT:      /* Programmable interval timer IRQ       */
1922             cpu_abort(cs, "Programmable interval timer interrupt "
1923                       "while in user mode. Aborting\n");
1924             break;
1925         case POWERPC_EXCP_IO:       /* IO error exception                    */
1926             cpu_abort(cs, "IO error exception while in user mode. "
1927                       "Aborting\n");
1928             break;
1929         case POWERPC_EXCP_RUNM:     /* Run mode exception                    */
1930             cpu_abort(cs, "Run mode exception while in user mode. "
1931                       "Aborting\n");
1932             break;
1933         case POWERPC_EXCP_EMUL:     /* Emulation trap exception              */
1934             cpu_abort(cs, "Emulation trap exception not handled\n");
1935             break;
1936         case POWERPC_EXCP_IFTLB:    /* Instruction fetch TLB error           */
1937             cpu_abort(cs, "Instruction fetch TLB exception "
1938                       "while in user-mode. Aborting");
1939             break;
1940         case POWERPC_EXCP_DLTLB:    /* Data load TLB miss                    */
1941             cpu_abort(cs, "Data load TLB exception while in user-mode. "
1942                       "Aborting");
1943             break;
1944         case POWERPC_EXCP_DSTLB:    /* Data store TLB miss                   */
1945             cpu_abort(cs, "Data store TLB exception while in user-mode. "
1946                       "Aborting");
1947             break;
1948         case POWERPC_EXCP_FPA:      /* Floating-point assist exception       */
1949             cpu_abort(cs, "Floating-point assist exception not handled\n");
1950             break;
1951         case POWERPC_EXCP_IABR:     /* Instruction address breakpoint        */
1952             cpu_abort(cs, "Instruction address breakpoint exception "
1953                       "not handled\n");
1954             break;
1955         case POWERPC_EXCP_SMI:      /* System management interrupt           */
1956             cpu_abort(cs, "System management interrupt while in user mode. "
1957                       "Aborting\n");
1958             break;
1959         case POWERPC_EXCP_THERM:    /* Thermal interrupt                     */
1960             cpu_abort(cs, "Thermal interrupt interrupt while in user mode. "
1961                       "Aborting\n");
1962             break;
1963         case POWERPC_EXCP_PERFM:   /* Embedded performance monitor IRQ      */
1964             cpu_abort(cs, "Performance monitor exception not handled\n");
1965             break;
1966         case POWERPC_EXCP_VPUA:     /* Vector assist exception               */
1967             cpu_abort(cs, "Vector assist exception not handled\n");
1968             break;
1969         case POWERPC_EXCP_SOFTP:    /* Soft patch exception                  */
1970             cpu_abort(cs, "Soft patch exception not handled\n");
1971             break;
1972         case POWERPC_EXCP_MAINT:    /* Maintenance exception                 */
1973             cpu_abort(cs, "Maintenance exception while in user mode. "
1974                       "Aborting\n");
1975             break;
1976         case POWERPC_EXCP_STOP:     /* stop translation                      */
1977             /* We did invalidate the instruction cache. Go on */
1978             break;
1979         case POWERPC_EXCP_BRANCH:   /* branch instruction:                   */
1980             /* We just stopped because of a branch. Go on */
1981             break;
1982         case POWERPC_EXCP_SYSCALL_USER:
1983             /* system call in user-mode emulation */
1984             /* WARNING:
1985              * PPC ABI uses overflow flag in cr0 to signal an error
1986              * in syscalls.
1987              */
1988             env->crf[0] &= ~0x1;
1989             ret = do_syscall(env, env->gpr[0], env->gpr[3], env->gpr[4],
1990                              env->gpr[5], env->gpr[6], env->gpr[7],
1991                              env->gpr[8], 0, 0);
1992             if (ret == -TARGET_ERESTARTSYS) {
1993                 break;
1994             }
1995             if (ret == (target_ulong)(-TARGET_QEMU_ESIGRETURN)) {
1996                 /* Returning from a successful sigreturn syscall.
1997                    Avoid corrupting register state.  */
1998                 break;
1999             }
2000             env->nip += 4;
2001             if (ret > (target_ulong)(-515)) {
2002                 env->crf[0] |= 0x1;
2003                 ret = -ret;
2004             }
2005             env->gpr[3] = ret;
2006             break;
2007         case POWERPC_EXCP_STCX:
2008             if (do_store_exclusive(env)) {
2009                 info.si_signo = TARGET_SIGSEGV;
2010                 info.si_errno = 0;
2011                 info.si_code = TARGET_SEGV_MAPERR;
2012                 info._sifields._sigfault._addr = env->nip;
2013                 queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
2014             }
2015             break;
2016         case EXCP_DEBUG:
2017             {
2018                 int sig;
2019 
2020                 sig = gdb_handlesig(cs, TARGET_SIGTRAP);
2021                 if (sig) {
2022                     info.si_signo = sig;
2023                     info.si_errno = 0;
2024                     info.si_code = TARGET_TRAP_BRKPT;
2025                     queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
2026                   }
2027             }
2028             break;
2029         case EXCP_INTERRUPT:
2030             /* just indicate that signals should be handled asap */
2031             break;
2032         default:
2033             cpu_abort(cs, "Unknown exception 0x%x. Aborting\n", trapnr);
2034             break;
2035         }
2036         process_pending_signals(env);
2037     }
2038 }
2039 #endif
2040 
2041 #ifdef TARGET_MIPS
2042 
2043 # ifdef TARGET_ABI_MIPSO32
2044 #  define MIPS_SYS(name, args) args,
2045 static const uint8_t mips_syscall_args[] = {
2046 	MIPS_SYS(sys_syscall	, 8)	/* 4000 */
2047 	MIPS_SYS(sys_exit	, 1)
2048 	MIPS_SYS(sys_fork	, 0)
2049 	MIPS_SYS(sys_read	, 3)
2050 	MIPS_SYS(sys_write	, 3)
2051 	MIPS_SYS(sys_open	, 3)	/* 4005 */
2052 	MIPS_SYS(sys_close	, 1)
2053 	MIPS_SYS(sys_waitpid	, 3)
2054 	MIPS_SYS(sys_creat	, 2)
2055 	MIPS_SYS(sys_link	, 2)
2056 	MIPS_SYS(sys_unlink	, 1)	/* 4010 */
2057 	MIPS_SYS(sys_execve	, 0)
2058 	MIPS_SYS(sys_chdir	, 1)
2059 	MIPS_SYS(sys_time	, 1)
2060 	MIPS_SYS(sys_mknod	, 3)
2061 	MIPS_SYS(sys_chmod	, 2)	/* 4015 */
2062 	MIPS_SYS(sys_lchown	, 3)
2063 	MIPS_SYS(sys_ni_syscall	, 0)
2064 	MIPS_SYS(sys_ni_syscall	, 0)	/* was sys_stat */
2065 	MIPS_SYS(sys_lseek	, 3)
2066 	MIPS_SYS(sys_getpid	, 0)	/* 4020 */
2067 	MIPS_SYS(sys_mount	, 5)
2068 	MIPS_SYS(sys_umount	, 1)
2069 	MIPS_SYS(sys_setuid	, 1)
2070 	MIPS_SYS(sys_getuid	, 0)
2071 	MIPS_SYS(sys_stime	, 1)	/* 4025 */
2072 	MIPS_SYS(sys_ptrace	, 4)
2073 	MIPS_SYS(sys_alarm	, 1)
2074 	MIPS_SYS(sys_ni_syscall	, 0)	/* was sys_fstat */
2075 	MIPS_SYS(sys_pause	, 0)
2076 	MIPS_SYS(sys_utime	, 2)	/* 4030 */
2077 	MIPS_SYS(sys_ni_syscall	, 0)
2078 	MIPS_SYS(sys_ni_syscall	, 0)
2079 	MIPS_SYS(sys_access	, 2)
2080 	MIPS_SYS(sys_nice	, 1)
2081 	MIPS_SYS(sys_ni_syscall	, 0)	/* 4035 */
2082 	MIPS_SYS(sys_sync	, 0)
2083 	MIPS_SYS(sys_kill	, 2)
2084 	MIPS_SYS(sys_rename	, 2)
2085 	MIPS_SYS(sys_mkdir	, 2)
2086 	MIPS_SYS(sys_rmdir	, 1)	/* 4040 */
2087 	MIPS_SYS(sys_dup		, 1)
2088 	MIPS_SYS(sys_pipe	, 0)
2089 	MIPS_SYS(sys_times	, 1)
2090 	MIPS_SYS(sys_ni_syscall	, 0)
2091 	MIPS_SYS(sys_brk		, 1)	/* 4045 */
2092 	MIPS_SYS(sys_setgid	, 1)
2093 	MIPS_SYS(sys_getgid	, 0)
2094 	MIPS_SYS(sys_ni_syscall	, 0)	/* was signal(2) */
2095 	MIPS_SYS(sys_geteuid	, 0)
2096 	MIPS_SYS(sys_getegid	, 0)	/* 4050 */
2097 	MIPS_SYS(sys_acct	, 0)
2098 	MIPS_SYS(sys_umount2	, 2)
2099 	MIPS_SYS(sys_ni_syscall	, 0)
2100 	MIPS_SYS(sys_ioctl	, 3)
2101 	MIPS_SYS(sys_fcntl	, 3)	/* 4055 */
2102 	MIPS_SYS(sys_ni_syscall	, 2)
2103 	MIPS_SYS(sys_setpgid	, 2)
2104 	MIPS_SYS(sys_ni_syscall	, 0)
2105 	MIPS_SYS(sys_olduname	, 1)
2106 	MIPS_SYS(sys_umask	, 1)	/* 4060 */
2107 	MIPS_SYS(sys_chroot	, 1)
2108 	MIPS_SYS(sys_ustat	, 2)
2109 	MIPS_SYS(sys_dup2	, 2)
2110 	MIPS_SYS(sys_getppid	, 0)
2111 	MIPS_SYS(sys_getpgrp	, 0)	/* 4065 */
2112 	MIPS_SYS(sys_setsid	, 0)
2113 	MIPS_SYS(sys_sigaction	, 3)
2114 	MIPS_SYS(sys_sgetmask	, 0)
2115 	MIPS_SYS(sys_ssetmask	, 1)
2116 	MIPS_SYS(sys_setreuid	, 2)	/* 4070 */
2117 	MIPS_SYS(sys_setregid	, 2)
2118 	MIPS_SYS(sys_sigsuspend	, 0)
2119 	MIPS_SYS(sys_sigpending	, 1)
2120 	MIPS_SYS(sys_sethostname	, 2)
2121 	MIPS_SYS(sys_setrlimit	, 2)	/* 4075 */
2122 	MIPS_SYS(sys_getrlimit	, 2)
2123 	MIPS_SYS(sys_getrusage	, 2)
2124 	MIPS_SYS(sys_gettimeofday, 2)
2125 	MIPS_SYS(sys_settimeofday, 2)
2126 	MIPS_SYS(sys_getgroups	, 2)	/* 4080 */
2127 	MIPS_SYS(sys_setgroups	, 2)
2128 	MIPS_SYS(sys_ni_syscall	, 0)	/* old_select */
2129 	MIPS_SYS(sys_symlink	, 2)
2130 	MIPS_SYS(sys_ni_syscall	, 0)	/* was sys_lstat */
2131 	MIPS_SYS(sys_readlink	, 3)	/* 4085 */
2132 	MIPS_SYS(sys_uselib	, 1)
2133 	MIPS_SYS(sys_swapon	, 2)
2134 	MIPS_SYS(sys_reboot	, 3)
2135 	MIPS_SYS(old_readdir	, 3)
2136 	MIPS_SYS(old_mmap	, 6)	/* 4090 */
2137 	MIPS_SYS(sys_munmap	, 2)
2138 	MIPS_SYS(sys_truncate	, 2)
2139 	MIPS_SYS(sys_ftruncate	, 2)
2140 	MIPS_SYS(sys_fchmod	, 2)
2141 	MIPS_SYS(sys_fchown	, 3)	/* 4095 */
2142 	MIPS_SYS(sys_getpriority	, 2)
2143 	MIPS_SYS(sys_setpriority	, 3)
2144 	MIPS_SYS(sys_ni_syscall	, 0)
2145 	MIPS_SYS(sys_statfs	, 2)
2146 	MIPS_SYS(sys_fstatfs	, 2)	/* 4100 */
2147 	MIPS_SYS(sys_ni_syscall	, 0)	/* was ioperm(2) */
2148 	MIPS_SYS(sys_socketcall	, 2)
2149 	MIPS_SYS(sys_syslog	, 3)
2150 	MIPS_SYS(sys_setitimer	, 3)
2151 	MIPS_SYS(sys_getitimer	, 2)	/* 4105 */
2152 	MIPS_SYS(sys_newstat	, 2)
2153 	MIPS_SYS(sys_newlstat	, 2)
2154 	MIPS_SYS(sys_newfstat	, 2)
2155 	MIPS_SYS(sys_uname	, 1)
2156 	MIPS_SYS(sys_ni_syscall	, 0)	/* 4110 was iopl(2) */
2157 	MIPS_SYS(sys_vhangup	, 0)
2158 	MIPS_SYS(sys_ni_syscall	, 0)	/* was sys_idle() */
2159 	MIPS_SYS(sys_ni_syscall	, 0)	/* was sys_vm86 */
2160 	MIPS_SYS(sys_wait4	, 4)
2161 	MIPS_SYS(sys_swapoff	, 1)	/* 4115 */
2162 	MIPS_SYS(sys_sysinfo	, 1)
2163 	MIPS_SYS(sys_ipc		, 6)
2164 	MIPS_SYS(sys_fsync	, 1)
2165 	MIPS_SYS(sys_sigreturn	, 0)
2166 	MIPS_SYS(sys_clone	, 6)	/* 4120 */
2167 	MIPS_SYS(sys_setdomainname, 2)
2168 	MIPS_SYS(sys_newuname	, 1)
2169 	MIPS_SYS(sys_ni_syscall	, 0)	/* sys_modify_ldt */
2170 	MIPS_SYS(sys_adjtimex	, 1)
2171 	MIPS_SYS(sys_mprotect	, 3)	/* 4125 */
2172 	MIPS_SYS(sys_sigprocmask	, 3)
2173 	MIPS_SYS(sys_ni_syscall	, 0)	/* was create_module */
2174 	MIPS_SYS(sys_init_module	, 5)
2175 	MIPS_SYS(sys_delete_module, 1)
2176 	MIPS_SYS(sys_ni_syscall	, 0)	/* 4130	was get_kernel_syms */
2177 	MIPS_SYS(sys_quotactl	, 0)
2178 	MIPS_SYS(sys_getpgid	, 1)
2179 	MIPS_SYS(sys_fchdir	, 1)
2180 	MIPS_SYS(sys_bdflush	, 2)
2181 	MIPS_SYS(sys_sysfs	, 3)	/* 4135 */
2182 	MIPS_SYS(sys_personality	, 1)
2183 	MIPS_SYS(sys_ni_syscall	, 0)	/* for afs_syscall */
2184 	MIPS_SYS(sys_setfsuid	, 1)
2185 	MIPS_SYS(sys_setfsgid	, 1)
2186 	MIPS_SYS(sys_llseek	, 5)	/* 4140 */
2187 	MIPS_SYS(sys_getdents	, 3)
2188 	MIPS_SYS(sys_select	, 5)
2189 	MIPS_SYS(sys_flock	, 2)
2190 	MIPS_SYS(sys_msync	, 3)
2191 	MIPS_SYS(sys_readv	, 3)	/* 4145 */
2192 	MIPS_SYS(sys_writev	, 3)
2193 	MIPS_SYS(sys_cacheflush	, 3)
2194 	MIPS_SYS(sys_cachectl	, 3)
2195 	MIPS_SYS(sys_sysmips	, 4)
2196 	MIPS_SYS(sys_ni_syscall	, 0)	/* 4150 */
2197 	MIPS_SYS(sys_getsid	, 1)
2198 	MIPS_SYS(sys_fdatasync	, 0)
2199 	MIPS_SYS(sys_sysctl	, 1)
2200 	MIPS_SYS(sys_mlock	, 2)
2201 	MIPS_SYS(sys_munlock	, 2)	/* 4155 */
2202 	MIPS_SYS(sys_mlockall	, 1)
2203 	MIPS_SYS(sys_munlockall	, 0)
2204 	MIPS_SYS(sys_sched_setparam, 2)
2205 	MIPS_SYS(sys_sched_getparam, 2)
2206 	MIPS_SYS(sys_sched_setscheduler, 3)	/* 4160 */
2207 	MIPS_SYS(sys_sched_getscheduler, 1)
2208 	MIPS_SYS(sys_sched_yield	, 0)
2209 	MIPS_SYS(sys_sched_get_priority_max, 1)
2210 	MIPS_SYS(sys_sched_get_priority_min, 1)
2211 	MIPS_SYS(sys_sched_rr_get_interval, 2)	/* 4165 */
2212 	MIPS_SYS(sys_nanosleep,	2)
2213 	MIPS_SYS(sys_mremap	, 5)
2214 	MIPS_SYS(sys_accept	, 3)
2215 	MIPS_SYS(sys_bind	, 3)
2216 	MIPS_SYS(sys_connect	, 3)	/* 4170 */
2217 	MIPS_SYS(sys_getpeername	, 3)
2218 	MIPS_SYS(sys_getsockname	, 3)
2219 	MIPS_SYS(sys_getsockopt	, 5)
2220 	MIPS_SYS(sys_listen	, 2)
2221 	MIPS_SYS(sys_recv	, 4)	/* 4175 */
2222 	MIPS_SYS(sys_recvfrom	, 6)
2223 	MIPS_SYS(sys_recvmsg	, 3)
2224 	MIPS_SYS(sys_send	, 4)
2225 	MIPS_SYS(sys_sendmsg	, 3)
2226 	MIPS_SYS(sys_sendto	, 6)	/* 4180 */
2227 	MIPS_SYS(sys_setsockopt	, 5)
2228 	MIPS_SYS(sys_shutdown	, 2)
2229 	MIPS_SYS(sys_socket	, 3)
2230 	MIPS_SYS(sys_socketpair	, 4)
2231 	MIPS_SYS(sys_setresuid	, 3)	/* 4185 */
2232 	MIPS_SYS(sys_getresuid	, 3)
2233 	MIPS_SYS(sys_ni_syscall	, 0)	/* was sys_query_module */
2234 	MIPS_SYS(sys_poll	, 3)
2235 	MIPS_SYS(sys_nfsservctl	, 3)
2236 	MIPS_SYS(sys_setresgid	, 3)	/* 4190 */
2237 	MIPS_SYS(sys_getresgid	, 3)
2238 	MIPS_SYS(sys_prctl	, 5)
2239 	MIPS_SYS(sys_rt_sigreturn, 0)
2240 	MIPS_SYS(sys_rt_sigaction, 4)
2241 	MIPS_SYS(sys_rt_sigprocmask, 4)	/* 4195 */
2242 	MIPS_SYS(sys_rt_sigpending, 2)
2243 	MIPS_SYS(sys_rt_sigtimedwait, 4)
2244 	MIPS_SYS(sys_rt_sigqueueinfo, 3)
2245 	MIPS_SYS(sys_rt_sigsuspend, 0)
2246 	MIPS_SYS(sys_pread64	, 6)	/* 4200 */
2247 	MIPS_SYS(sys_pwrite64	, 6)
2248 	MIPS_SYS(sys_chown	, 3)
