/*

* Virtual page mapping

*

* Copyright (c) 2003 Fabrice Bellard

*

* This library is free software; you can redistribute it and/or

* modify it under the terms of the GNU Lesser General Public

* License as published by the Free Software Foundation; either

* version 2 of the License, or (at your option) any later version.

*

* This library is distributed in the hope that it will be useful,

* but WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU

* Lesser General Public License for more details.

*

* You should have received a copy of the GNU Lesser General Public

* License along with this library; if not, see <http://www.gnu.org/licenses/>.

*/

#include "qemu/osdep.h"

#include "qapi/error.h"

#ifndef _WIN32

#endif

#include "qemu/cutils.h"

#include "cpu.h"

#include "exec/exec-all.h"

#include "tcg.h"

#include "hw/qdev-core.h"

#if !defined(CONFIG_USER_ONLY)

#include "hw/boards.h"

#include "hw/xen/xen.h"

#endif

#include "sysemu/kvm.h"

#include "sysemu/sysemu.h"

#include "qemu/timer.h"

#include "qemu/config-file.h"

#include "qemu/error-report.h"

#if defined(CONFIG_USER_ONLY)

#include "qemu.h"

#else /* !CONFIG_USER_ONLY */

#include "hw/hw.h"

#include "exec/memory.h"

#include "exec/ioport.h"

#include "sysemu/dma.h"

#include "sysemu/numa.h"

#include "sysemu/hw_accel.h"

#include "exec/address-spaces.h"

#include "sysemu/xen-mapcache.h"

#include "trace-root.h"

#include "panda/rr/rr_log.h"

#ifdef CONFIG_FALLOCATE_PUNCH_HOLE

#include <fcntl.h>

#include <linux/falloc.h>

#endif

#endif

#include "exec/cpu-all.h"

#include "qemu/rcu_queue.h"

#include "qemu/main-loop.h"

#include "translate-all.h"

#include "sysemu/replay.h"

#include "exec/memory-internal.h"

#include "exec/ram_addr.h"

#include "exec/log.h"

#include "migration/vmstate.h"

#include "qemu/range.h"

#ifndef _WIN32

#include "qemu/mmap-alloc.h"

#endif

#include <zlib.h>

#include "panda/callbacks/cb-support.h"

#include "panda/checkpoint.h"

//#define DEBUG_SUBPAGE

#if !defined(CONFIG_USER_ONLY)

/* ram_list is read under rcu_read_lock()/rcu_read_unlock(). Writes

* are protected by the ramlist lock.

*/

RAMList ram_list = { .blocks = QLIST_HEAD_INITIALIZER(ram_list.blocks) };

static MemoryRegion *system_memory;

static MemoryRegion *system_io;

AddressSpace address_space_io;

AddressSpace address_space_memory;

MemoryRegion io_mem_rom, io_mem_notdirty;

static MemoryRegion io_mem_unassigned;

/* RAM is pre-allocated and passed into qemu_ram_alloc_from_ptr */

#define RAM_PREALLOC (1 << 0)

/* RAM is mmap-ed with MAP_SHARED */

#define RAM_SHARED (1 << 1)

/* Only a portion of RAM (used_length) is actually used, and migrated.

* This used_length size can change across reboots.

*/

#define RAM_RESIZEABLE (1 << 2)

#endif

#ifdef TARGET_PAGE_BITS_VARY

int target_page_bits;

bool target_page_bits_decided;

#endif

struct CPUTailQ cpus = QTAILQ_HEAD_INITIALIZER(cpus);

/* current CPU in the current thread. It is only valid inside

cpu_exec() */

__thread CPUState *current_cpu;

/* 0 = Do not count executed instructions.

1 = Precise instruction counting.

2 = Adaptive rate instruction counting. */

int use_icount;

bool set_preferred_target_page_bits(int bits)

{

/* The target page size is the lowest common denominator for all

* the CPUs in the system, so we can only make it smaller, never

* larger. And we can't make it smaller once we've committed to

* a particular size.

