VBoxRecompiler.c@ 1057

Last change on this file since 1057 was 1057, checked in by vboxsync, 18 years ago
Trapping and virtualizing TSC (both disabled).
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 155.4 KB

Line
1	/** @file
2	*
3	* VBox Recompiler - QEMU.
4	*/
5
6	/*
7	* Copyright (C) 2006 InnoTek Systemberatung GmbH
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License as published by the Free Software Foundation,
13	* in version 2 as it comes in the "COPYING" file of the VirtualBox OSE
14	* distribution. VirtualBox OSE is distributed in the hope that it will
15	* be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* If you received this file as part of a commercial VirtualBox
18	* distribution, then only the terms of your commercial VirtualBox
19	* license agreement apply instead of the previous paragraph.
20	*/
21
22
23	/*******************************************************************************
24	* Header Files *
25	*******************************************************************************/
26	#include "vl.h"
27	#include "exec-all.h"
28
29	#include <VBox/rem.h>
30	#include <VBox/vmapi.h>
31	#include <VBox/tm.h>
32	#include <VBox/ssm.h>
33	#include <VBox/em.h>
34	#include <VBox/trpm.h>
35	#include <VBox/iom.h>
36	#include <VBox/mm.h>
37	#include <VBox/pgm.h>
38	#include <VBox/pdm.h>
39	#include <VBox/dbgf.h>
40	#include <VBox/dbg.h>
41	#include <VBox/hwaccm.h>
42	#include <VBox/patm.h>
43	#include <VBox/csam.h>
44	#include "REMInternal.h"
45	#include <VBox/vm.h>
46	#include <VBox/param.h>
47	#include <VBox/err.h>
48
49	#define LOG_GROUP LOG_GROUP_REM
50	#include <VBox/log.h>
51	#include <iprt/semaphore.h>
52	#include <iprt/asm.h>
53	#include <iprt/assert.h>
54	#include <iprt/thread.h>
55	#include <iprt/string.h>
56
57	////#define VBOX_RAW_V86
58
59	/* Don't wanna include everything. */
60	extern void cpu_x86_update_cr3(CPUX86State *env, target_ulong new_cr3);
61	extern void cpu_x86_update_cr0(CPUX86State *env, uint32_t new_cr0);
62	extern void cpu_x86_update_cr4(CPUX86State *env, uint32_t new_cr4);
63	extern void tlb_flush_page(CPUX86State *env, uint32_t addr);
64	extern void tlb_flush(CPUState *env, int flush_global);
65	extern void sync_seg(CPUX86State *env1, int seg_reg, int selector);
66	extern void sync_ldtr(CPUX86State *env1, int selector);
67	extern int sync_tr(CPUX86State *env1, int selector);
68
69	#ifdef VBOX_STRICT
70	unsigned long get_phys_page_offset(target_ulong addr);
71	#endif
72
73
74	/*******************************************************************************
75	* Defined Constants And Macros *
76	*******************************************************************************/
77
78	/** Copy 80-bit fpu register at pSrc to pDst.
79	* This is probably faster than calling memcpy.
80	*/
81	#define REM_COPY_FPU_REG(pDst, pSrc) \
82	do { (PX86FPUMMX)(pDst) = (const X86FPUMMX *)(pSrc); } while (0)
83
84
85	/*******************************************************************************
86	* Internal Functions *
87	*******************************************************************************/
88	static DECLCALLBACK(int) remR3Save(PVM pVM, PSSMHANDLE pSSM);
89	static DECLCALLBACK(int) remR3Load(PVM pVM, PSSMHANDLE pSSM, uint32_t u32Version);
90	static void remR3StateUpdate(PVM pVM);
91	static uint32_t remR3MMIOReadU8(void *pvVM, target_phys_addr_t GCPhys);
92	static uint32_t remR3MMIOReadU16(void *pvVM, target_phys_addr_t GCPhys);
93	static uint32_t remR3MMIOReadU32(void *pvVM, target_phys_addr_t GCPhys);
94	static void remR3MMIOWriteU8(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32);
95	static void remR3MMIOWriteU16(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32);
96	static void remR3MMIOWriteU32(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32);
97
98	static uint32_t remR3HandlerReadU8(void *pvVM, target_phys_addr_t GCPhys);
99	static uint32_t remR3HandlerReadU16(void *pvVM, target_phys_addr_t GCPhys);
100	static uint32_t remR3HandlerReadU32(void *pvVM, target_phys_addr_t GCPhys);
101	static void remR3HandlerWriteU8(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32);
102	static void remR3HandlerWriteU16(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32);
103	static void remR3HandlerWriteU32(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32);
104
105
106	/*******************************************************************************
107	* Global Variables *
108	*******************************************************************************/
109
110	/** The log level of the recompiler. */
111	#if 1
112	extern int loglevel;
113	#else
114	int loglevel = ~0;
115	FILE *logfile = NULL;
116	#endif
117
118
119	/** @todo Move stats to REM::s some rainy day we have nothing do to. */
120	#ifdef VBOX_WITH_STATISTICS
121	static STAMPROFILEADV gStatExecuteSingleInstr;
122	static STAMPROFILEADV gStatCompilationQEmu;
123	static STAMPROFILEADV gStatRunCodeQEmu;
124	static STAMPROFILEADV gStatTotalTimeQEmu;
125	static STAMPROFILEADV gStatTimers;
126	static STAMPROFILEADV gStatTBLookup;
127	static STAMPROFILEADV gStatIRQ;
128	static STAMPROFILEADV gStatRawCheck;
129	static STAMPROFILEADV gStatMemRead;
130	static STAMPROFILEADV gStatMemWrite;
131	static STAMCOUNTER gStatRefuseTFInhibit;
132	static STAMCOUNTER gStatRefuseVM86;
133	static STAMCOUNTER gStatRefusePaging;
134	static STAMCOUNTER gStatRefusePAE;
135	static STAMCOUNTER gStatRefuseIOPLNot0;
136	static STAMCOUNTER gStatRefuseIF0;
137	static STAMCOUNTER gStatRefuseCode16;
138	static STAMCOUNTER gStatRefuseWP0;
139	static STAMCOUNTER gStatRefuseRing1or2;
140	static STAMCOUNTER gStatRefuseCanExecute;
141	static STAMCOUNTER gStatREMGDTChange;
142	static STAMCOUNTER gStatREMIDTChange;
143	static STAMCOUNTER gStatREMLDTRChange;
144	static STAMCOUNTER gStatREMTRChange;
145	static STAMCOUNTER gStatSelOutOfSync[6];
146	static STAMCOUNTER gStatSelOutOfSyncStateBack[6];
147	#endif
148
149	/*
150	* Global stuff.
151	*/
152
153	/** MMIO read callbacks. */
154	CPUReadMemoryFunc *g_apfnMMIORead[3] =
155	{
156	remR3MMIOReadU8,
157	remR3MMIOReadU16,
158	remR3MMIOReadU32
159	};
160
161	/** MMIO write callbacks. */
162	CPUWriteMemoryFunc *g_apfnMMIOWrite[3] =
163	{
164	remR3MMIOWriteU8,
165	remR3MMIOWriteU16,
166	remR3MMIOWriteU32
167	};
168
169	/** Handler read callbacks. */
170	CPUReadMemoryFunc *g_apfnHandlerRead[3] =
171	{
172	remR3HandlerReadU8,
173	remR3HandlerReadU16,
174	remR3HandlerReadU32
175	};
176
177	/** Handler write callbacks. */
178	CPUWriteMemoryFunc *g_apfnHandlerWrite[3] =
179	{
180	remR3HandlerWriteU8,
181	remR3HandlerWriteU16,
182	remR3HandlerWriteU32
183	};
184
185	#ifndef PGM_DYNAMIC_RAM_ALLOC
186	/* Guest physical RAM base. Not to be used in external code. */
187	static uint8_t *phys_ram_base;
188	#endif
189
190	/*
191	* Instance stuff.
192	*/
193	/** Pointer to the cpu state. */
194	CPUState *cpu_single_env;
195
196
197	#ifdef VBOX_WITH_DEBUGGER
198	/*
199	* Debugger commands.
200	*/
201	static DECLCALLBACK(int) remR3CmdDisasEnableStepping(PCDBGCCMD pCmd, PDBGCCMDHLP pCmdHlp, PVM pVM, PCDBGCVAR paArgs, unsigned cArgs, PDBGCVAR pResult);
202
203	/** '.remstep' arguments. */
204	static const DBGCVARDESC g_aArgRemStep[] =
205	{
206	/* cTimesMin, cTimesMax, enmCategory, fFlags, pszName, pszDescription */
207	{ 0, ~0, DBGCVAR_CAT_NUMBER, 0, "on/off", "Boolean value/mnemonic indicating the new state." },
208	};
209
210	/** Command descriptors. */
211	static const DBGCCMD g_aCmds[] =
212	{
213	{
214	.pszCmd ="remstep",
215	.cArgsMin = 0,
216	.cArgsMax = 1,
217	.paArgDescs = &g_aArgRemStep[0],
218	.cArgDescs = ELEMENTS(g_aArgRemStep),
219	.pResultDesc = NULL,
220	.fFlags = 0,
221	.pfnHandler = remR3CmdDisasEnableStepping,
222	.pszSyntax = "[on/off]",
223	.pszDescription = "Enable or disable the single stepping with logged disassembly. "
224	"If no arguments show the current state."
225	}
226	};
227	#endif
228
229
230	/*******************************************************************************
231	* Internal Functions *
232	*******************************************************************************/
233	static void remAbort(int rc, const char *pszTip);
234
235
236	/* Put them here to avoid unused variable warning. */
237	AssertCompile(RT_SIZEOFMEMB(VM, rem.padding) >= RT_SIZEOFMEMB(VM, rem.s));
238	//AssertCompileMemberSize(REM, Env, REM_ENV_SIZE);
239	//AssertCompile(RT_SIZEOFMEMB(REM, Env) <= REM_ENV_SIZE);
240
241	/**
242	* Initializes the REM.
243	*
244	* @returns VBox status code.
245	* @param pVM The VM to operate on.
246	*/
247	REMR3DECL(int) REMR3Init(PVM pVM)
248	{
249	uint32_t u32Dummy;
250	AssertReleaseMsg(sizeof(pVM->rem.padding) >= sizeof(pVM->rem.s), ("%#x >= %#x; sizeof(Env)=%#x\n", sizeof(pVM->rem.padding), sizeof(pVM->rem.s), sizeof(pVM->rem.s.Env)));
251	//AssertReleaseMsg(sizeof(pVM->rem.s.Env) <= REM_ENV_SIZE, ("%#x == %#x\n", sizeof(pVM->rem.s.Env), REM_ENV_SIZE));
252	AssertReleaseMsg(!(RT_OFFSETOF(VM, rem) & 31), ("off=%#x\n", RT_OFFSETOF(VM, rem)));
253	#if 0 /* not merged yet */
254	Assert(!testmath());
255	#endif
256
257	/*
258	* Init some internal data members.
259	*/
260	pVM->rem.s.offVM = RT_OFFSETOF(VM, rem.s);
261	pVM->rem.s.Env.pVM = pVM;
262	#ifdef CPU_RAW_MODE_INIT
263	pVM->rem.s.state \|= CPU_RAW_MODE_INIT;
264	#endif
265
266	/* ctx. */
267	int rc = CPUMQueryGuestCtxPtr(pVM, &pVM->rem.s.pCtx);
268	if (VBOX_FAILURE(rc))
269	{
270	AssertMsgFailed(("Failed to obtain guest ctx pointer. rc=%Vrc\n", rc));
271	return rc;
272	}
273	AssertMsg(MMR3PhysGetRamSize(pVM) == 0, ("Init order have changed! REM depends on notification about ALL physical memory registrations\n"));
274
275	/*
276	* Init the recompiler.
277	*/
278	if (!cpu_x86_init(&pVM->rem.s.Env))
279	{
280	AssertMsgFailed(("cpu_x86_init failed - impossible!\n"));
281	return VERR_GENERAL_FAILURE;
282	}
283	CPUMGetGuestCpuId(pVM, 1, &u32Dummy, &u32Dummy, &pVM->rem.s.Env.cpuid_ext_features, &pVM->rem.s.Env.cpuid_features);
284
285	/* allocate code buffer for single instruction emulation. */
286	pVM->rem.s.Env.cbCodeBuffer = 4096;
287	pVM->rem.s.Env.pvCodeBuffer = RTMemExecAlloc(pVM->rem.s.Env.cbCodeBuffer);
288	AssertMsgReturn(pVM->rem.s.Env.pvCodeBuffer, ("Failed to allocate code buffer!\n"), VERR_NO_MEMORY);
289
290	/* finally, set the cpu_single_env global. */
291	cpu_single_env = &pVM->rem.s.Env;
292
293	/* Nothing is pending by default */
294	pVM->rem.s.u32PendingInterrupt = REM_NO_PENDING_IRQ;
295
296	#ifdef DEBUG_bird
297	//cpu_breakpoint_insert(&pVM->rem.s.Env, some-address);
298	#endif
299
300	/*
301	* Register ram types.
302	*/
303	pVM->rem.s.iMMIOMemType = cpu_register_io_memory(0, g_apfnMMIORead, g_apfnMMIOWrite, pVM);
304	AssertReleaseMsg(pVM->rem.s.iMMIOMemType > 0, ("pVM->rem.s.iMMIOMemType=%d\n", pVM->rem.s.iMMIOMemType));
305	pVM->rem.s.iHandlerMemType = cpu_register_io_memory(0, g_apfnHandlerRead, g_apfnHandlerWrite, pVM);
306	AssertReleaseMsg(pVM->rem.s.iHandlerMemType > 0, ("pVM->rem.s.iHandlerMemType=%d\n", pVM->rem.s.iHandlerMemType));
307	Log2(("REM: iMMIOMemType=%d iHandlerMemType=%d\n", pVM->rem.s.iMMIOMemType, pVM->rem.s.iHandlerMemType));
308
309	/*
310	* Register the saved state data unit.
311	*/
312	rc = SSMR3RegisterInternal(pVM, "rem", 1, REM_SAVED_STATE_VERSION, sizeof(uint32_t) * 10,
313	NULL, remR3Save, NULL,
314	NULL, remR3Load, NULL);
315	if (VBOX_FAILURE(rc))
316	return rc;
317
318	#ifdef VBOX_WITH_DEBUGGER
319	/*
320	* Debugger commands.
321	*/
322	static bool fRegisteredCmds = false;
323	if (!fRegisteredCmds)
324	{
325	int rc = DBGCRegisterCommands(&g_aCmds[0], ELEMENTS(g_aCmds));
326	if (VBOX_SUCCESS(rc))
327	fRegisteredCmds = true;
328	}
329	#endif
330
331	#ifdef VBOX_WITH_STATISTICS
332	/*
333	* Statistics.
334	*/
335	STAM_REG(pVM, &gStatExecuteSingleInstr, STAMTYPE_PROFILE, "/PROF/REM/SingleInstr",STAMUNIT_TICKS_PER_CALL, "Profiling single instruction emulation.");
336	STAM_REG(pVM, &gStatCompilationQEmu, STAMTYPE_PROFILE, "/PROF/REM/Compile", STAMUNIT_TICKS_PER_CALL, "Profiling QEmu compilation.");
337	STAM_REG(pVM, &gStatRunCodeQEmu, STAMTYPE_PROFILE, "/PROF/REM/Runcode", STAMUNIT_TICKS_PER_CALL, "Profiling QEmu code execution.");
338	STAM_REG(pVM, &gStatTotalTimeQEmu, STAMTYPE_PROFILE, "/PROF/REM/Emulate", STAMUNIT_TICKS_PER_CALL, "Profiling code emulation.");
339	STAM_REG(pVM, &gStatTimers, STAMTYPE_PROFILE, "/PROF/REM/Timers", STAMUNIT_TICKS_PER_CALL, "Profiling timer scheduling.");
340	STAM_REG(pVM, &gStatTBLookup, STAMTYPE_PROFILE, "/PROF/REM/TBLookup", STAMUNIT_TICKS_PER_CALL, "Profiling timer scheduling.");
341	STAM_REG(pVM, &gStatIRQ, STAMTYPE_PROFILE, "/PROF/REM/IRQ", STAMUNIT_TICKS_PER_CALL, "Profiling timer scheduling.");
342	STAM_REG(pVM, &gStatRawCheck, STAMTYPE_PROFILE, "/PROF/REM/RawCheck", STAMUNIT_TICKS_PER_CALL, "Profiling timer scheduling.");
343	STAM_REG(pVM, &gStatMemRead, STAMTYPE_PROFILE, "/PROF/REM/MemRead", STAMUNIT_TICKS_PER_CALL, "Profiling memory access.");
344	STAM_REG(pVM, &gStatMemWrite, STAMTYPE_PROFILE, "/PROF/REM/MemWrite", STAMUNIT_TICKS_PER_CALL, "Profiling memory access.");
345
346	STAM_REG(pVM, &gStatRefuseTFInhibit, STAMTYPE_COUNTER, "/REM/Refuse/TFInibit", STAMUNIT_OCCURENCES, "Raw mode refused because of TF or irq inhibit");
347	STAM_REG(pVM, &gStatRefuseVM86, STAMTYPE_COUNTER, "/REM/Refuse/VM86", STAMUNIT_OCCURENCES, "Raw mode refused because of VM86");
348	STAM_REG(pVM, &gStatRefusePaging, STAMTYPE_COUNTER, "/REM/Refuse/Paging", STAMUNIT_OCCURENCES, "Raw mode refused because of disabled paging/pm");
349	STAM_REG(pVM, &gStatRefusePAE, STAMTYPE_COUNTER, "/REM/Refuse/PAE", STAMUNIT_OCCURENCES, "Raw mode refused because of PAE");
350	STAM_REG(pVM, &gStatRefuseIOPLNot0, STAMTYPE_COUNTER, "/REM/Refuse/IOPLNot0", STAMUNIT_OCCURENCES, "Raw mode refused because of IOPL != 0");
351	STAM_REG(pVM, &gStatRefuseIF0, STAMTYPE_COUNTER, "/REM/Refuse/IF0", STAMUNIT_OCCURENCES, "Raw mode refused because of IF=0");
352	STAM_REG(pVM, &gStatRefuseCode16, STAMTYPE_COUNTER, "/REM/Refuse/Code16", STAMUNIT_OCCURENCES, "Raw mode refused because of 16 bit code");
353	STAM_REG(pVM, &gStatRefuseWP0, STAMTYPE_COUNTER, "/REM/Refuse/WP0", STAMUNIT_OCCURENCES, "Raw mode refused because of WP=0");
354	STAM_REG(pVM, &gStatRefuseRing1or2, STAMTYPE_COUNTER, "/REM/Refuse/Ring1or2", STAMUNIT_OCCURENCES, "Raw mode refused because of ring 1/2 execution");
355	STAM_REG(pVM, &gStatRefuseCanExecute, STAMTYPE_COUNTER, "/REM/Refuse/CanExecuteRaw", STAMUNIT_OCCURENCES, "Raw mode refused because of cCanExecuteRaw");
356
357	STAM_REG(pVM, &gStatREMGDTChange, STAMTYPE_COUNTER, "/REM/Change/GDTBase", STAMUNIT_OCCURENCES, "GDT base changes");
358	STAM_REG(pVM, &gStatREMLDTRChange, STAMTYPE_COUNTER, "/REM/Change/LDTR", STAMUNIT_OCCURENCES, "LDTR changes");
359	STAM_REG(pVM, &gStatREMIDTChange, STAMTYPE_COUNTER, "/REM/Change/IDTBase", STAMUNIT_OCCURENCES, "IDT base changes");
360	STAM_REG(pVM, &gStatREMTRChange, STAMTYPE_COUNTER, "/REM/Change/TR", STAMUNIT_OCCURENCES, "TR selector changes");
361
362	STAM_REG(pVM, &gStatSelOutOfSync[0], STAMTYPE_COUNTER, "/REM/State/SelOutOfSync/ES", STAMUNIT_OCCURENCES, "ES out of sync");
363	STAM_REG(pVM, &gStatSelOutOfSync[1], STAMTYPE_COUNTER, "/REM/State/SelOutOfSync/CS", STAMUNIT_OCCURENCES, "CS out of sync");
364	STAM_REG(pVM, &gStatSelOutOfSync[2], STAMTYPE_COUNTER, "/REM/State/SelOutOfSync/SS", STAMUNIT_OCCURENCES, "SS out of sync");
365	STAM_REG(pVM, &gStatSelOutOfSync[3], STAMTYPE_COUNTER, "/REM/State/SelOutOfSync/DS", STAMUNIT_OCCURENCES, "DS out of sync");
366	STAM_REG(pVM, &gStatSelOutOfSync[4], STAMTYPE_COUNTER, "/REM/State/SelOutOfSync/FS", STAMUNIT_OCCURENCES, "FS out of sync");
367	STAM_REG(pVM, &gStatSelOutOfSync[5], STAMTYPE_COUNTER, "/REM/State/SelOutOfSync/GS", STAMUNIT_OCCURENCES, "GS out of sync");
368
369	STAM_REG(pVM, &gStatSelOutOfSyncStateBack[0], STAMTYPE_COUNTER, "/REM/StateBack/SelOutOfSync/ES", STAMUNIT_OCCURENCES, "ES out of sync");
370	STAM_REG(pVM, &gStatSelOutOfSyncStateBack[1], STAMTYPE_COUNTER, "/REM/StateBack/SelOutOfSync/CS", STAMUNIT_OCCURENCES, "CS out of sync");
371	STAM_REG(pVM, &gStatSelOutOfSyncStateBack[2], STAMTYPE_COUNTER, "/REM/StateBack/SelOutOfSync/SS", STAMUNIT_OCCURENCES, "SS out of sync");
372	STAM_REG(pVM, &gStatSelOutOfSyncStateBack[3], STAMTYPE_COUNTER, "/REM/StateBack/SelOutOfSync/DS", STAMUNIT_OCCURENCES, "DS out of sync");
373	STAM_REG(pVM, &gStatSelOutOfSyncStateBack[4], STAMTYPE_COUNTER, "/REM/StateBack/SelOutOfSync/FS", STAMUNIT_OCCURENCES, "FS out of sync");
374	STAM_REG(pVM, &gStatSelOutOfSyncStateBack[5], STAMTYPE_COUNTER, "/REM/StateBack/SelOutOfSync/GS", STAMUNIT_OCCURENCES, "GS out of sync");
375
376	#endif
377	return rc;
378	}
379
380
381	/**
382	* Terminates the REM.
383	*
384	* Termination means cleaning up and freeing all resources,
385	* the VM it self is at this point powered off or suspended.
386	*
387	* @returns VBox status code.
388	* @param pVM The VM to operate on.
389	*/
390	REMR3DECL(int) REMR3Term(PVM pVM)
391	{
392	return VINF_SUCCESS;
393	}
394
395
396	/**
397	* The VM is being reset.
398	*
399	* For the REM component this means to call the cpu_reset() and
400	* reinitialize some state variables.
401	*
402	* @param pVM VM handle.
403	*/
404	REMR3DECL(void) REMR3Reset(PVM pVM)
405	{
406	pVM->rem.s.fIgnoreCR3Load = true;
407	pVM->rem.s.fIgnoreInvlPg = true;
408	pVM->rem.s.fIgnoreCpuMode = true;
409
410	/*
411	* Reset the REM cpu.
412	*/
413	cpu_reset(&pVM->rem.s.Env);
414	pVM->rem.s.cInvalidatedPages = 0;
415
416	pVM->rem.s.fIgnoreCR3Load = false;
417	pVM->rem.s.fIgnoreInvlPg = false;
418	pVM->rem.s.fIgnoreCpuMode = false;
419	}
420
421
422	/**
423	* Execute state save operation.
424	*
425	* @returns VBox status code.
426	* @param pVM VM Handle.
427	* @param pSSM SSM operation handle.
428	*/
429	static DECLCALLBACK(int) remR3Save(PVM pVM, PSSMHANDLE pSSM)
430	{
431	LogFlow(("remR3Save:\n"));
432
433	/*
434	* Save the required CPU Env bits.
435	* (Not much because we're never in REM when doing the save.)
436	*/
437	PREM pRem = &pVM->rem.s;
438	Assert(!pRem->fInREM);
439	SSMR3PutU32(pSSM, pRem->Env.hflags);
440	SSMR3PutMem(pSSM, &pRem->Env, RT_OFFSETOF(CPUState, jmp_env));
441	SSMR3PutU32(pSSM, ~0); /* separator */
442
443	/*
444	* Save the REM stuff.
445	*/
446	SSMR3PutUInt(pSSM, pRem->cInvalidatedPages);
447	unsigned i;
448	for (i = 0; i < pRem->cInvalidatedPages; i++)
449	SSMR3PutGCPtr(pSSM, pRem->aGCPtrInvalidatedPages[i]);
450
451	SSMR3PutUInt(pSSM, pVM->rem.s.u32PendingInterrupt);
452
453	return SSMR3PutU32(pSSM, ~0); /* terminator */
454	}
455
456
457	/**
458	* Execute state load operation.
459	*
460	* @returns VBox status code.