2249 	MIPS_SYS(sys_getcwd	, 2)
2250 	MIPS_SYS(sys_capget	, 2)
2251 	MIPS_SYS(sys_capset	, 2)	/* 4205 */
2252 	MIPS_SYS(sys_sigaltstack	, 2)
2253 	MIPS_SYS(sys_sendfile	, 4)
2254 	MIPS_SYS(sys_ni_syscall	, 0)
2255 	MIPS_SYS(sys_ni_syscall	, 0)
2256 	MIPS_SYS(sys_mmap2	, 6)	/* 4210 */
2257 	MIPS_SYS(sys_truncate64	, 4)
2258 	MIPS_SYS(sys_ftruncate64	, 4)
2259 	MIPS_SYS(sys_stat64	, 2)
2260 	MIPS_SYS(sys_lstat64	, 2)
2261 	MIPS_SYS(sys_fstat64	, 2)	/* 4215 */
2262 	MIPS_SYS(sys_pivot_root	, 2)
2263 	MIPS_SYS(sys_mincore	, 3)
2264 	MIPS_SYS(sys_madvise	, 3)
2265 	MIPS_SYS(sys_getdents64	, 3)
2266 	MIPS_SYS(sys_fcntl64	, 3)	/* 4220 */
2267 	MIPS_SYS(sys_ni_syscall	, 0)
2268 	MIPS_SYS(sys_gettid	, 0)
2269 	MIPS_SYS(sys_readahead	, 5)
2270 	MIPS_SYS(sys_setxattr	, 5)
2271 	MIPS_SYS(sys_lsetxattr	, 5)	/* 4225 */
2272 	MIPS_SYS(sys_fsetxattr	, 5)
2273 	MIPS_SYS(sys_getxattr	, 4)
2274 	MIPS_SYS(sys_lgetxattr	, 4)
2275 	MIPS_SYS(sys_fgetxattr	, 4)
2276 	MIPS_SYS(sys_listxattr	, 3)	/* 4230 */
2277 	MIPS_SYS(sys_llistxattr	, 3)
2278 	MIPS_SYS(sys_flistxattr	, 3)
2279 	MIPS_SYS(sys_removexattr	, 2)
2280 	MIPS_SYS(sys_lremovexattr, 2)
2281 	MIPS_SYS(sys_fremovexattr, 2)	/* 4235 */
2282 	MIPS_SYS(sys_tkill	, 2)
2283 	MIPS_SYS(sys_sendfile64	, 5)
2284 	MIPS_SYS(sys_futex	, 6)
2285 	MIPS_SYS(sys_sched_setaffinity, 3)
2286 	MIPS_SYS(sys_sched_getaffinity, 3)	/* 4240 */
2287 	MIPS_SYS(sys_io_setup	, 2)
2288 	MIPS_SYS(sys_io_destroy	, 1)
2289 	MIPS_SYS(sys_io_getevents, 5)
2290 	MIPS_SYS(sys_io_submit	, 3)
2291 	MIPS_SYS(sys_io_cancel	, 3)	/* 4245 */
2292 	MIPS_SYS(sys_exit_group	, 1)
2293 	MIPS_SYS(sys_lookup_dcookie, 3)
2294 	MIPS_SYS(sys_epoll_create, 1)
2295 	MIPS_SYS(sys_epoll_ctl	, 4)
2296 	MIPS_SYS(sys_epoll_wait	, 3)	/* 4250 */
2297 	MIPS_SYS(sys_remap_file_pages, 5)
2298 	MIPS_SYS(sys_set_tid_address, 1)
2299 	MIPS_SYS(sys_restart_syscall, 0)
2300 	MIPS_SYS(sys_fadvise64_64, 7)
2301 	MIPS_SYS(sys_statfs64	, 3)	/* 4255 */
2302 	MIPS_SYS(sys_fstatfs64	, 2)
2303 	MIPS_SYS(sys_timer_create, 3)
2304 	MIPS_SYS(sys_timer_settime, 4)
2305 	MIPS_SYS(sys_timer_gettime, 2)
2306 	MIPS_SYS(sys_timer_getoverrun, 1)	/* 4260 */
2307 	MIPS_SYS(sys_timer_delete, 1)
2308 	MIPS_SYS(sys_clock_settime, 2)
2309 	MIPS_SYS(sys_clock_gettime, 2)
2310 	MIPS_SYS(sys_clock_getres, 2)
2311 	MIPS_SYS(sys_clock_nanosleep, 4)	/* 4265 */
2312 	MIPS_SYS(sys_tgkill	, 3)
2313 	MIPS_SYS(sys_utimes	, 2)
2314 	MIPS_SYS(sys_mbind	, 4)
2315 	MIPS_SYS(sys_ni_syscall	, 0)	/* sys_get_mempolicy */
2316 	MIPS_SYS(sys_ni_syscall	, 0)	/* 4270 sys_set_mempolicy */
2317 	MIPS_SYS(sys_mq_open	, 4)
2318 	MIPS_SYS(sys_mq_unlink	, 1)
2319 	MIPS_SYS(sys_mq_timedsend, 5)
2320 	MIPS_SYS(sys_mq_timedreceive, 5)
2321 	MIPS_SYS(sys_mq_notify	, 2)	/* 4275 */
2322 	MIPS_SYS(sys_mq_getsetattr, 3)
2323 	MIPS_SYS(sys_ni_syscall	, 0)	/* sys_vserver */
2324 	MIPS_SYS(sys_waitid	, 4)
2325 	MIPS_SYS(sys_ni_syscall	, 0)	/* available, was setaltroot */
2326 	MIPS_SYS(sys_add_key	, 5)
2327 	MIPS_SYS(sys_request_key, 4)
2328 	MIPS_SYS(sys_keyctl	, 5)
2329 	MIPS_SYS(sys_set_thread_area, 1)
2330 	MIPS_SYS(sys_inotify_init, 0)
2331 	MIPS_SYS(sys_inotify_add_watch, 3) /* 4285 */
2332 	MIPS_SYS(sys_inotify_rm_watch, 2)
2333 	MIPS_SYS(sys_migrate_pages, 4)
2334 	MIPS_SYS(sys_openat, 4)
2335 	MIPS_SYS(sys_mkdirat, 3)
2336 	MIPS_SYS(sys_mknodat, 4)	/* 4290 */
2337 	MIPS_SYS(sys_fchownat, 5)
2338 	MIPS_SYS(sys_futimesat, 3)
2339 	MIPS_SYS(sys_fstatat64, 4)
2340 	MIPS_SYS(sys_unlinkat, 3)
2341 	MIPS_SYS(sys_renameat, 4)	/* 4295 */
2342 	MIPS_SYS(sys_linkat, 5)
2343 	MIPS_SYS(sys_symlinkat, 3)
2344 	MIPS_SYS(sys_readlinkat, 4)
2345 	MIPS_SYS(sys_fchmodat, 3)
2346 	MIPS_SYS(sys_faccessat, 3)	/* 4300 */
2347 	MIPS_SYS(sys_pselect6, 6)
2348 	MIPS_SYS(sys_ppoll, 5)
2349 	MIPS_SYS(sys_unshare, 1)
2350 	MIPS_SYS(sys_splice, 6)
2351 	MIPS_SYS(sys_sync_file_range, 7) /* 4305 */
2352 	MIPS_SYS(sys_tee, 4)
2353 	MIPS_SYS(sys_vmsplice, 4)
2354 	MIPS_SYS(sys_move_pages, 6)
2355 	MIPS_SYS(sys_set_robust_list, 2)
2356 	MIPS_SYS(sys_get_robust_list, 3) /* 4310 */
2357 	MIPS_SYS(sys_kexec_load, 4)
2358 	MIPS_SYS(sys_getcpu, 3)
2359 	MIPS_SYS(sys_epoll_pwait, 6)
2360 	MIPS_SYS(sys_ioprio_set, 3)
2361 	MIPS_SYS(sys_ioprio_get, 2)
2362         MIPS_SYS(sys_utimensat, 4)
2363         MIPS_SYS(sys_signalfd, 3)
2364         MIPS_SYS(sys_ni_syscall, 0)     /* was timerfd */
2365         MIPS_SYS(sys_eventfd, 1)
2366         MIPS_SYS(sys_fallocate, 6)      /* 4320 */
2367         MIPS_SYS(sys_timerfd_create, 2)
2368         MIPS_SYS(sys_timerfd_gettime, 2)
2369         MIPS_SYS(sys_timerfd_settime, 4)
2370         MIPS_SYS(sys_signalfd4, 4)
2371         MIPS_SYS(sys_eventfd2, 2)       /* 4325 */
2372         MIPS_SYS(sys_epoll_create1, 1)
2373         MIPS_SYS(sys_dup3, 3)
2374         MIPS_SYS(sys_pipe2, 2)
2375         MIPS_SYS(sys_inotify_init1, 1)
2376         MIPS_SYS(sys_preadv, 6)         /* 4330 */
2377         MIPS_SYS(sys_pwritev, 6)
2378         MIPS_SYS(sys_rt_tgsigqueueinfo, 4)
2379         MIPS_SYS(sys_perf_event_open, 5)
2380         MIPS_SYS(sys_accept4, 4)
2381         MIPS_SYS(sys_recvmmsg, 5)       /* 4335 */
2382         MIPS_SYS(sys_fanotify_init, 2)
2383         MIPS_SYS(sys_fanotify_mark, 6)
2384         MIPS_SYS(sys_prlimit64, 4)
2385         MIPS_SYS(sys_name_to_handle_at, 5)
2386         MIPS_SYS(sys_open_by_handle_at, 3) /* 4340 */
2387         MIPS_SYS(sys_clock_adjtime, 2)
2388         MIPS_SYS(sys_syncfs, 1)
2389 };
2390 #  undef MIPS_SYS
2391 # endif /* O32 */
2392 
2393 static int do_store_exclusive(CPUMIPSState *env)
2394 {
2395     target_ulong addr;
2396     target_ulong page_addr;
2397     target_ulong val;
2398     int flags;
2399     int segv = 0;
2400     int reg;
2401     int d;
2402 
2403     addr = env->lladdr;
2404     page_addr = addr & TARGET_PAGE_MASK;
2405     start_exclusive();
2406     mmap_lock();
2407     flags = page_get_flags(page_addr);
2408     if ((flags & PAGE_READ) == 0) {
2409         segv = 1;
2410     } else {
2411         reg = env->llreg & 0x1f;
2412         d = (env->llreg & 0x20) != 0;
2413         if (d) {
2414             segv = get_user_s64(val, addr);
2415         } else {
2416             segv = get_user_s32(val, addr);
2417         }
2418         if (!segv) {
2419             if (val != env->llval) {
2420                 env->active_tc.gpr[reg] = 0;
2421             } else {
2422                 if (d) {
2423                     segv = put_user_u64(env->llnewval, addr);
2424                 } else {
2425                     segv = put_user_u32(env->llnewval, addr);
2426                 }
2427                 if (!segv) {
2428                     env->active_tc.gpr[reg] = 1;
2429                 }
2430             }
2431         }
2432     }
2433     env->lladdr = -1;
2434     if (!segv) {
2435         env->active_tc.PC += 4;
2436     }
2437     mmap_unlock();
2438     end_exclusive();
2439     return segv;
2440 }
2441 
2442 /* Break codes */
2443 enum {
2444     BRK_OVERFLOW = 6,
2445     BRK_DIVZERO = 7
2446 };
2447 
2448 static int do_break(CPUMIPSState *env, target_siginfo_t *info,
2449                     unsigned int code)
2450 {
2451     int ret = -1;
2452 
2453     switch (code) {
2454     case BRK_OVERFLOW:
2455     case BRK_DIVZERO:
2456         info->si_signo = TARGET_SIGFPE;
2457         info->si_errno = 0;
2458         info->si_code = (code == BRK_OVERFLOW) ? FPE_INTOVF : FPE_INTDIV;
2459         queue_signal(env, info->si_signo, QEMU_SI_FAULT, &*info);
2460         ret = 0;
2461         break;
2462     default:
2463         info->si_signo = TARGET_SIGTRAP;
2464         info->si_errno = 0;
2465         queue_signal(env, info->si_signo, QEMU_SI_FAULT, &*info);
2466         ret = 0;
2467         break;
2468     }
2469 
2470     return ret;
2471 }
2472 
2473 void cpu_loop(CPUMIPSState *env)
2474 {
2475     CPUState *cs = CPU(mips_env_get_cpu(env));
2476     target_siginfo_t info;
2477     int trapnr;
2478     abi_long ret;
2479 # ifdef TARGET_ABI_MIPSO32
2480     unsigned int syscall_num;
2481 # endif
2482 
2483     for(;;) {
2484         cpu_exec_start(cs);
2485         trapnr = cpu_exec(cs);
2486         cpu_exec_end(cs);
2487         switch(trapnr) {
2488         case EXCP_SYSCALL:
2489             env->active_tc.PC += 4;
2490 # ifdef TARGET_ABI_MIPSO32
2491             syscall_num = env->active_tc.gpr[2] - 4000;
2492             if (syscall_num >= sizeof(mips_syscall_args)) {
2493                 ret = -TARGET_ENOSYS;
2494             } else {
2495                 int nb_args;
2496                 abi_ulong sp_reg;
2497                 abi_ulong arg5 = 0, arg6 = 0, arg7 = 0, arg8 = 0;
2498 
2499                 nb_args = mips_syscall_args[syscall_num];
2500                 sp_reg = env->active_tc.gpr[29];
2501                 switch (nb_args) {
2502                 /* these arguments are taken from the stack */
2503                 case 8:
2504                     if ((ret = get_user_ual(arg8, sp_reg + 28)) != 0) {
2505                         goto done_syscall;
2506                     }
2507                 case 7:
2508                     if ((ret = get_user_ual(arg7, sp_reg + 24)) != 0) {
2509                         goto done_syscall;
2510                     }
2511                 case 6:
2512                     if ((ret = get_user_ual(arg6, sp_reg + 20)) != 0) {
2513                         goto done_syscall;
2514                     }
2515                 case 5:
2516                     if ((ret = get_user_ual(arg5, sp_reg + 16)) != 0) {
2517                         goto done_syscall;
2518                     }
2519                 default:
2520                     break;
2521                 }
2522                 ret = do_syscall(env, env->active_tc.gpr[2],
2523                                  env->active_tc.gpr[4],
2524                                  env->active_tc.gpr[5],
2525                                  env->active_tc.gpr[6],
2526                                  env->active_tc.gpr[7],
2527                                  arg5, arg6, arg7, arg8);
2528             }
2529 done_syscall:
2530 # else
2531             ret = do_syscall(env, env->active_tc.gpr[2],
2532                              env->active_tc.gpr[4], env->active_tc.gpr[5],
2533                              env->active_tc.gpr[6], env->active_tc.gpr[7],
2534                              env->active_tc.gpr[8], env->active_tc.gpr[9],
2535                              env->active_tc.gpr[10], env->active_tc.gpr[11]);
2536 # endif /* O32 */
2537             if (ret == -TARGET_ERESTARTSYS) {
2538                 env->active_tc.PC -= 4;
2539                 break;
2540             }
2541             if (ret == -TARGET_QEMU_ESIGRETURN) {
2542                 /* Returning from a successful sigreturn syscall.
2543                    Avoid clobbering register state.  */
2544                 break;
2545             }
2546             if ((abi_ulong)ret >= (abi_ulong)-1133) {
2547                 env->active_tc.gpr[7] = 1; /* error flag */
2548                 ret = -ret;
2549             } else {
2550                 env->active_tc.gpr[7] = 0; /* error flag */
2551             }
2552             env->active_tc.gpr[2] = ret;
2553             break;
2554         case EXCP_TLBL:
2555         case EXCP_TLBS:
2556         case EXCP_AdEL:
2557         case EXCP_AdES:
2558             info.si_signo = TARGET_SIGSEGV;
2559             info.si_errno = 0;
2560             /* XXX: check env->error_code */
2561             info.si_code = TARGET_SEGV_MAPERR;
2562             info._sifields._sigfault._addr = env->CP0_BadVAddr;
2563             queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
2564             break;
2565         case EXCP_CpU:
2566         case EXCP_RI:
2567             info.si_signo = TARGET_SIGILL;
2568             info.si_errno = 0;
2569             info.si_code = 0;
2570             queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
2571             break;
2572         case EXCP_INTERRUPT:
2573             /* just indicate that signals should be handled asap */
2574             break;
2575         case EXCP_DEBUG:
2576             {
2577                 int sig;
2578 
2579                 sig = gdb_handlesig(cs, TARGET_SIGTRAP);
2580                 if (sig)
2581                   {
2582                     info.si_signo = sig;
2583                     info.si_errno = 0;
2584                     info.si_code = TARGET_TRAP_BRKPT;
2585                     queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
2586                   }
2587             }
2588             break;
2589         case EXCP_SC:
2590             if (do_store_exclusive(env)) {
2591                 info.si_signo = TARGET_SIGSEGV;
2592                 info.si_errno = 0;
2593                 info.si_code = TARGET_SEGV_MAPERR;
2594                 info._sifields._sigfault._addr = env->active_tc.PC;
2595                 queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
2596             }
2597             break;
2598         case EXCP_DSPDIS:
2599             info.si_signo = TARGET_SIGILL;
2600             info.si_errno = 0;
2601             info.si_code = TARGET_ILL_ILLOPC;
2602             queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
2603             break;
2604         /* The code below was inspired by the MIPS Linux kernel trap
2605          * handling code in arch/mips/kernel/traps.c.
2606          */