*/

#ifdef TARGET_PAGE_BITS_VARY

assert(bits >= TARGET_PAGE_BITS_MIN);

if (target_page_bits == 0 || target_page_bits > bits) {

if (target_page_bits_decided) {

return false;

}

target_page_bits = bits;

}

#endif

return true;

}

#if !defined(CONFIG_USER_ONLY)

static void finalize_target_page_bits(void)

{

#ifdef TARGET_PAGE_BITS_VARY

if (target_page_bits == 0) {

target_page_bits = TARGET_PAGE_BITS_MIN;

}

target_page_bits_decided = true;

#endif

}

typedef struct PhysPageEntry PhysPageEntry;

struct PhysPageEntry {

};

#define PHYS_MAP_NODE_NIL (((uint32_t)~0) >> 6)

/* Size of the L2 (and L3, etc) page tables. */

#define ADDR_SPACE_BITS 64

#define P_L2_BITS 9

#define P_L2_SIZE (1 << P_L2_BITS)

#define P_L2_LEVELS (((ADDR_SPACE_BITS - TARGET_PAGE_BITS - 1) / P_L2_BITS) 1)

typedef PhysPageEntry Node[P_L2_SIZE];

typedef struct PhysPageMap {

} PhysPageMap;

struct AddressSpaceDispatch {

};

#define SUBPAGE_IDX(addr) ((addr) & ~TARGET_PAGE_MASK)

typedef struct subpage_t {

} subpage_t;

#define PHYS_SECTION_UNASSIGNED 0

#define PHYS_SECTION_NOTDIRTY 1

#define PHYS_SECTION_ROM 2

#define PHYS_SECTION_WATCH 3

static void io_mem_init(void);

static void memory_map_init(void);

static void tcg_commit(MemoryListener *listener);

static MemoryRegion io_mem_watch;

/**

* CPUAddressSpace: all the information a CPU needs about an AddressSpace

* @cpu: the CPU whose AddressSpace this is

* @as: the AddressSpace itself

* @memory_dispatch: its dispatch pointer (cached, RCU protected)

* @tcg_as_listener: listener for tracking changes to the AddressSpace

*/

struct CPUAddressSpace {

};

#endif

#if !defined(CONFIG_USER_ONLY)

static void phys_map_node_reserve(PhysPageMap *map, unsigned nodes)

{

static unsigned alloc_hint = 16;

if (map->nodes_nb nodes > map->nodes_nb_alloc) {

map->nodes_nb_alloc = MAX(map->nodes_nb_alloc, alloc_hint);

map->nodes_nb_alloc = MAX(map->nodes_nb_alloc, map->nodes_nb nodes);

map->nodes = g_renew(Node, map->nodes, map->nodes_nb_alloc);

alloc_hint = map->nodes_nb_alloc;

}

}

static uint32_t phys_map_node_alloc(PhysPageMap *map, bool leaf)

{

unsigned i;

uint32_t ret;

PhysPageEntry e;

PhysPageEntry *p;

ret = map->nodes_nb ;

p = map->nodes[ret];

assert(ret != PHYS_MAP_NODE_NIL);

assert(ret != map->nodes_nb_alloc);

e.skip = leaf ? 0 : 1;

e.ptr = leaf ? PHYS_SECTION_UNASSIGNED : PHYS_MAP_NODE_NIL;

for (i = 0; i < P_L2_SIZE; i) {

memcpy(&p[i], &e, sizeof(e));

}

return ret;

}

static void phys_page_set_level(PhysPageMap *map, PhysPageEntry *lp,

hwaddr *index, hwaddr *nb, uint16_t leaf,

int level)

{

PhysPageEntry *p;

hwaddr step = (hwaddr)1 << (level * P_L2_BITS);

if (lp->skip && lp->ptr == PHYS_MAP_NODE_NIL) {

lp->ptr = phys_map_node_alloc(map, level == 0);

}

p = map->nodes[lp->ptr];

lp = &p[(*index >> (level * P_L2_BITS)) & (P_L2_SIZE - 1)];

while (*nb && lp < &p[P_L2_SIZE]) {

if ((*index & (step - 1)) == 0 && *nb >= step) {

lp->skip = 0;

lp->ptr = leaf;

*index = step;

*nb -= step;

} else {

phys_page_set_level(map, lp, index, nb, leaf, level - 1);

}

lp;

}

}

static void phys_page_set(AddressSpaceDispatch *d,

hwaddr index, hwaddr nb,

uint16_t leaf)

{

/* Wildly overreserve - it doesn't matter much. */

phys_map_node_reserve(&d->map, 3 * P_L2_LEVELS);

phys_page_set_level(&d->map, &d->phys_map, &index, &nb, leaf, P_L2_LEVELS - 1);

}

/* Compact a non leaf page entry. Simply detect that the entry has a single child,

* and update our entry so we can skip it and go directly to the destination.

