Commit graph

42 commits

Author SHA1 Message Date
Sergey Fedorov ba9a237586
tcg: Rework tb_invalidated_flag
'tb_invalidated_flag' was meant to catch two events:
* some TB has been invalidated by tb_phys_invalidate();
* the whole translation buffer has been flushed by tb_flush().

Then it was checked:
* in cpu_exec() to ensure that the last executed TB can be safely
linked to directly call the next one;
* in cpu_exec_nocache() to decide if the original TB should be provided
for further possible invalidation along with the temporarily
generated TB.

It is always safe to patch an invalidated TB since it is not going to be
used anyway. It is also safe to call tb_phys_invalidate() for an already
invalidated TB. Thus, setting this flag in tb_phys_invalidate() is
simply unnecessary. Moreover, it can prevent from pretty proper linking
of TBs, if any arbitrary TB has been invalidated. So just don't touch it
in tb_phys_invalidate().

If this flag is only used to catch whether tb_flush() has been called
then rename it to 'tb_flushed'. Declare it as 'bool' and stick to using
only 'true' and 'false' to set its value. Also, instead of setting it in
tb_gen_code(), just after tb_flush() has been called, do it right inside
of tb_flush().

In cpu_exec(), this flag is used to track if tb_flush() has been called
and have made 'next_tb' (a reference to the last executed TB) invalid
for linking it to directly call the next TB. tb_flush() can be called
during the CPU execution loop from tb_gen_code(), during TB execution or
by another thread while 'tb_lock' is released. Catch for translation
buffer flush reliably by resetting this flag once before first TB lookup
and each time we find it set before trying to add a direct jump. Don't
touch in in tb_find_physical().

Each vCPU has its own execution loop in multithreaded mode and thus
should have its own copy of the flag to be able to reset it with its own
'next_tb' and don't affect any other vCPU execution thread. So make this
flag per-vCPU and move it to CPUState.

In cpu_exec_nocache(), we only need to check if tb_flush() has been
called from tb_gen_code() called by cpu_exec_nocache() itself. To do
this reliably, preserve the old value of the flag, reset it before
calling tb_gen_code(), check afterwards, and combine the saved value
back to the flag.

This patch is based on the patch "tcg: move tb_invalidated_flag to
CPUState" from Paolo Bonzini <pbonzini@redhat.com>.

Backports commit 6f789be56d3f38e9214dafcfab3bf9be7191f370 from qemu
2018-02-23 23:34:51 -05:00
Sergey Fedorov c9700af2bd
tcg: Clean up from 'next_tb'
The value returned from tcg_qemu_tb_exec() is the value passed to the
corresponding tcg_gen_exit_tb() at translation time of the last TB
attempted to execute. It is a little confusing to store it in a variable
named 'next_tb'. In fact, it is a combination of 4-byte aligned pointer
and additional information in its two least significant bits. Break it
down right away into two variables named 'last_tb' and 'tb_exit' which
are a pointer to the last TB attempted to execute and the TB exit
reason, correspondingly. This simplifies the code and improves its
readability.

Correct a misleading documentation comment for tcg_qemu_tb_exec() and
fix logging in cpu_tb_exec(). Also rename a misleading 'next_tb' in
another couple of places.

Backports commit 819af24b9c1e95e6576f1cefd32f4d6bf56dfa56 from qemu
2018-02-23 23:29:04 -05:00
Sergey Fedorov 73c59faad5
tcg: Clean up direct block chaining safety checks
We don't take care of direct jumps when address mapping changes. Thus we
must be sure to generate direct jumps so that they always keep valid
even if address mapping changes. Luckily, we can only allow to execute a
TB if it was generated from the pages which match with current mapping.

Document tcg_gen_goto_tb() declaration and note the reason for
destination PC limitations.

Some targets with variable length instructions allow TB to straddle a
page boundary. However, we make sure that both of TB pages match the
current address mapping when looking up TBs. So it is safe to do direct
jumps into the both pages. Correct the checks for some of those targets.

Given that, we can safely patch a TB which spans two pages. Remove the
unnecessary check in cpu_exec() and allow such TBs to be patched.

Backports commit 5b053a4a28278bca606eeff7d1c0730df1b047e9 from qemu
2018-02-23 22:26:00 -05:00
Emilio G. Cota 170f6e0b3b
tb: consistently use uint32_t for tb->flags
We are inconsistent with the type of tb->flags: usage varies loosely
between int and uint64_t. Settle to uint32_t everywhere, which is
superior to both: at least one target (aarch64) uses the most significant
bit in the u32, and uint64_t is wasteful.

Compile-tested for all targets.