2607         case EXCP_BREAK:
2608             {
2609                 abi_ulong trap_instr;
2610                 unsigned int code;
2611 
2612                 if (env->hflags & MIPS_HFLAG_M16) {
2613                     if (env->insn_flags & ASE_MICROMIPS) {
2614                         /* microMIPS mode */
2615                         ret = get_user_u16(trap_instr, env->active_tc.PC);
2616                         if (ret != 0) {
2617                             goto error;
2618                         }
2619 
2620                         if ((trap_instr >> 10) == 0x11) {
2621                             /* 16-bit instruction */
2622                             code = trap_instr & 0xf;
2623                         } else {
2624                             /* 32-bit instruction */
2625                             abi_ulong instr_lo;
2626 
2627                             ret = get_user_u16(instr_lo,
2628                                                env->active_tc.PC + 2);
2629                             if (ret != 0) {
2630                                 goto error;
2631                             }
2632                             trap_instr = (trap_instr << 16) | instr_lo;
2633                             code = ((trap_instr >> 6) & ((1 << 20) - 1));
2634                             /* Unfortunately, microMIPS also suffers from
2635                                the old assembler bug...  */
2636                             if (code >= (1 << 10)) {
2637                                 code >>= 10;
2638                             }
2639                         }
2640                     } else {
2641                         /* MIPS16e mode */
2642                         ret = get_user_u16(trap_instr, env->active_tc.PC);
2643                         if (ret != 0) {
2644                             goto error;
2645                         }
2646                         code = (trap_instr >> 6) & 0x3f;
2647                     }
2648                 } else {
2649                     ret = get_user_u32(trap_instr, env->active_tc.PC);
2650                     if (ret != 0) {
2651                         goto error;
2652                     }
2653 
2654                     /* As described in the original Linux kernel code, the
2655                      * below checks on 'code' are to work around an old
2656                      * assembly bug.
2657                      */
2658                     code = ((trap_instr >> 6) & ((1 << 20) - 1));
2659                     if (code >= (1 << 10)) {
2660                         code >>= 10;
2661                     }
2662                 }
2663 
2664                 if (do_break(env, &info, code) != 0) {
2665                     goto error;
2666                 }
2667             }
2668             break;
2669         case EXCP_TRAP:
2670             {
2671                 abi_ulong trap_instr;
2672                 unsigned int code = 0;
2673 
2674                 if (env->hflags & MIPS_HFLAG_M16) {
2675                     /* microMIPS mode */
2676                     abi_ulong instr[2];
2677 
2678                     ret = get_user_u16(instr[0], env->active_tc.PC) ||
2679                           get_user_u16(instr[1], env->active_tc.PC + 2);
2680 
2681                     trap_instr = (instr[0] << 16) | instr[1];
2682                 } else {
2683                     ret = get_user_u32(trap_instr, env->active_tc.PC);
2684                 }
2685 
2686                 if (ret != 0) {
2687                     goto error;
2688                 }
2689 
2690                 /* The immediate versions don't provide a code.  */
2691                 if (!(trap_instr & 0xFC000000)) {
2692                     if (env->hflags & MIPS_HFLAG_M16) {
2693                         /* microMIPS mode */
2694                         code = ((trap_instr >> 12) & ((1 << 4) - 1));
2695                     } else {
2696                         code = ((trap_instr >> 6) & ((1 << 10) - 1));
2697                     }
2698                 }
2699 
2700                 if (do_break(env, &info, code) != 0) {
2701                     goto error;
2702                 }
2703             }
2704             break;
2705         default:
2706 error:
2707             EXCP_DUMP(env, "qemu: unhandled CPU exception 0x%x - aborting\n", trapnr);
2708             abort();
2709         }
2710         process_pending_signals(env);
2711     }
2712 }
2713 #endif
2714 
2715 #ifdef TARGET_OPENRISC
2716 
2717 void cpu_loop(CPUOpenRISCState *env)
2718 {
2719     CPUState *cs = CPU(openrisc_env_get_cpu(env));
2720     int trapnr, gdbsig;
2721     abi_long ret;
2722 
2723     for (;;) {
2724         cpu_exec_start(cs);
2725         trapnr = cpu_exec(cs);
2726         cpu_exec_end(cs);
2727         gdbsig = 0;
2728 
2729         switch (trapnr) {
2730         case EXCP_RESET:
2731             qemu_log_mask(CPU_LOG_INT, "\nReset request, exit, pc is %#x\n", env->pc);
2732             exit(EXIT_FAILURE);
2733             break;
2734         case EXCP_BUSERR:
2735             qemu_log_mask(CPU_LOG_INT, "\nBus error, exit, pc is %#x\n", env->pc);
2736             gdbsig = TARGET_SIGBUS;
2737             break;
2738         case EXCP_DPF:
2739         case EXCP_IPF:
2740             cpu_dump_state(cs, stderr, fprintf, 0);
2741             gdbsig = TARGET_SIGSEGV;
2742             break;
2743         case EXCP_TICK:
2744             qemu_log_mask(CPU_LOG_INT, "\nTick time interrupt pc is %#x\n", env->pc);
2745             break;
2746         case EXCP_ALIGN:
2747             qemu_log_mask(CPU_LOG_INT, "\nAlignment pc is %#x\n", env->pc);
2748             gdbsig = TARGET_SIGBUS;
2749             break;
2750         case EXCP_ILLEGAL:
2751             qemu_log_mask(CPU_LOG_INT, "\nIllegal instructionpc is %#x\n", env->pc);
2752             gdbsig = TARGET_SIGILL;
2753             break;
2754         case EXCP_INT:
2755             qemu_log_mask(CPU_LOG_INT, "\nExternal interruptpc is %#x\n", env->pc);
2756             break;
2757         case EXCP_DTLBMISS:
2758         case EXCP_ITLBMISS:
2759             qemu_log_mask(CPU_LOG_INT, "\nTLB miss\n");
2760             break;
2761         case EXCP_RANGE:
2762             qemu_log_mask(CPU_LOG_INT, "\nRange\n");
2763             gdbsig = TARGET_SIGSEGV;
2764             break;
2765         case EXCP_SYSCALL:
2766             env->pc += 4;   /* 0xc00; */
2767             ret = do_syscall(env,
2768                              env->gpr[11], /* return value       */
2769                              env->gpr[3],  /* r3 - r7 are params */
2770                              env->gpr[4],
2771                              env->gpr[5],
2772                              env->gpr[6],
2773                              env->gpr[7],
2774                              env->gpr[8], 0, 0);
2775             if (ret == -TARGET_ERESTARTSYS) {
2776                 env->pc -= 4;
2777             } else if (ret != -TARGET_QEMU_ESIGRETURN) {
2778                 env->gpr[11] = ret;
2779             }
2780             break;
2781         case EXCP_FPE:
2782             qemu_log_mask(CPU_LOG_INT, "\nFloating point error\n");
2783             break;
2784         case EXCP_TRAP:
2785             qemu_log_mask(CPU_LOG_INT, "\nTrap\n");
2786             gdbsig = TARGET_SIGTRAP;
2787             break;
2788         case EXCP_NR:
2789             qemu_log_mask(CPU_LOG_INT, "\nNR\n");
2790             break;
2791         default:
2792             EXCP_DUMP(env, "\nqemu: unhandled CPU exception %#x - aborting\n",
2793                      trapnr);
2794             gdbsig = TARGET_SIGILL;
2795             break;
2796         }
2797         if (gdbsig) {
2798             gdb_handlesig(cs, gdbsig);
2799             if (gdbsig != TARGET_SIGTRAP) {
2800                 exit(EXIT_FAILURE);
2801             }
2802         }
2803 
2804         process_pending_signals(env);
2805     }
2806 }
2807 
2808 #endif /* TARGET_OPENRISC */
2809 
2810 #ifdef TARGET_SH4
2811 void cpu_loop(CPUSH4State *env)
2812 {
2813     CPUState *cs = CPU(sh_env_get_cpu(env));
2814     int trapnr, ret;
2815     target_siginfo_t info;
2816 
2817     while (1) {
2818         cpu_exec_start(cs);
2819         trapnr = cpu_exec(cs);
2820         cpu_exec_end(cs);
2821 
2822         switch (trapnr) {
2823         case 0x160:
2824             env->pc += 2;
2825             ret = do_syscall(env,
2826                              env->gregs[3],
2827                              env->gregs[4],
2828                              env->gregs[5],
2829                              env->gregs[6],
2830                              env->gregs[7],
2831                              env->gregs[0],
2832                              env->gregs[1],
2833                              0, 0);
2834             if (ret == -TARGET_ERESTARTSYS) {
2835                 env->pc -= 2;
2836             } else if (ret != -TARGET_QEMU_ESIGRETURN) {
2837                 env->gregs[0] = ret;
2838             }
2839             break;
2840         case EXCP_INTERRUPT:
2841             /* just indicate that signals should be handled asap */
2842             break;
2843         case EXCP_DEBUG:
2844             {
2845                 int sig;
2846 
2847                 sig = gdb_handlesig(cs, TARGET_SIGTRAP);
2848                 if (sig)
2849                   {
2850                     info.si_signo = sig;
2851                     info.si_errno = 0;
2852                     info.si_code = TARGET_TRAP_BRKPT;
2853                     queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
2854                   }
2855             }
2856             break;
2857 	case 0xa0:
2858 	case 0xc0:
2859             info.si_signo = TARGET_SIGSEGV;
2860             info.si_errno = 0;
2861             info.si_code = TARGET_SEGV_MAPERR;
2862             info._sifields._sigfault._addr = env->tea;
2863             queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
2864 	    break;
2865 
2866         default:
2867             printf ("Unhandled trap: 0x%x\n", trapnr);
2868             cpu_dump_state(cs, stderr, fprintf, 0);
2869             exit(EXIT_FAILURE);
2870         }
2871         process_pending_signals (env);
2872     }
2873 }
2874 #endif
2875 
2876 #ifdef TARGET_CRIS
2877 void cpu_loop(CPUCRISState *env)
2878 {
2879     CPUState *cs = CPU(cris_env_get_cpu(env));
2880     int trapnr, ret;
2881     target_siginfo_t info;
2882 
2883     while (1) {
2884         cpu_exec_start(cs);
2885         trapnr = cpu_exec(cs);
2886         cpu_exec_end(cs);
2887         switch (trapnr) {
2888         case 0xaa:
2889             {
2890                 info.si_signo = TARGET_SIGSEGV;
2891                 info.si_errno = 0;
2892                 /* XXX: check env->error_code */
2893                 info.si_code = TARGET_SEGV_MAPERR;
2894                 info._sifields._sigfault._addr = env->pregs[PR_EDA];
2895                 queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
2896             }
2897             break;
2898 	case EXCP_INTERRUPT:
2899 	  /* just indicate that signals should be handled asap */
2900 	  break;
2901         case EXCP_BREAK:
2902             ret = do_syscall(env,
2903                              env->regs[9],
2904                              env->regs[10],
2905                              env->regs[11],
2906                              env->regs[12],
2907                              env->regs[13],
2908                              env->pregs[7],
2909                              env->pregs[11],
2910                              0, 0);
2911             if (ret == -TARGET_ERESTARTSYS) {
2912                 env->pc -= 2;
2913             } else if (ret != -TARGET_QEMU_ESIGRETURN) {
2914                 env->regs[10] = ret;
2915             }
2916             break;
2917         case EXCP_DEBUG:
2918             {
2919                 int sig;
2920 
2921                 sig = gdb_handlesig(cs, TARGET_SIGTRAP);
2922                 if (sig)
2923                   {
2924                     info.si_signo = sig;
2925                     info.si_errno = 0;
2926                     info.si_code = TARGET_TRAP_BRKPT;
2927                     queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
2928                   }
2929             }
2930             break;
2931         default:
2932             printf ("Unhandled trap: 0x%x\n", trapnr);
2933             cpu_dump_state(cs, stderr, fprintf, 0);
2934             exit(EXIT_FAILURE);
2935         }
2936         process_pending_signals (env);
2937     }
2938 }
2939 #endif
2940 
2941 #ifdef TARGET_MICROBLAZE
2942 void cpu_loop(CPUMBState *env)
2943 {
2944     CPUState *cs = CPU(mb_env_get_cpu(env));
2945     int trapnr, ret;
2946     target_siginfo_t info;
2947 
2948     while (1) {
2949         cpu_exec_start(cs);
2950         trapnr = cpu_exec(cs);
2951         cpu_exec_end(cs);
2952         switch (trapnr) {
2953         case 0xaa:
2954             {
2955                 info.si_signo = TARGET_SIGSEGV;
2956                 info.si_errno = 0;
2957                 /* XXX: check env->error_code */
2958                 info.si_code = TARGET_SEGV_MAPERR;
2959                 info._sifields._sigfault._addr = 0;
2960                 queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
2961             }
2962             break;
2963 	case EXCP_INTERRUPT:
2964 	  /* just indicate that signals should be handled asap */