*/

static void phys_page_compact(PhysPageEntry *lp, Node *nodes)

{

unsigned valid_ptr = P_L2_SIZE;

int valid = 0;

PhysPageEntry *p;

int i;

if (lp->ptr == PHYS_MAP_NODE_NIL) {

return;

}

p = nodes[lp->ptr];

for (i = 0; i < P_L2_SIZE; i ) {

if (p[i].ptr == PHYS_MAP_NODE_NIL) {

continue;

}

valid_ptr = i;

valid ;

if (p[i].skip) {

phys_page_compact(&p[i], nodes);

}

}

/* We can only compress if there's only one child. */

if (valid != 1) {

return;

}

assert(valid_ptr < P_L2_SIZE);

/* Don't compress if it won't fit in the # of bits we have. */

if (lp->skip p[valid_ptr].skip >= (1 << 3)) {

return;

}

lp->ptr = p[valid_ptr].ptr;

if (!p[valid_ptr].skip) {

/* If our only child is a leaf, make this a leaf. */

/* By design, we should have made this node a leaf to begin with so we

* should never reach here.

* But since it's so simple to handle this, let's do it just in case we

* change this rule.

*/

lp->skip = 0;

} else {

lp->skip = p[valid_ptr].skip;

}

}

static void phys_page_compact_all(AddressSpaceDispatch *d, int nodes_nb)

{

if (d->phys_map.skip) {

phys_page_compact(&d->phys_map, d->map.nodes);

}

}

static inline bool section_covers_addr(const MemoryRegionSection *section,

hwaddr addr)

{

/* Memory topology clips a memory region to [0, 2^64); size.hi > 0 means

* the section must cover the entire address space.

*/

return int128_gethi(section->size) ||

range_covers_byte(section->offset_within_address_space,

int128_getlo(section->size), addr);

}

static MemoryRegionSection *phys_page_find(PhysPageEntry lp, hwaddr addr,

Node *nodes, MemoryRegionSection *sections)

{

PhysPageEntry *p;

hwaddr index = addr >> TARGET_PAGE_BITS;

int i;

for (i = P_L2_LEVELS; lp.skip && (i -= lp.skip) >= 0;) {

if (lp.ptr == PHYS_MAP_NODE_NIL) {

return &sections[PHYS_SECTION_UNASSIGNED];

}

p = nodes[lp.ptr];

lp = p[(index >> (i * P_L2_BITS)) & (P_L2_SIZE - 1)];

}

if (section_covers_addr(&sections[lp.ptr], addr)) {

return &sections[lp.ptr];

} else {

return &sections[PHYS_SECTION_UNASSIGNED];

}

}

bool memory_region_is_unassigned(MemoryRegion *mr)

{

return mr != &io_mem_rom && mr != &io_mem_notdirty && !mr->rom_device

&& mr != &io_mem_watch;

}

/* Called from RCU critical section */

static MemoryRegionSection *address_space_lookup_region(AddressSpaceDispatch *d,

hwaddr addr,

bool resolve_subpage)

{

MemoryRegionSection *section = atomic_read(&d->mru_section);

subpage_t *subpage;

bool update;

if (section && section != &d->map.sections[PHYS_SECTION_UNASSIGNED] &&

section_covers_addr(section, addr)) {

update = false;

} else {

section = phys_page_find(d->phys_map, addr, d->map.nodes,

d->map.sections);

update = true;

}

if (resolve_subpage && section->mr->subpage) {

subpage = container_of(section->mr, subpage_t, iomem);

section = &d->map.sections[subpage->sub_section[SUBPAGE_IDX(addr)]];

}

if (update) {

atomic_set(&d->mru_section, section);

}

return section;

}

/* Called from RCU critical section */

static MemoryRegionSection *

address_space_translate_internal(AddressSpaceDispatch *d, hwaddr addr, hwaddr *xlat,

hwaddr *plen, bool resolve_subpage)

{

MemoryRegionSection *section;

MemoryRegion *mr;

Int128 diff;

section = address_space_lookup_region(d, addr, resolve_subpage);

/* Compute offset within MemoryRegionSection */

addr -= section->offset_within_address_space;

/* Compute offset within MemoryRegion */

*xlat = addr section->offset_within_region;

mr = section->mr;

/* MMIO registers can be expected to perform full-width accesses based only

* on their address, without considering adjacent registers that could

* decode to completely different MemoryRegions. When such registers

* exist (e.g. I/O ports 0xcf8 and 0xcf9 on most PC chipsets), MMIO

* regions overlap wildly. For this reason we cannot clamp the accesses

* here.