461	* @param pVM VM Handle.
462	* @param pSSM SSM operation handle.
463	* @param u32Version Data layout version.
464	*/
465	static DECLCALLBACK(int) remR3Load(PVM pVM, PSSMHANDLE pSSM, uint32_t u32Version)
466	{
467	uint32_t u32Dummy;
468	LogFlow(("remR3Load:\n"));
469
470	/*
471	* Validate version.
472	*/
473	if (u32Version != REM_SAVED_STATE_VERSION)
474	{
475	Log(("remR3Load: Invalid version u32Version=%d!\n", u32Version));
476	return VERR_SSM_UNSUPPORTED_DATA_UNIT_VERSION;
477	}
478
479	/*
480	* Do a reset to be on the safe side...
481	*/
482	REMR3Reset(pVM);
483
484	/*
485	* Ignore all ignorable notifications.
486	* Not doing this will cause big trouble.
487	*/
488	pVM->rem.s.fIgnoreCR3Load = true;
489	pVM->rem.s.fIgnoreInvlPg = true;
490	pVM->rem.s.fIgnoreCpuMode = true;
491
492	/*
493	* Load the required CPU Env bits.
494	* (Not much because we're never in REM when doing the save.)
495	*/
496	PREM pRem = &pVM->rem.s;
497	Assert(!pRem->fInREM);
498	SSMR3GetU32(pSSM, &pRem->Env.hflags);
499	SSMR3GetMem(pSSM, &pRem->Env, RT_OFFSETOF(CPUState, jmp_env));
500	uint32_t u32Sep;
501	int rc = SSMR3GetU32(pSSM, &u32Sep); /* separator */
502	if (VBOX_FAILURE(rc))
503	return rc;
504	if (u32Sep != ~0)
505	{
506	AssertMsgFailed(("u32Sep=%#x\n", u32Sep));
507	return VERR_SSM_DATA_UNIT_FORMAT_CHANGED;
508	}
509
510	/*
511	* Load the REM stuff.
512	*/
513	rc = SSMR3GetUInt(pSSM, &pRem->cInvalidatedPages);
514	if (VBOX_FAILURE(rc))
515	return rc;
516	if (pRem->cInvalidatedPages > ELEMENTS(pRem->aGCPtrInvalidatedPages))
517	{
518	AssertMsgFailed(("cInvalidatedPages=%#x\n", pRem->cInvalidatedPages));
519	return VERR_SSM_DATA_UNIT_FORMAT_CHANGED;
520	}
521	unsigned i;
522	for (i = 0; i < pRem->cInvalidatedPages; i++)
523	SSMR3GetGCPtr(pSSM, &pRem->aGCPtrInvalidatedPages[i]);
524
525	rc = SSMR3GetUInt(pSSM, &pVM->rem.s.u32PendingInterrupt);
526	if (VBOX_FAILURE(rc))
527	return rc;
528
529	/* check the terminator. */
530	rc = SSMR3GetU32(pSSM, &u32Sep);
531	if (VBOX_FAILURE(rc))
532	return rc;
533	if (u32Sep != ~0)
534	{
535	AssertMsgFailed(("u32Sep=%#x (term)\n", u32Sep));
536	return VERR_SSM_DATA_UNIT_FORMAT_CHANGED;
537	}
538
539	/*
540	* Get the CPUID features.
541	*/
542	CPUMGetGuestCpuId(pVM, 1, &u32Dummy, &u32Dummy, &pVM->rem.s.Env.cpuid_ext_features, &pVM->rem.s.Env.cpuid_features);
543
544	/*
545	* Sync the Load Flush the TLB
546	*/
547	tlb_flush(&pRem->Env, 1);
548
549	#if 0 /** @todo r=bird: this doesn't make sense. WHY? */
550	/*
551	* Clear all lazy flags (only FPU sync for now).
552	*/
553	CPUMGetAndClearFPUUsedREM(pVM);
554	#endif
555
556	/*
557	* Stop ignoring ignornable notifications.
558	*/
559	pVM->rem.s.fIgnoreCpuMode = false;
560	pVM->rem.s.fIgnoreInvlPg = false;
561	pVM->rem.s.fIgnoreCR3Load = false;
562
563	return VINF_SUCCESS;
564	}
565
566
567
568	#undef LOG_GROUP
569	#define LOG_GROUP LOG_GROUP_REM_RUN
570
571	/**
572	* Single steps an instruction in recompiled mode.
573	*
574	* Before calling this function the REM state needs to be in sync with
575	* the VM. Call REMR3State() to perform the sync. It's only necessary
576	* (and permitted) to sync at the first call to REMR3Step()/REMR3Run()
577	* and after calling REMR3StateBack().
578	*
579	* @returns VBox status code.
580	*
581	* @param pVM VM Handle.
582	*/
583	REMR3DECL(int) REMR3Step(PVM pVM)
584	{
585	/*
586	* Lock the REM - we don't wanna have anyone interrupting us
587	* while stepping - and enabled single stepping. We also ignore
588	* pending interrupts and suchlike.
589	*/
590	int interrupt_request = pVM->rem.s.Env.interrupt_request;
591	Assert(!(interrupt_request & ~(CPU_INTERRUPT_HARD \| CPU_INTERRUPT_EXIT \| CPU_INTERRUPT_EXITTB \| CPU_INTERRUPT_TIMER \| CPU_INTERRUPT_EXTERNAL_HARD \| CPU_INTERRUPT_EXTERNAL_EXIT \| CPU_INTERRUPT_EXTERNAL_TIMER)));
592	pVM->rem.s.Env.interrupt_request = 0;
593	cpu_single_step(&pVM->rem.s.Env, 1);
594
595	/*
596	* If we're standing at a breakpoint, that have to be disabled before we start stepping.
597	*/
598	RTGCPTR GCPtrPC = pVM->rem.s.Env.eip + pVM->rem.s.Env.segs[R_CS].base;
599	bool fBp = !cpu_breakpoint_remove(&pVM->rem.s.Env, GCPtrPC);
600
601	/*
602	* Execute and handle the return code.
603	* We execute without enabling the cpu tick, so on success we'll
604	* just flip it on and off to make sure it moves
605	*/
606	int rc = cpu_exec(&pVM->rem.s.Env);
607	if (rc == EXCP_DEBUG)
608	{
609	TMCpuTickResume(pVM);
610	TMCpuTickPause(pVM);
611	TMVirtualResume(pVM);
612	TMVirtualPause(pVM);
613	rc = VINF_EM_DBG_STEPPED;
614	}
615	else
616	{
617	AssertMsgFailed(("Damn, this shouldn't happen! cpu_exec returned %d while singlestepping\n", rc));
618	switch (rc)
619	{
620	case EXCP_INTERRUPT: rc = VINF_SUCCESS; break;
621	case EXCP_HLT: rc = VINF_EM_HALT; break;
622	case EXCP_RC:
623	rc = pVM->rem.s.rc;
624	pVM->rem.s.rc = VERR_INTERNAL_ERROR;
625	break;
626	default:
627	AssertReleaseMsgFailed(("This really shouldn't happen, rc=%d!\n", rc));
628	rc = VERR_INTERNAL_ERROR;
629	break;
630	}
631	}
632
633	/*
634	* Restore the stuff we changed to prevent interruption.
635	* Unlock the REM.
636	*/
637	if (fBp)
638	{
639	int rc2 = cpu_breakpoint_insert(&pVM->rem.s.Env, GCPtrPC);
640	Assert(rc2 == 0); NOREF(rc2);
641	}
642	cpu_single_step(&pVM->rem.s.Env, 0);
643	pVM->rem.s.Env.interrupt_request = interrupt_request;
644
645	return rc;
646	}
647
648
649	/**
650	* Set a breakpoint using the REM facilities.
651	*
652	* @returns VBox status code.
653	* @param pVM The VM handle.
654	* @param Address The breakpoint address.
655	* @thread The emulation thread.
656	*/
657	REMR3DECL(int) REMR3BreakpointSet(PVM pVM, RTGCUINTPTR Address)
658	{
659	VM_ASSERT_EMT(pVM);
660	if (!cpu_breakpoint_insert(&pVM->rem.s.Env, Address))
661	{
662	LogFlow(("REMR3BreakpointSet: Address=%VGv\n", Address));
663	return VINF_SUCCESS;
664	}
665	LogFlow(("REMR3BreakpointSet: Address=%VGv - failed!\n", Address));
666	return VERR_REM_NO_MORE_BP_SLOTS;
667	}
668
669
670	/**
671	* Clears a breakpoint set by REMR3BreakpointSet().
672	*
673	* @returns VBox status code.
674	* @param pVM The VM handle.
675	* @param Address The breakpoint address.
676	* @thread The emulation thread.
677	*/
678	REMR3DECL(int) REMR3BreakpointClear(PVM pVM, RTGCUINTPTR Address)
679	{
680	VM_ASSERT_EMT(pVM);
681	if (!cpu_breakpoint_remove(&pVM->rem.s.Env, Address))
682	{
683	LogFlow(("REMR3BreakpointClear: Address=%VGv\n", Address));
684	return VINF_SUCCESS;
685	}
686	LogFlow(("REMR3BreakpointClear: Address=%VGv - not found!\n", Address));
687	return VERR_REM_BP_NOT_FOUND;
688	}
689
690
691	/**
692	* Emulate an instruction.
693	*
694	* This function executes one instruction without letting anyone
695	* interrupt it. This is intended for being called while being in
696	* raw mode and thus will take care of all the state syncing between
697	* REM and the rest.
698	*
699	* @returns VBox status code.
700	* @param pVM VM handle.
701	*/
702	REMR3DECL(int) REMR3EmulateInstruction(PVM pVM)
703	{
704	Log2(("REMR3EmulateInstruction: (cs:eip=%04x:%08x)\n", pVM->rem.s.Env.segs[R_CS].selector, pVM->rem.s.Env.eip));
705
706	/*
707	* Sync the state and enable single instruction / single stepping.
708	*/
709	int rc = REMR3State(pVM);
710	if (VBOX_SUCCESS(rc))
711	{
712	int interrupt_request = pVM->rem.s.Env.interrupt_request;
713	Assert(!(interrupt_request & ~(CPU_INTERRUPT_HARD \| CPU_INTERRUPT_EXIT \| CPU_INTERRUPT_EXITTB \| CPU_INTERRUPT_TIMER \| CPU_INTERRUPT_EXTERNAL_HARD \| CPU_INTERRUPT_EXTERNAL_EXIT \| CPU_INTERRUPT_EXTERNAL_TIMER)));
714	Assert(!pVM->rem.s.Env.singlestep_enabled);
715	#if 1
716
717	/*
718	* Now we set the execute single instruction flag and enter the cpu_exec loop.
719	*/
720	pVM->rem.s.Env.interrupt_request = CPU_INTERRUPT_SINGLE_INSTR;
721	rc = cpu_exec(&pVM->rem.s.Env);
722	switch (rc)
723	{
724	/*
725	* Executed without anything out of the way happening.
726	*/
727	case EXCP_SINGLE_INSTR:
728	rc = VINF_EM_RESCHEDULE;
729	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_SINGLE_INSTR\n"));
730	break;
731
732	/*
733	* If we take a trap or start servicing a pending interrupt, we might end up here.
734	* (Timer thread or some other thread wishing EMT's attention.)
735	*/
736	case EXCP_INTERRUPT:
737	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_INTERRUPT\n"));
738	rc = VINF_EM_RESCHEDULE;
739	break;
740
741	/*
742	* Single step, we assume!
743	* If there was a breakpoint there we're fucked now.
744	*/
745	case EXCP_DEBUG:
746	{
747	/* breakpoint or single step? */
748	RTGCPTR GCPtrPC = pVM->rem.s.Env.eip + pVM->rem.s.Env.segs[R_CS].base;
749	int iBP;
750	rc = VINF_EM_DBG_STEPPED;
751	for (iBP = 0; iBP < pVM->rem.s.Env.nb_breakpoints; iBP++)
752	if (pVM->rem.s.Env.breakpoints[iBP] == GCPtrPC)
753	{
754	rc = VINF_EM_DBG_BREAKPOINT;
755	break;
756	}
757	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_DEBUG rc=%Vrc iBP=%d GCPtrPC=%VGv\n", rc, iBP, GCPtrPC));
758	break;
759	}
760
761	/*
762	* hlt instruction.
763	*/
764	case EXCP_HLT:
765	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_HLT\n"));
766	rc = VINF_EM_HALT;
767	break;
768
769	/*
770	* Switch to RAW-mode.
771	*/
772	case EXCP_EXECUTE_RAW:
773	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_EXECUTE_RAW\n"));
774	rc = VINF_EM_RESCHEDULE_RAW;
775	break;
776
777	/*
778	* Switch to hardware accelerated RAW-mode.
779	*/
780	case EXCP_EXECUTE_HWACC:
781	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_EXECUTE_HWACC\n"));
782	rc = VINF_EM_RESCHEDULE_HWACC;
783	break;
784
785	/*
786	* An EM RC was raised (VMR3Reset/Suspend/PowerOff).
787	*/
788	case EXCP_RC:
789	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_RC\n"));
790	rc = pVM->rem.s.rc;
791	pVM->rem.s.rc = VERR_INTERNAL_ERROR;
792	break;
793
794	/*
795	* Figure out the rest when they arrive....
796	*/
797	default:
798	AssertMsgFailed(("rc=%d\n", rc));
799	Log2(("REMR3EmulateInstruction: cpu_exec -> %d\n", rc));
800	rc = VINF_EM_RESCHEDULE;
801	break;
802	}
803
804	/*
805	* Switch back the state.
806	*/
807	#else
808	pVM->rem.s.Env.interrupt_request = 0;
809	cpu_single_step(&pVM->rem.s.Env, 1);
810
811	/*
812	* Execute and handle the return code.
813	* We execute without enabling the cpu tick, so on success we'll
814	* just flip it on and off to make sure it moves.
815	*
816	* (We do not use emulate_single_instr() because that doesn't enter the
817	* right way in will cause serious trouble if a longjmp was attempted.)
818	*/
819	#ifdef DEBUG_bird
820	remR3DisasInstr(&pVM->rem.s.Env, 1, "REMR3EmulateInstruction");
821	#endif
822	int cTimesMax = 16384;
823	uint32_t eip = pVM->rem.s.Env.eip;
824	do
825	{
826	rc = cpu_exec(&pVM->rem.s.Env);
827	} while ( eip == pVM->rem.s.Env.eip
828	&& (rc == EXCP_DEBUG \|\| rc == EXCP_EXECUTE_RAW)
829	&& --cTimesMax > 0);
830	switch (rc)
831	{
832	/*
833	* Single step, we assume!
834	* If there was a breakpoint there we're fucked now.
835	*/
836	case EXCP_DEBUG:
837	{
838	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_DEBUG\n"));
839	rc = VINF_EM_RESCHEDULE;
840	break;
841	}
842
843	/*
844	* We cannot be interrupted!
845	*/
846	case EXCP_INTERRUPT:
847	AssertMsgFailed(("Shouldn't happen! Everything was locked!\n"));
848	rc = VERR_INTERNAL_ERROR;
849	break;
850
851	/*
852	* hlt instruction.
853	*/
854	case EXCP_HLT:
855	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_HLT\n"));
856	rc = VINF_EM_HALT;
857	break;
858
859	/*
860	* Switch to RAW-mode.
861	*/
862	case EXCP_EXECUTE_RAW:
863	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_EXECUTE_RAW\n"));
864	rc = VINF_EM_RESCHEDULE_RAW;
865	break;
866
867	/*
868	* Switch to hardware accelerated RAW-mode.
869	*/
870	case EXCP_EXECUTE_HWACC:
871	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_EXECUTE_HWACC\n"));
872	rc = VINF_EM_RESCHEDULE_HWACC;
873	break;
874
875	/*
876	* An EM RC was raised (VMR3Reset/Suspend/PowerOff).
877	*/
878	case EXCP_RC:
879	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_RC rc=%Vrc\n", pVM->rem.s.rc));
880	rc = pVM->rem.s.rc;
881	pVM->rem.s.rc = VERR_INTERNAL_ERROR;
882	break;
883
884	/*
885	* Figure out the rest when they arrive....
886	*/
887	default:
888	AssertMsgFailed(("rc=%d\n", rc));
889	Log2(("REMR3EmulateInstruction: cpu_exec -> %d\n", rc));
890	rc = VINF_SUCCESS;
891	break;
892	}
893
894	/*
895	* Switch back the state.
896	*/
897	cpu_single_step(&pVM->rem.s.Env, 0);
898	#endif
899	pVM->rem.s.Env.interrupt_request = interrupt_request;
900	int rc2 = REMR3StateBack(pVM);
901	AssertRC(rc2);
902	}
903
904	Log2(("REMR3EmulateInstruction: returns %Vrc (cs:eip=%04x:%08x)\n",
905	rc, pVM->rem.s.Env.segs[R_CS].selector, pVM->rem.s.Env.eip));
906	return rc;
907	}
908
909
910	/**
911	* Runs code in recompiled mode.
912	*
913	* Before calling this function the REM state needs to be in sync with
914	* the VM. Call REMR3State() to perform the sync. It's only necessary
915	* (and permitted) to sync at the first call to REMR3Step()/REMR3Run()
916	* and after calling REMR3StateBack().
917	*
918	* @returns VBox status code.
919	*
920	* @param pVM VM Handle.
921	*/
922	REMR3DECL(int) REMR3Run(PVM pVM)
923	{
924	Log2(("REMR3Run: (cs:eip=%04x:%08x)\n", pVM->rem.s.Env.segs[R_CS].selector, pVM->rem.s.Env.eip));
925	Assert(pVM->rem.s.fInREM);
926	////Keyboard / tb stuff:
927	//if ( pVM->rem.s.Env.segs[R_CS].selector == 0xf000
928	// && pVM->rem.s.Env.eip >= 0xe860
929	// && pVM->rem.s.Env.eip <= 0xe880)
930	// pVM->rem.s.Env.state \|= CPU_EMULATE_SINGLE_STEP;
931	////A20:
932	//if ( pVM->rem.s.Env.segs[R_CS].selector == 0x9020
933	// && pVM->rem.s.Env.eip >= 0x970
934	// && pVM->rem.s.Env.eip <= 0x9a0)
935	// pVM->rem.s.Env.state \|= CPU_EMULATE_SINGLE_STEP;
936	////Speaker (port 61h)
937	//if ( pVM->rem.s.Env.segs[R_CS].selector == 0x0010
938	// && ( (pVM->rem.s.Env.eip >= 0x90278c10 && pVM->rem.s.Env.eip <= 0x90278c30)
939	// \|\| (pVM->rem.s.Env.eip >= 0x9010e250 && pVM->rem.s.Env.eip <= 0x9010e260)
940	// )
941	// )
942	// pVM->rem.s.Env.state \|= CPU_EMULATE_SINGLE_STEP;
943	//DBGFR3InfoLog(pVM, "timers", NULL);
944
945
946	int rc = cpu_exec(&pVM->rem.s.Env);
947	switch (rc)
948	{
949	/*
950	* This happens when the execution was interrupted
951	* by an external event, like pending timers.
952	*/
953	case EXCP_INTERRUPT:
954	Log2(("REMR3Run: cpu_exec -> EXCP_INTERRUPT\n"));
955	rc = VINF_SUCCESS;
956	break;
957
958	/*
959	* hlt instruction.
960	*/
961	case EXCP_HLT:
962	Log2(("REMR3Run: cpu_exec -> EXCP_HLT\n"));
963	rc = VINF_EM_HALT;
964	break;
965
966	/*
967	* Breakpoint/single step.
968	*/
969	case EXCP_DEBUG:
970	{
971	#if 0//def DEBUG_bird
972	static int iBP = 0;
973	printf("howdy, breakpoint! iBP=%d\n", iBP);
974	switch (iBP)
975	{
976	case 0:
977	cpu_breakpoint_remove(&pVM->rem.s.Env, pVM->rem.s.Env.eip + pVM->rem.s.Env.segs[R_CS].base);
978	pVM->rem.s.Env.state \|= CPU_EMULATE_SINGLE_STEP;
979	//pVM->rem.s.Env.interrupt_request = 0;
980	//pVM->rem.s.Env.exception_index = -1;
981	//g_fInterruptDisabled = 1;
982	rc = VINF_SUCCESS;
983	asm("int3");
984	break;
985	default:
986	asm("int3");
987	break;
988	}
989	iBP++;
990	#else
991	/* breakpoint or single step? */
992	RTGCPTR GCPtrPC = pVM->rem.s.Env.eip + pVM->rem.s.Env.segs[R_CS].base;
993	int iBP;
994	rc = VINF_EM_DBG_STEPPED;
995	for (iBP = 0; iBP < pVM->rem.s.Env.nb_breakpoints; iBP++)
996	if (pVM->rem.s.Env.breakpoints[iBP] == GCPtrPC)
997	{
998	rc = VINF_EM_DBG_BREAKPOINT;
999	break;
1000	}
1001	Log2(("REMR3Run: cpu_exec -> EXCP_DEBUG rc=%Vrc iBP=%d GCPtrPC=%VGv\n", rc, iBP, GCPtrPC));
1002	#endif
1003	break;
1004	}
1005
1006	/*
1007	* Switch to RAW-mode.
1008	*/
1009	case EXCP_EXECUTE_RAW:
1010	Log2(("REMR3Run: cpu_exec -> EXCP_EXECUTE_RAW\n"));
1011	rc = VINF_EM_RESCHEDULE_RAW;
1012	break;
1013
1014	/*
1015	* Switch to hardware accelerated RAW-mode.
1016	*/
1017	case EXCP_EXECUTE_HWACC:
1018	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_EXECUTE_HWACC\n"));
1019	rc = VINF_EM_RESCHEDULE_HWACC;
1020	break;
1021
1022	/*
1023	* An EM RC was raised (VMR3Reset/Suspend/PowerOff).
1024	*/
1025	case EXCP_RC:
1026	Log2(("REMR3Run: cpu_exec -> EXCP_RC rc=%Vrc\n", pVM->rem.s.rc));
1027	rc = pVM->rem.s.rc;
1028	pVM->rem.s.rc = VERR_INTERNAL_ERROR;
1029	break;
1030
1031	/*
1032	* Figure out the rest when they arrive....
1033	*/
1034	default:
1035	AssertMsgFailed(("rc=%d\n", rc));
1036	Log2(("REMR3Run: cpu_exec -> %d\n", rc));
1037	rc = VINF_SUCCESS;
1038	break;
1039	}
1040
1041	Log2(("REMR3Run: returns %Vrc (cs:eip=%04x:%08x)\n", rc, pVM->rem.s.Env.segs[R_CS].selector, pVM->rem.s.Env.eip));
1042	return rc;
1043	}
1044
1045
1046	/**
1047	* Check if the cpu state is suitable for Raw execution.
1048	*
1049	* @returns boolean
1050	* @param env The CPU env struct.
1051	* @param eip The EIP to check this for (might differ from env->eip).
1052	* @param fFlags hflags OR'ed with IOPL, TF and VM from eflags.
1053	* @param pExceptionIndex Stores EXCP_EXECUTE_RAW/HWACC in case raw mode is supported in this context
1054	*
1055	* @remark This function must be kept in perfect sync with the scheduler in EM.cpp!
1056	*/
1057	bool remR3CanExecuteRaw(CPUState env, RTGCPTR eip, unsigned fFlags, uint32_t pExceptionIndex)
1058	{
1059	/* !!! THIS MUST BE IN SYNC WITH emR3Reschedule !!! */
1060	/* !!! THIS MUST BE IN SYNC WITH emR3Reschedule !!! */
1061	/* !!! THIS MUST BE IN SYNC WITH emR3Reschedule !!! */
1062
1063	/* Update counter. */
1064	env->pVM->rem.s.cCanExecuteRaw++;
1065
1066	if (HWACCMIsEnabled(env->pVM))
1067	{
1068	env->state \|= CPU_RAW_HWACC;
1069
1070	/*
1071	* Create partial context for HWACCMR3CanExecuteGuest
1072	*/
1073	CPUMCTX Ctx;
1074	Ctx.cr0 = env->cr[0];
1075	Ctx.cr3 = env->cr[3];
1076	Ctx.cr4 = env->cr[4];
1077
1078	Ctx.tr = env->tr.selector;
1079	Ctx.trHid.u32Base = (uint32_t)env->tr.base;
1080	Ctx.trHid.u32Limit = env->tr.limit;
1081	Ctx.trHid.Attr.u = (env->tr.flags >> 8) & 0xF0FF;
1082
1083	Ctx.idtr.cbIdt = env->idt.limit;
1084	Ctx.idtr.pIdt = (uint32_t)env->idt.base;
1085
1086	Ctx.eflags.u32 = env->eflags;
1087
1088	Ctx.cs = env->segs[R_CS].selector;
1089	Ctx.csHid.u32Base = (uint32_t)env->segs[R_CS].base;
1090	Ctx.csHid.u32Limit = env->segs[R_CS].limit;
1091	Ctx.csHid.Attr.u = (env->segs[R_CS].flags >> 8) & 0xF0FF;
1092
1093	Ctx.ss = env->segs[R_SS].selector;
1094	Ctx.ssHid.u32Base = (uint32_t)env->segs[R_SS].base;
1095	Ctx.ssHid.u32Limit = env->segs[R_SS].limit;
1096	Ctx.ssHid.Attr.u = (env->segs[R_SS].flags >> 8) & 0xF0FF;
1097
1098	/* Hardware accelerated raw-mode:
1099	*
1100	* Typically only 32-bits protected mode, with paging enabled, code is allowed here.