2965 	  break;
2966         case EXCP_BREAK:
2967             /* Return address is 4 bytes after the call.  */
2968             env->regs[14] += 4;
2969             env->sregs[SR_PC] = env->regs[14];
2970             ret = do_syscall(env,
2971                              env->regs[12],
2972                              env->regs[5],
2973                              env->regs[6],
2974                              env->regs[7],
2975                              env->regs[8],
2976                              env->regs[9],
2977                              env->regs[10],
2978                              0, 0);
2979             if (ret == -TARGET_ERESTARTSYS) {
2980                 /* Wind back to before the syscall. */
2981                 env->sregs[SR_PC] -= 4;
2982             } else if (ret != -TARGET_QEMU_ESIGRETURN) {
2983                 env->regs[3] = ret;
2984             }
2985             /* All syscall exits result in guest r14 being equal to the
2986              * PC we return to, because the kernel syscall exit "rtbd" does
2987              * this. (This is true even for sigreturn(); note that r14 is
2988              * not a userspace-usable register, as the kernel may clobber it
2989              * at any point.)
2990              */
2991             env->regs[14] = env->sregs[SR_PC];
2992             break;
2993         case EXCP_HW_EXCP:
2994             env->regs[17] = env->sregs[SR_PC] + 4;
2995             if (env->iflags & D_FLAG) {
2996                 env->sregs[SR_ESR] |= 1 << 12;
2997                 env->sregs[SR_PC] -= 4;
2998                 /* FIXME: if branch was immed, replay the imm as well.  */
2999             }
3000 
3001             env->iflags &= ~(IMM_FLAG | D_FLAG);
3002 
3003             switch (env->sregs[SR_ESR] & 31) {
3004                 case ESR_EC_DIVZERO:
3005                     info.si_signo = TARGET_SIGFPE;
3006                     info.si_errno = 0;
3007                     info.si_code = TARGET_FPE_FLTDIV;
3008                     info._sifields._sigfault._addr = 0;
3009                     queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
3010                     break;
3011                 case ESR_EC_FPU:
3012                     info.si_signo = TARGET_SIGFPE;
3013                     info.si_errno = 0;
3014                     if (env->sregs[SR_FSR] & FSR_IO) {
3015                         info.si_code = TARGET_FPE_FLTINV;
3016                     }
3017                     if (env->sregs[SR_FSR] & FSR_DZ) {
3018                         info.si_code = TARGET_FPE_FLTDIV;
3019                     }
3020                     info._sifields._sigfault._addr = 0;
3021                     queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
3022                     break;
3023                 default:
3024                     printf ("Unhandled hw-exception: 0x%x\n",
3025                             env->sregs[SR_ESR] & ESR_EC_MASK);
3026                     cpu_dump_state(cs, stderr, fprintf, 0);
3027                     exit(EXIT_FAILURE);
3028                     break;
3029             }
3030             break;
3031         case EXCP_DEBUG:
3032             {
3033                 int sig;
3034 
3035                 sig = gdb_handlesig(cs, TARGET_SIGTRAP);
3036                 if (sig)
3037                   {
3038                     info.si_signo = sig;
3039                     info.si_errno = 0;
3040                     info.si_code = TARGET_TRAP_BRKPT;
3041                     queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
3042                   }
3043             }
3044             break;
3045         default:
3046             printf ("Unhandled trap: 0x%x\n", trapnr);
3047             cpu_dump_state(cs, stderr, fprintf, 0);
3048             exit(EXIT_FAILURE);
3049         }
3050         process_pending_signals (env);
3051     }
3052 }
3053 #endif
3054 
3055 #ifdef TARGET_M68K
3056 
3057 void cpu_loop(CPUM68KState *env)
3058 {
3059     CPUState *cs = CPU(m68k_env_get_cpu(env));
3060     int trapnr;
3061     unsigned int n;
3062     target_siginfo_t info;
3063     TaskState *ts = cs->opaque;
3064 
3065     for(;;) {
3066         cpu_exec_start(cs);
3067         trapnr = cpu_exec(cs);
3068         cpu_exec_end(cs);
3069         switch(trapnr) {
3070         case EXCP_ILLEGAL:
3071             {
3072                 if (ts->sim_syscalls) {
3073                     uint16_t nr;
3074                     get_user_u16(nr, env->pc + 2);
3075                     env->pc += 4;
3076                     do_m68k_simcall(env, nr);
3077                 } else {
3078                     goto do_sigill;
3079                 }
3080             }
3081             break;
3082         case EXCP_HALT_INSN:
3083             /* Semihosing syscall.  */
3084             env->pc += 4;
3085             do_m68k_semihosting(env, env->dregs[0]);
3086             break;
3087         case EXCP_LINEA:
3088         case EXCP_LINEF:
3089         case EXCP_UNSUPPORTED:
3090         do_sigill:
3091             info.si_signo = TARGET_SIGILL;
3092             info.si_errno = 0;
3093             info.si_code = TARGET_ILL_ILLOPN;
3094             info._sifields._sigfault._addr = env->pc;
3095             queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
3096             break;
3097         case EXCP_TRAP0:
3098             {
3099                 abi_long ret;
3100                 ts->sim_syscalls = 0;
3101                 n = env->dregs[0];
3102                 env->pc += 2;
3103                 ret = do_syscall(env,
3104                                  n,
3105                                  env->dregs[1],
3106                                  env->dregs[2],
3107                                  env->dregs[3],
3108                                  env->dregs[4],
3109                                  env->dregs[5],
3110                                  env->aregs[0],
3111                                  0, 0);
3112                 if (ret == -TARGET_ERESTARTSYS) {
3113                     env->pc -= 2;
3114                 } else if (ret != -TARGET_QEMU_ESIGRETURN) {
3115                     env->dregs[0] = ret;
3116                 }
3117             }
3118             break;
3119         case EXCP_INTERRUPT:
3120             /* just indicate that signals should be handled asap */
3121             break;
3122         case EXCP_ACCESS:
3123             {
3124                 info.si_signo = TARGET_SIGSEGV;
3125                 info.si_errno = 0;
3126                 /* XXX: check env->error_code */
3127                 info.si_code = TARGET_SEGV_MAPERR;
3128                 info._sifields._sigfault._addr = env->mmu.ar;
3129                 queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
3130             }
3131             break;
3132         case EXCP_DEBUG:
3133             {
3134                 int sig;
3135 
3136                 sig = gdb_handlesig(cs, TARGET_SIGTRAP);
3137                 if (sig)
3138                   {
3139                     info.si_signo = sig;
3140                     info.si_errno = 0;
3141                     info.si_code = TARGET_TRAP_BRKPT;
3142                     queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
3143                   }
3144             }
3145             break;
3146         default:
3147             EXCP_DUMP(env, "qemu: unhandled CPU exception 0x%x - aborting\n", trapnr);
3148             abort();
3149         }
3150         process_pending_signals(env);
3151     }
3152 }
3153 #endif /* TARGET_M68K */
3154 
3155 #ifdef TARGET_ALPHA
3156 static void do_store_exclusive(CPUAlphaState *env, int reg, int quad)
3157 {
3158     target_ulong addr, val, tmp;
3159     target_siginfo_t info;
3160     int ret = 0;
3161 
3162     addr = env->lock_addr;
3163     tmp = env->lock_st_addr;
3164     env->lock_addr = -1;
3165     env->lock_st_addr = 0;
3166 
3167     start_exclusive();
3168     mmap_lock();
3169 
3170     if (addr == tmp) {
3171         if (quad ? get_user_s64(val, addr) : get_user_s32(val, addr)) {
3172             goto do_sigsegv;
3173         }
3174 
3175         if (val == env->lock_value) {
3176             tmp = env->ir[reg];
3177             if (quad ? put_user_u64(tmp, addr) : put_user_u32(tmp, addr)) {
3178                 goto do_sigsegv;
3179             }
3180             ret = 1;
3181         }
3182     }
3183     env->ir[reg] = ret;
3184     env->pc += 4;
3185 
3186     mmap_unlock();
3187     end_exclusive();
3188     return;
3189 
3190  do_sigsegv:
3191     mmap_unlock();
3192     end_exclusive();
3193 
3194     info.si_signo = TARGET_SIGSEGV;
3195     info.si_errno = 0;
3196     info.si_code = TARGET_SEGV_MAPERR;
3197     info._sifields._sigfault._addr = addr;
3198     queue_signal(env, TARGET_SIGSEGV, QEMU_SI_FAULT, &info);
3199 }
3200 
3201 void cpu_loop(CPUAlphaState *env)
3202 {
3203     CPUState *cs = CPU(alpha_env_get_cpu(env));
3204     int trapnr;
3205     target_siginfo_t info;
3206     abi_long sysret;
3207 
3208     while (1) {
3209         cpu_exec_start(cs);
3210         trapnr = cpu_exec(cs);
3211         cpu_exec_end(cs);
3212 
3213         /* All of the traps imply a transition through PALcode, which
3214            implies an REI instruction has been executed.  Which means
3215            that the intr_flag should be cleared.  */
3216         env->intr_flag = 0;
3217 
3218         switch (trapnr) {
3219         case EXCP_RESET:
3220             fprintf(stderr, "Reset requested. Exit\n");
3221             exit(EXIT_FAILURE);
3222             break;
3223         case EXCP_MCHK:
3224             fprintf(stderr, "Machine check exception. Exit\n");
3225             exit(EXIT_FAILURE);
3226             break;
3227         case EXCP_SMP_INTERRUPT:
3228         case EXCP_CLK_INTERRUPT:
3229         case EXCP_DEV_INTERRUPT:
3230             fprintf(stderr, "External interrupt. Exit\n");
3231             exit(EXIT_FAILURE);
3232             break;
3233         case EXCP_MMFAULT:
3234             env->lock_addr = -1;
3235             info.si_signo = TARGET_SIGSEGV;
3236             info.si_errno = 0;
3237             info.si_code = (page_get_flags(env->trap_arg0) & PAGE_VALID
3238                             ? TARGET_SEGV_ACCERR : TARGET_SEGV_MAPERR);
3239             info._sifields._sigfault._addr = env->trap_arg0;
3240             queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
3241             break;
3242         case EXCP_UNALIGN:
3243             env->lock_addr = -1;
3244             info.si_signo = TARGET_SIGBUS;
3245             info.si_errno = 0;
3246             info.si_code = TARGET_BUS_ADRALN;
3247             info._sifields._sigfault._addr = env->trap_arg0;
3248             queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
3249             break;
3250         case EXCP_OPCDEC:
3251         do_sigill:
3252             env->lock_addr = -1;
3253             info.si_signo = TARGET_SIGILL;
3254             info.si_errno = 0;
3255             info.si_code = TARGET_ILL_ILLOPC;
3256             info._sifields._sigfault._addr = env->pc;
3257             queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
3258             break;
3259         case EXCP_ARITH:
3260             env->lock_addr = -1;
3261             info.si_signo = TARGET_SIGFPE;
3262             info.si_errno = 0;
3263             info.si_code = TARGET_FPE_FLTINV;
3264             info._sifields._sigfault._addr = env->pc;
3265             queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
3266             break;
3267         case EXCP_FEN:
3268             /* No-op.  Linux simply re-enables the FPU.  */
3269             break;
3270         case EXCP_CALL_PAL:
3271             env->lock_addr = -1;
3272             switch (env->error_code) {
3273             case 0x80:
3274                 /* BPT */
3275                 info.si_signo = TARGET_SIGTRAP;
3276                 info.si_errno = 0;
3277                 info.si_code = TARGET_TRAP_BRKPT;
3278                 info._sifields._sigfault._addr = env->pc;
3279                 queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
3280                 break;
3281             case 0x81:
3282                 /* BUGCHK */
3283                 info.si_signo = TARGET_SIGTRAP;
3284                 info.si_errno = 0;
3285                 info.si_code = 0;
3286                 info._sifields._sigfault._addr = env->pc;
3287                 queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
3288                 break;
3289             case 0x83:
3290                 /* CALLSYS */
3291                 trapnr = env->ir[IR_V0];
3292                 sysret = do_syscall(env, trapnr,
3293                                     env->ir[IR_A0], env->ir[IR_A1],
3294                                     env->ir[IR_A2], env->ir[IR_A3],
3295                                     env->ir[IR_A4], env->ir[IR_A5],
3296                                     0, 0);
3297                 if (sysret == -TARGET_ERESTARTSYS) {
3298                     env->pc -= 4;
3299                     break;
3300                 }
3301                 if (sysret == -TARGET_QEMU_ESIGRETURN) {
3302                     break;
3303                 }
3304                 /* Syscall writes 0 to V0 to bypass error check, similar
3305                    to how this is handled internal to Linux kernel.