Backports commit 89fee74a0f066dfd73830a7b5fa137e87888c870 from qemu
2018-02-23 21:28:11 -05:00
Alex Bennée 3da7d9d9ae
qemu-log: dfilter-ise exec, out_asm, op and opt_op
qemu-log: dfilter-ise exec, out_asm, op and opt_op

This ensures the code generation debug code will honour -dfilter if set.
For the "exec" tracing I've added a new inline macro for efficiency's
sake.

Backports commit d977e1c2dbc9e63454b2000f91954d02543bf43b from qemu
2018-02-22 10:06:19 -05:00
Peter Maydell 3f5e36e15f
qemu-log: Improve the exec TB execution logging
Improve the TB execution logging so that it is easier to identify
what is happening from trace logs:
* move the "Trace" logging of executed TBs into cpu_tb_exec()
so that it is emitted if and only if we actually execute a TB,
and for consistency for the CPU state logging
* log when we link two TBs together via tb_add_jump()
* log when cpu_tb_exec() returns early from a chain of TBs

The new style logging looks like this:

Trace 0x7fb7cc822ca0 [ffffffc0000dce00]
Linking TBs 0x7fb7cc822ca0 [ffffffc0000dce00] index 0 -> 0x7fb7cc823110 [ffffffc0000dce10]
Trace 0x7fb7cc823110 [ffffffc0000dce10]
Trace 0x7fb7cc823420 [ffffffc000302688]
Trace 0x7fb7cc8234a0 [ffffffc000302698]
Trace 0x7fb7cc823520 [ffffffc0003026a4]
Trace 0x7fb7cc823560 [ffffffc0000dce44]
Linking TBs 0x7fb7cc823560 [ffffffc0000dce44] index 1 -> 0x7fb7cc8235d0 [ffffffc0000dce70]
Trace 0x7fb7cc8235d0 [ffffffc0000dce70]
Stopped execution of TB chain before 0x7fb7cc8235d0 [ffffffc0000dce70]
Trace 0x7fb7cc8235d0 [ffffffc0000dce70]
Trace 0x7fb7cc822fd0 [ffffffc0000dd52c]

Backports commit 1a830635229e14c403600167823ea6b3b79d3097 from qemu
2018-02-22 09:40:11 -05:00
Peter Maydell 293266a9d8
exec: Clean up includes
Clean up includes so that osdep.h is included first and headers
which it implies are not included manually.

This commit was created with scripts/clean-includes.

Backports commit 7b31bbc2e68605ab2f10dc609dd54cf4c7b5f49a from qemu
2018-02-19 00:49:55 -05:00
Paolo Bonzini 3907ea1a3b
cpu-exec: Fix compiler warning (-Werror=clobbered)
Reloading of local variables after sigsetjmp is only needed for some
buggy compilers.

The code which should reload these variables causes compiler warnings
with gcc 4.7 when compiler optimizations are enabled:

cpu-exec.c:204:15: error:
variable ‘cpu’ might be clobbered by ‘longjmp’ or ‘vfork’ [-Werror=clobbered]
cpu-exec.c:207:15: error:
variable ‘cc’ might be clobbered by ‘longjmp’ or ‘vfork’ [-Werror=clobbered]
cpu-exec.c:202:28: error:
argument ‘env’ might be clobbered by ‘longjmp’ or ‘vfork’ [-Werror=clobbered]

Now this code is only used for compilers which need it
(and gcc 4.5.x, x > 0 which does not need it but won't give warnings).

There were bug reports for clang and gcc 4.5.0, while gcc 4.5.1
was reported to work fine without the reload code. For clang it
is not clear which versions are affected, so simply keep the status quo
for all clang compilations. This can be improved later.

Backports commit 0448f5f8b816923b198ab6c32286fd1f3b2f3e45 from qemu
2018-02-17 15:24:15 -05:00
Richard Henderson e9e8833da4
cpu-exec: Add nochain debug flag
Respect it to avoid linking TBs together.

Backports commit 89a82cd4b6a90fe117fa715e2abe51d5c607560c from qemu
2018-02-17 15:24:04 -05:00
Peter Crosthwaite bf067fcc26
cpu-exec: Migrate some generic fns to cpu-exec-common
The goal is to split the functions such that cpu-exec is CPU specific
content, while cpus-exec-common.c is generic code only. The function
interface to cpu-exec needs to be virtualised to prepare support for
multi-arch and moving these definitions out saves bloating the QOM
interface. So move these definitions out of cpu-exec to a new module,
cpu-exec-common.