1101	*/
1102	if (HWACCMR3CanExecuteGuest(env->pVM, &Ctx) == true)
1103	{
1104	*pExceptionIndex = EXCP_EXECUTE_HWACC;
1105	return true;
1106	}
1107	return false;
1108	}
1109
1110	/*
1111	* Here we only support 16 & 32 bits protected mode ring 3 code that has no IO privileges
1112	* or 32 bits protected mode ring 0 code
1113	*
1114	* The tests are ordered by the likelyhood of being true during normal execution.
1115	*/
1116	if (fFlags & (HF_TF_MASK \| HF_INHIBIT_IRQ_MASK))
1117	{
1118	STAM_COUNTER_INC(&gStatRefuseTFInhibit);
1119	Log2(("raw mode refused: fFlags=%#x\n", fFlags));
1120	return false;
1121	}
1122
1123	#ifndef VBOX_RAW_V86
1124	if (fFlags & VM_MASK) {
1125	STAM_COUNTER_INC(&gStatRefuseVM86);
1126	Log2(("raw mode refused: VM_MASK\n"));
1127	return false;
1128	}
1129	#endif
1130
1131	if (env->state & CPU_EMULATE_SINGLE_INSTR)
1132	{
1133	#ifndef DEBUG_bird
1134	Log2(("raw mode refused: CPU_EMULATE_SINGLE_INSTR\n"));
1135	#endif
1136	return false;
1137	}
1138
1139	if (env->singlestep_enabled)
1140	{
1141	//Log2(("raw mode refused: Single step\n"));
1142	return false;
1143	}
1144
1145	if (env->nb_breakpoints > 0)
1146	{
1147	//Log2(("raw mode refused: Breakpoints\n"));
1148	return false;
1149	}
1150
1151	uint32_t u32CR0 = env->cr[0];
1152	if ((u32CR0 & (X86_CR0_PG \| X86_CR0_PE)) != (X86_CR0_PG \| X86_CR0_PE))
1153	{
1154	STAM_COUNTER_INC(&gStatRefusePaging);
1155	//Log2(("raw mode refused: %s%s%s\n", (u32CR0 & X86_CR0_PG) ? "" : " !PG", (u32CR0 & X86_CR0_PE) ? "" : " !PE", (u32CR0 & X86_CR0_AM) ? "" : " !AM"));
1156	return false;
1157	}
1158
1159	if (env->cr[4] & CR4_PAE_MASK)
1160	{
1161	STAM_COUNTER_INC(&gStatRefusePAE);
1162	//Log2(("raw mode refused: PAE\n"));
1163	return false;
1164	}
1165
1166	if (((fFlags >> HF_CPL_SHIFT) & 3) == 3)
1167	{
1168	if (!EMIsRawRing3Enabled(env->pVM))
1169	return false;
1170
1171	if (!(env->eflags & IF_MASK))
1172	{
1173	#ifdef VBOX_RAW_V86
1174	if(!(fFlags & VM_MASK))
1175	return false;
1176	#else
1177	STAM_COUNTER_INC(&gStatRefuseIF0);
1178	Log2(("raw mode refused: IF (RawR3)\n"));
1179	return false;
1180	#endif
1181	}
1182
1183	if (!(u32CR0 & CR0_WP_MASK) && EMIsRawRing0Enabled(env->pVM))
1184	{
1185	STAM_COUNTER_INC(&gStatRefuseWP0);
1186	Log2(("raw mode refused: CR0.WP + RawR0\n"));
1187	return false;
1188	}
1189	}
1190	else
1191	{
1192	if (!EMIsRawRing0Enabled(env->pVM))
1193	return false;
1194
1195	// Let's start with pure 32 bits ring 0 code first
1196	if ((fFlags & (HF_SS32_MASK \| HF_CS32_MASK)) != (HF_SS32_MASK \| HF_CS32_MASK))
1197	{
1198	STAM_COUNTER_INC(&gStatRefuseCode16);
1199	Log2(("raw r0 mode refused: HF_[S\|C]S32_MASK fFlags=%#x\n", fFlags));
1200	return false;
1201	}
1202
1203	// Only R0
1204	if (((fFlags >> HF_CPL_SHIFT) & 3) != 0)
1205	{
1206	STAM_COUNTER_INC(&gStatRefuseRing1or2);
1207	Log2(("raw r0 mode refused: CPL %d\n", ((fFlags >> HF_CPL_SHIFT) & 3) ));
1208	return false;
1209	}
1210
1211	if (!(u32CR0 & CR0_WP_MASK))
1212	{
1213	STAM_COUNTER_INC(&gStatRefuseWP0);
1214	Log2(("raw r0 mode refused: CR0.WP=0!\n"));
1215	return false;
1216	}
1217
1218	if (PATMIsPatchGCAddr(env->pVM, eip))
1219	{
1220	Log2(("raw r0 mode forced: patch code\n"));
1221	*pExceptionIndex = EXCP_EXECUTE_RAW;
1222	return true;
1223	}
1224
1225	#if !defined(VBOX_ALLOW_IF0) && !defined(VBOX_RUN_INTERRUPT_GATE_HANDLERS)
1226	if (!(env->eflags & IF_MASK))
1227	{
1228	STAM_COUNTER_INC(&gStatRefuseIF0);
1229	////Log2(("R0: IF=0 VIF=%d %08X\n", eip, *env->pVMeflags));
1230	//Log2(("RR0: Interrupts turned off; fall back to emulation\n"));
1231	return false;
1232	}
1233	#endif
1234
1235	env->state \|= CPU_RAW_RING0;
1236	}
1237
1238	/*
1239	* Don't reschedule the first time we're called, because there might be
1240	* special reasons why we're here that is not covered by the above checks.
1241	*/
1242	if (env->pVM->rem.s.cCanExecuteRaw == 1)
1243	{
1244	Log2(("raw mode refused: first scheduling\n"));
1245	STAM_COUNTER_INC(&gStatRefuseCanExecute);
1246	return false;
1247	}
1248
1249	Assert(PGMPhysIsA20Enabled(env->pVM));
1250	*pExceptionIndex = EXCP_EXECUTE_RAW;
1251	return true;
1252	}
1253
1254
1255	/**
1256	* Fetches a code byte.
1257	*
1258	* @returns Success indicator (bool) for ease of use.
1259	* @param env The CPU environment structure.
1260	* @param GCPtrInstr Where to fetch code.
1261	* @param pu8Byte Where to store the byte on success
1262	*/
1263	bool remR3GetOpcode(CPUState env, RTGCPTR GCPtrInstr, uint8_t pu8Byte)
1264	{
1265	int rc = PATMR3QueryOpcode(env->pVM, GCPtrInstr, pu8Byte);
1266	if (VBOX_SUCCESS(rc))
1267	return true;
1268	return false;
1269	}
1270
1271
1272	/**
1273	* Flush (or invalidate if you like) page table/dir entry.
1274	*
1275	* (invlpg instruction; tlb_flush_page)
1276	*
1277	* @param env Pointer to cpu environment.
1278	* @param GCPtr The virtual address which page table/dir entry should be invalidated.
1279	*/
1280	void remR3FlushPage(CPUState *env, RTGCPTR GCPtr)
1281	{
1282	PVM pVM = env->pVM;
1283
1284	/*
1285	* When we're replaying invlpg instructions or restoring a saved
1286	* state we disable this path.
1287	*/
1288	if (pVM->rem.s.fIgnoreInvlPg)
1289	return;
1290	Log(("remR3FlushPage: GCPtr=%VGv\n", GCPtr));
1291
1292	//RAWEx_ProfileStop(env, STATS_QEMU_TOTAL);
1293
1294	/*
1295	* Update the control registers before calling PGMFlushPage.
1296	*/
1297	PCPUMCTX pCtx = (PCPUMCTX)pVM->rem.s.pCtx;
1298	pCtx->cr0 = env->cr[0];
1299	pCtx->cr3 = env->cr[3];
1300	pCtx->cr4 = env->cr[4];
1301
1302	/*
1303	* Let PGM do the rest.
1304	*/
1305	int rc = PGMInvalidatePage(pVM, GCPtr);
1306	if (VBOX_FAILURE(rc))
1307	{
1308	AssertMsgFailed(("remR3FlushPage %x %x %x %d failed!!\n", GCPtr));
1309	VM_FF_SET(pVM, VM_FF_PGM_SYNC_CR3);
1310	}
1311	//RAWEx_ProfileStart(env, STATS_QEMU_TOTAL);
1312	}
1313
1314	/**
1315	* Set page table/dir entry. (called from tlb_set_page)
1316	*
1317	* @param env Pointer to cpu environment.
1318	*/
1319	void remR3SetPage(CPUState env, CPUTLBEntry pRead, CPUTLBEntry *pWrite, int prot, int is_user)
1320	{
1321	uint32_t virt_addr, addend;
1322
1323	Log2(("tlb_set_page_raw read (%x-%x) write (%x-%x) prot %x is_user %d\n", pRead->address, pRead->addend, pWrite->address, pWrite->addend, prot, is_user));
1324
1325	if (prot & PAGE_WRITE)
1326	{
1327	addend = pWrite->addend;
1328	virt_addr = pWrite->address;
1329	}
1330	else
1331	if (prot & PAGE_READ)
1332	{
1333	addend = pRead->addend;
1334	virt_addr = pRead->address;
1335	}
1336	else
1337	{
1338	// Should never happen!
1339	AssertMsgFailed(("tlb_set_page_raw unexpected protection flags %x\n", prot));
1340	return;
1341	}
1342
1343	// Clear IO_* flags (TODO: are they actually useful for us??)
1344	virt_addr &= ~0xFFF;
1345
1346	/*
1347	* Update the control registers before calling PGMFlushPage.
1348	*/
1349	PCPUMCTX pCtx = (PCPUMCTX)env->pVM->rem.s.pCtx;
1350	pCtx->cr0 = env->cr[0];
1351	pCtx->cr3 = env->cr[3];
1352	pCtx->cr4 = env->cr[4];
1353
1354	/*
1355	* Let PGM do the rest.
1356	*/
1357	int rc = PGMInvalidatePage(env->pVM, (RTGCPTR)virt_addr);
1358	if (VBOX_FAILURE(rc))
1359	{
1360	AssertMsgFailed(("RAWEx_SetPageEntry %x %x %d failed!!\n", virt_addr, prot, is_user));
1361	VM_FF_SET(env->pVM, VM_FF_PGM_SYNC_CR3);
1362	}
1363	}
1364
1365	/**
1366	* Called from tlb_protect_code in order to write monitor a code page.
1367	*
1368	* @param env Pointer to the CPU environment.
1369	* @param GCPtr Code page to monitor
1370	*/
1371	void remR3ProtectCode(CPUState *env, RTGCPTR GCPtr)
1372	{
1373	if ( (env->cr[0] & X86_CR0_PG) /* paging must be enabled */
1374	&& !(env->state & CPU_EMULATE_SINGLE_INSTR) /* ignore during single instruction execution */
1375	&& (((env->hflags >> HF_CPL_SHIFT) & 3) == 0) /* supervisor mode only */
1376	&& !(env->eflags & VM_MASK) /* no V86 mode */
1377	&& !HWACCMIsEnabled(env->pVM))
1378	CSAMR3MonitorPage(env->pVM, GCPtr, CSAM_TAG_REM);
1379	}
1380
1381	/**
1382	* Called when the CPU is initialized, any of the CRx registers are changed or
1383	* when the A20 line is modified.
1384	*
1385	* @param env Pointer to the CPU environment.
1386	* @param fGlobal Set if the flush is global.
1387	*/
1388	void remR3FlushTLB(CPUState *env, bool fGlobal)
1389	{
1390	PVM pVM = env->pVM;
1391
1392	/*
1393	* When we're replaying invlpg instructions or restoring a saved
1394	* state we disable this path.
1395	*/
1396	if (pVM->rem.s.fIgnoreCR3Load)
1397	return;
1398
1399	/*
1400	* The caller doesn't check cr4, so we have to do that for ourselves.
1401	*/
1402	if (!fGlobal && !(env->cr[4] & X86_CR4_PGE))
1403	fGlobal = true;
1404	Log(("remR3FlushTLB: CR0=%VGp CR3=%VGp CR4=%VGp %s\n", env->cr[0], env->cr[3], env->cr[4], fGlobal ? " global" : ""));
1405
1406	/*
1407	* Update the control registers before calling PGMR3FlushTLB.
1408	*/
1409	PCPUMCTX pCtx = (PCPUMCTX)pVM->rem.s.pCtx;
1410	pCtx->cr0 = env->cr[0];
1411	pCtx->cr3 = env->cr[3];
1412	pCtx->cr4 = env->cr[4];
1413
1414	/*
1415	* Let PGM do the rest.
1416	*/
1417	PGMFlushTLB(pVM, env->cr[3], fGlobal);
1418	}
1419
1420
1421	/**
1422	* Called when any of the cr0, cr4 or efer registers is updated.
1423	*
1424	* @param env Pointer to the CPU environment.
1425	*/
1426	void remR3ChangeCpuMode(CPUState *env)
1427	{
1428	int rc;
1429	PVM pVM = env->pVM;
1430
1431	/*
1432	* When we're replaying loads or restoring a saved
1433	* state this path is disabled.
1434	*/
1435	if (pVM->rem.s.fIgnoreCpuMode)
1436	return;
1437
1438	/*
1439	* Update the control registers before calling PGMR3ChangeMode()
1440	* as it may need to map whatever cr3 is pointing to.
1441	*/
1442	PCPUMCTX pCtx = (PCPUMCTX)pVM->rem.s.pCtx;
1443	pCtx->cr0 = env->cr[0];
1444	pCtx->cr3 = env->cr[3];
1445	pCtx->cr4 = env->cr[4];
1446
1447	#ifdef TARGET_X86_64
1448	rc = PGMChangeMode(pVM, env->cr[0], env->cr[4], env->efer);
1449	if (rc != VINF_SUCCESS)
1450	cpu_abort(env, "PGMChangeMode(, %08x, %08x, %016llx) -> %Vrc\n", env->cr[0], env->cr[4], env->efer, rc);
1451	#else
1452	rc = PGMChangeMode(pVM, env->cr[0], env->cr[4], 0);
1453	if (rc != VINF_SUCCESS)
1454	cpu_abort(env, "PGMChangeMode(, %08x, %08x, %016llx) -> %Vrc\n", env->cr[0], env->cr[4], 0LL, rc);
1455	#endif
1456	}
1457
1458
1459	/**
1460	* Called from compiled code to run dma.
1461	*
1462	* @param env Pointer to the CPU environment.
1463	*/
1464	void remR3DmaRun(CPUState *env)
1465	{
1466	remR3ProfileStop(STATS_QEMU_RUN_EMULATED_CODE);
1467	PDMR3DmaRun(env->pVM);
1468	remR3ProfileStart(STATS_QEMU_RUN_EMULATED_CODE);
1469	}
1470
1471	/**
1472	* Called from compiled code to schedule pending timers in VMM
1473	*
1474	* @param env Pointer to the CPU environment.
1475	*/
1476	void remR3TimersRun(CPUState *env)
1477	{
1478	remR3ProfileStop(STATS_QEMU_RUN_EMULATED_CODE);
1479	remR3ProfileStart(STATS_QEMU_RUN_TIMERS);
1480	TMR3TimerQueuesDo(env->pVM);
1481	remR3ProfileStop(STATS_QEMU_RUN_TIMERS);
1482	remR3ProfileStart(STATS_QEMU_RUN_EMULATED_CODE);
1483	}
1484
1485	/**
1486	* Record trap occurance
1487	*
1488	* @returns VBox status code
1489	* @param env Pointer to the CPU environment.
1490	* @param uTrap Trap nr
1491	* @param uErrorCode Error code
1492	* @param pvNextEIP Next EIP
1493	*/
1494	int remR3NotifyTrap(CPUState *env, uint32_t uTrap, uint32_t uErrorCode, uint32_t pvNextEIP)
1495	{
1496	PVM pVM = (PVM)env->pVM;
1497	#ifdef VBOX_WITH_STATISTICS
1498	static STAMCOUNTER aStatTrap[255];
1499	static bool aRegisters[ELEMENTS(aStatTrap)];
1500	#endif
1501
1502	#ifdef VBOX_WITH_STATISTICS
1503	if (uTrap < 255)
1504	{
1505	if (!aRegisters[uTrap])
1506	{
1507	aRegisters[uTrap] = true;
1508	char szStatName[64];
1509	RTStrPrintf(szStatName, sizeof(szStatName), "/REM/Trap/0x%02X", uTrap);
1510	STAM_REG(env->pVM, &aStatTrap[uTrap], STAMTYPE_COUNTER, szStatName, STAMUNIT_OCCURENCES, "Trap stats.");
1511	}
1512	STAM_COUNTER_INC(&aStatTrap[uTrap]);
1513	}
1514	#endif
1515	Log(("remR3NotifyTrap: uTrap=%x error=%x next_eip=%VGv eip=%VGv cr2=%08x\n", uTrap, uErrorCode, pvNextEIP, env->eip, env->cr[2]));
1516	if(uTrap < 0x20)
1517	{
1518	remR3DisasInstr(env, 1, "remR3NotifyTrap: ");
1519
1520	if(pVM->rem.s.uPendingException == uTrap && ++pVM->rem.s.cPendingExceptions > 128)
1521	{
1522	LogRel(("VERR_REM_TOO_MANY_TRAPS -> uTrap=%x error=%x next_eip=%VGv eip=%VGv cr2=%08x\n", uTrap, uErrorCode, pvNextEIP, env->eip, env->cr[2]));
1523	remR3RaiseRC(env->pVM, VERR_REM_TOO_MANY_TRAPS);
1524	return VERR_REM_TOO_MANY_TRAPS;
1525	}
1526	if(pVM->rem.s.uPendingException != uTrap \|\| pVM->rem.s.uPendingExcptEIP != env->eip \|\| pVM->rem.s.uPendingExcptCR2 != env->cr[2])
1527	pVM->rem.s.cPendingExceptions = 1;
1528	pVM->rem.s.uPendingException = uTrap;
1529	pVM->rem.s.uPendingExcptEIP = env->eip;
1530	pVM->rem.s.uPendingExcptCR2 = env->cr[2];
1531	}
1532	else
1533	{
1534	pVM->rem.s.cPendingExceptions = 0;
1535	pVM->rem.s.uPendingException = uTrap;
1536	pVM->rem.s.uPendingExcptEIP = env->eip;
1537	pVM->rem.s.uPendingExcptCR2 = env->cr[2];
1538	}
1539	return VINF_SUCCESS;
1540	}
1541
1542	/*
1543	* Clear current active trap
1544	*
1545	* @param pVM VM Handle.
1546	*/
1547	void remR3TrapClear(PVM pVM)
1548	{
1549	pVM->rem.s.cPendingExceptions = 0;
1550	pVM->rem.s.uPendingException = 0;
1551	pVM->rem.s.uPendingExcptEIP = 0;
1552	pVM->rem.s.uPendingExcptCR2 = 0;
1553	}
1554
1555
1556	/**
1557	* Syncs the internal REM state with the VM.
1558	*
1559	* This must be called before REMR3Run() is invoked whenever when the REM
1560	* state is not up to date. Calling it several times in a row is not
1561	* permitted.
1562	*
1563	* @returns VBox status code.
1564	*
1565	* @param pVM VM Handle.
1566	*
1567	* @remark The caller has to check for important FFs before calling REMR3Run. REMR3State will
1568	* no do this since the majority of the callers don't want any unnecessary of events
1569	* pending that would immediatly interrupt execution.
1570	*/
1571	REMR3DECL(int) REMR3State(PVM pVM)
1572	{
1573	Assert(!pVM->rem.s.fInREM);
1574	Log2(("REMR3State:\n"));
1575	STAM_PROFILE_START(&pVM->rem.s.StatsState, a);
1576	register const CPUMCTX *pCtx = pVM->rem.s.pCtx;
1577	register unsigned fFlags;
1578
1579	/*
1580	* Copy the registers which requires no special handling.
1581	*/
1582	Assert(R_EAX == 0);
1583	pVM->rem.s.Env.regs[R_EAX] = pCtx->eax;
1584	Assert(R_ECX == 1);
1585	pVM->rem.s.Env.regs[R_ECX] = pCtx->ecx;
1586	Assert(R_EDX == 2);
1587	pVM->rem.s.Env.regs[R_EDX] = pCtx->edx;
1588	Assert(R_EBX == 3);
1589	pVM->rem.s.Env.regs[R_EBX] = pCtx->ebx;
1590	Assert(R_ESP == 4);
1591	pVM->rem.s.Env.regs[R_ESP] = pCtx->esp;
1592	Assert(R_EBP == 5);
1593	pVM->rem.s.Env.regs[R_EBP] = pCtx->ebp;
1594	Assert(R_ESI == 6);
1595	pVM->rem.s.Env.regs[R_ESI] = pCtx->esi;
1596	Assert(R_EDI == 7);
1597	pVM->rem.s.Env.regs[R_EDI] = pCtx->edi;
1598	pVM->rem.s.Env.eip = pCtx->eip;
1599
1600	pVM->rem.s.Env.eflags = pCtx->eflags.u32;
1601
1602	pVM->rem.s.Env.cr[2] = pCtx->cr2;
1603
1604	/** @todo we could probably benefit from using a CPUM_CHANGED_DRx flag too! */
1605	pVM->rem.s.Env.dr[0] = pCtx->dr0;
1606	pVM->rem.s.Env.dr[1] = pCtx->dr1;
1607	pVM->rem.s.Env.dr[2] = pCtx->dr2;
1608	pVM->rem.s.Env.dr[3] = pCtx->dr3;
1609	pVM->rem.s.Env.dr[4] = pCtx->dr4;
1610	pVM->rem.s.Env.dr[5] = pCtx->dr5;
1611	pVM->rem.s.Env.dr[6] = pCtx->dr6;
1612	pVM->rem.s.Env.dr[7] = pCtx->dr7;
1613
1614	/*
1615	* Replay invlpg?
1616	*/
1617	if (pVM->rem.s.cInvalidatedPages)
1618	{
1619	pVM->rem.s.fIgnoreInvlPg = true;
1620	RTUINT i;
1621	for (i = 0; i < pVM->rem.s.cInvalidatedPages; i++)
1622	{
1623	Log2(("REMR3State: invlpg %VGv\n", pVM->rem.s.aGCPtrInvalidatedPages[i]));
1624	tlb_flush_page(&pVM->rem.s.Env, pVM->rem.s.aGCPtrInvalidatedPages[i]);
1625	}
1626	pVM->rem.s.fIgnoreInvlPg = false;
1627	pVM->rem.s.cInvalidatedPages = 0;
1628	}
1629
1630	/*
1631	* Registers which are seldomly changed and require special handling / order when changed.