3306                    (Ab)use trapnr temporarily as boolean indicating error.  */
3307                 trapnr = (env->ir[IR_V0] != 0 && sysret < 0);
3308                 env->ir[IR_V0] = (trapnr ? -sysret : sysret);
3309                 env->ir[IR_A3] = trapnr;
3310                 break;
3311             case 0x86:
3312                 /* IMB */
3313                 /* ??? We can probably elide the code using page_unprotect
3314                    that is checking for self-modifying code.  Instead we
3315                    could simply call tb_flush here.  Until we work out the
3316                    changes required to turn off the extra write protection,
3317                    this can be a no-op.  */
3318                 break;
3319             case 0x9E:
3320                 /* RDUNIQUE */
3321                 /* Handled in the translator for usermode.  */
3322                 abort();
3323             case 0x9F:
3324                 /* WRUNIQUE */
3325                 /* Handled in the translator for usermode.  */
3326                 abort();
3327             case 0xAA:
3328                 /* GENTRAP */
3329                 info.si_signo = TARGET_SIGFPE;
3330                 switch (env->ir[IR_A0]) {
3331                 case TARGET_GEN_INTOVF:
3332                     info.si_code = TARGET_FPE_INTOVF;
3333                     break;
3334                 case TARGET_GEN_INTDIV:
3335                     info.si_code = TARGET_FPE_INTDIV;
3336                     break;
3337                 case TARGET_GEN_FLTOVF:
3338                     info.si_code = TARGET_FPE_FLTOVF;
3339                     break;
3340                 case TARGET_GEN_FLTUND:
3341                     info.si_code = TARGET_FPE_FLTUND;
3342                     break;
3343                 case TARGET_GEN_FLTINV:
3344                     info.si_code = TARGET_FPE_FLTINV;
3345                     break;
3346                 case TARGET_GEN_FLTINE:
3347                     info.si_code = TARGET_FPE_FLTRES;
3348                     break;
3349                 case TARGET_GEN_ROPRAND:
3350                     info.si_code = 0;
3351                     break;
3352                 default:
3353                     info.si_signo = TARGET_SIGTRAP;
3354                     info.si_code = 0;
3355                     break;
3356                 }
3357                 info.si_errno = 0;
3358                 info._sifields._sigfault._addr = env->pc;
3359                 queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
3360                 break;
3361             default:
3362                 goto do_sigill;
3363             }
3364             break;
3365         case EXCP_DEBUG:
3366             info.si_signo = gdb_handlesig(cs, TARGET_SIGTRAP);
3367             if (info.si_signo) {
3368                 env->lock_addr = -1;
3369                 info.si_errno = 0;
3370                 info.si_code = TARGET_TRAP_BRKPT;
3371                 queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
3372             }
3373             break;
3374         case EXCP_STL_C:
3375         case EXCP_STQ_C:
3376             do_store_exclusive(env, env->error_code, trapnr - EXCP_STL_C);
3377             break;
3378         case EXCP_INTERRUPT:
3379             /* Just indicate that signals should be handled asap.  */
3380             break;
3381         default:
3382             printf ("Unhandled trap: 0x%x\n", trapnr);
3383             cpu_dump_state(cs, stderr, fprintf, 0);
3384             exit(EXIT_FAILURE);
3385         }
3386         process_pending_signals (env);
3387     }
3388 }
3389 #endif /* TARGET_ALPHA */
3390 
3391 #ifdef TARGET_S390X
3392 void cpu_loop(CPUS390XState *env)
3393 {
3394     CPUState *cs = CPU(s390_env_get_cpu(env));
3395     int trapnr, n, sig;
3396     target_siginfo_t info;
3397     target_ulong addr;
3398     abi_long ret;
3399 
3400     while (1) {
3401         cpu_exec_start(cs);
3402         trapnr = cpu_exec(cs);
3403         cpu_exec_end(cs);
3404         switch (trapnr) {
3405         case EXCP_INTERRUPT:
3406             /* Just indicate that signals should be handled asap.  */
3407             break;
3408 
3409         case EXCP_SVC:
3410             n = env->int_svc_code;
3411             if (!n) {
3412                 /* syscalls > 255 */
3413                 n = env->regs[1];
3414             }
3415             env->psw.addr += env->int_svc_ilen;
3416             ret = do_syscall(env, n, env->regs[2], env->regs[3],
3417                              env->regs[4], env->regs[5],
3418                              env->regs[6], env->regs[7], 0, 0);
3419             if (ret == -TARGET_ERESTARTSYS) {
3420                 env->psw.addr -= env->int_svc_ilen;
3421             } else if (ret != -TARGET_QEMU_ESIGRETURN) {
3422                 env->regs[2] = ret;
3423             }
3424             break;
3425 
3426         case EXCP_DEBUG:
3427             sig = gdb_handlesig(cs, TARGET_SIGTRAP);
3428             if (sig) {
3429                 n = TARGET_TRAP_BRKPT;
3430                 goto do_signal_pc;
3431             }
3432             break;
3433         case EXCP_PGM:
3434             n = env->int_pgm_code;
3435             switch (n) {
3436             case PGM_OPERATION:
3437             case PGM_PRIVILEGED:
3438                 sig = TARGET_SIGILL;
3439                 n = TARGET_ILL_ILLOPC;
3440                 goto do_signal_pc;
3441             case PGM_PROTECTION:
3442             case PGM_ADDRESSING:
3443                 sig = TARGET_SIGSEGV;
3444                 /* XXX: check env->error_code */
3445                 n = TARGET_SEGV_MAPERR;
3446                 addr = env->__excp_addr;
3447                 goto do_signal;
3448             case PGM_EXECUTE:
3449             case PGM_SPECIFICATION:
3450             case PGM_SPECIAL_OP:
3451             case PGM_OPERAND:
3452             do_sigill_opn:
3453                 sig = TARGET_SIGILL;
3454                 n = TARGET_ILL_ILLOPN;
3455                 goto do_signal_pc;
3456 
3457             case PGM_FIXPT_OVERFLOW:
3458                 sig = TARGET_SIGFPE;
3459                 n = TARGET_FPE_INTOVF;
3460                 goto do_signal_pc;
3461             case PGM_FIXPT_DIVIDE:
3462                 sig = TARGET_SIGFPE;
3463                 n = TARGET_FPE_INTDIV;
3464                 goto do_signal_pc;
3465 
3466             case PGM_DATA:
3467                 n = (env->fpc >> 8) & 0xff;
3468                 if (n == 0xff) {
3469                     /* compare-and-trap */
3470                     goto do_sigill_opn;
3471                 } else {
3472                     /* An IEEE exception, simulated or otherwise.  */
3473                     if (n & 0x80) {
3474                         n = TARGET_FPE_FLTINV;
3475                     } else if (n & 0x40) {
3476                         n = TARGET_FPE_FLTDIV;
3477                     } else if (n & 0x20) {
3478                         n = TARGET_FPE_FLTOVF;
3479                     } else if (n & 0x10) {
3480                         n = TARGET_FPE_FLTUND;
3481                     } else if (n & 0x08) {
3482                         n = TARGET_FPE_FLTRES;
3483                     } else {
3484                         /* ??? Quantum exception; BFP, DFP error.  */
3485                         goto do_sigill_opn;
3486                     }
3487                     sig = TARGET_SIGFPE;
3488                     goto do_signal_pc;
3489                 }
3490 
3491             default:
3492                 fprintf(stderr, "Unhandled program exception: %#x\n", n);
3493                 cpu_dump_state(cs, stderr, fprintf, 0);
3494                 exit(EXIT_FAILURE);
3495             }
3496             break;
3497 
3498         do_signal_pc:
3499             addr = env->psw.addr;
3500         do_signal:
3501             info.si_signo = sig;
3502             info.si_errno = 0;
3503             info.si_code = n;
3504             info._sifields._sigfault._addr = addr;
3505             queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
3506             break;
3507 
3508         default:
3509             fprintf(stderr, "Unhandled trap: 0x%x\n", trapnr);
3510             cpu_dump_state(cs, stderr, fprintf, 0);
3511             exit(EXIT_FAILURE);
3512         }
3513         process_pending_signals (env);
3514     }
3515 }
3516 
3517 #endif /* TARGET_S390X */
3518 
3519 #ifdef TARGET_TILEGX
3520 
3521 static void gen_sigill_reg(CPUTLGState *env)
3522 {
3523     target_siginfo_t info;
3524 
3525     info.si_signo = TARGET_SIGILL;
3526     info.si_errno = 0;
3527     info.si_code = TARGET_ILL_PRVREG;
3528     info._sifields._sigfault._addr = env->pc;
3529     queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
3530 }
3531 
3532 static void do_signal(CPUTLGState *env, int signo, int sigcode)
3533 {
3534     target_siginfo_t info;
3535 
3536     info.si_signo = signo;
3537     info.si_errno = 0;
3538     info._sifields._sigfault._addr = env->pc;
3539 
3540     if (signo == TARGET_SIGSEGV) {
3541         /* The passed in sigcode is a dummy; check for a page mapping
3542            and pass either MAPERR or ACCERR.  */
3543         target_ulong addr = env->excaddr;
3544         info._sifields._sigfault._addr = addr;
3545         if (page_check_range(addr, 1, PAGE_VALID) < 0) {
3546             sigcode = TARGET_SEGV_MAPERR;
3547         } else {
3548             sigcode = TARGET_SEGV_ACCERR;
3549         }
3550     }
3551     info.si_code = sigcode;
3552 
3553     queue_signal(env, info.si_signo, QEMU_SI_FAULT, &info);
3554 }
3555 
3556 static void gen_sigsegv_maperr(CPUTLGState *env, target_ulong addr)
3557 {
3558     env->excaddr = addr;
3559     do_signal(env, TARGET_SIGSEGV, 0);
3560 }
3561 
3562 static void set_regval(CPUTLGState *env, uint8_t reg, uint64_t val)
3563 {
3564     if (unlikely(reg >= TILEGX_R_COUNT)) {
3565         switch (reg) {
3566         case TILEGX_R_SN:
3567         case TILEGX_R_ZERO:
3568             return;
3569         case TILEGX_R_IDN0:
3570         case TILEGX_R_IDN1:
3571         case TILEGX_R_UDN0:
3572         case TILEGX_R_UDN1:
3573         case TILEGX_R_UDN2:
3574         case TILEGX_R_UDN3:
3575             gen_sigill_reg(env);
3576             return;
3577         default:
3578             g_assert_not_reached();
3579         }
3580     }
3581     env->regs[reg] = val;
3582 }
3583 
3584 /*
3585  * Compare the 8-byte contents of the CmpValue SPR with the 8-byte value in
3586  * memory at the address held in the first source register. If the values are
3587  * not equal, then no memory operation is performed. If the values are equal,
3588  * the 8-byte quantity from the second source register is written into memory
3589  * at the address held in the first source register. In either case, the result
3590  * of the instruction is the value read from memory. The compare and write to
3591  * memory are atomic and thus can be used for synchronization purposes. This
3592  * instruction only operates for addresses aligned to a 8-byte boundary.
3593  * Unaligned memory access causes an Unaligned Data Reference interrupt.
3594  *
3595  * Functional Description (64-bit)
3596  *       uint64_t memVal = memoryReadDoubleWord (rf[SrcA]);
3597  *       rf[Dest] = memVal;
3598  *       if (memVal == SPR[CmpValueSPR])
3599  *           memoryWriteDoubleWord (rf[SrcA], rf[SrcB]);
3600  *
3601  * Functional Description (32-bit)
3602  *       uint64_t memVal = signExtend32 (memoryReadWord (rf[SrcA]));
3603  *       rf[Dest] = memVal;
3604  *       if (memVal == signExtend32 (SPR[CmpValueSPR]))
3605  *           memoryWriteWord (rf[SrcA], rf[SrcB]);
3606  *
3607  *
3608  * This function also processes exch and exch4 which need not process SPR.