*

* If the length is small (as is the case for address_space_ldl/stl),

* everything works fine. If the incoming length is large, however,

* the caller really has to do the clamping through memory_access_size.

*/

if (memory_region_is_ram(mr)) {

diff = int128_sub(section->size, int128_make64(addr));

*plen = int128_get64(int128_min(diff, int128_make64(*plen)));

}

return section;

}

/* Called from RCU critical section */

IOMMUTLBEntry address_space_get_iotlb_entry(AddressSpace *as, hwaddr addr,

bool is_write)

{

IOMMUTLBEntry iotlb = {0};

MemoryRegionSection *section;

MemoryRegion *mr;

for (;;) {

AddressSpaceDispatch *d = atomic_rcu_read(&as->dispatch);

section = address_space_lookup_region(d, addr, false);

addr = addr - section->offset_within_address_space

section->offset_within_region;

mr = section->mr;

if (!mr->iommu_ops) {

break;

}

iotlb = mr->iommu_ops->translate(mr, addr, is_write);

if (!(iotlb.perm & (1 << is_write))) {

iotlb.target_as = NULL;

break;

}

addr = ((iotlb.translated_addr & ~iotlb.addr_mask)

| (addr & iotlb.addr_mask));

as = iotlb.target_as;

}

return iotlb;

}

/* Called from RCU critical section */

MemoryRegion *address_space_translate(AddressSpace *as, hwaddr addr,

hwaddr *xlat, hwaddr *plen,

bool is_write)

{

IOMMUTLBEntry iotlb;

MemoryRegionSection *section;

MemoryRegion *mr;

for (;;) {

AddressSpaceDispatch *d = atomic_rcu_read(&as->dispatch);

section = address_space_translate_internal(d, addr, &addr, plen, true);

mr = section->mr;

if (!mr->iommu_ops) {

break;

}

iotlb = mr->iommu_ops->translate(mr, addr, is_write);

addr = ((iotlb.translated_addr & ~iotlb.addr_mask)

| (addr & iotlb.addr_mask));

*plen = MIN(*plen, (addr | iotlb.addr_mask) - addr 1);

if (!(iotlb.perm & (1 << is_write))) {

mr = &io_mem_unassigned;

break;

}

as = iotlb.target_as;

}

if (xen_enabled() && memory_access_is_direct(mr, is_write)) {

hwaddr page = ((addr & TARGET_PAGE_MASK) TARGET_PAGE_SIZE) - addr;

*plen = MIN(page, *plen);

}

*xlat = addr;

return mr;

}

/* Called from RCU critical section */

MemoryRegionSection *

address_space_translate_for_iotlb(CPUState *cpu, int asidx, hwaddr addr,

hwaddr *xlat, hwaddr *plen)

{

MemoryRegionSection *section;

AddressSpaceDispatch *d = atomic_rcu_read(&cpu->cpu_ases[asidx].memory_dispatch);

section = address_space_translate_internal(d, addr, xlat, plen, false);

assert(!section->mr->iommu_ops);

return section;

}

#endif

#if !defined(CONFIG_USER_ONLY)

static int cpu_common_post_load(void *opaque, int version_id)

{

CPUState *cpu = opaque;

/* 0x01 was CPU_INTERRUPT_EXIT. This line can be removed when the

version_id is increased. */

cpu->interrupt_request &= ~0x01;

tlb_flush(cpu);

return 0;

}

static int cpu_common_pre_load(void *opaque)

{

CPUState *cpu = opaque;

cpu->exception_index = -1;

return 0;

}

static bool cpu_common_exception_index_needed(void *opaque)

{

CPUState *cpu = opaque;

return tcg_enabled() && cpu->exception_index != -1;