1632	*/
1633	fFlags = CPUMGetAndClearChangedFlagsREM(pVM);
1634	if (fFlags & ( CPUM_CHANGED_CR4 \| CPUM_CHANGED_CR3 \| CPUM_CHANGED_CR0
1635	\| CPUM_CHANGED_GDTR \| CPUM_CHANGED_IDTR \| CPUM_CHANGED_LDTR \| CPUM_CHANGED_TR
1636	\| CPUM_CHANGED_FPU_REM \| CPUM_CHANGED_SYSENTER_MSR))
1637	{
1638	if (fFlags & CPUM_CHANGED_FPU_REM)
1639	save_raw_fp_state(&pVM->rem.s.Env, (uint8_t )&pCtx->fpu); / 'save' is an excellent name. */
1640
1641	if (fFlags & CPUM_CHANGED_GLOBAL_TLB_FLUSH)
1642	{
1643	pVM->rem.s.fIgnoreCR3Load = true;
1644	tlb_flush(&pVM->rem.s.Env, true);
1645	pVM->rem.s.fIgnoreCR3Load = false;
1646	}
1647
1648	if (fFlags & CPUM_CHANGED_CR4)
1649	{
1650	pVM->rem.s.fIgnoreCR3Load = true;
1651	pVM->rem.s.fIgnoreCpuMode = true;
1652	cpu_x86_update_cr4(&pVM->rem.s.Env, pCtx->cr4);
1653	pVM->rem.s.fIgnoreCpuMode = false;
1654	pVM->rem.s.fIgnoreCR3Load = false;
1655	}
1656
1657	if (fFlags & CPUM_CHANGED_CR0)
1658	{
1659	pVM->rem.s.fIgnoreCR3Load = true;
1660	pVM->rem.s.fIgnoreCpuMode = true;
1661	cpu_x86_update_cr0(&pVM->rem.s.Env, pCtx->cr0);
1662	pVM->rem.s.fIgnoreCpuMode = false;
1663	pVM->rem.s.fIgnoreCR3Load = false;
1664	}
1665
1666	if (fFlags & CPUM_CHANGED_CR3)
1667	{
1668	pVM->rem.s.fIgnoreCR3Load = true;
1669	cpu_x86_update_cr3(&pVM->rem.s.Env, pCtx->cr3);
1670	pVM->rem.s.fIgnoreCR3Load = false;
1671	}
1672
1673	if (fFlags & CPUM_CHANGED_GDTR)
1674	{
1675	pVM->rem.s.Env.gdt.base = pCtx->gdtr.pGdt;
1676	pVM->rem.s.Env.gdt.limit = pCtx->gdtr.cbGdt;
1677	}
1678
1679	if (fFlags & CPUM_CHANGED_IDTR)
1680	{
1681	pVM->rem.s.Env.idt.base = pCtx->idtr.pIdt;
1682	pVM->rem.s.Env.idt.limit = pCtx->idtr.cbIdt;
1683	}
1684
1685	if (fFlags & CPUM_CHANGED_SYSENTER_MSR)
1686	{
1687	pVM->rem.s.Env.sysenter_cs = pCtx->SysEnter.cs;
1688	pVM->rem.s.Env.sysenter_eip = pCtx->SysEnter.eip;
1689	pVM->rem.s.Env.sysenter_esp = pCtx->SysEnter.esp;
1690	}
1691
1692	if (fFlags & CPUM_CHANGED_LDTR)
1693	{
1694	if (fFlags & CPUM_CHANGED_HIDDEN_SEL_REGS)
1695	{
1696	pVM->rem.s.Env.ldt.selector = pCtx->ldtr;
1697	pVM->rem.s.Env.ldt.base = pCtx->ldtrHid.u32Base;
1698	pVM->rem.s.Env.ldt.limit = pCtx->ldtrHid.u32Limit;
1699	pVM->rem.s.Env.ldt.flags = (pCtx->ldtrHid.Attr.u << 8) & 0xFFFFFF;;
1700	}
1701	else
1702	sync_ldtr(&pVM->rem.s.Env, pCtx->ldtr);
1703	}
1704
1705	if (fFlags & CPUM_CHANGED_TR)
1706	{
1707	if (fFlags & CPUM_CHANGED_HIDDEN_SEL_REGS)
1708	{
1709	pVM->rem.s.Env.tr.selector = pCtx->tr;
1710	pVM->rem.s.Env.tr.base = pCtx->trHid.u32Base;
1711	pVM->rem.s.Env.tr.limit = pCtx->trHid.u32Limit;
1712	pVM->rem.s.Env.tr.flags = (pCtx->trHid.Attr.u << 8) & 0xFFFFFF;;
1713	}
1714	else
1715	sync_tr(&pVM->rem.s.Env, pCtx->tr);
1716
1717	/** @note do_interrupt will fault if the busy flag is still set.... */
1718	pVM->rem.s.Env.tr.flags &= ~DESC_TSS_BUSY_MASK;
1719	}
1720	}
1721
1722	/*
1723	* Update selector registers.
1724	* This must be done after we've synced gdt, ldt and crX registers
1725	* since we're reading the GDT/LDT om sync_seg. This will happen with
1726	* saved state which takes a quick dip into rawmode for instance.
1727	*/
1728	/*
1729	* Stack; Note first check this one as the CPL might have changed. The
1730	* wrong CPL can cause QEmu to raise an exception in sync_seg!!
1731	*/
1732
1733	if (fFlags & CPUM_CHANGED_HIDDEN_SEL_REGS)
1734	{
1735	/* The hidden selector registers are valid in the CPU context. */
1736	/** @note QEmu saves the 2nd dword of the descriptor; we should convert the attribute word back! */
1737
1738	cpu_x86_load_seg_cache(&pVM->rem.s.Env, R_CS, pCtx->cs, pCtx->csHid.u32Base, pCtx->csHid.u32Limit, (pCtx->csHid.Attr.u << 8) & 0xFFFFFF);
1739	cpu_x86_load_seg_cache(&pVM->rem.s.Env, R_SS, pCtx->ss, pCtx->ssHid.u32Base, pCtx->ssHid.u32Limit, (pCtx->ssHid.Attr.u << 8) & 0xFFFFFF);
1740	cpu_x86_load_seg_cache(&pVM->rem.s.Env, R_DS, pCtx->ds, pCtx->dsHid.u32Base, pCtx->dsHid.u32Limit, (pCtx->dsHid.Attr.u << 8) & 0xFFFFFF);
1741	cpu_x86_load_seg_cache(&pVM->rem.s.Env, R_ES, pCtx->es, pCtx->esHid.u32Base, pCtx->esHid.u32Limit, (pCtx->esHid.Attr.u << 8) & 0xFFFFFF);
1742	cpu_x86_load_seg_cache(&pVM->rem.s.Env, R_FS, pCtx->fs, pCtx->fsHid.u32Base, pCtx->fsHid.u32Limit, (pCtx->fsHid.Attr.u << 8) & 0xFFFFFF);
1743	cpu_x86_load_seg_cache(&pVM->rem.s.Env, R_GS, pCtx->gs, pCtx->gsHid.u32Base, pCtx->gsHid.u32Limit, (pCtx->gsHid.Attr.u << 8) & 0xFFFFFF);
1744
1745	/* Set current CPL. */
1746	if (pCtx->eflags.Bits.u1VM == 1)
1747	cpu_x86_set_cpl(&pVM->rem.s.Env, 3);
1748	else
1749	cpu_x86_set_cpl(&pVM->rem.s.Env, pCtx->ss & 3);
1750	}
1751	else
1752	{
1753	/* In 'normal' raw mode we don't have access to the hidden selector registers. */
1754	if (pVM->rem.s.Env.segs[R_SS].selector != (uint16_t)pCtx->ss)
1755	{
1756	Log2(("REMR3State: SS changed from %04x to %04x!\n", pVM->rem.s.Env.segs[R_SS].selector, pCtx->ss));
1757	if (pCtx->eflags.Bits.u1VM == 1)
1758	{
1759	cpu_x86_set_cpl(&pVM->rem.s.Env, 3);
1760	pVM->rem.s.Env.segs[R_SS].selector = (uint16_t)pCtx->ss;
1761	}
1762	else
1763	{
1764	cpu_x86_set_cpl(&pVM->rem.s.Env, pCtx->ss & 3);
1765	sync_seg(&pVM->rem.s.Env, R_SS, pCtx->ss);
1766	#ifdef VBOX_WITH_STATISTICS
1767	if (pVM->rem.s.Env.segs[R_SS].newselector)
1768	{
1769	STAM_COUNTER_INC(&gStatSelOutOfSync[R_SS]);
1770	}
1771	#endif
1772	}
1773	}
1774	else
1775	pVM->rem.s.Env.segs[R_SS].newselector = 0;
1776
1777	if (pVM->rem.s.Env.segs[R_ES].selector != pCtx->es)
1778	{
1779	Log2(("REMR3State: ES changed from %04x to %04x!\n", pVM->rem.s.Env.segs[R_ES].selector, pCtx->es));
1780	if (pCtx->eflags.Bits.u1VM == 1)
1781	{
1782	pVM->rem.s.Env.segs[R_ES].selector = (uint16_t)pCtx->es;
1783	}
1784	else
1785	{
1786	sync_seg(&pVM->rem.s.Env, R_ES, pCtx->es);
1787	#ifdef VBOX_WITH_STATISTICS
1788	if (pVM->rem.s.Env.segs[R_ES].newselector)
1789	{
1790	STAM_COUNTER_INC(&gStatSelOutOfSync[R_ES]);
1791	}
1792	#endif
1793	}
1794	}
1795	else
1796	pVM->rem.s.Env.segs[R_ES].newselector = 0;
1797
1798	if (pVM->rem.s.Env.segs[R_CS].selector != pCtx->cs)
1799	{
1800	Log2(("REMR3State: CS changed from %04x to %04x!\n", pVM->rem.s.Env.segs[R_CS].selector, pCtx->cs));
1801	if (pCtx->eflags.Bits.u1VM == 1)
1802	{
1803	pVM->rem.s.Env.segs[R_CS].selector = (uint16_t)pCtx->cs;
1804	}
1805	else
1806	{
1807	sync_seg(&pVM->rem.s.Env, R_CS, pCtx->cs);
1808	#ifdef VBOX_WITH_STATISTICS
1809	if (pVM->rem.s.Env.segs[R_CS].newselector)
1810	{
1811	STAM_COUNTER_INC(&gStatSelOutOfSync[R_CS]);
1812	}
1813	#endif
1814	}
1815	}
1816	else
1817	pVM->rem.s.Env.segs[R_CS].newselector = 0;
1818
1819	if (pVM->rem.s.Env.segs[R_DS].selector != pCtx->ds)
1820	{
1821	Log2(("REMR3State: DS changed from %04x to %04x!\n", pVM->rem.s.Env.segs[R_DS].selector, pCtx->ds));
1822	if (pCtx->eflags.Bits.u1VM == 1)
1823	{
1824	pVM->rem.s.Env.segs[R_DS].selector = (uint16_t)pCtx->ds;
1825	}
1826	else
1827	{
1828	sync_seg(&pVM->rem.s.Env, R_DS, pCtx->ds);
1829	#ifdef VBOX_WITH_STATISTICS
1830	if (pVM->rem.s.Env.segs[R_DS].newselector)
1831	{
1832	STAM_COUNTER_INC(&gStatSelOutOfSync[R_DS]);
1833	}
1834	#endif
1835	}
1836	}
1837	else
1838	pVM->rem.s.Env.segs[R_DS].newselector = 0;
1839
1840	/** @todo need to find a way to communicate potential GDT/LDT changes and thread switches. The selector might
1841	* be the same but not the base/limit. */
1842	if (pVM->rem.s.Env.segs[R_FS].selector != pCtx->fs)
1843	{
1844	Log2(("REMR3State: FS changed from %04x to %04x!\n", pVM->rem.s.Env.segs[R_FS].selector, pCtx->fs));
1845	if (pCtx->eflags.Bits.u1VM == 1)
1846	{
1847	pVM->rem.s.Env.segs[R_FS].selector = (uint16_t)pCtx->fs;
1848	}
1849	else
1850	{
1851	sync_seg(&pVM->rem.s.Env, R_FS, pCtx->fs);
1852	#ifdef VBOX_WITH_STATISTICS
1853	if (pVM->rem.s.Env.segs[R_FS].newselector)
1854	{
1855	STAM_COUNTER_INC(&gStatSelOutOfSync[R_FS]);
1856	}
1857	#endif
1858	}
1859	}
1860	else
1861	pVM->rem.s.Env.segs[R_FS].newselector = 0;
1862
1863	if (pVM->rem.s.Env.segs[R_GS].selector != pCtx->gs)
1864	{
1865	Log2(("REMR3State: GS changed from %04x to %04x!\n", pVM->rem.s.Env.segs[R_GS].selector, pCtx->gs));
1866	if (pCtx->eflags.Bits.u1VM == 1)
1867	{
1868	pVM->rem.s.Env.segs[R_GS].selector = (uint16_t)pCtx->gs;
1869	}
1870	else
1871	{
1872	sync_seg(&pVM->rem.s.Env, R_GS, pCtx->gs);
1873	#ifdef VBOX_WITH_STATISTICS
1874	if (pVM->rem.s.Env.segs[R_GS].newselector)
1875	{
1876	STAM_COUNTER_INC(&gStatSelOutOfSync[R_GS]);
1877	}
1878	#endif
1879	}
1880	}
1881	else
1882	pVM->rem.s.Env.segs[R_GS].newselector = 0;
1883	}
1884
1885	/*
1886	* Check for traps.
1887	*/
1888	pVM->rem.s.Env.exception_index = -1; /** @todo this won't work :/ */
1889	bool fIsSoftwareInterrupt;
1890	uint8_t u8TrapNo;
1891	int rc = TRPMQueryTrap(pVM, &u8TrapNo, &fIsSoftwareInterrupt);
1892	if (VBOX_SUCCESS(rc))
1893	{
1894	#ifdef DEBUG
1895	if (u8TrapNo == 0x80)
1896	{
1897	remR3DumpLnxSyscall(pVM);
1898	remR3DumpOBsdSyscall(pVM);
1899	}
1900	#endif
1901
1902	pVM->rem.s.Env.exception_index = u8TrapNo;
1903	if (!fIsSoftwareInterrupt)
1904	{
1905	pVM->rem.s.Env.exception_is_int = 0;
1906	pVM->rem.s.Env.exception_next_eip = pVM->rem.s.Env.eip;
1907	}
1908	else
1909	{
1910	/*
1911	* The there are two 1 byte opcodes and one 2 byte opcode for software interrupts.
1912	* We ASSUME that there are no prefixes and sets the default to 2 byte, and checks
1913	* for int03 and into.
1914	*/
1915	pVM->rem.s.Env.exception_is_int = 1;
1916	pVM->rem.s.Env.exception_next_eip = pCtx->eip + 2;
1917	/* int 3 may be generated by one-byte 0xcc */
1918	if (u8TrapNo == 3)
1919	{
1920	if (read_byte(&pVM->rem.s.Env, pVM->rem.s.Env.segs[R_CS].base + pCtx->eip) == 0xcc)
1921	pVM->rem.s.Env.exception_next_eip = pCtx->eip + 1;
1922	}
1923	/* int 4 may be generated by one-byte 0xce */
1924	else if (u8TrapNo == 4)
1925	{
1926	if (read_byte(&pVM->rem.s.Env, pVM->rem.s.Env.segs[R_CS].base + pCtx->eip) == 0xce)
1927	pVM->rem.s.Env.exception_next_eip = pCtx->eip + 1;
1928	}
1929	}
1930
1931	/* get error code and cr2 if needed. */
1932	switch (u8TrapNo)
1933	{
1934	case 0x0e:
1935	pVM->rem.s.Env.cr[2] = TRPMGetFaultAddress(pVM);
1936	/* fallthru */
1937	case 0x0a: case 0x0b: case 0x0c: case 0x0d:
1938	pVM->rem.s.Env.error_code = TRPMGetErrorCode(pVM);
1939	break;
1940
1941	case 0x11: case 0x08:
1942	default:
1943	pVM->rem.s.Env.error_code = 0;
1944	break;
1945	}
1946
1947	/*
1948	* We can now reset the active trap since the recompiler is gonna have a go at it.
1949	*/
1950	rc = TRPMResetTrap(pVM);
1951	AssertRC(rc);
1952	Log2(("REMR3State: trap=%02x errcd=%VGv cr2=%VGv nexteip=%VGv%s\n", pVM->rem.s.Env.exception_index, pVM->rem.s.Env.error_code,
1953	pVM->rem.s.Env.cr[2], pVM->rem.s.Env.exception_next_eip, pVM->rem.s.Env.exception_is_int ? " software" : ""));
1954	//if (pVM->rem.s.Env.eip == 0x40005a2f)
1955	// pVM->rem.s.Env.state \|= CPU_EMULATE_SINGLE_STEP \| CPU_RAW_MODE_DISABLED \| CPU_RAWR0_MODE_DISABLED;
1956	}
1957
1958	/*
1959	* Clear old interrupt request flags; Check for pending hardware interrupts.
1960	* (See @remark for why we don't check for other FFs.)
1961	*/
1962	pVM->rem.s.Env.interrupt_request &= ~(CPU_INTERRUPT_HARD \| CPU_INTERRUPT_EXIT \| CPU_INTERRUPT_EXITTB \| CPU_INTERRUPT_TIMER);
1963	if ( pVM->rem.s.u32PendingInterrupt != REM_NO_PENDING_IRQ
1964	\|\| VM_FF_ISPENDING(pVM, VM_FF_INTERRUPT_APIC \| VM_FF_INTERRUPT_PIC))
1965	pVM->rem.s.Env.interrupt_request \|= CPU_INTERRUPT_HARD;
1966
1967	/*
1968	* We're now in REM mode.
1969	*/
1970	pVM->rem.s.fInREM = true;
1971	pVM->rem.s.cCanExecuteRaw = 0;
1972	STAM_PROFILE_STOP(&pVM->rem.s.StatsState, a);
1973	Log2(("REMR3State: returns VINF_SUCCESS\n"));
1974	return VINF_SUCCESS;
1975	}
1976
1977
1978	/**
1979	* Syncs back changes in the REM state to the the VM state.
1980	*
1981	* This must be called after invoking REMR3Run().
1982	* Calling it several times in a row is not permitted.
1983	*
1984	* @returns VBox status code.
1985	*
1986	* @param pVM VM Handle.
1987	*/
1988	REMR3DECL(int) REMR3StateBack(PVM pVM)
1989	{
1990	Log2(("REMR3StateBack:\n"));
1991	Assert(pVM->rem.s.fInREM);
1992	STAM_PROFILE_START(&pVM->rem.s.StatsStateBack, a);
1993	register PCPUMCTX pCtx = pVM->rem.s.pCtx;
1994
1995	/*
1996	* Copy back the registers.
1997	* This is done in the order they are declared in the CPUMCTX structure.
1998	*/
1999
2000	/** @todo FOP */
2001	/** @todo FPUIP */
2002	/** @todo CS */
2003	/** @todo FPUDP */
2004	/** @todo DS */
2005	/** @todo Fix MXCSR support in QEMU so we don't overwrite MXCSR with 0 when we shouldn't! */
2006	pCtx->fpu.MXCSR = 0;
2007	pCtx->fpu.MXCSR_MASK = 0;
2008
2009	/** @todo check if FPU/XMM was actually used in the recompiler */
2010	restore_raw_fp_state(&pVM->rem.s.Env, (uint8_t *)&pCtx->fpu);
2011	//// dprintf2(("FPU state CW=%04X TT=%04X SW=%04X (%04X)\n", env->fpuc, env->fpstt, env->fpus, pVMCtx->fpu.FSW));
2012
2013	pCtx->edi = pVM->rem.s.Env.regs[R_EDI];
2014	pCtx->esi = pVM->rem.s.Env.regs[R_ESI];
2015	pCtx->ebp = pVM->rem.s.Env.regs[R_EBP];
2016	pCtx->eax = pVM->rem.s.Env.regs[R_EAX];
2017	pCtx->ebx = pVM->rem.s.Env.regs[R_EBX];
2018	pCtx->edx = pVM->rem.s.Env.regs[R_EDX];
2019	pCtx->ecx = pVM->rem.s.Env.regs[R_ECX];
2020
2021	pCtx->esp = pVM->rem.s.Env.regs[R_ESP];
2022	pCtx->ss = pVM->rem.s.Env.segs[R_SS].selector;
2023
2024	#ifdef VBOX_WITH_STATISTICS
2025	if (pVM->rem.s.Env.segs[R_SS].newselector)
2026	{
2027	STAM_COUNTER_INC(&gStatSelOutOfSyncStateBack[R_SS]);
2028	}
2029	if (pVM->rem.s.Env.segs[R_GS].newselector)
2030	{
2031	STAM_COUNTER_INC(&gStatSelOutOfSyncStateBack[R_GS]);
2032	}
2033	if (pVM->rem.s.Env.segs[R_FS].newselector)
2034	{
2035	STAM_COUNTER_INC(&gStatSelOutOfSyncStateBack[R_FS]);
2036	}
2037	if (pVM->rem.s.Env.segs[R_ES].newselector)
2038	{
2039	STAM_COUNTER_INC(&gStatSelOutOfSyncStateBack[R_ES]);
2040	}
2041	if (pVM->rem.s.Env.segs[R_DS].newselector)
2042	{
2043	STAM_COUNTER_INC(&gStatSelOutOfSyncStateBack[R_DS]);
2044	}
2045	if (pVM->rem.s.Env.segs[R_CS].newselector)
2046	{
2047	STAM_COUNTER_INC(&gStatSelOutOfSyncStateBack[R_CS]);
2048	}
2049	#endif
2050	pCtx->gs = pVM->rem.s.Env.segs[R_GS].selector;
2051	pCtx->fs = pVM->rem.s.Env.segs[R_FS].selector;
2052	pCtx->es = pVM->rem.s.Env.segs[R_ES].selector;
2053	pCtx->ds = pVM->rem.s.Env.segs[R_DS].selector;
2054	pCtx->cs = pVM->rem.s.Env.segs[R_CS].selector;
2055
2056	pCtx->eip = pVM->rem.s.Env.eip;
2057	pCtx->eflags.u32 = pVM->rem.s.Env.eflags;
2058
2059	pCtx->cr0 = pVM->rem.s.Env.cr[0];
2060	pCtx->cr2 = pVM->rem.s.Env.cr[2];
2061	pCtx->cr3 = pVM->rem.s.Env.cr[3];
2062	pCtx->cr4 = pVM->rem.s.Env.cr[4];
2063
2064	pCtx->dr0 = pVM->rem.s.Env.dr[0];
2065	pCtx->dr1 = pVM->rem.s.Env.dr[1];
2066	pCtx->dr2 = pVM->rem.s.Env.dr[2];
2067	pCtx->dr3 = pVM->rem.s.Env.dr[3];
2068	pCtx->dr4 = pVM->rem.s.Env.dr[4];
2069	pCtx->dr5 = pVM->rem.s.Env.dr[5];
2070	pCtx->dr6 = pVM->rem.s.Env.dr[6];
2071	pCtx->dr7 = pVM->rem.s.Env.dr[7];
2072
2073	pCtx->gdtr.cbGdt = pVM->rem.s.Env.gdt.limit;
2074	if (pCtx->gdtr.pGdt != (uint32_t)pVM->rem.s.Env.gdt.base)
2075	{
2076	pCtx->gdtr.pGdt = (uint32_t)pVM->rem.s.Env.gdt.base;
2077	STAM_COUNTER_INC(&gStatREMGDTChange);
2078	VM_FF_SET(pVM, VM_FF_SELM_SYNC_GDT);
2079	}
2080
2081	pCtx->idtr.cbIdt = pVM->rem.s.Env.idt.limit;
2082	if (pCtx->idtr.pIdt != (uint32_t)pVM->rem.s.Env.idt.base)
2083	{
2084	pCtx->idtr.pIdt = (uint32_t)pVM->rem.s.Env.idt.base;
2085	STAM_COUNTER_INC(&gStatREMIDTChange);
2086	VM_FF_SET(pVM, VM_FF_TRPM_SYNC_IDT);
2087	}
2088
2089	if (pCtx->ldtr != pVM->rem.s.Env.ldt.selector)
2090	{
2091	pCtx->ldtr = pVM->rem.s.Env.ldt.selector;
2092	STAM_COUNTER_INC(&gStatREMLDTRChange);
2093	VM_FF_SET(pVM, VM_FF_SELM_SYNC_LDT);
2094	}
2095	if (pCtx->tr != pVM->rem.s.Env.tr.selector)
2096	{
2097	pCtx->tr = pVM->rem.s.Env.tr.selector;
2098	STAM_COUNTER_INC(&gStatREMTRChange);
2099	VM_FF_SET(pVM, VM_FF_SELM_SYNC_TSS);
2100	}
2101
2102	/** @todo These values could still be out of sync! */
2103	pCtx->csHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_CS].base;
2104	pCtx->csHid.u32Limit = pVM->rem.s.Env.segs[R_CS].limit;
2105	/** @note QEmu saves the 2nd dword of the descriptor; we should store the attribute word only! */
2106	pCtx->csHid.Attr.u = (pVM->rem.s.Env.segs[R_CS].flags >> 8) & 0xF0FF;
2107
2108	pCtx->dsHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_DS].base;
2109	pCtx->dsHid.u32Limit = pVM->rem.s.Env.segs[R_DS].limit;
2110	pCtx->dsHid.Attr.u = (pVM->rem.s.Env.segs[R_DS].flags >> 8) & 0xF0FF;
2111
2112	pCtx->esHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_ES].base;
2113	pCtx->esHid.u32Limit = pVM->rem.s.Env.segs[R_ES].limit;
2114	pCtx->esHid.Attr.u = (pVM->rem.s.Env.segs[R_ES].flags >> 8) & 0xF0FF;
2115
2116	pCtx->fsHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_FS].base;
2117	pCtx->fsHid.u32Limit = pVM->rem.s.Env.segs[R_FS].limit;
2118	pCtx->fsHid.Attr.u = (pVM->rem.s.Env.segs[R_FS].flags >> 8) & 0xF0FF;
2119
2120	pCtx->gsHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_GS].base;
2121	pCtx->gsHid.u32Limit = pVM->rem.s.Env.segs[R_GS].limit;
2122	pCtx->gsHid.Attr.u = (pVM->rem.s.Env.segs[R_GS].flags >> 8) & 0xF0FF;
2123
2124	pCtx->ssHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_SS].base;
2125	pCtx->ssHid.u32Limit = pVM->rem.s.Env.segs[R_SS].limit;
2126	pCtx->ssHid.Attr.u = (pVM->rem.s.Env.segs[R_SS].flags >> 8) & 0xF0FF;
2127
2128	pCtx->ldtrHid.u32Base = (uint32_t)pVM->rem.s.Env.ldt.base;
2129	pCtx->ldtrHid.u32Limit = pVM->rem.s.Env.ldt.limit;
2130	pCtx->ldtrHid.Attr.u = (pVM->rem.s.Env.ldt.flags >> 8) & 0xF0FF;
2131
2132	pCtx->trHid.u32Base = (uint32_t)pVM->rem.s.Env.tr.base;
2133	pCtx->trHid.u32Limit = pVM->rem.s.Env.tr.limit;
2134	pCtx->trHid.Attr.u = (pVM->rem.s.Env.tr.flags >> 8) & 0xF0FF;
2135
2136	/* Sysenter MSR */
2137	pCtx->SysEnter.cs = pVM->rem.s.Env.sysenter_cs;
2138	pCtx->SysEnter.eip = pVM->rem.s.Env.sysenter_eip;
2139	pCtx->SysEnter.esp = pVM->rem.s.Env.sysenter_esp;
2140
2141	remR3TrapClear(pVM);
2142
2143	/*
2144	* Check for traps.