Backports commit 5abf9495ca9ff41160260ac274115825c10545cc from qemu
2018-02-17 15:23:51 -05:00
Paolo Bonzini 62045513bb
tcg: synchronize exit_request and tcg_current_cpu accesses
Synchronize the remaining pair of accesses in cpu_signal. These should
be necessary on Windows as well, at least in theory. Probably
SuspendProcess and ResumeProcess introduce some implicit memory
barrier.

Backports relevant parts of commit aed807c8e2bf009b2c6a35490d4fd4383887221d from qemu
2018-02-17 15:23:49 -05:00
Paolo Bonzini 7f1d59bb83
tcg: synchronize cpu->exit_request and cpu->tcg_exit_req accesses
Backports commit ab096a75cd626dcd4ad34b2a11652df0269bee0d from qemu
2018-02-17 15:23:49 -05:00
Paolo Bonzini 1cfd4190a7
tcg: assign cpu->current_tb in a simpler place
TCG has not been reading cpu->current_tb from signal handlers for years.
The code that synchronized cpu_exec with the signal handler is not
needed anymore.

Backports commit b0a46fa796504c7334202877a68c857e49f7c96c from qemu
2018-02-17 15:23:49 -05:00
Paolo Bonzini 96e5a7ced3
tcg: introduce tcg_current_cpu
This is already useful on Windows in order to remove tls.h, because
accesses to current_cpu are done from a different thread on that
platform. It will be used on POSIX platforms as soon TCG stops using
signals to interrupt the execution of translated code.

Backports commit 9373e63297c43752f9cf085feb7f5aed57d959f8 from qemu
2018-02-17 15:23:49 -05:00
Pavel Dovgalyuk 4a05c9ee28
cpu-exec: introduce loop exit with restore function
This patch introduces loop exit function, which also
restores guest CPU state according to the value of host
program counter.

Backports commit 1c3c8af1fb40a481c07749e0448644d9b7700415 from qemu
2018-02-17 15:23:38 -05:00
Peter Crosthwaite e51f8c9f6f
cpu-exec: Purge all uses of ENV_GET_CPU()
Remove un-needed usages of ENV_GET_CPU() by converting the APIs to use
CPUState pointers and retrieving the env_ptr as minimally needed.

Scripted conversion for target-* change:

for I in target-*/cpu.h; do
sed -i \
's/\(^int cpu_[^_]*_exec(\)[^ ][^ ]* \*s);$/\1CPUState *cpu);/' \
$I;
done

Backports commit ea3e9847408131abc840240bd61e892d28459452 from qemu
2018-02-17 15:23:18 -05:00
Peter Crosthwaite 8200453545
translate-all: Change tb_flush() env argument to cpu
All of the core-code usages of this API have the cpu pointer handy so
pass it in. There are only 3 architecture specific usages (2 of which
are commented out) which can just use ENV_GET_CPU() locally to get the
cpu pointer. The reduces core code usage of the CPU env, which brings
us closer to common-obj'ing these core files.

Backports commit bbd77c180d7ff1b04a7661bb878939b2e1d23798 from qemu
2018-02-17 15:23:18 -05:00
Peter Crosthwaite 09d23c6604
include/exec: Move tb hash functions out
This is one of very few things in exec-all with a genuine CPU
architecture dependency. Move these hashing helpers to a new
header to trim exec-all.h down to a near architecture-agnostic
header.

The defs are only used by cpu-exec and translate-all which are both
arch-obj's so the new tb-hash.h has no core code usage.

Backports commit e1b89321bafea9fb33d87852fc91fee579d17dfe from qemu
2018-02-17 15:23:15 -05:00
Paolo Bonzini a46accd252
exec: make iotlb RCU-friendly
After the previous patch, TLBs will be flushed on every change to
the memory mapping. This patch augments that with synchronization
of the MemoryRegionSections referred to in the iotlb array.

With this change, it is guaranteed that iotlb_to_region will access
the correct memory map, even once the TLB will be accessed outside
the BQL.

Backports commit 9d82b5a792236db31a75b9db5c93af69ac07c7c5 from qemu
2018-02-12 15:20:39 -05:00
Paolo Bonzini 3fbda890df
exec: introduce cpu_reload_memory_map
This for now is a simple TLB flush. This can change later for two
reasons:

1) an AddressSpaceDispatch will be cached in the CPUState object

2) it will not be possible to do tlb_flush once the TCG-generated code
runs outside the BQL.