}

static const VMStateDescription vmstate_cpu_common_exception_index = {

.name = "cpu_common/exception_index",

.version_id = 1,

.minimum_version_id = 1,

.needed = cpu_common_exception_index_needed,

.fields = (VMStateField[]) {

VMSTATE_INT32(exception_index, CPUState),

VMSTATE_END_OF_LIST()

}

};

static bool cpu_common_crash_occurred_needed(void *opaque)

{

CPUState *cpu = opaque;

return cpu->crash_occurred;

}

static const VMStateDescription vmstate_cpu_common_crash_occurred = {

.name = "cpu_common/crash_occurred",

.version_id = 1,

.minimum_version_id = 1,

.needed = cpu_common_crash_occurred_needed,

.fields = (VMStateField[]) {

VMSTATE_BOOL(crash_occurred, CPUState),

VMSTATE_END_OF_LIST()

}

};

const VMStateDescription vmstate_cpu_common = {

.name = "cpu_common",

.version_id = 1,

.minimum_version_id = 1,

.pre_load = cpu_common_pre_load,

.post_load = cpu_common_post_load,

.fields = (VMStateField[]) {

VMSTATE_UINT32(halted, CPUState),

VMSTATE_UINT32(interrupt_request, CPUState),

VMSTATE_END_OF_LIST()

},

.subsections = (const VMStateDescription*[]) {

&vmstate_cpu_common_exception_index,

&vmstate_cpu_common_crash_occurred,

NULL

}

};

#endif

CPUState *qemu_get_cpu(int index)

{

CPUState *cpu;

CPU_FOREACH(cpu) {

if (cpu->cpu_index == index) {

return cpu;

}

}

return NULL;

}

#if !defined(CONFIG_USER_ONLY)

MemoryListener rr_listener;

static RR_mem_type rr_mem_region_type(MemoryRegion* mr) {

RR_mem_type mtype = RR_MEM_UNKNOWN;

if (!(memory_region_is_ram(mr) || memory_region_is_romd(mr))) {

mtype = RR_MEM_IO;

} else if (memory_region_is_ram(mr)) {

mtype = RR_MEM_RAM;

}

return mtype;

}

static void rr_mem_region_added_cb(MemoryListener *listener, MemoryRegionSection *section) {

if (!rr_in_record()) return;

RR_mem_type mtype = rr_mem_region_type(section->mr);

rr_mem_region_change_record(section->offset_within_address_space, int128_get64(section->size),

section->mr->name, mtype, true);

}

static void rr_mem_region_deleted_cb(MemoryListener *listener, MemoryRegionSection *section) {

if (!rr_in_record()) return;

RR_mem_type mtype = rr_mem_region_type(section->mr);

rr_mem_region_change_record(section->offset_within_address_space, int128_get64(section->size),

section->mr->name, mtype, false);

}

void cpu_address_space_init(CPUState *cpu, AddressSpace *as, int asidx)

{

CPUAddressSpace *newas;

/* Target code should have set num_ases before calling us */

assert(asidx < cpu->num_ases);

if (asidx == 0) {

/* address space 0 gets the convenience alias */

cpu->as = as;

}

/* KVM cannot currently support multiple address spaces. */

assert(asidx == 0 || !kvm_enabled());

if (!cpu->cpu_ases) {

cpu->cpu_ases = g_new0(CPUAddressSpace, cpu->num_ases);

}

newas = &cpu->cpu_ases[asidx];

newas->cpu = cpu;

newas->as = as;

if (tcg_enabled()) {

newas->tcg_as_listener.commit = tcg_commit;

memory_listener_register(&newas->tcg_as_listener, as);

// PANDA Record and Replay

rr_listener.region_add = rr_mem_region_added_cb;

rr_listener.region_del = rr_mem_region_deleted_cb;

memory_listener_register(&rr_listener, as);

}

}

AddressSpace *cpu_get_address_space(CPUState *cpu, int asidx)

{

/* Return the AddressSpace corresponding to the specified index */

return cpu->cpu_ases[asidx].as;

}

#endif

void cpu_exec_unrealizefn(CPUState *cpu)

{

CPUClass *cc = CPU_GET_CLASS(cpu);

cpu_list_remove(cpu);

if (cc->vmsd != NULL) {

vmstate_unregister(NULL, cc->vmsd, cpu);

}

if (qdev_get_vmsd(DEVICE(cpu)) == NULL) {

vmstate_unregister(NULL, &vmstate_cpu_common, cpu);

}

}

void cpu_exec_initfn(CPUState *cpu)

{

cpu->as = NULL;

cpu->num_ases = 0;

#ifndef CONFIG_USER_ONLY

cpu->thread_id = qemu_get_thread_id();

/* This is a softmmu CPU object, so create a property for it

* so users can wire up its memory. (This can't go in qom/cpu.c

* because that file is compiled only once for both user-mode

* and system builds.) The default if no link is set up is to use

* the system address space.