2145	*/
2146	if ( pVM->rem.s.Env.exception_index >= 0
2147	&& pVM->rem.s.Env.exception_index < 256)
2148	{
2149	Log(("REMR3StateBack: Pending trap %x %d\n", pVM->rem.s.Env.exception_index, pVM->rem.s.Env.exception_is_int));
2150	int rc = TRPMAssertTrap(pVM, pVM->rem.s.Env.exception_index, pVM->rem.s.Env.exception_is_int);
2151	AssertRC(rc);
2152	switch (pVM->rem.s.Env.exception_index)
2153	{
2154	case 0x0e:
2155	TRPMSetFaultAddress(pVM, pCtx->cr2);
2156	/* fallthru */
2157	case 0x0a: case 0x0b: case 0x0c: case 0x0d:
2158	case 0x11: case 0x08: /* 0 */
2159	TRPMSetErrorCode(pVM, pVM->rem.s.Env.error_code);
2160	break;
2161	}
2162
2163	}
2164
2165	/*
2166	* We're not longer in REM mode.
2167	*/
2168	pVM->rem.s.fInREM = false;
2169	STAM_PROFILE_STOP(&pVM->rem.s.StatsStateBack, a);
2170	Log2(("REMR3StateBack: returns VINF_SUCCESS\n"));
2171	return VINF_SUCCESS;
2172	}
2173
2174
2175	/**
2176	* This is called by the disassembler when it wants to update the cpu state
2177	* before for instance doing a register dump.
2178	*/
2179	static void remR3StateUpdate(PVM pVM)
2180	{
2181	Assert(pVM->rem.s.fInREM);
2182	register PCPUMCTX pCtx = pVM->rem.s.pCtx;
2183
2184	/*
2185	* Copy back the registers.
2186	* This is done in the order they are declared in the CPUMCTX structure.
2187	*/
2188
2189	/** @todo FOP */
2190	/** @todo FPUIP */
2191	/** @todo CS */
2192	/** @todo FPUDP */
2193	/** @todo DS */
2194	/** @todo Fix MXCSR support in QEMU so we don't overwrite MXCSR with 0 when we shouldn't! */
2195	pCtx->fpu.MXCSR = 0;
2196	pCtx->fpu.MXCSR_MASK = 0;
2197
2198	/** @todo check if FPU/XMM was actually used in the recompiler */
2199	restore_raw_fp_state(&pVM->rem.s.Env, (uint8_t *)&pCtx->fpu);
2200	//// dprintf2(("FPU state CW=%04X TT=%04X SW=%04X (%04X)\n", env->fpuc, env->fpstt, env->fpus, pVMCtx->fpu.FSW));
2201
2202	pCtx->edi = pVM->rem.s.Env.regs[R_EDI];
2203	pCtx->esi = pVM->rem.s.Env.regs[R_ESI];
2204	pCtx->ebp = pVM->rem.s.Env.regs[R_EBP];
2205	pCtx->eax = pVM->rem.s.Env.regs[R_EAX];
2206	pCtx->ebx = pVM->rem.s.Env.regs[R_EBX];
2207	pCtx->edx = pVM->rem.s.Env.regs[R_EDX];
2208	pCtx->ecx = pVM->rem.s.Env.regs[R_ECX];
2209
2210	pCtx->esp = pVM->rem.s.Env.regs[R_ESP];
2211	pCtx->ss = pVM->rem.s.Env.segs[R_SS].selector;
2212
2213	pCtx->gs = pVM->rem.s.Env.segs[R_GS].selector;
2214	pCtx->fs = pVM->rem.s.Env.segs[R_FS].selector;
2215	pCtx->es = pVM->rem.s.Env.segs[R_ES].selector;
2216	pCtx->ds = pVM->rem.s.Env.segs[R_DS].selector;
2217	pCtx->cs = pVM->rem.s.Env.segs[R_CS].selector;
2218
2219	pCtx->eip = pVM->rem.s.Env.eip;
2220	pCtx->eflags.u32 = pVM->rem.s.Env.eflags;
2221
2222	pCtx->cr0 = pVM->rem.s.Env.cr[0];
2223	pCtx->cr2 = pVM->rem.s.Env.cr[2];
2224	pCtx->cr3 = pVM->rem.s.Env.cr[3];
2225	pCtx->cr4 = pVM->rem.s.Env.cr[4];
2226
2227	pCtx->dr0 = pVM->rem.s.Env.dr[0];
2228	pCtx->dr1 = pVM->rem.s.Env.dr[1];
2229	pCtx->dr2 = pVM->rem.s.Env.dr[2];
2230	pCtx->dr3 = pVM->rem.s.Env.dr[3];
2231	pCtx->dr4 = pVM->rem.s.Env.dr[4];
2232	pCtx->dr5 = pVM->rem.s.Env.dr[5];
2233	pCtx->dr6 = pVM->rem.s.Env.dr[6];
2234	pCtx->dr7 = pVM->rem.s.Env.dr[7];
2235
2236	pCtx->gdtr.cbGdt = pVM->rem.s.Env.gdt.limit;
2237	if (pCtx->gdtr.pGdt != (uint32_t)pVM->rem.s.Env.gdt.base)
2238	{
2239	pCtx->gdtr.pGdt = (uint32_t)pVM->rem.s.Env.gdt.base;
2240	STAM_COUNTER_INC(&gStatREMGDTChange);
2241	VM_FF_SET(pVM, VM_FF_SELM_SYNC_GDT);
2242	}
2243
2244	pCtx->idtr.cbIdt = pVM->rem.s.Env.idt.limit;
2245	if (pCtx->idtr.pIdt != (uint32_t)pVM->rem.s.Env.idt.base)
2246	{
2247	pCtx->idtr.pIdt = (uint32_t)pVM->rem.s.Env.idt.base;
2248	STAM_COUNTER_INC(&gStatREMIDTChange);
2249	VM_FF_SET(pVM, VM_FF_TRPM_SYNC_IDT);
2250	}
2251
2252	if (pCtx->ldtr != pVM->rem.s.Env.ldt.selector)
2253	{
2254	pCtx->ldtr = pVM->rem.s.Env.ldt.selector;
2255	STAM_COUNTER_INC(&gStatREMLDTRChange);
2256	VM_FF_SET(pVM, VM_FF_SELM_SYNC_LDT);
2257	}
2258	if (pCtx->tr != pVM->rem.s.Env.tr.selector)
2259	{
2260	pCtx->tr = pVM->rem.s.Env.tr.selector;
2261	STAM_COUNTER_INC(&gStatREMTRChange);
2262	VM_FF_SET(pVM, VM_FF_SELM_SYNC_TSS);
2263	}
2264
2265	/** @todo These values could still be out of sync! */
2266	pCtx->csHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_CS].base;
2267	pCtx->csHid.u32Limit = pVM->rem.s.Env.segs[R_CS].limit;
2268	/** @note QEmu saves the 2nd dword of the descriptor; we should store the attribute word only! */
2269	pCtx->csHid.Attr.u = (pVM->rem.s.Env.segs[R_CS].flags >> 8) & 0xFFFF;
2270
2271	pCtx->dsHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_DS].base;
2272	pCtx->dsHid.u32Limit = pVM->rem.s.Env.segs[R_DS].limit;
2273	pCtx->dsHid.Attr.u = (pVM->rem.s.Env.segs[R_DS].flags >> 8) & 0xFFFF;
2274
2275	pCtx->esHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_ES].base;
2276	pCtx->esHid.u32Limit = pVM->rem.s.Env.segs[R_ES].limit;
2277	pCtx->esHid.Attr.u = (pVM->rem.s.Env.segs[R_ES].flags >> 8) & 0xFFFF;
2278
2279	pCtx->fsHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_FS].base;
2280	pCtx->fsHid.u32Limit = pVM->rem.s.Env.segs[R_FS].limit;
2281	pCtx->fsHid.Attr.u = (pVM->rem.s.Env.segs[R_FS].flags >> 8) & 0xFFFF;
2282
2283	pCtx->gsHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_GS].base;
2284	pCtx->gsHid.u32Limit = pVM->rem.s.Env.segs[R_GS].limit;
2285	pCtx->gsHid.Attr.u = (pVM->rem.s.Env.segs[R_GS].flags >> 8) & 0xFFFF;
2286
2287	pCtx->ssHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_SS].base;
2288	pCtx->ssHid.u32Limit = pVM->rem.s.Env.segs[R_SS].limit;
2289	pCtx->ssHid.Attr.u = (pVM->rem.s.Env.segs[R_SS].flags >> 8) & 0xFFFF;
2290
2291	pCtx->ldtrHid.u32Base = (uint32_t)pVM->rem.s.Env.ldt.base;
2292	pCtx->ldtrHid.u32Limit = pVM->rem.s.Env.ldt.limit;
2293	pCtx->ldtrHid.Attr.u = (pVM->rem.s.Env.ldt.flags >> 8) & 0xFFFF;
2294
2295	pCtx->trHid.u32Base = (uint32_t)pVM->rem.s.Env.tr.base;
2296	pCtx->trHid.u32Limit = pVM->rem.s.Env.tr.limit;
2297	pCtx->trHid.Attr.u = (pVM->rem.s.Env.tr.flags >> 8) & 0xFFFF;
2298
2299	/* Sysenter MSR */
2300	pCtx->SysEnter.cs = pVM->rem.s.Env.sysenter_cs;
2301	pCtx->SysEnter.eip = pVM->rem.s.Env.sysenter_eip;
2302	pCtx->SysEnter.esp = pVM->rem.s.Env.sysenter_esp;
2303	}
2304
2305
2306	/**
2307	* Update the VMM state information if we're currently in REM.
2308	*
2309	* This method is used by the DBGF and PDMDevice when there is any uncertainty of whether
2310	* we're currently executing in REM and the VMM state is invalid. This method will of
2311	* course check that we're executing in REM before syncing any data over to the VMM.
2312	*
2313	* @param pVM The VM handle.
2314	*/
2315	REMR3DECL(void) REMR3StateUpdate(PVM pVM)
2316	{
2317	if (pVM->rem.s.fInREM)
2318	remR3StateUpdate(pVM);
2319	}
2320
2321
2322	#undef LOG_GROUP
2323	#define LOG_GROUP LOG_GROUP_REM
2324
2325
2326	/**
2327	* Notify the recompiler about Address Gate 20 state change.
2328	*
2329	* This notification is required since A20 gate changes are
2330	* initialized from a device driver and the VM might just as
2331	* well be in REM mode as in RAW mode.
2332	*
2333	* @param pVM VM handle.
2334	* @param fEnable True if the gate should be enabled.
2335	* False if the gate should be disabled.
2336	*/
2337	REMR3DECL(void) REMR3A20Set(PVM pVM, bool fEnable)
2338	{
2339	LogFlow(("REMR3A20Set: fEnable=%d\n", fEnable));
2340	VM_ASSERT_EMT(pVM);
2341	cpu_x86_set_a20(&pVM->rem.s.Env, fEnable);
2342	}
2343
2344
2345	/**
2346	* Replays the invalidated recorded pages.
2347	* Called in response to VERR_REM_FLUSHED_PAGES_OVERFLOW from the RAW execution loop.
2348	*
2349	* @param pVM VM handle.
2350	*/
2351	REMR3DECL(void) REMR3ReplayInvalidatedPages(PVM pVM)
2352	{
2353	VM_ASSERT_EMT(pVM);
2354
2355	/*
2356	* Sync the required registers.
2357	*/
2358	pVM->rem.s.Env.cr[0] = pVM->rem.s.pCtx->cr0;
2359	pVM->rem.s.Env.cr[2] = pVM->rem.s.pCtx->cr2;
2360	pVM->rem.s.Env.cr[3] = pVM->rem.s.pCtx->cr3;
2361	pVM->rem.s.Env.cr[4] = pVM->rem.s.pCtx->cr4;
2362
2363	/*
2364	* Replay the flushes.
2365	*/
2366	pVM->rem.s.fIgnoreInvlPg = true;
2367	RTUINT i;
2368	for (i = 0; i < pVM->rem.s.cInvalidatedPages; i++)
2369	{
2370	Log2(("REMR3ReplayInvalidatedPages: invlpg %VGv\n", pVM->rem.s.aGCPtrInvalidatedPages[i]));
2371	tlb_flush_page(&pVM->rem.s.Env, pVM->rem.s.aGCPtrInvalidatedPages[i]);
2372	}
2373	pVM->rem.s.fIgnoreInvlPg = false;
2374	pVM->rem.s.cInvalidatedPages = 0;
2375	}
2376
2377
2378	/**
2379	* Replays the invalidated recorded pages.
2380	* Called in response to VERR_REM_FLUSHED_PAGES_OVERFLOW from the RAW execution loop.
2381	*
2382	* @param pVM VM handle.
2383	*/
2384	REMR3DECL(void) REMR3ReplayHandlerNotifications(PVM pVM)
2385	{
2386	LogFlow(("REMR3ReplayInvalidatedPages:\n"));
2387	VM_ASSERT_EMT(pVM);
2388
2389	/*
2390	* Replay the flushes.
2391	*/
2392	RTUINT i;
2393	const RTUINT c = pVM->rem.s.cHandlerNotifications;
2394	pVM->rem.s.cHandlerNotifications = 0;
2395	for (i = 0; i < c; i++)
2396	{
2397	PREMHANDLERNOTIFICATION pRec = &pVM->rem.s.aHandlerNotifications[i];
2398	switch (pRec->enmKind)
2399	{
2400	case REMHANDLERNOTIFICATIONKIND_PHYSICAL_REGISTER:
2401	REMR3NotifyHandlerPhysicalRegister(pVM,
2402	pRec->u.PhysicalRegister.enmType,
2403	pRec->u.PhysicalRegister.GCPhys,
2404	pRec->u.PhysicalRegister.cb,
2405	pRec->u.PhysicalRegister.fHasHCHandler);
2406	break;
2407
2408	case REMHANDLERNOTIFICATIONKIND_PHYSICAL_DEREGISTER:
2409	REMR3NotifyHandlerPhysicalDeregister(pVM,
2410	pRec->u.PhysicalDeregister.enmType,
2411	pRec->u.PhysicalDeregister.GCPhys,
2412	pRec->u.PhysicalDeregister.cb,
2413	pRec->u.PhysicalDeregister.fHasHCHandler,
2414	pRec->u.PhysicalDeregister.pvHCPtr);
2415	break;
2416
2417	case REMHANDLERNOTIFICATIONKIND_PHYSICAL_MODIFY:
2418	REMR3NotifyHandlerPhysicalModify(pVM,
2419	pRec->u.PhysicalModify.enmType,
2420	pRec->u.PhysicalModify.GCPhysOld,
2421	pRec->u.PhysicalModify.GCPhysNew,
2422	pRec->u.PhysicalModify.cb,
2423	pRec->u.PhysicalModify.fHasHCHandler,
2424	pRec->u.PhysicalModify.pvHCPtr);
2425	break;
2426
2427	default:
2428	AssertReleaseMsgFailed(("enmKind=%d\n", pRec->enmKind));
2429	break;
2430	}
2431	}
2432	}
2433
2434
2435	/**
2436	* Notify REM about changed code page.
2437	*
2438	* @returns VBox status code.
2439	* @param pVM VM handle.
2440	* @param pvCodePage Code page address
2441	*/
2442	REMR3DECL(int) REMR3NotifyCodePageChanged(PVM pVM, RTGCPTR pvCodePage)
2443	{
2444	int rc;
2445	RTGCPHYS PhysGC;
2446	uint64_t flags;
2447
2448	VM_ASSERT_EMT(pVM);
2449
2450	/*
2451	* Get the physical page address.
2452	*/
2453	rc = PGMGstGetPage(pVM, pvCodePage, &flags, &PhysGC);
2454	if (rc == VINF_SUCCESS)
2455	{
2456	/*
2457	* Sync the required registers and flush the whole page.
2458	* (Easier to do the whole page than notifying it about each physical
2459	* byte that was changed.
2460	*/
2461	pVM->rem.s.Env.cr[0] = pVM->rem.s.pCtx->cr0;
2462	pVM->rem.s.Env.cr[2] = pVM->rem.s.pCtx->cr2;
2463	pVM->rem.s.Env.cr[3] = pVM->rem.s.pCtx->cr3;
2464	pVM->rem.s.Env.cr[4] = pVM->rem.s.pCtx->cr4;
2465
2466	tb_invalidate_phys_page_range(PhysGC, PhysGC + PAGE_SIZE - 1, 0);
2467	}
2468	return VINF_SUCCESS;
2469	}
2470
2471	/**
2472	* Notification about a successful MMR3PhysRegister() call.
2473	*
2474	* @param pVM VM handle.
2475	* @param GCPhys The physical address the RAM.
2476	* @param cb Size of the memory.
2477	* @param pvRam The HC address of the RAM.
2478	* @param fFlags Flags of the MM_RAM_FLAGS_* defines.
2479	*/
2480	REMR3DECL(void) REMR3NotifyPhysRamRegister(PVM pVM, RTGCPHYS GCPhys, RTUINT cb, void *pvRam, unsigned fFlags)
2481	{
2482	Log(("REMR3NotifyPhysRamRegister: GCPhys=%VGp cb=%d pvRam=%p fFlags=%d\n", GCPhys, cb, pvRam, fFlags));
2483	VM_ASSERT_EMT(pVM);
2484
2485	/*
2486	* Validate input - we trust the caller.
2487	*/
2488	Assert(!GCPhys \|\| pvRam);
2489	Assert(RT_ALIGN_P(pvRam, PAGE_SIZE) == pvRam);
2490	Assert(RT_ALIGN_T(GCPhys, PAGE_SIZE, RTGCPHYS) == GCPhys);
2491	Assert(cb);
2492	Assert(RT_ALIGN_Z(cb, PAGE_SIZE) == cb);
2493
2494	/*
2495	* Base ram?
2496	*/
2497	if (!GCPhys)
2498	{
2499	#ifndef PGM_DYNAMIC_RAM_ALLOC
2500	AssertRelease(!phys_ram_base);
2501	phys_ram_base = pvRam;
2502	#endif
2503	phys_ram_size = cb;
2504	phys_ram_dirty = MMR3HeapAllocZ(pVM, MM_TAG_REM, cb >> PAGE_SHIFT);
2505	AssertReleaseMsg(phys_ram_dirty, ("failed to allocate %d bytes of dirty bytes\n", cb >> PAGE_SHIFT));
2506	}
2507	#ifndef PGM_DYNAMIC_RAM_ALLOC
2508	AssertRelease(phys_ram_base);
2509	#endif
2510
2511	/*
2512	* Register the ram.
2513	*/
2514	#ifdef PGM_DYNAMIC_RAM_ALLOC
2515	if (!GCPhys)
2516	cpu_register_physical_memory(GCPhys, cb, GCPhys \| IO_MEM_RAM_MISSING);
2517	else
2518	{
2519	uint32_t i;
2520
2521	cpu_register_physical_memory(GCPhys, cb, GCPhys \| (fFlags & MM_RAM_FLAGS_RESERVED ? IO_MEM_UNASSIGNED : 0));
2522
2523	AssertRelease(pVM->rem.s.cPhysRegistrations < REM_MAX_PHYS_REGISTRATIONS);
2524	for (i=0;i<pVM->rem.s.cPhysRegistrations;i++)
2525	{
2526	if (pVM->rem.s.aPhysReg[i].GCPhys == GCPhys)
2527	{
2528	pVM->rem.s.aPhysReg[i].HCVirt = (RTHCUINTPTR)pvRam;
2529	pVM->rem.s.aPhysReg[i].cb = cb;
2530	break;
2531	}
2532	}
2533	if (i == pVM->rem.s.cPhysRegistrations)
2534	{
2535	pVM->rem.s.aPhysReg[i].GCPhys = GCPhys;
2536	pVM->rem.s.aPhysReg[i].HCVirt = (RTHCUINTPTR)pvRam;
2537	pVM->rem.s.aPhysReg[i].cb = cb;
2538	pVM->rem.s.cPhysRegistrations++;
2539	}
2540	}
2541	#else
2542	cpu_register_physical_memory(GCPhys, cb, ((uintptr_t)pvRam - (uintptr_t)phys_ram_base)
2543	\| (fFlags & MM_RAM_FLAGS_RESERVED ? IO_MEM_UNASSIGNED : 0));
2544	#endif
2545	}
2546
2547
2548	/**
2549	* Notification about a successful PGMR3PhysRegisterChunk() call.
2550	*
2551	* @param pVM VM handle.
2552	* @param GCPhys The physical address the RAM.
2553	* @param cb Size of the memory.
2554	* @param pvRam The HC address of the RAM.
2555	* @param fFlags Flags of the MM_RAM_FLAGS_* defines.
2556	*/
2557	REMR3DECL(void) REMR3NotifyPhysRamChunkRegister(PVM pVM, RTGCPHYS GCPhys, RTUINT cb, RTHCUINTPTR pvRam, unsigned fFlags)
2558	{
2559	uint32_t idx;
2560
2561	Log(("REMR3NotifyPhysRamChunkRegister: GCPhys=%VGp cb=%d pvRam=%p fFlags=%d\n", GCPhys, cb, pvRam, fFlags));
2562	VM_ASSERT_EMT(pVM);
2563
2564	/*
2565	* Validate input - we trust the caller.
2566	*/
2567	Assert(pvRam);
2568	Assert(RT_ALIGN(pvRam, PAGE_SIZE) == pvRam);
2569	Assert(RT_ALIGN_T(GCPhys, PAGE_SIZE, RTGCPHYS) == GCPhys);
2570	Assert(cb == PGM_DYNAMIC_CHUNK_SIZE);
2571	Assert(fFlags == 0 /* normal RAM */);
2572
2573	if (!pVM->rem.s.paHCVirtToGCPhys)
2574	{
2575	uint32_t size = (_4G >> PGM_DYNAMIC_CHUNK_SHIFT) * sizeof(REMCHUNKINFO);
2576
2577	Assert(phys_ram_size);
2578
2579	pVM->rem.s.paHCVirtToGCPhys = (PREMCHUNKINFO)MMR3HeapAllocZ(pVM, MM_TAG_REM, size);
2580	pVM->rem.s.paGCPhysToHCVirt = (RTHCPTR)MMR3HeapAllocZ(pVM, MM_TAG_REM, (phys_ram_size >> PGM_DYNAMIC_CHUNK_SHIFT)*sizeof(RTHCPTR));
2581	}
2582	pVM->rem.s.paGCPhysToHCVirt[GCPhys >> PGM_DYNAMIC_CHUNK_SHIFT] = pvRam;
2583
2584	idx = (pvRam >> PGM_DYNAMIC_CHUNK_SHIFT);
2585	if (!pVM->rem.s.paHCVirtToGCPhys[idx].pChunk1)
2586	{
2587	pVM->rem.s.paHCVirtToGCPhys[idx].pChunk1 = pvRam;
2588	pVM->rem.s.paHCVirtToGCPhys[idx].GCPhys1 = GCPhys;
2589	}
2590	else
2591	{
2592	Assert(!pVM->rem.s.paHCVirtToGCPhys[idx].pChunk2);
2593	pVM->rem.s.paHCVirtToGCPhys[idx].pChunk2 = pvRam;
2594	pVM->rem.s.paHCVirtToGCPhys[idx].GCPhys2 = GCPhys;
2595	}
2596	/* Does the region spawn two chunks? */
2597	if (pvRam & PGM_DYNAMIC_CHUNK_OFFSET_MASK)
2598	{
2599	if (!pVM->rem.s.paHCVirtToGCPhys[idx+1].pChunk1)
2600	{
2601	pVM->rem.s.paHCVirtToGCPhys[idx+1].pChunk1 = pvRam;
2602	pVM->rem.s.paHCVirtToGCPhys[idx+1].GCPhys1 = GCPhys;
2603	}
2604	else
2605	{
2606	Assert(!pVM->rem.s.paHCVirtToGCPhys[idx+1].pChunk2);
2607	pVM->rem.s.paHCVirtToGCPhys[idx+1].pChunk2 = pvRam;
2608	pVM->rem.s.paHCVirtToGCPhys[idx+1].GCPhys2 = GCPhys;
2609	}
2610	}
2611	cpu_register_physical_memory(GCPhys, cb, GCPhys);
2612	}
2613
2614	/**
2615	* Convert GC physical address to HC virt
2616	*
2617	* @returns The HC virt address corresponding to addr.