Backports commit 76e5c76f2e2e0d20bab2cd5c7a87452f711654fb from qemu
2018-02-12 15:09:49 -05:00
Andrew Dutcher 363cbacee4 Only set eip to the instruction pointer after an interrupt if the interrupt was user-generated (#875) 2017-08-29 17:14:36 +07:00
xorstream b0ae2138fb Merge remote-tracking branch 'unicorn-engine/master' into msvc_native 2017-01-20 22:37:51 +11:00
Nguyen Anh Quynh 42771848d6 no more spinlock 2017-01-20 14:57:33 +08:00
xorstream 1aeaf5c40d This code should now build the x86_x64-softmmu part 2. 2017-01-19 22:50:28 +11:00
Hoang-Vu Dang 9a2a5b15d8 Rename unhandled CPU exception 2016-07-05 11:10:39 -05:00
Hoang-Vu Dang 9cdca5a32b Unhandled interrupt will halt execution 2016-07-04 17:07:57 -05:00
Nguyen Anh Quynh c8569d8128 arm: fix change PC feature. now tests/regress/callback-pc.py passes 2016-01-28 16:03:19 +08:00
Nguyen Anh Quynh 5a04bcb115 allow to change PC during callback. this solves issue #210 2016-01-28 14:06:17 +08:00
Ryan Hileman 93052f6566 refactor to allow multiple hooks for one type 2016-01-22 18:41:43 -08:00
farmdve c9f4bd27cc Reset env->invalid_error before executing a translation block. 2016-01-11 18:12:57 +02:00
Nguyen Anh Quynh 9099755ca1 flush JIT cache before finishing emulation. this fixes issue #263. TODO: optimize this for better performance 2015-11-13 23:57:03 +08:00
Nguyen Anh Quynh 938d0b89eb x86: check for exit request after every hooked instruction. this should fix issue #232 2015-11-07 01:02:45 +08:00
Nguyen Anh Quynh 9e64cba6ec Rename some hook related enums:
- UC_ERR_READ_INVALID -> UC_ERR_READ_UNMAPPED
 - UC_ERR_WRITE_INVALID -> UC_ERR_WRITE_UNMAPPED
 - UC_ERR_FETCH_INVALID -> UC_ERR_FETCH_UNMAPPED
 - UC_MEM_READ_INVALID -> UC_MEM_READ_UNMAPPED
 - UC_MEM_WRITE_INVALID -> UC_MEM_WRITE_UNMAPPED
 - UC_MEM_FETCH_INVALID -> UC_MEM_FETCH_UNMAPPED
 - UC_HOOK_MEM_READ_INVALID -> UC_HOOK_MEM_READ_UNMAPPED
 - UC_HOOK_MEM_WRITE_INVALID -> UC_HOOK_MEM_WRITE_UNMAPPED
 - UC_HOOK_MEM_FETCH_INVALID -> UC_HOOK_MEM_FETCH_UNMAPPED
 - UC_HOOK_MEM_INVALID -> UC_HOOK_MEM_UNMAPPED

This also renames some newly added macros to use _INVALID postfix:

 - UC_HOOK_MEM_READ_ERR -> UC_HOOK_MEM_READ_INVALID
 - UC_HOOK_MEM_WRITE_ERR -> UC_HOOK_MEM_WRITE_INVALID
 - UC_HOOK_MEM_FETCH_ERR -> UC_HOOK_MEM_FETCH_INVALID
 - UC_HOOK_MEM_ERR -> UC_HOOK_MEM_INVALID

Fixed all the bindings Java, Go & Python.
2015-09-30 14:46:55 +08:00
Nguyen Anh Quynh 2b0b4169bc mips: advance PC for SYSCALL instruction. this fixes issue #157 2015-09-28 10:58:43 +08:00
Nguyen Anh Quynh 886946dcf4 do not use syscall to quit emulation. this can fix issues #147 & #148 2015-09-26 16:49:00 +08:00
Nguyen Anh Quynh a166c24f8e x86: correct EIP of INT instruction by updating it only after calling interrupt handler 2015-09-06 14:58:11 +08:00
Jonathon Reinhart 2c802a3e4b Merge remote-tracking branch 'upstream/master' into change-handle-based-api
# Conflicts:
#	qemu/target-i386/unicorn.c
2015-09-01 13:17:03 -04:00
Nguyen Anh Quynh bea73ef213 stop emulation when hitting invalid code address. this fixes issue #82 2015-09-01 00:17:55 +08:00
Jonathon Reinhart 3bd705a060 Merge remote-tracking branch 'upstream/master' into change-handle-based-api 2015-08-30 00:23:51 -04:00
Nguyen Anh Quynh 4a1c5ff071 x86: verify until address early when translating block in frontend. this should fix issue #63 2015-08-28 16:06:06 +08:00
Jonathon Reinhart fcb099805f change uch to uc_struct (qemu) 2015-08-26 09:02:16 -04:00
Nguyen Anh Quynh 344d016104 import 2015-08-21 15:04:50 +08:00