*/

object_property_add_link(OBJECT(cpu), "memory", TYPE_MEMORY_REGION,

(Object **)&cpu->memory,

qdev_prop_allow_set_link_before_realize,

OBJ_PROP_LINK_UNREF_ON_RELEASE,

&error_abort);

cpu->memory = system_memory;

object_ref(OBJECT(cpu->memory));

#endif

}

void cpu_exec_realizefn(CPUState *cpu, Error **errp)

{

CPUClass *cc ATTRIBUTE_UNUSED = CPU_GET_CLASS(cpu);

cpu_list_add(cpu);

#ifndef CONFIG_USER_ONLY

if (qdev_get_vmsd(DEVICE(cpu)) == NULL) {

vmstate_register(NULL, cpu->cpu_index, &vmstate_cpu_common, cpu);

}

if (cc->vmsd != NULL) {

vmstate_register(NULL, cpu->cpu_index, cc->vmsd, cpu);

}

#endif

}

static void breakpoint_invalidate(CPUState *cpu, target_ulong pc)

{

/* Flush the whole TB as this will not have race conditions

* even if we don't have proper locking yet.

* Ideally we would just invalidate the TBs for the

* specified PC.

*/

tb_flush(cpu);

}

#if defined(CONFIG_USER_ONLY)

void cpu_watchpoint_remove_all(CPUState *cpu, int mask)

{

}

int cpu_watchpoint_remove(CPUState *cpu, vaddr addr, vaddr len,

int flags)

{

return -ENOSYS;

}

void cpu_watchpoint_remove_by_ref(CPUState *cpu, CPUWatchpoint *watchpoint)

{

}

int cpu_watchpoint_insert(CPUState *cpu, vaddr addr, vaddr len,

int flags, CPUWatchpoint **watchpoint)

{

return -ENOSYS;

}

#else

/* Add a watchpoint. */

int cpu_watchpoint_insert(CPUState *cpu, vaddr addr, vaddr len,

int flags, CPUWatchpoint **watchpoint)

{

CPUWatchpoint *wp;

/* forbid ranges which are empty or run off the end of the address space */

if (len == 0 || (addr len - 1) < addr) {

error_report("tried to set invalid watchpoint at %"

VADDR_PRIx ", len=%" VADDR_PRIu, addr, len);

return -EINVAL;

}

wp = g_malloc(sizeof(*wp));

wp->virtaddr = addr;

wp->len = len;

wp->flags = flags;

/* keep all GDB-injected watchpoints in front */

if (flags & BP_GDB) {

QTAILQ_INSERT_HEAD(&cpu->watchpoints, wp, entry);

} else {

QTAILQ_INSERT_TAIL(&cpu->watchpoints, wp, entry);

}

tlb_flush_page(cpu, addr);

if (watchpoint)

*watchpoint = wp;

return 0;

}

/* Remove a specific watchpoint. */

int cpu_watchpoint_remove(CPUState *cpu, vaddr addr, vaddr len,

int flags)

{

CPUWatchpoint *wp;

QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {

if (addr == wp->virtaddr && len == wp->len

&& flags == (wp->flags & ~BP_WATCHPOINT_HIT)) {

cpu_watchpoint_remove_by_ref(cpu, wp);

return 0;

}

}

return -ENOENT;

}

/* Remove a specific watchpoint by reference. */

void cpu_watchpoint_remove_by_ref(CPUState *cpu, CPUWatchpoint *watchpoint)

{

QTAILQ_REMOVE(&cpu->watchpoints, watchpoint, entry);

tlb_flush_page(cpu, watchpoint->virtaddr);

g_free(watchpoint);

}

/* Remove all matching watchpoints. */

void cpu_watchpoint_remove_all(CPUState *cpu, int mask)

{

CPUWatchpoint *wp, *next;

QTAILQ_FOREACH_SAFE(wp, &cpu->watchpoints, entry, next) {

if (wp->flags & mask) {

cpu_watchpoint_remove_by_ref(cpu, wp);

}

}

}

/* Return true if this watchpoint address matches the specified

* access (ie the address range covered by the watchpoint overlaps

* partially or completely with the address range covered by the

* access).