2618	* @param env The cpu environment.
2619	* @param addr The physical address.
2620	*/
2621	void remR3GCPhys2HCVirt(void env, target_ulong addr)
2622	{
2623	#ifdef PGM_DYNAMIC_RAM_ALLOC
2624	PVM pVM = ((CPUState *)env)->pVM;
2625	uint32_t i;
2626
2627	/* lookup in pVM->rem.s.aPhysReg array first (for ROM range(s) inside the guest's RAM) */
2628	for (i=0;i<pVM->rem.s.cPhysRegistrations;i++)
2629	{
2630	uint32_t off = addr - pVM->rem.s.aPhysReg[i].GCPhys;
2631	if (off < pVM->rem.s.aPhysReg[i].cb)
2632	{
2633	Log(("remR3GCPhys2HCVirt: %x -> %x\n", addr, pVM->rem.s.aPhysReg[i].HCVirt + off));
2634	return (void *)(pVM->rem.s.aPhysReg[i].HCVirt + off);
2635	}
2636	}
2637	AssertMsg(addr < phys_ram_size, ("remR3GCPhys2HCVirt: unknown physical address %x\n", addr));
2638	Log(("remR3GCPhys2HCVirt: %x -> %x\n", addr, pVM->rem.s.paGCPhysToHCVirt[addr >> PGM_DYNAMIC_CHUNK_SHIFT] + (addr & PGM_DYNAMIC_CHUNK_OFFSET_MASK)));
2639	return (void *)(pVM->rem.s.paGCPhysToHCVirt[addr >> PGM_DYNAMIC_CHUNK_SHIFT] + (addr & PGM_DYNAMIC_CHUNK_OFFSET_MASK));
2640	#else
2641	return phys_ram_base + addr;
2642	#endif
2643	}
2644
2645	/**
2646	* Convert GC physical address to HC virt
2647	*
2648	* @returns The HC virt address corresponding to addr.
2649	* @param env The cpu environment.
2650	* @param addr The physical address.
2651	*/
2652	target_ulong remR3HCVirt2GCPhys(void env, void addr)
2653	{
2654	#ifdef PGM_DYNAMIC_RAM_ALLOC
2655	PVM pVM = ((CPUState *)env)->pVM;
2656	RTHCUINTPTR HCVirt = (RTHCUINTPTR)addr;
2657	uint32_t idx = (HCVirt >> PGM_DYNAMIC_CHUNK_SHIFT);
2658	RTHCUINTPTR off;
2659	RTUINT i;
2660
2661	off = HCVirt - pVM->rem.s.paHCVirtToGCPhys[idx].pChunk1;
2662
2663	if ( pVM->rem.s.paHCVirtToGCPhys[idx].pChunk1
2664	&& off < PGM_DYNAMIC_CHUNK_SIZE)
2665	{
2666	Log(("remR3HCVirt2GCPhys %x -> %x\n", addr, pVM->rem.s.paHCVirtToGCPhys[idx].GCPhys1 + off));
2667	return pVM->rem.s.paHCVirtToGCPhys[idx].GCPhys1 + off;
2668	}
2669
2670	off = HCVirt - pVM->rem.s.paHCVirtToGCPhys[idx].pChunk2;
2671	if ( pVM->rem.s.paHCVirtToGCPhys[idx].pChunk2
2672	&& off < PGM_DYNAMIC_CHUNK_SIZE)
2673	{
2674	Log(("remR3HCVirt2GCPhys %x -> %x\n", addr, pVM->rem.s.paHCVirtToGCPhys[idx].GCPhys2 + off));
2675	return pVM->rem.s.paHCVirtToGCPhys[idx].GCPhys2 + off;
2676	}
2677
2678	/* Must be externally registered RAM/ROM range */
2679	for (i=0;i<pVM->rem.s.cPhysRegistrations;i++)
2680	{
2681	uint32_t off = HCVirt - pVM->rem.s.aPhysReg[i].HCVirt;
2682	if (off < pVM->rem.s.aPhysReg[i].cb)
2683	{
2684	Log(("remR3HCVirt2GCPhys %x -> %x\n", addr, pVM->rem.s.aPhysReg[i].GCPhys + off));
2685	return pVM->rem.s.aPhysReg[i].GCPhys + off;
2686	}
2687	}
2688	AssertReleaseMsgFailed(("No translation for physical address %VHv???\n", addr));
2689	return 0;
2690	#else
2691	return (target_ulong)addr - (target_ulong)phys_ram_base;
2692	#endif
2693	}
2694
2695	/**
2696	* Grows dynamically allocated guest RAM.
2697	* Will raise a fatal error if the operation fails.
2698	*
2699	* @param physaddr The physical address.
2700	*/
2701	void remR3GrowDynRange(unsigned long physaddr)
2702	{
2703	int rc;
2704	PVM pVM = cpu_single_env->pVM;
2705
2706	Log(("remR3GrowDynRange %VGp\n", physaddr));
2707	rc = PGM3PhysGrowRange(pVM, (RTGCPHYS)physaddr);
2708	if (VBOX_SUCCESS(rc))
2709	return;
2710
2711	LogRel(("\nUnable to allocate guest RAM chunk at %VGp\n", physaddr));
2712	cpu_abort(cpu_single_env, "Unable to allocate guest RAM chunk at %VGp\n", physaddr);
2713	AssertFatalFailed();
2714	}
2715
2716	/**
2717	* Notification about a successful MMR3PhysRomRegister() call.
2718	*
2719	* @param pVM VM handle.
2720	* @param GCPhys The physical address of the ROM.
2721	* @param cb The size of the ROM.
2722	* @param pvCopy Pointer to the ROM copy.
2723	*/
2724	REMR3DECL(void) REMR3NotifyPhysRomRegister(PVM pVM, RTGCPHYS GCPhys, RTUINT cb, void *pvCopy)
2725	{
2726	#ifdef PGM_DYNAMIC_RAM_ALLOC
2727	uint32_t i;
2728	#endif
2729	Log(("REMR3NotifyPhysRomRegister: GCPhys=%VGp cb=%d pvCopy=%p\n", GCPhys, cb, pvCopy));
2730	VM_ASSERT_EMT(pVM);
2731
2732	/*
2733	* Validate input - we trust the caller.
2734	*/
2735	Assert(RT_ALIGN_T(GCPhys, PAGE_SIZE, RTGCPHYS) == GCPhys);
2736	Assert(cb);
2737	Assert(RT_ALIGN_Z(cb, PAGE_SIZE) == cb);
2738	Assert(pvCopy);
2739	Assert(RT_ALIGN_P(pvCopy, PAGE_SIZE) == pvCopy);
2740
2741	/*
2742	* Register the rom.
2743	*/
2744	#ifdef PGM_DYNAMIC_RAM_ALLOC
2745	cpu_register_physical_memory(GCPhys, cb, GCPhys \| IO_MEM_ROM);
2746	AssertRelease(pVM->rem.s.cPhysRegistrations < REM_MAX_PHYS_REGISTRATIONS);
2747	for (i=0;i<pVM->rem.s.cPhysRegistrations;i++)
2748	{
2749	if (pVM->rem.s.aPhysReg[i].GCPhys == GCPhys)
2750	{
2751	pVM->rem.s.aPhysReg[i].HCVirt = (RTHCUINTPTR)pvCopy;
2752	pVM->rem.s.aPhysReg[i].cb = cb;
2753	break;
2754	}
2755	}
2756	if (i == pVM->rem.s.cPhysRegistrations)
2757	{
2758	pVM->rem.s.aPhysReg[i].GCPhys = GCPhys;
2759	pVM->rem.s.aPhysReg[i].HCVirt = (RTHCUINTPTR)pvCopy;
2760	pVM->rem.s.aPhysReg[i].cb = cb;
2761	pVM->rem.s.cPhysRegistrations++;
2762	}
2763	#else
2764	AssertRelease(phys_ram_base);
2765	cpu_register_physical_memory(GCPhys, cb, ((uintptr_t)pvCopy - (uintptr_t)phys_ram_base) \| IO_MEM_ROM);
2766	#endif
2767	Log2(("%.64Vhxd\n", (char *)pvCopy + cb - 64));
2768	}
2769
2770
2771	/**
2772	* Notification about a successful MMR3PhysRegister() call.
2773	*
2774	* @param pVM VM Handle.
2775	* @param GCPhys Start physical address.
2776	* @param cb The size of the range.
2777	*/
2778	REMR3DECL(void) REMR3NotifyPhysReserve(PVM pVM, RTGCPHYS GCPhys, RTUINT cb)
2779	{
2780	LogFlow(("REMR3NotifyPhysReserve: GCPhys=%VGp cb=%d\n", GCPhys, cb));
2781	VM_ASSERT_EMT(pVM);
2782
2783	/*
2784	* Validate input - we trust the caller.
2785	*/
2786	Assert(RT_ALIGN_T(GCPhys, PAGE_SIZE, RTGCPHYS) == GCPhys);
2787	Assert(cb);
2788	Assert(RT_ALIGN_Z(cb, PAGE_SIZE) == cb);
2789
2790	/*
2791	* Unassigning the memory.
2792	*/
2793	cpu_register_physical_memory(GCPhys, cb, IO_MEM_UNASSIGNED);
2794	}
2795
2796
2797	/**
2798	* Notification about a successful PGMR3HandlerPhysicalRegister() call.
2799	*
2800	* @param pVM VM Handle.
2801	* @param enmType Handler type.
2802	* @param GCPhys Handler range address.
2803	* @param cb Size of the handler range.
2804	* @param fHasHCHandler Set if the handler has a HC callback function.
2805	*
2806	* @remark MMR3PhysRomRegister assumes that this function will not apply the
2807	* Handler memory type to memory which has no HC handler.
2808	*/
2809	REMR3DECL(void) REMR3NotifyHandlerPhysicalRegister(PVM pVM, PGMPHYSHANDLERTYPE enmType, RTGCPHYS GCPhys, RTGCPHYS cb, bool fHasHCHandler)
2810	{
2811	LogFlow(("REMR3NotifyHandlerPhysicalRegister: enmType=%d GCPhys=%VGp cb=%d fHasHCHandler=%d\n",
2812	enmType, GCPhys, cb, fHasHCHandler));
2813	VM_ASSERT_EMT(pVM);
2814	Assert(RT_ALIGN_T(GCPhys, PAGE_SIZE, RTGCPHYS) == GCPhys);
2815	Assert(RT_ALIGN_T(cb, PAGE_SIZE, RTGCPHYS) == cb);
2816
2817	if (pVM->rem.s.cHandlerNotifications)
2818	REMR3ReplayHandlerNotifications(pVM);
2819
2820	if (enmType == PGMPHYSHANDLERTYPE_MMIO)
2821	cpu_register_physical_memory(GCPhys, cb, pVM->rem.s.iMMIOMemType);
2822	else if (fHasHCHandler)
2823	cpu_register_physical_memory(GCPhys, cb, pVM->rem.s.iHandlerMemType);
2824	}
2825
2826
2827	/**
2828	* Notification about a successful PGMR3HandlerPhysicalDeregister() operation.
2829	*
2830	* @param pVM VM Handle.
2831	* @param enmType Handler type.
2832	* @param GCPhys Handler range address.
2833	* @param cb Size of the handler range.
2834	* @param fHasHCHandler Set if the handler has a HC callback function.
2835	* @param pvHCPtr The HC virtual address corresponding to GCPhys if available.
2836	*/
2837	REMR3DECL(void) REMR3NotifyHandlerPhysicalDeregister(PVM pVM, PGMPHYSHANDLERTYPE enmType, RTGCPHYS GCPhys, RTGCPHYS cb, bool fHasHCHandler, void *pvHCPtr)
2838	{
2839	LogFlow(("REMR3NotifyHandlerPhysicalDeregister: enmType=%d GCPhys=%VGp cb=%d fHasHCHandler=%d pvHCPtr=%p RAM=%08x\n",
2840	enmType, GCPhys, cb, fHasHCHandler, pvHCPtr, MMR3PhysGetRamSize(pVM)));
2841	VM_ASSERT_EMT(pVM);
2842
2843	if (pVM->rem.s.cHandlerNotifications)
2844	REMR3ReplayHandlerNotifications(pVM);
2845
2846	if (enmType == PGMPHYSHANDLERTYPE_MMIO)
2847	cpu_register_physical_memory(GCPhys, cb, IO_MEM_UNASSIGNED);
2848	else if (fHasHCHandler)
2849	{
2850	if (!pvHCPtr)
2851	{
2852	Assert(GCPhys > MMR3PhysGetRamSize(pVM));
2853	cpu_register_physical_memory(GCPhys, cb, IO_MEM_UNASSIGNED);
2854	}
2855	else
2856	{
2857	/* This is not prefect, but it'll do for PD monitoring... */
2858	Assert(cb == PAGE_SIZE);
2859	Assert(RT_ALIGN_T(GCPhys, PAGE_SIZE, RTGCPHYS) == GCPhys);
2860	Assert(remR3HCVirt2GCPhys(cpu_single_env, pvHCPtr) < MMR3PhysGetRamSize(pVM));
2861	#ifdef PGM_DYNAMIC_RAM_ALLOC
2862	cpu_register_physical_memory(GCPhys, cb, GCPhys);
2863	#else
2864	cpu_register_physical_memory(GCPhys, cb, remR3HCVirt2GCPhys(cpu_single_env, pvHCPtr));
2865	#endif
2866	}
2867	}
2868	}
2869
2870
2871	/**
2872	* Notification about a successful PGMR3HandlerPhysicalModify() call.
2873	*
2874	* @param pVM VM Handle.
2875	* @param enmType Handler type.
2876	* @param GCPhysOld Old handler range address.
2877	* @param GCPhysNew New handler range address.
2878	* @param cb Size of the handler range.
2879	* @param fHasHCHandler Set if the handler has a HC callback function.
2880	* @param pvHCPtr The HC virtual address corresponding to GCPhys if available.
2881	*/
2882	REMR3DECL(void) REMR3NotifyHandlerPhysicalModify(PVM pVM, PGMPHYSHANDLERTYPE enmType, RTGCPHYS GCPhysOld, RTGCPHYS GCPhysNew, RTGCPHYS cb, bool fHasHCHandler, void *pvHCPtr)
2883	{
2884	LogFlow(("REMR3NotifyHandlerPhysicalModify: enmType=%d GCPhysOld=%VGp GCPhysNew=%VGp cb=%d fHasHCHandler=%d pvHCPtr=%p\n",
2885	enmType, GCPhysOld, GCPhysNew, cb, fHasHCHandler, pvHCPtr));
2886	VM_ASSERT_EMT(pVM);
2887	AssertReleaseMsg(enmType != PGMPHYSHANDLERTYPE_MMIO, ("enmType=%d\n", enmType));
2888
2889	if (pVM->rem.s.cHandlerNotifications)
2890	REMR3ReplayHandlerNotifications(pVM);
2891
2892	if (fHasHCHandler)
2893	{
2894	/*
2895	* Reset the old page.
2896	*/
2897	if (!pvHCPtr)
2898	cpu_register_physical_memory(GCPhysOld, cb, IO_MEM_UNASSIGNED);
2899	else
2900	{
2901	/* This is not prefect, but it'll do for PD monitoring... */
2902	Assert(cb == PAGE_SIZE);
2903	Assert(RT_ALIGN_T(GCPhysOld, PAGE_SIZE, RTGCPHYS) == GCPhysOld);
2904	Assert(remR3HCVirt2GCPhys(cpu_single_env, pvHCPtr) < MMR3PhysGetRamSize(pVM));
2905	#ifdef PGM_DYNAMIC_RAM_ALLOC
2906	cpu_register_physical_memory(GCPhysOld, cb, GCPhysOld);
2907	#else
2908	cpu_register_physical_memory(GCPhysOld, cb, remR3HCVirt2GCPhys(cpu_single_env, pvHCPtr));
2909	#endif
2910	}
2911
2912	/*
2913	* Update the new page.
2914	*/
2915	Assert(RT_ALIGN_T(GCPhysNew, PAGE_SIZE, RTGCPHYS) == GCPhysNew);
2916	Assert(RT_ALIGN_T(cb, PAGE_SIZE, RTGCPHYS) == cb);
2917	cpu_register_physical_memory(GCPhysNew, cb, pVM->rem.s.iHandlerMemType);
2918	}
2919	}
2920
2921
2922	/**
2923	* Checks if we're handling access to this page or not.
2924	*
2925	* @returns true if we're trapping access.
2926	* @returns false if we aren't.
2927	* @param pVM The VM handle.
2928	* @param GCPhys The physical address.
2929	*
2930	* @remark This function will only work correctly in VBOX_STRICT builds!
2931	*/
2932	REMDECL(bool) REMR3IsPageAccessHandled(PVM pVM, RTGCPHYS GCPhys)
2933	{
2934	#ifdef VBOX_STRICT
2935	if (pVM->rem.s.cHandlerNotifications)
2936	REMR3ReplayHandlerNotifications(pVM);
2937
2938	unsigned long off = get_phys_page_offset(GCPhys);
2939	return (off & PAGE_OFFSET_MASK) == pVM->rem.s.iHandlerMemType
2940	\|\| (off & PAGE_OFFSET_MASK) == pVM->rem.s.iMMIOMemType
2941	\|\| (off & PAGE_OFFSET_MASK) == IO_MEM_ROM;
2942	#else
2943	return false;
2944	#endif
2945	}
2946
2947
2948	/**
2949	* Deals with a rare case in get_phys_addr_code where the code
2950	* is being monitored.
2951	*
2952	* It could also be an MMIO page, in which case we will raise a fatal error.
2953	*
2954	* @returns The physical address corresponding to addr.
2955	* @param env The cpu environment.
2956	* @param addr The virtual address.
2957	* @param pTLBEntry The TLB entry.
2958	*/
2959	target_ulong remR3PhysGetPhysicalAddressCode(CPUState env, target_ulong addr, CPUTLBEntry pTLBEntry)
2960	{
2961	PVM pVM = env->pVM;
2962	if ((pTLBEntry->address & ~TARGET_PAGE_MASK) == pVM->rem.s.iHandlerMemType)
2963	{
2964	target_ulong ret = pTLBEntry->addend + addr;
2965	AssertMsg2("remR3PhysGetPhysicalAddressCode: addr=%VGv address=%VGv addend=%VGp ret=%VGp\n",
2966	(RTGCPTR)addr, (RTGCPTR)pTLBEntry->address, (RTGCPHYS)pTLBEntry->addend, ret);
2967	return ret;
2968	}
2969	LogRel(("\nTrying to execute code with memory type address=%VGv addend=%VGp at %VGv! (iHandlerMemType=%#x iMMIOMemType=%#x)\n"
2970	"*** handlers\n",
2971	(RTGCPTR)pTLBEntry->address, (RTGCPHYS)pTLBEntry->addend, (RTGCPTR)addr, pVM->rem.s.iHandlerMemType, pVM->rem.s.iMMIOMemType));
2972	DBGFR3Info(pVM, "handlers", NULL, DBGFR3InfoLogRelHlp());
2973	LogRel(("*** mmio\n"));
2974	DBGFR3Info(pVM, "mmio", NULL, DBGFR3InfoLogRelHlp());
2975	LogRel(("*** phys\n"));
2976	DBGFR3Info(pVM, "phys", NULL, DBGFR3InfoLogRelHlp());
2977	cpu_abort(env, "Trying to execute code with memory type address=%VGv addend=%VGp at %VGv. (iHandlerMemType=%#x iMMIOMemType=%#x)\n",
2978	(RTGCPTR)pTLBEntry->address, (RTGCPHYS)pTLBEntry->addend, (RTGCPTR)addr, pVM->rem.s.iHandlerMemType, pVM->rem.s.iMMIOMemType);
2979	AssertFatalFailed();
2980	}
2981
2982	/**
2983	* Read guest RAM and ROM.
2984	*
2985	* @param pbSrcPhys The source address. Relative to guest RAM.
2986	* @param pvDst The destination address.
2987	* @param cb Number of bytes
2988	*/
2989	void remR3PhysReadBytes(uint8_t pbSrcPhys, void pvDst, unsigned cb)
2990	{
2991	STAM_PROFILE_ADV_START(&gStatMemRead, a);
2992
2993	/*
2994	* Calc the physical address ('off') and check that it's within the RAM.
2995	* ROM is accessed this way, even if it's not part of the RAM.
2996	*/
2997	/** @todo This is rather ugly, but there's no other way when we don't wish to touch many other files. */
2998	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbSrcPhys);
2999	if (off < (uintptr_t)phys_ram_size)
3000	PGMPhysRead(cpu_single_env->pVM, (RTGCPHYS)off, pvDst, cb);
3001	else
3002	{
3003	/* ROM range outside physical RAM, HC address passed directly */
3004	Log4(("remR3PhysReadBytes ROM: %p\n", pbSrcPhys));
3005	memcpy(pvDst, pbSrcPhys, cb);
3006	}
3007	STAM_PROFILE_ADV_STOP(&gStatMemRead, a);
3008	}
3009
3010	/** @todo r=bird: s/Byte/U8/ s/Word/U16/ s/Dword/U32/, see MMIO and other functions.
3011	* It could be an idea to inline these wrapper functions... */
3012
3013	/**
3014	* Read guest RAM and ROM.
3015	*
3016	* @param pbSrcPhys The source address. Relative to guest RAM.
3017	*/
3018	uint8_t remR3PhysReadUByte(uint8_t *pbSrcPhys)
3019	{
3020	uint8_t val;
3021
3022	STAM_PROFILE_ADV_START(&gStatMemRead, a);
3023
3024	/*
3025	* Calc the physical address ('off') and check that it's within the RAM.
3026	* ROM is accessed this way, even if it's not part of the RAM.
3027	*/
3028	/** @todo This is rather ugly, but there's no other way when we don't wish to touch many other files. */
3029	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbSrcPhys);
3030	if (off < (uintptr_t)phys_ram_size)
3031	val = PGMR3PhysReadByte(cpu_single_env->pVM, (RTGCPHYS)off);
3032	else
3033	{
3034	/* ROM range outside physical RAM, HC address passed directly */
3035	Log4(("remR3PhysReadBytes ROM: %p\n", pbSrcPhys));
3036	val = *pbSrcPhys;
3037	}
3038	STAM_PROFILE_ADV_STOP(&gStatMemRead, a);
3039	return val;
3040	}
3041
3042	/**
3043	* Read guest RAM and ROM.
3044	*
3045	* @param pbSrcPhys The source address. Relative to guest RAM.
3046	*/
3047	int8_t remR3PhysReadSByte(uint8_t *pbSrcPhys)
3048	{
3049	int8_t val;
3050
3051	STAM_PROFILE_ADV_START(&gStatMemRead, a);
3052
3053	/*
3054	* Calc the physical address ('off') and check that it's within the RAM.
3055	* ROM is accessed this way, even if it's not part of the RAM.
3056	*/
3057	/** @todo This is rather ugly, but there's no other way when we don't wish to touch many other files. */
3058	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbSrcPhys);
3059	if (off < (uintptr_t)phys_ram_size)
3060	val = PGMR3PhysReadByte(cpu_single_env->pVM, (RTGCPHYS)off);
3061	else
3062	{
3063	/* ROM range outside physical RAM, HC address passed directly */
3064	Log4(("remR3PhysReadBytes ROM: %p\n", pbSrcPhys));
3065	val = (int8_t )pbSrcPhys;
3066	}
3067	STAM_PROFILE_ADV_STOP(&gStatMemRead, a);
3068	return val;
3069	}
3070
3071	/**
3072	* Read guest RAM and ROM.
3073	*
3074	* @param pbSrcPhys The source address. Relative to guest RAM.
3075	*/
3076	uint16_t remR3PhysReadUWord(uint8_t *pbSrcPhys)
3077	{
3078	uint16_t val;
3079
3080	STAM_PROFILE_ADV_START(&gStatMemRead, a);
3081
3082	/*
3083	* Calc the physical address ('off') and check that it's within the RAM.
3084	* ROM is accessed this way, even if it's not part of the RAM.
3085	*/
3086	/** @todo This is rather ugly, but there's no other way when we don't wish to touch many other files. */
3087	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbSrcPhys);
3088	if (off < (uintptr_t)phys_ram_size)
3089	val = PGMR3PhysReadWord(cpu_single_env->pVM, (RTGCPHYS)off);
3090	else
3091	{
3092	/* ROM range outside physical RAM, HC address passed directly */
3093	Log4(("remR3PhysReadBytes ROM: %p\n", pbSrcPhys));
3094	val = (uint16_t )pbSrcPhys;
3095	}
3096	STAM_PROFILE_ADV_STOP(&gStatMemRead, a);
3097	return val;
3098	}
3099
3100	/**
3101	* Read guest RAM and ROM.
3102	*
3103	* @param pbSrcPhys The source address. Relative to guest RAM.
3104	*/
3105	int16_t remR3PhysReadSWord(uint8_t *pbSrcPhys)
3106	{
3107	int16_t val;
3108
3109	STAM_PROFILE_ADV_START(&gStatMemRead, a);
3110
3111	/*
3112	* Calc the physical address ('off') and check that it's within the RAM.
3113	* ROM is accessed this way, even if it's not part of the RAM.