3609  */
3610 static void do_exch(CPUTLGState *env, bool quad, bool cmp)
3611 {
3612     target_ulong addr;
3613     target_long val, sprval;
3614 
3615     start_exclusive();
3616 
3617     addr = env->atomic_srca;
3618     if (quad ? get_user_s64(val, addr) : get_user_s32(val, addr)) {
3619         goto sigsegv_maperr;
3620     }
3621 
3622     if (cmp) {
3623         if (quad) {
3624             sprval = env->spregs[TILEGX_SPR_CMPEXCH];
3625         } else {
3626             sprval = sextract64(env->spregs[TILEGX_SPR_CMPEXCH], 0, 32);
3627         }
3628     }
3629 
3630     if (!cmp || val == sprval) {
3631         target_long valb = env->atomic_srcb;
3632         if (quad ? put_user_u64(valb, addr) : put_user_u32(valb, addr)) {
3633             goto sigsegv_maperr;
3634         }
3635     }
3636 
3637     set_regval(env, env->atomic_dstr, val);
3638     end_exclusive();
3639     return;
3640 
3641  sigsegv_maperr:
3642     end_exclusive();
3643     gen_sigsegv_maperr(env, addr);
3644 }
3645 
3646 static void do_fetch(CPUTLGState *env, int trapnr, bool quad)
3647 {
3648     int8_t write = 1;
3649     target_ulong addr;
3650     target_long val, valb;
3651 
3652     start_exclusive();
3653 
3654     addr = env->atomic_srca;
3655     valb = env->atomic_srcb;
3656     if (quad ? get_user_s64(val, addr) : get_user_s32(val, addr)) {
3657         goto sigsegv_maperr;
3658     }
3659 
3660     switch (trapnr) {
3661     case TILEGX_EXCP_OPCODE_FETCHADD:
3662     case TILEGX_EXCP_OPCODE_FETCHADD4:
3663         valb += val;
3664         break;
3665     case TILEGX_EXCP_OPCODE_FETCHADDGEZ:
3666         valb += val;
3667         if (valb < 0) {
3668             write = 0;
3669         }
3670         break;
3671     case TILEGX_EXCP_OPCODE_FETCHADDGEZ4:
3672         valb += val;
3673         if ((int32_t)valb < 0) {
3674             write = 0;
3675         }
3676         break;
3677     case TILEGX_EXCP_OPCODE_FETCHAND:
3678     case TILEGX_EXCP_OPCODE_FETCHAND4:
3679         valb &= val;
3680         break;
3681     case TILEGX_EXCP_OPCODE_FETCHOR:
3682     case TILEGX_EXCP_OPCODE_FETCHOR4:
3683         valb |= val;
3684         break;
3685     default:
3686         g_assert_not_reached();
3687     }
3688 
3689     if (write) {
3690         if (quad ? put_user_u64(valb, addr) : put_user_u32(valb, addr)) {
3691             goto sigsegv_maperr;
3692         }
3693     }
3694 
3695     set_regval(env, env->atomic_dstr, val);
3696     end_exclusive();
3697     return;
3698 
3699  sigsegv_maperr:
3700     end_exclusive();
3701     gen_sigsegv_maperr(env, addr);
3702 }
3703 
3704 void cpu_loop(CPUTLGState *env)
3705 {
3706     CPUState *cs = CPU(tilegx_env_get_cpu(env));
3707     int trapnr;
3708 
3709     while (1) {
3710         cpu_exec_start(cs);
3711         trapnr = cpu_exec(cs);
3712         cpu_exec_end(cs);
3713         switch (trapnr) {
3714         case TILEGX_EXCP_SYSCALL:
3715         {
3716             abi_ulong ret = do_syscall(env, env->regs[TILEGX_R_NR],
3717                                        env->regs[0], env->regs[1],
3718                                        env->regs[2], env->regs[3],
3719                                        env->regs[4], env->regs[5],
3720                                        env->regs[6], env->regs[7]);
3721             if (ret == -TARGET_ERESTARTSYS) {
3722                 env->pc -= 8;
3723             } else if (ret != -TARGET_QEMU_ESIGRETURN) {
3724                 env->regs[TILEGX_R_RE] = ret;
3725                 env->regs[TILEGX_R_ERR] = TILEGX_IS_ERRNO(ret) ? -ret : 0;
3726             }
3727             break;
3728         }
3729         case TILEGX_EXCP_OPCODE_EXCH:
3730             do_exch(env, true, false);
3731             break;
3732         case TILEGX_EXCP_OPCODE_EXCH4:
3733             do_exch(env, false, false);
3734             break;
3735         case TILEGX_EXCP_OPCODE_CMPEXCH:
3736             do_exch(env, true, true);
3737             break;
3738         case TILEGX_EXCP_OPCODE_CMPEXCH4:
3739             do_exch(env, false, true);
3740             break;
3741         case TILEGX_EXCP_OPCODE_FETCHADD:
3742         case TILEGX_EXCP_OPCODE_FETCHADDGEZ:
3743         case TILEGX_EXCP_OPCODE_FETCHAND:
3744         case TILEGX_EXCP_OPCODE_FETCHOR:
3745             do_fetch(env, trapnr, true);
3746             break;
3747         case TILEGX_EXCP_OPCODE_FETCHADD4:
3748         case TILEGX_EXCP_OPCODE_FETCHADDGEZ4:
3749         case TILEGX_EXCP_OPCODE_FETCHAND4:
3750         case TILEGX_EXCP_OPCODE_FETCHOR4:
3751             do_fetch(env, trapnr, false);
3752             break;
3753         case TILEGX_EXCP_SIGNAL:
3754             do_signal(env, env->signo, env->sigcode);
3755             break;
3756         case TILEGX_EXCP_REG_IDN_ACCESS:
3757         case TILEGX_EXCP_REG_UDN_ACCESS:
3758             gen_sigill_reg(env);
3759             break;
3760         default:
3761             fprintf(stderr, "trapnr is %d[0x%x].\n", trapnr, trapnr);
3762             g_assert_not_reached();
3763         }
3764         process_pending_signals(env);
3765     }
3766 }
3767 
3768 #endif
3769 
3770 THREAD CPUState *thread_cpu;
3771 
3772 void task_settid(TaskState *ts)
3773 {
3774     if (ts->ts_tid == 0) {
3775         ts->ts_tid = (pid_t)syscall(SYS_gettid);
3776     }
3777 }
3778 
3779 void stop_all_tasks(void)
3780 {
3781     /*
3782      * We trust that when using NPTL, start_exclusive()
3783      * handles thread stopping correctly.
3784      */
3785     start_exclusive();
3786 }
3787 
3788 /* Assumes contents are already zeroed.  */
3789 void init_task_state(TaskState *ts)
3790 {
3791     ts->used = 1;
3792 }
3793 
3794 CPUArchState *cpu_copy(CPUArchState *env)
3795 {
3796     CPUState *cpu = ENV_GET_CPU(env);
3797     CPUState *new_cpu = cpu_init(cpu_model);
3798     CPUArchState *new_env = new_cpu->env_ptr;
3799     CPUBreakpoint *bp;
3800     CPUWatchpoint *wp;
3801 
3802     /* Reset non arch specific state */
3803     cpu_reset(new_cpu);
3804 
3805     memcpy(new_env, env, sizeof(CPUArchState));
3806 
3807     /* Clone all break/watchpoints.
3808        Note: Once we support ptrace with hw-debug register access, make sure
3809        BP_CPU break/watchpoints are handled correctly on clone. */
3810     QTAILQ_INIT(&new_cpu->breakpoints);
3811     QTAILQ_INIT(&new_cpu->watchpoints);
3812     QTAILQ_FOREACH(bp, &cpu->breakpoints, entry) {
3813         cpu_breakpoint_insert(new_cpu, bp->pc, bp->flags, NULL);
3814     }
3815     QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
3816         cpu_watchpoint_insert(new_cpu, wp->vaddr, wp->len, wp->flags, NULL);
3817     }
3818 
3819     return new_env;
3820 }
3821 
3822 static void handle_arg_help(const char *arg)
3823 {
3824     usage(EXIT_SUCCESS);
3825 }
3826 
3827 static void handle_arg_log(const char *arg)
3828 {
3829     int mask;
3830 
3831     mask = qemu_str_to_log_mask(arg);
3832     if (!mask) {
3833         qemu_print_log_usage(stdout);
3834         exit(EXIT_FAILURE);
3835     }
3836     qemu_log_needs_buffers();
3837     qemu_set_log(mask);
3838 }
3839 
3840 static void handle_arg_log_filename(const char *arg)
3841 {
3842     qemu_set_log_filename(arg, &error_fatal);
3843 }
3844 
3845 static void handle_arg_set_env(const char *arg)
3846 {
3847     char *r, *p, *token;
3848     r = p = strdup(arg);
3849     while ((token = strsep(&p, ",")) != NULL) {
3850         if (envlist_setenv(envlist, token) != 0) {
3851             usage(EXIT_FAILURE);
3852         }
3853     }
3854     free(r);
3855 }
3856 
3857 static void handle_arg_unset_env(const char *arg)
3858 {
3859     char *r, *p, *token;
3860     r = p = strdup(arg);
3861     while ((token = strsep(&p, ",")) != NULL) {
3862         if (envlist_unsetenv(envlist, token) != 0) {
3863             usage(EXIT_FAILURE);
3864         }
3865     }
3866     free(r);
3867 }
3868 
3869 static void handle_arg_argv0(const char *arg)
3870 {
3871     argv0 = strdup(arg);
3872 }
3873 
3874 static void handle_arg_stack_size(const char *arg)
3875 {
3876     char *p;
3877     guest_stack_size = strtoul(arg, &p, 0);
3878     if (guest_stack_size == 0) {
3879         usage(EXIT_FAILURE);
3880     }
3881 
3882     if (*p == 'M') {
3883         guest_stack_size *= 1024 * 1024;
3884     } else if (*p == 'k' || *p == 'K') {
3885         guest_stack_size *= 1024;
3886     }
3887 }
3888 
3889 static void handle_arg_ld_prefix(const char *arg)
3890 {
3891     interp_prefix = strdup(arg);
3892 }
3893 
3894 static void handle_arg_pagesize(const char *arg)
3895 {
3896     qemu_host_page_size = atoi(arg);
3897     if (qemu_host_page_size == 0 ||
3898         (qemu_host_page_size & (qemu_host_page_size - 1)) != 0) {
3899         fprintf(stderr, "page size must be a power of two\n");
3900         exit(EXIT_FAILURE);
3901     }
3902 }
3903 
3904 static void handle_arg_randseed(const char *arg)
3905 {
3906     unsigned long long seed;
3907 
3908     if (parse_uint_full(arg, &seed, 0) != 0 || seed > UINT_MAX) {
3909         fprintf(stderr, "Invalid seed number: %s\n", arg);
3910         exit(EXIT_FAILURE);
3911     }
3912     srand(seed);
3913 }
3914 
3915 static void handle_arg_gdb(const char *arg)
3916 {
3917     gdbstub_port = atoi(arg);
3918 }
3919 
3920 static void handle_arg_uname(const char *arg)
3921 {
3922     qemu_uname_release = strdup(arg);
3923 }
3924 
3925 static void handle_arg_cpu(const char *arg)
3926 {
3927     cpu_model = strdup(arg);
3928     if (cpu_model == NULL || is_help_option(cpu_model)) {
3929         /* XXX: implement xxx_cpu_list for targets that still miss it */
3930 #if defined(cpu_list)
3931         cpu_list(stdout, &fprintf);
3932 #endif
3933         exit(EXIT_FAILURE);
3934     }
3935 }
3936 
3937 static void handle_arg_guest_base(const char *arg)
3938 {
3939     guest_base = strtol(arg, NULL, 0);
3940     have_guest_base = 1;
3941 }
3942 
3943 static void handle_arg_reserved_va(const char *arg)
3944 {
3945     char *p;
3946     int shift = 0;
3947     reserved_va = strtoul(arg, &p, 0);
3948     switch (*p) {
3949     case 'k':
3950     case 'K':
3951         shift = 10;
3952         break;
3953     case 'M':
3954         shift = 20;
3955         break;
3956     case 'G':
3957         shift = 30;
3958         break;
3959     }
3960     if (shift) {
3961         unsigned long unshifted = reserved_va;
3962         p++;
3963         reserved_va <<= shift;
3964         if (((reserved_va >> shift) != unshifted)
3965 #if HOST_LONG_BITS > TARGET_VIRT_ADDR_SPACE_BITS
3966             || (reserved_va > (1ul << TARGET_VIRT_ADDR_SPACE_BITS))
3967 #endif
3968             ) {
3969             fprintf(stderr, "Reserved virtual address too big\n");
3970             exit(EXIT_FAILURE);
3971         }
3972     }
3973     if (*p) {
3974         fprintf(stderr, "Unrecognised -R size suffix '%s'\n", p);
3975         exit(EXIT_FAILURE);
3976     }
3977 }
3978 
3979 static void handle_arg_singlestep(const char *arg)
3980 {
3981     singlestep = 1;
3982 }
3983 
3984 static void handle_arg_strace(const char *arg)
3985 {
3986     do_strace = 1;
3987 }
3988 
3989 static void handle_arg_version(const char *arg)
3990 {
3991     printf("qemu-" TARGET_NAME " version " QEMU_VERSION QEMU_PKGVERSION
3992            ", " QEMU_COPYRIGHT "\n");
3993     exit(EXIT_SUCCESS);
3994 }
3995 
3996 static char *trace_file;
3997 static void handle_arg_trace(const char *arg)
3998 {
3999     g_free(trace_file);
4000     trace_file = trace_opt_parse(arg);
4001 }
4002 
4003 struct qemu_argument {
4004     const char *argv;
4005     const char *env;
4006     bool has_arg;
4007     void (*handle_opt)(const char *arg);
4008     const char *example;
4009     const char *help;
4010 };
4011 
4012 static const struct qemu_argument arg_table[] = {
4013     {"h",          "",                 false, handle_arg_help,
4014      "",           "print this help"},
4015     {"help",       "",                 false, handle_arg_help,
4016      "",           ""},
4017     {"g",          "QEMU_GDB",         true,  handle_arg_gdb,
4018      "port",       "wait gdb connection to 'port'"},
4019     {"L",          "QEMU_LD_PREFIX",   true,  handle_arg_ld_prefix,
4020      "path",       "set the elf interpreter prefix to 'path'"},
4021     {"s",          "QEMU_STACK_SIZE",  true,  handle_arg_stack_size,
4022      "size",       "set the stack size to 'size' bytes"},
4023     {"cpu",        "QEMU_CPU",         true,  handle_arg_cpu,
4024      "model",      "select CPU (-cpu help for list)"},
4025     {"E",          "QEMU_SET_ENV",     true,  handle_arg_set_env,
4026      "var=value",  "sets targets environment variable (see below)"},
4027     {"U",          "QEMU_UNSET_ENV",   true,  handle_arg_unset_env,
4028      "var",        "unsets targets environment variable (see below)"},
4029     {"0",          "QEMU_ARGV0",       true,  handle_arg_argv0,
4030      "argv0",      "forces target process argv[0] to be 'argv0'"},
4031     {"r",          "QEMU_UNAME",       true,  handle_arg_uname,
4032      "uname",      "set qemu uname release string to 'uname'"},
4033     {"B",          "QEMU_GUEST_BASE",  true,  handle_arg_guest_base,
4034      "address",    "set guest_base address to 'address'"},
4035     {"R",          "QEMU_RESERVED_VA", true,  handle_arg_reserved_va,
4036      "size",       "reserve 'size' bytes for guest virtual address space"},
4037     {"d",          "QEMU_LOG",         true,  handle_arg_log,
4038      "item[,...]", "enable logging of specified items "
4039      "(use '-d help' for a list of items)"},
4040     {"D",          "QEMU_LOG_FILENAME", true, handle_arg_log_filename,
4041      "logfile",     "write logs to 'logfile' (default stderr)"},
4042     {"p",          "QEMU_PAGESIZE",    true,  handle_arg_pagesize,
4043      "pagesize",   "set the host page size to 'pagesize'"},
4044     {"singlestep", "QEMU_SINGLESTEP",  false, handle_arg_singlestep,
4045      "",           "run in singlestep mode"},
4046     {"strace",     "QEMU_STRACE",      false, handle_arg_strace,
4047      "",           "log system calls"},
4048     {"seed",       "QEMU_RAND_SEED",   true,  handle_arg_randseed,
4049      "",           "Seed for pseudo-random number generator"},
4050     {"trace",      "QEMU_TRACE",       true,  handle_arg_trace,
4051      "",           "[[enable=]<pattern>][,events=<file>][,file=<file>]"},
4052     {"version",    "QEMU_VERSION",     false, handle_arg_version,
4053      "",           "display version information and exit"},
4054     {NULL, NULL, false, NULL, NULL, NULL}
4055 };
4056 
4057 static void usage(int exitcode)
4058 {
4059     const struct qemu_argument *arginfo;
4060     int maxarglen;
4061     int maxenvlen;
4062 
4063     printf("usage: qemu-" TARGET_NAME " [options] program [arguments...]\n"
4064            "Linux CPU emulator (compiled for " TARGET_NAME " emulation)\n"
4065            "\n"
4066            "Options and associated environment variables:\n"
4067            "\n");
4068 
4069     /* Calculate column widths. We must always have at least enough space
4070      * for the column header.