*/

static inline bool cpu_watchpoint_address_matches(CPUWatchpoint *wp,

vaddr addr,

vaddr len)

{

/* We know the lengths are non-zero, but a little caution is

* required to avoid errors in the case where the range ends

* exactly at the top of the address space and so addr len

* wraps round to zero.

*/

vaddr wpend = wp->virtaddr wp->len - 1;

vaddr addrend = addr len - 1;

return !(addr > wpend || wp->virtaddr > addrend);

}

#endif

/* Add a breakpoint. */

int cpu_breakpoint_insert(CPUState *cpu, vaddr pc, int flags,

CPUBreakpoint **breakpoint)

{

CPUBreakpoint *bp;

bp = g_malloc(sizeof(*bp));

bp->pc = pc;

bp->rr_instr_count = 0;

bp->flags = flags;

/* keep all GDB-injected breakpoints in front */

if (flags & BP_GDB) {

QTAILQ_INSERT_HEAD(&cpu->breakpoints, bp, entry);

} else {

QTAILQ_INSERT_TAIL(&cpu->breakpoints, bp, entry);

}

breakpoint_invalidate(cpu, pc);

if (breakpoint) {

*breakpoint = bp;

}

return 0;

}

int cpu_rr_breakpoint_insert(CPUState *cpu, uint64_t rr_instr_count, int flags,

CPUBreakpoint **breakpoint)

{

CPUBreakpoint *bp;

bp = g_malloc(sizeof(*bp));

bp->pc = 0;

bp->rr_instr_count = rr_instr_count;

bp->flags = flags;

/* keep all GDB-injected breakpoints in front */

if (flags & BP_GDB) {

QTAILQ_INSERT_HEAD(&cpu->breakpoints, bp, entry);

} else {

QTAILQ_INSERT_TAIL(&cpu->breakpoints, bp, entry);

}

//breakpoint_invalidate(cpu, pc);

tb_flush(cpu);

printf("Inserted bp @ instr count %" PRIu64 "\n", rr_instr_count);

if (breakpoint) {

*breakpoint = bp;

}

return 0;

}

/* Remove a specific breakpoint. */

int cpu_breakpoint_remove(CPUState *cpu, vaddr pc, int flags)

{

CPUBreakpoint *bp;

QTAILQ_FOREACH(bp, &cpu->breakpoints, entry) {

if (bp->pc == pc && bp->flags == flags) {

cpu_breakpoint_remove_by_ref(cpu, bp);

return 0;

}

}

return -ENOENT;

}

/* Remove a specific breakpoint by rr instr count. */

int cpu_breakpoint_remove_by_instr(CPUState *cpu, uint64_t rr_instr_count, int flags)

{

CPUBreakpoint *bp;

QTAILQ_FOREACH(bp, &cpu->breakpoints, entry) {

if (bp->rr_instr_count == rr_instr_count && bp->flags == flags) {

cpu_breakpoint_remove_by_ref(cpu, bp);

return 0;

}

}

return -ENOENT;

}

/* Remove a specific breakpoint by reference. */

void cpu_breakpoint_remove_by_ref(CPUState *cpu, CPUBreakpoint *breakpoint)

{

QTAILQ_REMOVE(&cpu->breakpoints, breakpoint, entry);

//breakpoint_invalidate(cpu, breakpoint->pc);

g_free(breakpoint);

}

/* Remove all matching breakpoints. */

void cpu_breakpoint_remove_all(CPUState *cpu, int mask)

{

CPUBreakpoint *bp, *next;

QTAILQ_FOREACH_SAFE(bp, &cpu->breakpoints, entry, next) {

if (bp->flags & mask) {

cpu_breakpoint_remove_by_ref(cpu, bp);

}

}

}

/*

* rw: Handles reverse-continue logic. Checks whether we are in first or second pass