3114	*/
3115	/** @todo This is rather ugly, but there's no other way when we don't wish to touch many other files. */
3116	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbSrcPhys);
3117	if (off < (uintptr_t)phys_ram_size)
3118	val = PGMR3PhysReadWord(cpu_single_env->pVM, (RTGCPHYS)off);
3119	else
3120	{
3121	/* ROM range outside physical RAM, HC address passed directly */
3122	Log4(("remR3PhysReadBytes ROM: %p\n", pbSrcPhys));
3123	val = (int16_t )pbSrcPhys;
3124	}
3125	STAM_PROFILE_ADV_STOP(&gStatMemRead, a);
3126	return val;
3127	}
3128
3129	/**
3130	* Read guest RAM and ROM.
3131	*
3132	* @param pbSrcPhys The source address. Relative to guest RAM.
3133	*/
3134	uint32_t remR3PhysReadULong(uint8_t *pbSrcPhys)
3135	{
3136	uint32_t val;
3137
3138	STAM_PROFILE_ADV_START(&gStatMemRead, a);
3139
3140	/*
3141	* Calc the physical address ('off') and check that it's within the RAM.
3142	* ROM is accessed this way, even if it's not part of the RAM.
3143	*/
3144	/** @todo This is rather ugly, but there's no other way when we don't wish to touch many other files. */
3145	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbSrcPhys);
3146	if (off < (uintptr_t)phys_ram_size)
3147	val = PGMR3PhysReadDword(cpu_single_env->pVM, (RTGCPHYS)off);
3148	else
3149	{
3150	/* ROM range outside physical RAM, HC address passed directly */
3151	Log4(("remR3PhysReadBytes ROM: %p\n", pbSrcPhys));
3152	val = (uint32_t )pbSrcPhys;
3153	}
3154	STAM_PROFILE_ADV_STOP(&gStatMemRead, a);
3155	return val;
3156	}
3157
3158	/**
3159	* Read guest RAM and ROM.
3160	*
3161	* @param pbSrcPhys The source address. Relative to guest RAM.
3162	*/
3163	int32_t remR3PhysReadSLong(uint8_t *pbSrcPhys)
3164	{
3165	int32_t val;
3166
3167	STAM_PROFILE_ADV_START(&gStatMemRead, a);
3168
3169	/*
3170	* Calc the physical address ('off') and check that it's within the RAM.
3171	* ROM is accessed this way, even if it's not part of the RAM.
3172	*/
3173	/** @todo This is rather ugly, but there's no other way when we don't wish to touch many other files. */
3174	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbSrcPhys);
3175	if (off < (uintptr_t)phys_ram_size)
3176	val = PGMR3PhysReadDword(cpu_single_env->pVM, (RTGCPHYS)off);
3177	else
3178	{
3179	/* ROM range outside physical RAM, HC address passed directly */
3180	Log4(("remR3PhysReadBytes ROM: %p\n", pbSrcPhys));
3181	val = (int32_t )pbSrcPhys;
3182	}
3183	STAM_PROFILE_ADV_STOP(&gStatMemRead, a);
3184	return val;
3185	}
3186
3187	/**
3188	* Write guest RAM.
3189	*
3190	* @param pbDstPhys The destination address. Relative to guest RAM.
3191	* @param pvSrc The source address.
3192	* @param cb Number of bytes to write
3193	*/
3194	void remR3PhysWriteBytes(uint8_t pbDstPhys, const void pvSrc, unsigned cb)
3195	{
3196	STAM_PROFILE_ADV_START(&gStatMemWrite, a);
3197	/*
3198	* Calc the physical address ('off') and check that it's within the RAM.
3199	*/
3200	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbDstPhys);
3201	if (off < (uintptr_t)phys_ram_size)
3202	PGMPhysWrite(cpu_single_env->pVM, (RTGCPHYS)off, pvSrc, cb);
3203	else
3204	AssertMsgFailed(("pbDstPhys=%p off=%p cb=%d\n", pbDstPhys, off, cb));
3205	STAM_PROFILE_ADV_STOP(&gStatMemWrite, a);
3206	}
3207
3208
3209	/**
3210	* Write guest RAM.
3211	*
3212	* @param pbDstPhys The destination address. Relative to guest RAM.
3213	* @param val Value
3214	*/
3215	void remR3PhysWriteByte(uint8_t *pbDstPhys, uint8_t val)
3216	{
3217	STAM_PROFILE_ADV_START(&gStatMemWrite, a);
3218	/*
3219	* Calc the physical address ('off') and check that it's within the RAM.
3220	*/
3221	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbDstPhys);
3222	if (off < (uintptr_t)phys_ram_size)
3223	PGMR3PhysWriteByte(cpu_single_env->pVM, (RTGCPHYS)off, val);
3224	else
3225	AssertMsgFailed(("pbDstPhys=%p off=%p cb=%d\n", pbDstPhys, off, 1));
3226	STAM_PROFILE_ADV_STOP(&gStatMemWrite, a);
3227	}
3228
3229	/**
3230	* Write guest RAM.
3231	*
3232	* @param pbDstPhys The destination address. Relative to guest RAM.
3233	* @param val Value
3234	*/
3235	void remR3PhysWriteWord(uint8_t *pbDstPhys, uint16_t val)
3236	{
3237	STAM_PROFILE_ADV_START(&gStatMemWrite, a);
3238	/*
3239	* Calc the physical address ('off') and check that it's within the RAM.
3240	*/
3241	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbDstPhys);
3242	if (off < (uintptr_t)phys_ram_size)
3243	PGMR3PhysWriteWord(cpu_single_env->pVM, (RTGCPHYS)off, val);
3244	else
3245	AssertMsgFailed(("pbDstPhys=%p off=%p cb=%d\n", pbDstPhys, off, 2));
3246	STAM_PROFILE_ADV_STOP(&gStatMemWrite, a);
3247	}
3248
3249	/**
3250	* Write guest RAM.
3251	*
3252	* @param pbDstPhys The destination address. Relative to guest RAM.
3253	* @param val Value
3254	*/
3255	void remR3PhysWriteDword(uint8_t *pbDstPhys, uint32_t val)
3256	{
3257	STAM_PROFILE_ADV_START(&gStatMemWrite, a);
3258	/*
3259	* Calc the physical address ('off') and check that it's within the RAM.
3260	*/
3261	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbDstPhys);
3262	if (off < (uintptr_t)phys_ram_size)
3263	PGMR3PhysWriteDword(cpu_single_env->pVM, (RTGCPHYS)off, val);
3264	else
3265	AssertMsgFailed(("pbDstPhys=%p off=%p cb=%d\n", pbDstPhys, off, 4));
3266	STAM_PROFILE_ADV_STOP(&gStatMemWrite, a);
3267	}
3268
3269
3270
3271	#undef LOG_GROUP
3272	#define LOG_GROUP LOG_GROUP_REM_MMIO
3273
3274	/** Read MMIO memory. */
3275	static uint32_t remR3MMIOReadU8(void *pvVM, target_phys_addr_t GCPhys)
3276	{
3277	uint32_t u32 = 0;
3278	int rc = IOMMMIORead((PVM)pvVM, GCPhys, &u32, 1);
3279	AssertMsg(rc == VINF_SUCCESS, ("rc=%Vrc\n", rc)); NOREF(rc);
3280	Log2(("remR3MMIOReadU8: GCPhys=%VGp -> %02x\n", GCPhys, u32));
3281	return u32;
3282	}
3283
3284	/** Read MMIO memory. */
3285	static uint32_t remR3MMIOReadU16(void *pvVM, target_phys_addr_t GCPhys)
3286	{
3287	uint32_t u32 = 0;
3288	int rc = IOMMMIORead((PVM)pvVM, GCPhys, &u32, 2);
3289	AssertMsg(rc == VINF_SUCCESS, ("rc=%Vrc\n", rc)); NOREF(rc);
3290	Log2(("remR3MMIOReadU16: GCPhys=%VGp -> %04x\n", GCPhys, u32));
3291	return u32;
3292	}
3293
3294	/** Read MMIO memory. */
3295	static uint32_t remR3MMIOReadU32(void *pvVM, target_phys_addr_t GCPhys)
3296	{
3297	uint32_t u32 = 0;
3298	int rc = IOMMMIORead((PVM)pvVM, GCPhys, &u32, 4);
3299	AssertMsg(rc == VINF_SUCCESS, ("rc=%Vrc\n", rc)); NOREF(rc);
3300	Log2(("remR3MMIOReadU32: GCPhys=%VGp -> %08x\n", GCPhys, u32));
3301	return u32;
3302	}
3303
3304	/** Write to MMIO memory. */
3305	static void remR3MMIOWriteU8(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32)
3306	{
3307	Log2(("remR3MMIOWriteU8: GCPhys=%VGp u32=%#x\n", GCPhys, u32));
3308	int rc = IOMMMIOWrite((PVM)pvVM, GCPhys, u32, 1);
3309	AssertMsg(rc == VINF_SUCCESS, ("rc=%Vrc\n", rc)); NOREF(rc);
3310	}
3311
3312	/** Write to MMIO memory. */
3313	static void remR3MMIOWriteU16(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32)
3314	{
3315	Log2(("remR3MMIOWriteU16: GCPhys=%VGp u32=%#x\n", GCPhys, u32));
3316	int rc = IOMMMIOWrite((PVM)pvVM, GCPhys, u32, 2);
3317	AssertMsg(rc == VINF_SUCCESS, ("rc=%Vrc\n", rc)); NOREF(rc);
3318	}
3319
3320	/** Write to MMIO memory. */
3321	static void remR3MMIOWriteU32(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32)
3322	{
3323	Log2(("remR3MMIOWriteU32: GCPhys=%VGp u32=%#x\n", GCPhys, u32));
3324	int rc = IOMMMIOWrite((PVM)pvVM, GCPhys, u32, 4);
3325	AssertMsg(rc == VINF_SUCCESS, ("rc=%Vrc\n", rc)); NOREF(rc);
3326	}
3327
3328
3329	#undef LOG_GROUP
3330	#define LOG_GROUP LOG_GROUP_REM_HANDLER
3331
3332	/* !!!WARNING!!! This is extremely hackish right now, we assume it's only for LFB access! !!!WARNING!!! */
3333
3334	static uint32_t remR3HandlerReadU8(void *pvVM, target_phys_addr_t GCPhys)
3335	{
3336	Log2(("remR3HandlerReadU8: GCPhys=%VGp\n", GCPhys));
3337	uint8_t u8;
3338	PGMPhysRead((PVM)pvVM, GCPhys, &u8, sizeof(u8));
3339	return u8;
3340	}
3341
3342	static uint32_t remR3HandlerReadU16(void *pvVM, target_phys_addr_t GCPhys)
3343	{
3344	Log2(("remR3HandlerReadU16: GCPhys=%VGp\n", GCPhys));
3345	uint16_t u16;
3346	PGMPhysRead((PVM)pvVM, GCPhys, &u16, sizeof(u16));
3347	return u16;
3348	}
3349
3350	static uint32_t remR3HandlerReadU32(void *pvVM, target_phys_addr_t GCPhys)
3351	{
3352	Log2(("remR3HandlerReadU32: GCPhys=%VGp\n", GCPhys));
3353	uint32_t u32;
3354	PGMPhysRead((PVM)pvVM, GCPhys, &u32, sizeof(u32));
3355	return u32;
3356	}
3357
3358	static void remR3HandlerWriteU8(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32)
3359	{
3360	Log2(("remR3HandlerWriteU8: GCPhys=%VGp u32=%#x\n", GCPhys, u32));
3361	PGMPhysWrite((PVM)pvVM, GCPhys, &u32, sizeof(uint8_t));
3362	}
3363
3364	static void remR3HandlerWriteU16(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32)
3365	{
3366	Log2(("remR3HandlerWriteU16: GCPhys=%VGp u32=%#x\n", GCPhys, u32));
3367	PGMPhysWrite((PVM)pvVM, GCPhys, &u32, sizeof(uint16_t));
3368	}
3369
3370	static void remR3HandlerWriteU32(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32)
3371	{
3372	Log2(("remR3HandlerWriteU32: GCPhys=%VGp u32=%#x\n", GCPhys, u32));
3373	PGMPhysWrite((PVM)pvVM, GCPhys, &u32, sizeof(uint32_t));
3374	}
3375
3376	/* -+- disassembly -+- */
3377
3378	#undef LOG_GROUP
3379	#define LOG_GROUP LOG_GROUP_REM_DISAS
3380
3381
3382	/**
3383	* Enables or disables singled stepped disassembly.
3384	*
3385	* @returns VBox status code.
3386	* @param pVM VM handle.
3387	* @param fEnable To enable set this flag, to disable clear it.
3388	*/
3389	static DECLCALLBACK(int) remR3DisasEnableStepping(PVM pVM, bool fEnable)
3390	{
3391	LogFlow(("remR3DisasEnableStepping: fEnable=%d\n", fEnable));
3392	VM_ASSERT_EMT(pVM);
3393
3394	if (fEnable)
3395	pVM->rem.s.Env.state \|= CPU_EMULATE_SINGLE_STEP;
3396	else
3397	pVM->rem.s.Env.state &= ~CPU_EMULATE_SINGLE_STEP;
3398	return VINF_SUCCESS;
3399	}
3400
3401
3402	/**
3403	* Enables or disables singled stepped disassembly.
3404	*
3405	* @returns VBox status code.
3406	* @param pVM VM handle.
3407	* @param fEnable To enable set this flag, to disable clear it.
3408	*/
3409	REMR3DECL(int) REMR3DisasEnableStepping(PVM pVM, bool fEnable)
3410	{
3411	PVMREQ pReq;
3412	int rc;
3413
3414	LogFlow(("REMR3DisasEnableStepping: fEnable=%d\n", fEnable));
3415	if (VM_IS_EMT(pVM))
3416	return remR3DisasEnableStepping(pVM, fEnable);
3417
3418	rc = VMR3ReqCall(pVM, &pReq, RT_INDEFINITE_WAIT, (PFNRT)remR3DisasEnableStepping, 2, pVM, fEnable);
3419	AssertRC(rc);
3420	if (VBOX_SUCCESS(rc))
3421	rc = pReq->iStatus;
3422	VMR3ReqFree(pReq);
3423	return rc;
3424	}
3425
3426
3427	#ifdef VBOX_WITH_DEBUGGER
3428	/**
3429	* External Debugger Command: .remstep [on\|off\|1\|0]
3430	*/
3431	static DECLCALLBACK(int) remR3CmdDisasEnableStepping(PCDBGCCMD pCmd, PDBGCCMDHLP pCmdHlp, PVM pVM, PCDBGCVAR paArgs, unsigned cArgs, PDBGCVAR pResult)
3432	{
3433	bool fEnable;
3434	int rc;
3435
3436	/* print status */
3437	if (cArgs == 0)
3438	return pCmdHlp->pfnPrintf(pCmdHlp, NULL, "DisasStepping is %s\n",
3439	pVM->rem.s.Env.state & CPU_EMULATE_SINGLE_STEP ? "enabled" : "disabled");
3440
3441	/* convert the argument and change the mode. */
3442	rc = pCmdHlp->pfnVarToBool(pCmdHlp, &paArgs[0], &fEnable);
3443	if (VBOX_FAILURE(rc))
3444	return pCmdHlp->pfnVBoxError(pCmdHlp, rc, "boolean conversion failed!\n");
3445	rc = REMR3DisasEnableStepping(pVM, fEnable);
3446	if (VBOX_FAILURE(rc))
3447	return pCmdHlp->pfnVBoxError(pCmdHlp, rc, "REMR3DisasEnableStepping failed!\n");
3448	return rc;
3449	}
3450	#endif
3451
3452
3453	/**
3454	* Disassembles n instructions and prints them to the log.
3455	*
3456	* @returns Success indicator.
3457	* @param env Pointer to the recompiler CPU structure.
3458	* @param f32BitCode Indicates that whether or not the code should
3459	* be disassembled as 16 or 32 bit. If -1 the CS
3460	* selector will be inspected.
3461	* @param nrInstructions Nr of instructions to disassemble
3462	* @param pszPrefix
3463	* @remark not currently used for anything but ad-hoc debugging.
3464	*/
3465	bool remR3DisasBlock(CPUState env, int f32BitCode, int nrInstructions, char pszPrefix)
3466	{
3467	int i;
3468
3469	/*
3470	* Determin 16/32 bit mode.
3471	*/
3472	if (f32BitCode == -1)
3473	f32BitCode = !!(env->segs[R_CS].flags & X86_DESC_DB); /** @todo is this right?!!?!?!?!? */
3474
3475	/*
3476	* Convert cs:eip to host context address.
3477	* We don't care to much about cross page correctness presently.
3478	*/
3479	RTGCPTR GCPtrPC = env->segs[R_CS].base + env->eip;
3480	void *pvPC;
3481	if (f32BitCode && (env->cr[0] & (X86_CR0_PE \| X86_CR0_PG)) == (X86_CR0_PE \| X86_CR0_PG))
3482	{
3483	/* convert eip to physical address. */
3484	int rc = PGMPhysGCPtr2HCPtrByGstCR3(env->pVM,
3485	GCPtrPC,
3486	env->cr[3],
3487	env->cr[4] & (X86_CR4_PSE \| X86_CR4_PAE), /** @todo add longmode flag */
3488	&pvPC);
3489	if (VBOX_FAILURE(rc))
3490	{
3491	if (!PATMIsPatchGCAddr(env->pVM, GCPtrPC))
3492	return false;
3493	pvPC = (char *)PATMR3QueryPatchMemHC(env->pVM, NULL)
3494	+ (GCPtrPC - PATMR3QueryPatchMemGC(env->pVM, NULL));
3495	}
3496	}
3497	else
3498	{
3499	/* physical address */
3500	int rc = PGMPhysGCPhys2HCPtr(env->pVM, (RTGCPHYS)GCPtrPC, nrInstructions*16, &pvPC);
3501	if (VBOX_FAILURE(rc))
3502	return false;
3503	}
3504
3505	/*
3506	* Disassemble.
3507	*/
3508	RTINTPTR off = env->eip - (RTINTPTR)pvPC;
3509	DISCPUSTATE Cpu;
3510	Cpu.mode = f32BitCode ? CPUMODE_32BIT : CPUMODE_16BIT;
3511	Cpu.pfnReadBytes = NULL; /** @todo make cs:eip reader for the disassembler. */
3512	//Cpu.dwUserData[0] = (uintptr_t)pVM;
3513	//Cpu.dwUserData[1] = (uintptr_t)pvPC;
3514	//Cpu.dwUserData[2] = GCPtrPC;
3515
3516	for (i=0;i<nrInstructions;i++)
3517	{
3518	char szOutput[256];
3519	uint32_t cbOp;
3520	if (!DISInstr(&Cpu, (uintptr_t)pvPC, off, &cbOp, &szOutput[0]))
3521	return false;
3522	if (pszPrefix)
3523	Log(("%s: %s", pszPrefix, szOutput));
3524	else
3525	Log(("%s", szOutput));
3526
3527	pvPC += cbOp;
3528	}
3529	return true;
3530	}
3531
3532
3533	/** @todo need to test the new code, using the old code in the mean while. */
3534	#define USE_OLD_DUMP_AND_DISASSEMBLY
3535
3536	/**
3537	* Disassembles one instruction and prints it to the log.
3538	*
3539	* @returns Success indicator.
3540	* @param env Pointer to the recompiler CPU structure.
3541	* @param f32BitCode Indicates that whether or not the code should
3542	* be disassembled as 16 or 32 bit. If -1 the CS
3543	* selector will be inspected.
3544	* @param pszPrefix
3545	*/
3546	bool remR3DisasInstr(CPUState env, int f32BitCode, char pszPrefix)
3547	{
3548	#ifdef USE_OLD_DUMP_AND_DISASSEMBLY
3549	PVM pVM = env->pVM;
3550
3551	/*
3552	* Determin 16/32 bit mode.
3553	*/
3554	if (f32BitCode == -1)
3555	f32BitCode = !!(env->segs[R_CS].flags & X86_DESC_DB); /** @todo is this right?!!?!?!?!? */
3556
3557	/*
3558	* Log registers
3559	*/
3560	if (LogIs2Enabled())
3561	{
3562	remR3StateUpdate(pVM);
3563	DBGFR3InfoLog(pVM, "cpumguest", pszPrefix);
3564	}
3565
3566	/*
3567	* Convert cs:eip to host context address.
3568	* We don't care to much about cross page correctness presently.
3569	*/
3570	RTGCPTR GCPtrPC = env->segs[R_CS].base + env->eip;
3571	void *pvPC;
3572	if ((env->cr[0] & (X86_CR0_PE \| X86_CR0_PG)) == (X86_CR0_PE \| X86_CR0_PG))
3573	{
3574	/* convert eip to physical address. */
3575	int rc = PGMPhysGCPtr2HCPtrByGstCR3(pVM,
3576	GCPtrPC,
3577	env->cr[3],
3578	env->cr[4] & (X86_CR4_PSE \| X86_CR4_PAE),
3579	&pvPC);
3580	if (VBOX_FAILURE(rc))
3581	{
3582	if (!PATMIsPatchGCAddr(pVM, GCPtrPC))
3583	return false;
3584	pvPC = (char *)PATMR3QueryPatchMemHC(pVM, NULL)
3585	+ (GCPtrPC - PATMR3QueryPatchMemGC(pVM, NULL));
3586	}
3587	}
3588	else
3589	{
3590
3591	/* physical address */
3592	int rc = PGMPhysGCPhys2HCPtr(pVM, (RTGCPHYS)GCPtrPC, 16, &pvPC);
3593	if (VBOX_FAILURE(rc))
3594	return false;
3595	}
3596
3597	/*
3598	* Disassemble.
3599	*/
3600	RTINTPTR off = env->eip - (RTINTPTR)pvPC;
3601	DISCPUSTATE Cpu;
3602	Cpu.mode = f32BitCode ? CPUMODE_32BIT : CPUMODE_16BIT;
3603	Cpu.pfnReadBytes = NULL; /** @todo make cs:eip reader for the disassembler. */
3604	//Cpu.dwUserData[0] = (uintptr_t)pVM;
3605	//Cpu.dwUserData[1] = (uintptr_t)pvPC;
3606	//Cpu.dwUserData[2] = GCPtrPC;
3607	char szOutput[256];
3608	uint32_t cbOp;
3609	if (!DISInstr(&Cpu, (uintptr_t)pvPC, off, &cbOp, &szOutput[0]))
3610	return false;
3611
3612	if (!f32BitCode)
3613	{
3614	if (pszPrefix)
3615	Log(("%s: %04X:%s", pszPrefix, env->segs[R_CS].selector, szOutput));
3616	else
3617	Log(("%04X:%s", env->segs[R_CS].selector, szOutput));
3618	}
3619	else
3620	{
3621	if (pszPrefix)
3622	Log(("%s: %s", pszPrefix, szOutput));
3623	else
3624	Log(("%s", szOutput));
3625	}
3626	return true;
3627
3628	#else /* !USE_OLD_DUMP_AND_DISASSEMBLY */
3629	PVM pVM = env->pVM;
3630	const bool fLog = LogIsEnabled();
3631	const bool fLog2 = LogIs2Enabled();
3632	int rc = VINF_SUCCESS;
3633
3634	/*
3635	* Don't bother if there ain't any log output to do.
3636	*/
3637	if (!fLog && !fLog2)
3638	return true;
3639
3640	/*
3641	* Update the state so DBGF reads the correct register values.
3642	*/
3643	remR3StateUpdate(pVM);
3644
3645	/*
3646	* Log registers if requested.
3647	*/
3648	if (!fLog2)
3649	DBGFR3InfoLog(pVM, "cpumguest", pszPrefix);
3650
3651	/*
3652	* Disassemble to log.
3653	*/
3654	if (fLog)
3655	rc = DBGFR3DisasInstrCurrentLogInternal(pVM, pszPrefix);
3656
3657	return VBOX_SUCCESS(rc);
3658	#endif
3659	}
3660
3661
3662	/**
3663	* Disassemble recompiled code.
3664	*
3665	* @param phFileIgnored Ignored, logfile usually.
3666	* @param pvCode Pointer to the code block.
3667	* @param cb Size of the code block.
3668	*/
3669	void disas(FILE phFileIgnored, void pvCode, unsigned long cb)
3670	{
3671	if (LogIs2Enabled())
3672	{
3673	unsigned off = 0;
3674	char szOutput[256];
3675	DISCPUSTATE Cpu = {0};
3676	Cpu.mode = CPUMODE_32BIT;
3677
3678	RTLogPrintf("Recompiled Code: %p %#lx (%ld) bytes\n", pvCode, cb, cb);
3679	while (off < cb)
3680	{
3681	uint32_t cbInstr;
3682	if (DISInstr(&Cpu, (uintptr_t)pvCode + off, 0, &cbInstr, szOutput))
3683	RTLogPrintf("%s", szOutput);
3684	else
3685	{
3686	RTLogPrintf("disas error\n");
3687	cbInstr = 1;
3688	}
3689	off += cbInstr;
3690	}
3691	}
3692	NOREF(phFileIgnored);
3693	}
3694
3695
3696	/**
3697	* Disassemble guest code.