4071      */
4072     maxarglen = strlen("Argument");
4073     maxenvlen = strlen("Env-variable");
4074 
4075     for (arginfo = arg_table; arginfo->handle_opt != NULL; arginfo++) {
4076         int arglen = strlen(arginfo->argv);
4077         if (arginfo->has_arg) {
4078             arglen += strlen(arginfo->example) + 1;
4079         }
4080         if (strlen(arginfo->env) > maxenvlen) {
4081             maxenvlen = strlen(arginfo->env);
4082         }
4083         if (arglen > maxarglen) {
4084             maxarglen = arglen;
4085         }
4086     }
4087 
4088     printf("%-*s %-*s Description\n", maxarglen+1, "Argument",
4089             maxenvlen, "Env-variable");
4090 
4091     for (arginfo = arg_table; arginfo->handle_opt != NULL; arginfo++) {
4092         if (arginfo->has_arg) {
4093             printf("-%s %-*s %-*s %s\n", arginfo->argv,
4094                    (int)(maxarglen - strlen(arginfo->argv) - 1),
4095                    arginfo->example, maxenvlen, arginfo->env, arginfo->help);
4096         } else {
4097             printf("-%-*s %-*s %s\n", maxarglen, arginfo->argv,
4098                     maxenvlen, arginfo->env,
4099                     arginfo->help);
4100         }
4101     }
4102 
4103     printf("\n"
4104            "Defaults:\n"
4105            "QEMU_LD_PREFIX  = %s\n"
4106            "QEMU_STACK_SIZE = %ld byte\n",
4107            interp_prefix,
4108            guest_stack_size);
4109 
4110     printf("\n"
4111            "You can use -E and -U options or the QEMU_SET_ENV and\n"
4112            "QEMU_UNSET_ENV environment variables to set and unset\n"
4113            "environment variables for the target process.\n"
4114            "It is possible to provide several variables by separating them\n"
4115            "by commas in getsubopt(3) style. Additionally it is possible to\n"
4116            "provide the -E and -U options multiple times.\n"
4117            "The following lines are equivalent:\n"
4118            "    -E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG\n"
4119            "    -E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG\n"
4120            "    QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG\n"
4121            "Note that if you provide several changes to a single variable\n"
4122            "the last change will stay in effect.\n");
4123 
4124     exit(exitcode);
4125 }
4126 
4127 static int parse_args(int argc, char **argv)
4128 {
4129     const char *r;
4130     int optind;
4131     const struct qemu_argument *arginfo;
4132 
4133     for (arginfo = arg_table; arginfo->handle_opt != NULL; arginfo++) {
4134         if (arginfo->env == NULL) {
4135             continue;
4136         }
4137 
4138         r = getenv(arginfo->env);
4139         if (r != NULL) {
4140             arginfo->handle_opt(r);
4141         }
4142     }
4143 
4144     optind = 1;
4145     for (;;) {
4146         if (optind >= argc) {
4147             break;
4148         }
4149         r = argv[optind];
4150         if (r[0] != '-') {
4151             break;
4152         }
4153         optind++;
4154         r++;
4155         if (!strcmp(r, "-")) {
4156             break;
4157         }
4158         /* Treat --foo the same as -foo.  */
4159         if (r[0] == '-') {
4160             r++;
4161         }
4162 
4163         for (arginfo = arg_table; arginfo->handle_opt != NULL; arginfo++) {
4164             if (!strcmp(r, arginfo->argv)) {
4165                 if (arginfo->has_arg) {
4166                     if (optind >= argc) {
4167                         (void) fprintf(stderr,
4168                             "qemu: missing argument for option '%s'\n", r);
4169                         exit(EXIT_FAILURE);
4170                     }
4171                     arginfo->handle_opt(argv[optind]);
4172                     optind++;
4173                 } else {
4174                     arginfo->handle_opt(NULL);
4175                 }
4176                 break;
4177             }
4178         }
4179 
4180         /* no option matched the current argv */
4181         if (arginfo->handle_opt == NULL) {
4182             (void) fprintf(stderr, "qemu: unknown option '%s'\n", r);
4183             exit(EXIT_FAILURE);
4184         }
4185     }
4186 
4187     if (optind >= argc) {
4188         (void) fprintf(stderr, "qemu: no user program specified\n");
4189         exit(EXIT_FAILURE);
4190     }
4191 
4192     filename = argv[optind];
4193     exec_path = argv[optind];
4194 
4195     return optind;
4196 }
4197 
4198 int main(int argc, char **argv, char **envp)
4199 {
4200     struct target_pt_regs regs1, *regs = &regs1;
4201     struct image_info info1, *info = &info1;
4202     struct linux_binprm bprm;
4203     TaskState *ts;
4204     CPUArchState *env;
4205     CPUState *cpu;
4206     int optind;
4207     char **target_environ, **wrk;
4208     char **target_argv;
4209     int target_argc;
4210     int i;
4211     int ret;
4212     int execfd;
4213 
4214     module_call_init(MODULE_INIT_QOM);
4215 
4216     if ((envlist = envlist_create()) == NULL) {
4217         (void) fprintf(stderr, "Unable to allocate envlist\n");
4218         exit(EXIT_FAILURE);
4219     }
4220 
4221     /* add current environment into the list */
4222     for (wrk = environ; *wrk != NULL; wrk++) {
4223         (void) envlist_setenv(envlist, *wrk);
4224     }
4225 
4226     /* Read the stack limit from the kernel.  If it's "unlimited",
4227        then we can do little else besides use the default.  */
4228     {
4229         struct rlimit lim;
4230         if (getrlimit(RLIMIT_STACK, &lim) == 0
4231             && lim.rlim_cur != RLIM_INFINITY
4232             && lim.rlim_cur == (target_long)lim.rlim_cur) {
4233             guest_stack_size = lim.rlim_cur;
4234         }
4235     }
4236 
4237     cpu_model = NULL;
4238 
4239     srand(time(NULL));
4240 
4241     qemu_add_opts(&qemu_trace_opts);
4242 
4243     optind = parse_args(argc, argv);
4244 
4245     if (!trace_init_backends()) {
4246         exit(1);
4247     }
4248     trace_init_file(trace_file);
4249 
4250     /* Zero out regs */
4251     memset(regs, 0, sizeof(struct target_pt_regs));
4252 
4253     /* Zero out image_info */
4254     memset(info, 0, sizeof(struct image_info));
4255 
4256     memset(&bprm, 0, sizeof (bprm));
4257 
4258     /* Scan interp_prefix dir for replacement files. */
4259     init_paths(interp_prefix);
4260 
4261     init_qemu_uname_release();
4262 
4263     if (cpu_model == NULL) {
4264 #if defined(TARGET_I386)
4265 #ifdef TARGET_X86_64
4266         cpu_model = "qemu64";
4267 #else
4268         cpu_model = "qemu32";
4269 #endif
4270 #elif defined(TARGET_ARM)
4271         cpu_model = "any";
4272 #elif defined(TARGET_UNICORE32)
4273         cpu_model = "any";
4274 #elif defined(TARGET_M68K)
4275         cpu_model = "any";
4276 #elif defined(TARGET_SPARC)
4277 #ifdef TARGET_SPARC64
4278         cpu_model = "TI UltraSparc II";
4279 #else
4280         cpu_model = "Fujitsu MB86904";
4281 #endif
4282 #elif defined(TARGET_MIPS)
4283 #if defined(TARGET_ABI_MIPSN32) || defined(TARGET_ABI_MIPSN64)
4284         cpu_model = "5KEf";
4285 #else
4286         cpu_model = "24Kf";
4287 #endif
4288 #elif defined TARGET_OPENRISC
4289         cpu_model = "or1200";
4290 #elif defined(TARGET_PPC)
4291 # ifdef TARGET_PPC64
4292         cpu_model = "POWER8";
4293 # else
4294         cpu_model = "750";
4295 # endif
4296 #elif defined TARGET_SH4
4297         cpu_model = TYPE_SH7785_CPU;
4298 #else
4299         cpu_model = "any";
4300 #endif
4301     }
4302     tcg_exec_init(0);
4303     /* NOTE: we need to init the CPU at this stage to get
4304        qemu_host_page_size */
4305     cpu = cpu_init(cpu_model);
4306     if (!cpu) {
4307         fprintf(stderr, "Unable to find CPU definition\n");
4308         exit(EXIT_FAILURE);
4309     }
4310     env = cpu->env_ptr;
4311     cpu_reset(cpu);
4312 
4313     thread_cpu = cpu;
4314 
4315     if (getenv("QEMU_STRACE")) {
4316         do_strace = 1;
4317     }
4318 
4319     if (getenv("QEMU_RAND_SEED")) {
4320         handle_arg_randseed(getenv("QEMU_RAND_SEED"));
4321     }
4322 
4323     target_environ = envlist_to_environ(envlist, NULL);
4324     envlist_free(envlist);
4325 
4326     /*
4327      * Now that page sizes are configured in cpu_init() we can do
4328      * proper page alignment for guest_base.
4329      */
4330     guest_base = HOST_PAGE_ALIGN(guest_base);
4331 
4332     if (reserved_va || have_guest_base) {
4333         guest_base = init_guest_space(guest_base, reserved_va, 0,
4334                                       have_guest_base);
4335         if (guest_base == (unsigned long)-1) {
4336             fprintf(stderr, "Unable to reserve 0x%lx bytes of virtual address "
4337                     "space for use as guest address space (check your virtual "
4338                     "memory ulimit setting or reserve less using -R option)\n",
4339                     reserved_va);
4340             exit(EXIT_FAILURE);
4341         }
4342 
4343         if (reserved_va) {
4344             mmap_next_start = reserved_va;
4345         }
4346     }
4347 
4348     /*
4349      * Read in mmap_min_addr kernel parameter.  This value is used
4350      * When loading the ELF image to determine whether guest_base
4351      * is needed.  It is also used in mmap_find_vma.
4352      */
4353     {
4354         FILE *fp;
4355 
4356         if ((fp = fopen("/proc/sys/vm/mmap_min_addr", "r")) != NULL) {
4357             unsigned long tmp;
4358             if (fscanf(fp, "%lu", &tmp) == 1) {
4359                 mmap_min_addr = tmp;
4360                 qemu_log_mask(CPU_LOG_PAGE, "host mmap_min_addr=0x%lx\n", mmap_min_addr);
4361             }
4362             fclose(fp);
4363         }
4364     }
4365 
4366     /*
4367      * Prepare copy of argv vector for target.
4368      */
4369     target_argc = argc - optind;
4370     target_argv = calloc(target_argc + 1, sizeof (char *));
4371     if (target_argv == NULL) {
4372 	(void) fprintf(stderr, "Unable to allocate memory for target_argv\n");
4373 	exit(EXIT_FAILURE);
4374     }
4375 
4376     /*
4377      * If argv0 is specified (using '-0' switch) we replace
4378      * argv[0] pointer with the given one.
4379      */
4380     i = 0;
4381     if (argv0 != NULL) {
4382         target_argv[i++] = strdup(argv0);
4383     }
4384     for (; i < target_argc; i++) {
4385         target_argv[i] = strdup(argv[optind + i]);
4386     }
4387     target_argv[target_argc] = NULL;
4388 
4389     ts = g_new0(TaskState, 1);
4390     init_task_state(ts);
4391     /* build Task State */
4392     ts->info = info;
4393     ts->bprm = &bprm;
4394     cpu->opaque = ts;
4395     task_settid(ts);
4396 
4397     execfd = qemu_getauxval(AT_EXECFD);
4398     if (execfd == 0) {
4399         execfd = open(filename, O_RDONLY);
4400         if (execfd < 0) {
4401             printf("Error while loading %s: %s\n", filename, strerror(errno));
4402             _exit(EXIT_FAILURE);
4403         }
4404     }
4405 
4406     ret = loader_exec(execfd, filename, target_argv, target_environ, regs,
4407         info, &bprm);
4408     if (ret != 0) {
4409         printf("Error while loading %s: %s\n", filename, strerror(-ret));
4410         _exit(EXIT_FAILURE);
4411     }
4412 
4413     for (wrk = target_environ; *wrk; wrk++) {
4414         free(*wrk);
4415     }
4416 
4417     free(target_environ);
4418 
4419     if (qemu_loglevel_mask(CPU_LOG_PAGE)) {
4420         qemu_log("guest_base  0x%lx\n", guest_base);
4421         log_page_dump();
4422 
4423         qemu_log("start_brk   0x" TARGET_ABI_FMT_lx "\n", info->start_brk);
4424         qemu_log("end_code    0x" TARGET_ABI_FMT_lx "\n", info->end_code);
4425         qemu_log("start_code  0x" TARGET_ABI_FMT_lx "\n",
4426                  info->start_code);
4427         qemu_log("start_data  0x" TARGET_ABI_FMT_lx "\n",
4428                  info->start_data);
4429         qemu_log("end_data    0x" TARGET_ABI_FMT_lx "\n", info->end_data);
4430         qemu_log("start_stack 0x" TARGET_ABI_FMT_lx "\n",
4431                  info->start_stack);
4432         qemu_log("brk         0x" TARGET_ABI_FMT_lx "\n", info->brk);
4433         qemu_log("entry       0x" TARGET_ABI_FMT_lx "\n", info->entry);
4434     }
4435 
4436     target_set_brk(info->brk);
4437     syscall_init();
4438     signal_init();
4439 
4440     /* Now that we've loaded the binary, GUEST_BASE is fixed.  Delay
4441        generating the prologue until now so that the prologue can take
4442        the real value of GUEST_BASE into account.  */
4443     tcg_prologue_init(&tcg_ctx);
4444 
4445 #if defined(TARGET_I386)
4446     env->cr[0] = CR0_PG_MASK | CR0_WP_MASK | CR0_PE_MASK;
4447     env->hflags |= HF_PE_MASK | HF_CPL_MASK;
4448     if (env->features[FEAT_1_EDX] & CPUID_SSE) {
4449         env->cr[4] |= CR4_OSFXSR_MASK;
4450         env->hflags |= HF_OSFXSR_MASK;
4451     }
4452 #ifndef TARGET_ABI32
4453     /* enable 64 bit mode if possible */
4454     if (!(env->features[FEAT_8000_0001_EDX] & CPUID_EXT2_LM)) {
4455         fprintf(stderr, "The selected x86 CPU does not support 64 bit mode\n");
4456         exit(EXIT_FAILURE);
4457     }
4458     env->cr[4] |= CR4_PAE_MASK;
4459     env->efer |= MSR_EFER_LMA | MSR_EFER_LME;
4460     env->hflags |= HF_LMA_MASK;
4461 #endif
4462 
4463     /* flags setup : we activate the IRQs by default as in user mode */
4464     env->eflags |= IF_MASK;
4465 
4466     /* linux register setup */
4467 #ifndef TARGET_ABI32
4468     env->regs[R_EAX] = regs->rax;
4469     env->regs[R_EBX] = regs->rbx;
4470     env->regs[R_ECX] = regs->rcx;
4471     env->regs[R_EDX] = regs->rdx;
4472     env->regs[R_ESI] = regs->rsi;
4473     env->regs[R_EDI] = regs->rdi;
4474     env->regs[R_EBP] = regs->rbp;
4475     env->regs[R_ESP] = regs->rsp;
4476     env->eip = regs->rip;
4477 #else
4478     env->regs[R_EAX] = regs->eax;
4479     env->regs[R_EBX] = regs->ebx;
4480     env->regs[R_ECX] = regs->ecx;
4481     env->regs[R_EDX] = regs->edx;
4482     env->regs[R_ESI] = regs->esi;
4483     env->regs[R_EDI] = regs->edi;
4484     env->regs[R_EBP] = regs->ebp;
4485     env->regs[R_ESP] = regs->esp;
4486     env->eip = regs->eip;
4487 #endif
4488 
4489     /* linux interrupt setup */
4490 #ifndef TARGET_ABI32
4491     env->idt.limit = 511;
4492 #else
4493     env->idt.limit = 255;
4494 #endif
4495     env->idt.base = target_mmap(0, sizeof(uint64_t) * (env->idt.limit + 1),
4496                                 PROT_READ|PROT_WRITE,
4497                                 MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
4498     idt_table = g2h(env->idt.base);
4499     set_idt(0, 0);
4500     set_idt(1, 0);
4501     set_idt(2, 0);
4502     set_idt(3, 3);
4503     set_idt(4, 3);
4504     set_idt(5, 0);
4505     set_idt(6, 0);
4506     set_idt(7, 0);
4507     set_idt(8, 0);
4508     set_idt(9, 0);
4509     set_idt(10, 0);
4510     set_idt(11, 0);
4511     set_idt(12, 0);
4512     set_idt(13, 0);
4513     set_idt(14, 0);
4514     set_idt(15, 0);
4515     set_idt(16, 0);
4516     set_idt(17, 0);
4517     set_idt(18, 0);
4518     set_idt(19, 0);
4519     set_idt(0x80, 3);
4520 
4521     /* linux segment setup */
4522     {
4523         uint64_t *gdt_table;
4524         env->gdt.base = target_mmap(0, sizeof(uint64_t) * TARGET_GDT_ENTRIES,
4525                                     PROT_READ|PROT_WRITE,
4526                                     MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
4527         env->gdt.limit = sizeof(uint64_t) * TARGET_GDT_ENTRIES - 1;
4528         gdt_table = g2h(env->gdt.base);
4529 #ifdef TARGET_ABI32
4530         write_dt(&gdt_table[__USER_CS >> 3], 0, 0xfffff,
4531                  DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | DESC_S_MASK |
4532                  (3 << DESC_DPL_SHIFT) | (0xa << DESC_TYPE_SHIFT));
4533 #else
4534         /* 64 bit code segment */
4535         write_dt(&gdt_table[__USER_CS >> 3], 0, 0xfffff,
4536                  DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | DESC_S_MASK |
4537                  DESC_L_MASK |
4538                  (3 << DESC_DPL_SHIFT) | (0xa << DESC_TYPE_SHIFT));
4539 #endif
4540         write_dt(&gdt_table[__USER_DS >> 3], 0, 0xfffff,
4541                  DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | DESC_S_MASK |
4542                  (3 << DESC_DPL_SHIFT) | (0x2 << DESC_TYPE_SHIFT));
4543     }
4544     cpu_x86_load_seg(env, R_CS, __USER_CS);
4545     cpu_x86_load_seg(env, R_SS, __USER_DS);
4546 #ifdef TARGET_ABI32
4547     cpu_x86_load_seg(env, R_DS, __USER_DS);
4548     cpu_x86_load_seg(env, R_ES, __USER_DS);
4549     cpu_x86_load_seg(env, R_FS, __USER_DS);
4550     cpu_x86_load_seg(env, R_GS, __USER_DS);
4551     /* This hack makes Wine work... */
4552     env->segs[R_FS].selector = 0;
4553 #else
4554     cpu_x86_load_seg(env, R_DS, 0);
4555     cpu_x86_load_seg(env, R_ES, 0);
4556     cpu_x86_load_seg(env, R_FS, 0);
4557     cpu_x86_load_seg(env, R_GS, 0);
4558 #endif
4559 #elif defined(TARGET_AARCH64)
4560     {
4561         int i;
4562 
4563         if (!(arm_feature(env, ARM_FEATURE_AARCH64))) {
4564             fprintf(stderr,
4565                     "The selected ARM CPU does not support 64 bit mode\n");
4566             exit(EXIT_FAILURE);
4567         }
4568 
4569         for (i = 0; i < 31; i++) {
4570             env->xregs[i] = regs->regs[i];
4571         }
4572         env->pc = regs->pc;
4573         env->xregs[31] = regs->sp;
4574     }
4575 #elif defined(TARGET_ARM)
4576     {
4577         int i;
4578         cpsr_write(env, regs->uregs[16], CPSR_USER | CPSR_EXEC,
4579                    CPSRWriteByInstr);
4580         for(i = 0; i < 16; i++) {
4581             env->regs[i] = regs->uregs[i];
4582         }
4583 #ifdef TARGET_WORDS_BIGENDIAN
4584         /* Enable BE8.  */
4585         if (EF_ARM_EABI_VERSION(info->elf_flags) >= EF_ARM_EABI_VER4
4586             && (info->elf_flags & EF_ARM_BE8)) {
4587             env->uncached_cpsr |= CPSR_E;
4588             env->cp15.sctlr_el[1] |= SCTLR_E0E;
4589         } else {
4590             env->cp15.sctlr_el[1] |= SCTLR_B;
4591         }
4592 #endif
4593     }
4594 #elif defined(TARGET_UNICORE32)
4595     {
4596         int i;
4597         cpu_asr_write(env, regs->uregs[32], 0xffffffff);
4598         for (i = 0; i < 32; i++) {
4599             env->regs[i] = regs->uregs[i];
4600         }
4601     }
4602 #elif defined(TARGET_SPARC)
4603     {
4604         int i;
4605 	env->pc = regs->pc;
4606 	env->npc = regs->npc;
4607         env->y = regs->y;
4608         for(i = 0; i < 8; i++)
4609             env->gregs[i] = regs->u_regs[i];
4610         for(i = 0; i < 8; i++)
4611             env->regwptr[i] = regs->u_regs[i + 8];
4612     }
4613 #elif defined(TARGET_PPC)
4614     {
4615         int i;
4616 
4617 #if defined(TARGET_PPC64)
4618         int flag = (env->insns_flags2 & PPC2_BOOKE206) ? MSR_CM : MSR_SF;
4619 #if defined(TARGET_ABI32)
4620         env->msr &= ~((target_ulong)1 << flag);
4621 #else
4622         env->msr |= (target_ulong)1 << flag;
4623 #endif
4624 #endif
4625         env->nip = regs->nip;
4626         for(i = 0; i < 32; i++) {
4627             env->gpr[i] = regs->gpr[i];
4628         }
4629     }
4630 #elif defined(TARGET_M68K)
4631     {
4632         env->pc = regs->pc;
4633         env->dregs[0] = regs->d0;
4634         env->dregs[1] = regs->d1;
4635         env->dregs[2] = regs->d2;
4636         env->dregs[3] = regs->d3;
4637         env->dregs[4] = regs->d4;
4638         env->dregs[5] = regs->d5;
4639         env->dregs[6] = regs->d6;
4640         env->dregs[7] = regs->d7;
4641         env->aregs[0] = regs->a0;
4642         env->aregs[1] = regs->a1;
4643         env->aregs[2] = regs->a2;
4644         env->aregs[3] = regs->a3;
4645         env->aregs[4] = regs->a4;
4646         env->aregs[5] = regs->a5;
4647         env->aregs[6] = regs->a6;
4648         env->aregs[7] = regs->usp;
4649         env->sr = regs->sr;
4650         ts->sim_syscalls = 1;
4651     }
4652 #elif defined(TARGET_MICROBLAZE)
4653     {
4654         env->regs[0] = regs->r0;
4655         env->regs[1] = regs->r1;
4656         env->regs[2] = regs->r2;
4657         env->regs[3] = regs->r3;
4658         env->regs[4] = regs->r4;
4659         env->regs[5] = regs->r5;
4660         env->regs[6] = regs->r6;
4661         env->regs[7] = regs->r7;
4662         env->regs[8] = regs->r8;
4663         env->regs[9] = regs->r9;
4664         env->regs[10] = regs->r10;
4665         env->regs[11] = regs->r11;
4666         env->regs[12] = regs->r12;
4667         env->regs[13] = regs->r13;
4668         env->regs[14] = regs->r14;
4669         env->regs[15] = regs->r15;
4670         env->regs[16] = regs->r16;
4671         env->regs[17] = regs->r17;
4672         env->regs[18] = regs->r18;
4673         env->regs[19] = regs->r19;
4674         env->regs[20] = regs->r20;
4675         env->regs[21] = regs->r21;
4676         env->regs[22] = regs->r22;
4677         env->regs[23] = regs->r23;
4678         env->regs[24] = regs->r24;
4679         env->regs[25] = regs->r25;
4680         env->regs[26] = regs->r26;
4681         env->regs[27] = regs->r27;
4682         env->regs[28] = regs->r28;
4683         env->regs[29] = regs->r29;
4684         env->regs[30] = regs->r30;
4685         env->regs[31] = regs->r31;
4686         env->sregs[SR_PC] = regs->pc;
4687     }
4688 #elif defined(TARGET_MIPS)
4689     {
4690         int i;
4691 
4692         for(i = 0; i < 32; i++) {
4693             env->active_tc.gpr[i] = regs->regs[i];
4694         }
4695         env->active_tc.PC = regs->cp0_epc & ~(target_ulong)1;
4696         if (regs->cp0_epc & 1) {
4697             env->hflags |= MIPS_HFLAG_M16;
4698         }
4699         if (((info->elf_flags & EF_MIPS_NAN2008) != 0) !=
4700             ((env->active_fpu.fcr31 & (1 << FCR31_NAN2008)) != 0)) {
4701             if ((env->active_fpu.fcr31_rw_bitmask &
4702                   (1 << FCR31_NAN2008)) == 0) {
4703                 fprintf(stderr, "ELF binary's NaN mode not supported by CPU\n");
4704                 exit(1);
4705             }
4706             if ((info->elf_flags & EF_MIPS_NAN2008) != 0) {
4707                 env->active_fpu.fcr31 |= (1 << FCR31_NAN2008);
4708             } else {
4709                 env->active_fpu.fcr31 &= ~(1 << FCR31_NAN2008);
4710             }
4711             restore_snan_bit_mode(env);
4712         }
4713     }
4714 #elif defined(TARGET_OPENRISC)
4715     {
4716         int i;
4717 
4718         for (i = 0; i < 32; i++) {
4719             env->gpr[i] = regs->gpr[i];
4720         }
4721 
4722         env->sr = regs->sr;
4723         env->pc = regs->pc;
4724     }
4725 #elif defined(TARGET_SH4)
4726     {
4727         int i;
4728 
4729         for(i = 0; i < 16; i++) {
4730             env->gregs[i] = regs->regs[i];
4731         }
4732         env->pc = regs->pc;
4733     }
4734 #elif defined(TARGET_ALPHA)
4735     {
4736         int i;
4737 
4738         for(i = 0; i < 28; i++) {
4739             env->ir[i] = ((abi_ulong *)regs)[i];
4740         }
4741         env->ir[IR_SP] = regs->usp;
4742         env->pc = regs->pc;
4743     }
4744 #elif defined(TARGET_CRIS)
4745     {
4746 	    env->regs[0] = regs->r0;
4747 	    env->regs[1] = regs->r1;
4748 	    env->regs[2] = regs->r2;
4749 	    env->regs[3] = regs->r3;
4750 	    env->regs[4] = regs->r4;
4751 	    env->regs[5] = regs->r5;
4752 	    env->regs[6] = regs->r6;
4753 	    env->regs[7] = regs->r7;
4754 	    env->regs[8] = regs->r8;
4755 	    env->regs[9] = regs->r9;
4756 	    env->regs[10] = regs->r10;
4757 	    env->regs[11] = regs->r11;
4758 	    env->regs[12] = regs->r12;
4759 	    env->regs[13] = regs->r13;
4760 	    env->regs[14] = info->start_stack;
4761 	    env->regs[15] = regs->acr;
4762 	    env->pc = regs->erp;
4763     }
4764 #elif defined(TARGET_S390X)
4765     {
4766             int i;
4767             for (i = 0; i < 16; i++) {
4768                 env->regs[i] = regs->gprs[i];
4769             }
4770             env->psw.mask = regs->psw.mask;
4771             env->psw.addr = regs->psw.addr;
4772     }
4773 #elif defined(TARGET_TILEGX)
4774     {
4775         int i;
4776         for (i = 0; i < TILEGX_R_COUNT; i++) {
4777             env->regs[i] = regs->regs[i];
4778         }
4779         for (i = 0; i < TILEGX_SPR_COUNT; i++) {
4780             env->spregs[i] = 0;
4781         }
4782         env->pc = regs->pc;
4783     }
4784 #else
4785 #error unsupported target CPU
4786 #endif
4787 
4788 #if defined(TARGET_ARM) || defined(TARGET_M68K) || defined(TARGET_UNICORE32)
4789     ts->stack_base = info->start_stack;
4790     ts->heap_base = info->brk;
4791     /* This will be filled in on the first SYS_HEAPINFO call.  */
4792     ts->heap_limit = 0;
4793 #endif
4794 
4795     if (gdbstub_port) {
4796         if (gdbserver_start(gdbstub_port) < 0) {
4797             fprintf(stderr, "qemu: could not open gdbserver on port %d\n",
4798                     gdbstub_port);
4799             exit(EXIT_FAILURE);
4800         }
4801         gdb_handlesig(cpu, 0);
4802     }
4803     cpu_loop(env);
4804     /* never exits */
4805     return 0;
4806 }
4807