3698	*
3699	* @param phFileIgnored Ignored, logfile usually.
3700	* @param uCode The guest address of the code to disassemble. (flat?)
3701	* @param cb Number of bytes to disassemble.
3702	* @param fFlags Flags, probably something which tells if this is 16, 32 or 64 bit code.
3703	*/
3704	void target_disas(FILE *phFileIgnored, target_ulong uCode, target_ulong cb, int fFlags)
3705	{
3706	if (LogIs2Enabled())
3707	{
3708	PVM pVM = cpu_single_env->pVM;
3709
3710	/*
3711	* Update the state so DBGF reads the correct register values (flags).
3712	*/
3713	remR3StateUpdate(pVM);
3714
3715	/*
3716	* Do the disassembling.
3717	*/
3718	RTLogPrintf("Guest Code: PC=%VGp #VGp (%VGp) bytes fFlags=%d\n", uCode, cb, cb, fFlags);
3719	RTSEL cs = cpu_single_env->segs[R_CS].selector;
3720	RTGCUINTPTR eip = uCode - cpu_single_env->segs[R_CS].base;
3721	for (;;)
3722	{
3723	char szBuf[256];
3724	size_t cbInstr;
3725	int rc = DBGFR3DisasInstrEx(pVM,
3726	cs,
3727	eip,
3728	0,
3729	szBuf, sizeof(szBuf),
3730	&cbInstr);
3731	if (VBOX_SUCCESS(rc))
3732	RTLogPrintf("%VGp %s\n", uCode, szBuf);
3733	else
3734	{
3735	RTLogPrintf("%VGp %04x:%VGp: %s\n", uCode, cs, eip, szBuf);
3736	cbInstr = 1;
3737	}
3738
3739	/* next */
3740	if (cb <= cbInstr)
3741	break;
3742	cb -= cbInstr;
3743	uCode += cbInstr;
3744	eip += cbInstr;
3745	}
3746	}
3747	NOREF(phFileIgnored);
3748	}
3749
3750
3751	/**
3752	* Looks up a guest symbol.
3753	*
3754	* @returns Pointer to symbol name. This is a static buffer.
3755	* @param orig_addr The address in question.
3756	*/
3757	const char *lookup_symbol(target_ulong orig_addr)
3758	{
3759	RTGCINTPTR off = 0;
3760	DBGFSYMBOL Sym;
3761	PVM pVM = cpu_single_env->pVM;
3762	int rc = DBGFR3SymbolByAddr(pVM, orig_addr, &off, &Sym);
3763	if (VBOX_SUCCESS(rc))
3764	{
3765	static char szSym[sizeof(Sym.szName) + 48];
3766	if (!off)
3767	RTStrPrintf(szSym, sizeof(szSym), "%s\n", Sym.szName);
3768	else if (off > 0)
3769	RTStrPrintf(szSym, sizeof(szSym), "%s+%x\n", Sym.szName, off);
3770	else
3771	RTStrPrintf(szSym, sizeof(szSym), "%s-%x\n", Sym.szName, -off);
3772	return szSym;
3773	}
3774	return "<N/A>";
3775	}
3776
3777
3778	#undef LOG_GROUP
3779	#define LOG_GROUP LOG_GROUP_REM
3780
3781
3782	/* -+- FF notifications -+- */
3783
3784
3785	/**
3786	* Notification about a pending interrupt.
3787	*
3788	* @param pVM VM Handle.
3789	* @param u8Interrupt Interrupt
3790	* @thread The emulation thread.
3791	*/
3792	REMR3DECL(void) REMR3NotifyPendingInterrupt(PVM pVM, uint8_t u8Interrupt)
3793	{
3794	Assert(pVM->rem.s.u32PendingInterrupt == REM_NO_PENDING_IRQ);
3795	pVM->rem.s.u32PendingInterrupt = u8Interrupt;
3796	}
3797
3798	/**
3799	* Notification about a pending interrupt.
3800	*
3801	* @returns Pending interrupt or REM_NO_PENDING_IRQ
3802	* @param pVM VM Handle.
3803	* @thread The emulation thread.
3804	*/
3805	REMR3DECL(uint32_t) REMR3QueryPendingInterrupt(PVM pVM)
3806	{
3807	return pVM->rem.s.u32PendingInterrupt;
3808	}
3809
3810	/**
3811	* Notification about the interrupt FF being set.
3812	*
3813	* @param pVM VM Handle.
3814	* @thread The emulation thread.
3815	*/
3816	REMR3DECL(void) REMR3NotifyInterruptSet(PVM pVM)
3817	{
3818	LogFlow(("REMR3NotifyInterruptSet: fInRem=%d interrupts %s\n", pVM->rem.s.fInREM,
3819	(pVM->rem.s.Env.eflags & IF_MASK) && !(pVM->rem.s.Env.hflags & HF_INHIBIT_IRQ_MASK) ? "enabled" : "disabled"));
3820	if (pVM->rem.s.fInREM)
3821	{
3822	if (VM_IS_EMT(pVM))
3823	cpu_interrupt(cpu_single_env, CPU_INTERRUPT_HARD);
3824	else
3825	ASMAtomicOrS32(&cpu_single_env->interrupt_request, CPU_INTERRUPT_EXTERNAL_HARD);
3826	}
3827	}
3828
3829
3830	/**
3831	* Notification about the interrupt FF being set.
3832	*
3833	* @param pVM VM Handle.
3834	* @thread The emulation thread.
3835	*/
3836	REMR3DECL(void) REMR3NotifyInterruptClear(PVM pVM)
3837	{
3838	LogFlow(("REMR3NotifyInterruptClear:\n"));
3839	VM_ASSERT_EMT(pVM);
3840	if (pVM->rem.s.fInREM)
3841	cpu_reset_interrupt(cpu_single_env, CPU_INTERRUPT_HARD);
3842	}
3843
3844
3845	/**
3846	* Notification about pending timer(s).
3847	*
3848	* @param pVM VM Handle.
3849	* @thread Any.
3850	*/
3851	REMR3DECL(void) REMR3NotifyTimerPending(PVM pVM)
3852	{
3853	#ifndef DEBUG_bird
3854	LogFlow(("REMR3NotifyTimerPending: fInRem=%d\n", pVM->rem.s.fInREM));
3855	#endif
3856	if (pVM->rem.s.fInREM)
3857	{
3858	if (VM_IS_EMT(pVM))
3859	cpu_interrupt(cpu_single_env, CPU_INTERRUPT_EXIT);
3860	else
3861	ASMAtomicOrS32(&cpu_single_env->interrupt_request, CPU_INTERRUPT_EXTERNAL_TIMER);
3862	}
3863	}
3864
3865
3866	/**
3867	* Notification about pending DMA transfers.
3868	*
3869	* @param pVM VM Handle.
3870	* @thread Any.
3871	*/
3872	REMR3DECL(void) REMR3NotifyDmaPending(PVM pVM)
3873	{
3874	LogFlow(("REMR3NotifyDmaPending: fInRem=%d\n", pVM->rem.s.fInREM));
3875	if (pVM->rem.s.fInREM)
3876	{
3877	if (VM_IS_EMT(pVM))
3878	cpu_interrupt(cpu_single_env, CPU_INTERRUPT_EXIT);
3879	else
3880	ASMAtomicOrS32(&cpu_single_env->interrupt_request, CPU_INTERRUPT_EXTERNAL_DMA);
3881	}
3882	}
3883
3884
3885	/**
3886	* Notification about pending timer(s).
3887	*
3888	* @param pVM VM Handle.
3889	* @thread Any.
3890	*/
3891	REMR3DECL(void) REMR3NotifyQueuePending(PVM pVM)
3892	{
3893	LogFlow(("REMR3NotifyQueuePending: fInRem=%d\n", pVM->rem.s.fInREM));
3894	if (pVM->rem.s.fInREM)
3895	{
3896	if (VM_IS_EMT(pVM))
3897	cpu_interrupt(cpu_single_env, CPU_INTERRUPT_EXIT);
3898	else
3899	ASMAtomicOrS32(&cpu_single_env->interrupt_request, CPU_INTERRUPT_EXTERNAL_EXIT);
3900	}
3901	}
3902
3903
3904	/**
3905	* Notification about pending FF set by an external thread.
3906	*
3907	* @param pVM VM handle.
3908	* @thread Any.
3909	*/
3910	REMR3DECL(void) REMR3NotifyFF(PVM pVM)
3911	{
3912	LogFlow(("REMR3NotifyFF: fInRem=%d\n", pVM->rem.s.fInREM));
3913	if (pVM->rem.s.fInREM)
3914	{
3915	if (VM_IS_EMT(pVM))
3916	cpu_interrupt(cpu_single_env, CPU_INTERRUPT_EXIT);
3917	else
3918	ASMAtomicOrS32(&cpu_single_env->interrupt_request, CPU_INTERRUPT_EXTERNAL_EXIT);
3919	}
3920	}
3921
3922
3923	#ifdef VBOX_WITH_STATISTICS
3924	void remR3ProfileStart(int statcode)
3925	{
3926	STAMPROFILEADV *pStat;
3927	switch(statcode)
3928	{
3929	case STATS_EMULATE_SINGLE_INSTR:
3930	pStat = &gStatExecuteSingleInstr;
3931	break;
3932	case STATS_QEMU_COMPILATION:
3933	pStat = &gStatCompilationQEmu;
3934	break;
3935	case STATS_QEMU_RUN_EMULATED_CODE:
3936	pStat = &gStatRunCodeQEmu;
3937	break;
3938	case STATS_QEMU_TOTAL:
3939	pStat = &gStatTotalTimeQEmu;
3940	break;
3941	case STATS_QEMU_RUN_TIMERS:
3942	pStat = &gStatTimers;
3943	break;
3944	case STATS_TLB_LOOKUP:
3945	pStat= &gStatTBLookup;
3946	break;
3947	case STATS_IRQ_HANDLING:
3948	pStat= &gStatIRQ;
3949	break;
3950	case STATS_RAW_CHECK:
3951	pStat = &gStatRawCheck;
3952	break;
3953
3954	default:
3955	AssertMsgFailed(("unknown stat %d\n", statcode));
3956	return;
3957	}
3958	STAM_PROFILE_ADV_START(pStat, a);
3959	}
3960
3961
3962	void remR3ProfileStop(int statcode)
3963	{
3964	STAMPROFILEADV *pStat;
3965	switch(statcode)
3966	{
3967	case STATS_EMULATE_SINGLE_INSTR:
3968	pStat = &gStatExecuteSingleInstr;
3969	break;
3970	case STATS_QEMU_COMPILATION:
3971	pStat = &gStatCompilationQEmu;
3972	break;
3973	case STATS_QEMU_RUN_EMULATED_CODE:
3974	pStat = &gStatRunCodeQEmu;
3975	break;
3976	case STATS_QEMU_TOTAL:
3977	pStat = &gStatTotalTimeQEmu;
3978	break;
3979	case STATS_QEMU_RUN_TIMERS:
3980	pStat = &gStatTimers;
3981	break;
3982	case STATS_TLB_LOOKUP:
3983	pStat= &gStatTBLookup;
3984	break;
3985	case STATS_IRQ_HANDLING:
3986	pStat= &gStatIRQ;
3987	break;
3988	case STATS_RAW_CHECK:
3989	pStat = &gStatRawCheck;
3990	break;
3991	default:
3992	AssertMsgFailed(("unknown stat %d\n", statcode));
3993	return;
3994	}
3995	STAM_PROFILE_ADV_STOP(pStat, a);
3996	}
3997	#endif
3998
3999	/**
4000	* Raise an RC, force rem exit.
4001	*
4002	* @param pVM VM handle.
4003	* @param rc The rc.
4004	*/
4005	void remR3RaiseRC(PVM pVM, int rc)
4006	{
4007	Log(("remR3RaiseRC: rc=%Vrc\n", rc));
4008	Assert(pVM->rem.s.fInREM);
4009	VM_ASSERT_EMT(pVM);
4010	pVM->rem.s.rc = rc;
4011	cpu_interrupt(&pVM->rem.s.Env, CPU_INTERRUPT_RC);
4012	}
4013
4014
4015	/* -+- timers -+- */
4016
4017	uint64_t cpu_get_tsc(CPUX86State *env)
4018	{
4019	return TMCpuTickGet(env->pVM);
4020	}
4021
4022
4023	/* -+- interrupts -+- */
4024
4025	void cpu_set_ferr(CPUX86State *env)
4026	{
4027	int rc = PDMIsaSetIrq(env->pVM, 13, 1);
4028	LogFlow(("cpu_set_ferr: rc=%d\n", rc)); NOREF(rc);
4029	}
4030
4031	int cpu_get_pic_interrupt(CPUState *env)
4032	{
4033	uint8_t u8Interrupt;
4034	int rc;
4035
4036	/* When we fail to forward interrupts directly in raw mode, we fall back to the recompiler.
4037	* In that case we can't call PDMGetInterrupt anymore, because it has already cleared the interrupt
4038	* with the (a)pic.
4039	*/
4040	/** @note We assume we will go directly to the recompiler to handle the pending interrupt! */
4041	/** @todo r=bird: In the long run we should just do the interrupt handling in EM/CPUM/TRPM/somewhere and
4042	* if we cannot execute the interrupt handler in raw-mode just reschedule to REM. Once that is done we
4043	* remove this kludge. */
4044	if (env->pVM->rem.s.u32PendingInterrupt != REM_NO_PENDING_IRQ)
4045	{
4046	rc = VINF_SUCCESS;
4047	Assert(env->pVM->rem.s.u32PendingInterrupt >= 0 && env->pVM->rem.s.u32PendingInterrupt <= 255);
4048	u8Interrupt = env->pVM->rem.s.u32PendingInterrupt;
4049	env->pVM->rem.s.u32PendingInterrupt = REM_NO_PENDING_IRQ;
4050	}
4051	else
4052	rc = PDMGetInterrupt(env->pVM, &u8Interrupt);
4053
4054	LogFlow(("cpu_get_pic_interrupt: u8Interrupt=%d rc=%Vrc\n", u8Interrupt, rc));
4055	if (VBOX_SUCCESS(rc))
4056	{
4057	if (VM_FF_ISPENDING(env->pVM, VM_FF_INTERRUPT_APIC \| VM_FF_INTERRUPT_PIC))
4058	env->interrupt_request \|= CPU_INTERRUPT_HARD;
4059	return u8Interrupt;
4060	}
4061	return -1;
4062	}
4063
4064
4065	/* -+- local apic -+- */
4066
4067	void cpu_set_apic_base(CPUX86State *env, uint64_t val)
4068	{
4069	int rc = PDMApicSetBase(env->pVM, val);
4070	LogFlow(("cpu_set_apic_base: val=%#llx rc=%Vrc\n", val, rc)); NOREF(rc);
4071	}
4072
4073	uint64_t cpu_get_apic_base(CPUX86State *env)
4074	{
4075	uint64_t u64;
4076	int rc = PDMApicGetBase(env->pVM, &u64);
4077	if (VBOX_SUCCESS(rc))
4078	{
4079	LogFlow(("cpu_get_apic_base: returns %#llx \n", u64));
4080	return u64;
4081	}
4082	LogFlow(("cpu_get_apic_base: returns 0 (rc=%Vrc)\n", rc));
4083	return 0;
4084	}
4085
4086	void cpu_set_apic_tpr(CPUX86State *env, uint8_t val)
4087	{
4088	int rc = PDMApicSetTPR(env->pVM, val);
4089	LogFlow(("cpu_set_apic_tpr: val=%#x rc=%Vrc\n", val, rc)); NOREF(rc);
4090	}
4091
4092	uint8_t cpu_get_apic_tpr(CPUX86State *env)
4093	{
4094	uint8_t u8;
4095	int rc = PDMApicGetTPR(env->pVM, &u8);
4096	if (VBOX_SUCCESS(rc))
4097	{
4098	LogFlow(("cpu_get_apic_tpr: returns %#x\n", u8));
4099	return u8;
4100	}
4101	LogFlow(("cpu_get_apic_tpr: returns 0 (rc=%Vrc)\n", rc));
4102	return 0;
4103	}
4104
4105
4106	/* -+- I/O Ports -+- */
4107
4108	#undef LOG_GROUP
4109	#define LOG_GROUP LOG_GROUP_REM_IOPORT
4110
4111	void cpu_outb(CPUState *env, int addr, int val)
4112	{
4113	if (addr != 0x80 && addr != 0x70 && addr != 0x61)
4114	Log2(("cpu_outb: addr=%#06x val=%#x\n", addr, val));
4115
4116	int rc = IOMIOPortWrite(env->pVM, (RTIOPORT)addr, val, 1);
4117	if (rc == VINF_SUCCESS)
4118	return;
4119	if (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST)
4120	{
4121	Log(("cpu_outb: addr=%#06x val=%#x -> %Vrc\n", addr, val, rc));
4122	remR3RaiseRC(env->pVM, rc);
4123	return;
4124	}
4125	remAbort(rc, __FUNCTION__);
4126	}
4127
4128	void cpu_outw(CPUState *env, int addr, int val)
4129	{
4130	//Log2(("cpu_outw: addr=%#06x val=%#x\n", addr, val));
4131	int rc = IOMIOPortWrite(env->pVM, (RTIOPORT)addr, val, 2);
4132	if (rc == VINF_SUCCESS)
4133	return;
4134	if (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST)
4135	{
4136	Log(("cpu_outw: addr=%#06x val=%#x -> %Vrc\n", addr, val, rc));
4137	remR3RaiseRC(env->pVM, rc);
4138	return;
4139	}
4140	remAbort(rc, __FUNCTION__);
4141	}
4142
4143	void cpu_outl(CPUState *env, int addr, int val)
4144	{
4145	Log2(("cpu_outl: addr=%#06x val=%#x\n", addr, val));
4146	int rc = IOMIOPortWrite(env->pVM, (RTIOPORT)addr, val, 4);
4147	if (rc == VINF_SUCCESS)
4148	return;
4149	if (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST)
4150	{
4151	Log(("cpu_outl: addr=%#06x val=%#x -> %Vrc\n", addr, val, rc));
4152	remR3RaiseRC(env->pVM, rc);
4153	return;
4154	}
4155	remAbort(rc, __FUNCTION__);
4156	}
4157
4158	int cpu_inb(CPUState *env, int addr)
4159	{
4160	uint32_t u32 = 0;
4161	int rc = IOMIOPortRead(env->pVM, (RTIOPORT)addr, &u32, 1);
4162	if (rc == VINF_SUCCESS)
4163	{
4164	if (/addr != 0x61 && /addr != 0x71)
4165	Log2(("cpu_inb: addr=%#06x -> %#x\n", addr, u32));
4166	return (int)u32;
4167	}
4168	if (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST)
4169	{
4170	Log(("cpu_inb: addr=%#06x -> %#x rc=%Vrc\n", addr, u32, rc));
4171	remR3RaiseRC(env->pVM, rc);
4172	return (int)u32;
4173	}
4174	remAbort(rc, __FUNCTION__);
4175	return 0xff;
4176	}
4177
4178	int cpu_inw(CPUState *env, int addr)
4179	{
4180	uint32_t u32 = 0;
4181	int rc = IOMIOPortRead(env->pVM, (RTIOPORT)addr, &u32, 2);
4182	if (rc == VINF_SUCCESS)
4183	{
4184	Log2(("cpu_inw: addr=%#06x -> %#x\n", addr, u32));
4185	return (int)u32;
4186	}
4187	if (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST)
4188	{
4189	Log(("cpu_inw: addr=%#06x -> %#x rc=%Vrc\n", addr, u32, rc));
4190	remR3RaiseRC(env->pVM, rc);
4191	return (int)u32;
4192	}
4193	remAbort(rc, __FUNCTION__);
4194	return 0xffff;
4195	}
4196
4197	int cpu_inl(CPUState *env, int addr)
4198	{
4199	uint32_t u32 = 0;
4200	int rc = IOMIOPortRead(env->pVM, (RTIOPORT)addr, &u32, 4);
4201	if (rc == VINF_SUCCESS)
4202	{
4203	//if (addr==0x01f0 && u32 == 0x6b6d)
4204	// loglevel = ~0;
4205	Log2(("cpu_inl: addr=%#06x -> %#x\n", addr, u32));
4206	return (int)u32;
4207	}
4208	if (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST)
4209	{
4210	Log(("cpu_inl: addr=%#06x -> %#x rc=%Vrc\n", addr, u32, rc));
4211	remR3RaiseRC(env->pVM, rc);
4212	return (int)u32;
4213	}
4214	remAbort(rc, __FUNCTION__);
4215	return 0xffffffff;
4216	}
4217
4218	#undef LOG_GROUP
4219	#define LOG_GROUP LOG_GROUP_REM
4220
4221
4222	/* -+- helpers and misc other interfaces -+- */
4223
4224	/**
4225	* Perform the CPUID instruction.
4226	*
4227	* ASMCpuId cannot be invoked from some source files where this is used because of global
4228	* register allocations.
4229	*
4230	* @param env Pointer to the recompiler CPU structure.
4231	* @param uOperator CPUID operation (eax).
4232	* @param pvEAX Where to store eax.
4233	* @param pvEBX Where to store ebx.
4234	* @param pvECX Where to store ecx.
4235	* @param pvEDX Where to store edx.
4236	*/
4237	void remR3CpuId(CPUState env, unsigned uOperator, void pvEAX, void pvEBX, void pvECX, void *pvEDX)
4238	{
4239	CPUMGetGuestCpuId(env->pVM, uOperator, (uint32_t )pvEAX, (uint32_t )pvEBX, (uint32_t )pvECX, (uint32_t )pvEDX);
4240	}
4241
4242
4243	#if 0 /* not used */
4244	/**
4245	* Interface for qemu hardware to report back fatal errors.
4246	*/
4247	void hw_error(const char *pszFormat, ...)
4248	{
4249	/*
4250	* Bitch about it.
4251	*/
4252	/** @todo Add support for nested arg lists in the LogPrintfV routine! I've code for
4253	* this in my Odin32 tree at home! */
4254	va_list args;
4255	va_start(args, pszFormat);
4256	RTLogPrintf("fatal error in virtual hardware:");
4257	RTLogPrintfV(pszFormat, args);
4258	va_end(args);
4259	AssertReleaseMsgFailed(("fatal error in virtual hardware: %s\n", pszFormat));
4260
4261	/*
4262	* If we're in REM context we'll sync back the state before 'jumping' to
4263	* the EMs failure handling.
4264	*/
4265	PVM pVM = cpu_single_env->pVM;
4266	if (pVM->rem.s.fInREM)
4267	REMR3StateBack(pVM);
4268	EMR3FatalError(pVM, VERR_REM_VIRTUAL_HARDWARE_ERROR);
4269	AssertMsgFailed(("EMR3FatalError returned!\n"));
4270	}
4271	#endif
4272
4273	/**
4274	* Interface for the qemu cpu to report unhandled situation
4275	* raising a fatal VM error.
4276	*/
4277	void cpu_abort(CPUState env, const char pszFormat, ...)
4278	{
4279	/*
4280	* Bitch about it.
4281	*/
4282	RTLogFlags(NULL, "nodisabled nobuffered");
4283	va_list args;
4284	va_start(args, pszFormat);
4285	RTLogPrintf("fatal error in recompiler cpu: %N\n", pszFormat, &args);
4286	va_end(args);
4287	va_start(args, pszFormat);
4288	AssertReleaseMsgFailed(("fatal error in recompiler cpu: %N\n", pszFormat, &args));
4289	va_end(args);
4290
4291	/*
4292	* If we're in REM context we'll sync back the state before 'jumping' to
4293	* the EMs failure handling.
4294	*/
4295	PVM pVM = cpu_single_env->pVM;
4296	if (pVM->rem.s.fInREM)
4297	REMR3StateBack(pVM);
4298	EMR3FatalError(pVM, VERR_REM_VIRTUAL_CPU_ERROR);
4299	AssertMsgFailed(("EMR3FatalError returned!\n"));
4300	}
4301
4302
4303	/**
4304	* Aborts the VM.
4305	*
4306	* @param rc VBox error code.
4307	* @param pszTip Hint about why/when this happend.
4308	*/
4309	static void remAbort(int rc, const char *pszTip)
4310	{
4311	/*
4312	* Bitch about it.
4313	*/
4314	RTLogPrintf("internal REM fatal error: rc=%Vrc %s\n", rc, pszTip);
4315	AssertReleaseMsgFailed(("internal REM fatal error: rc=%Vrc %s\n", rc, pszTip));
4316
4317	/*
4318	* Jump back to where we entered the recompiler.
4319	*/
4320	PVM pVM = cpu_single_env->pVM;
4321	if (pVM->rem.s.fInREM)
4322	REMR3StateBack(pVM);
4323	EMR3FatalError(pVM, rc);
4324	AssertMsgFailed(("EMR3FatalError returned!\n"));
4325	}
4326
4327
4328	/**
4329	* Dumps a linux system call.
4330	* @param pVM VM handle.
4331	*/
4332	void remR3DumpLnxSyscall(PVM pVM)
4333	{
4334	static const char *apsz[] =
4335	{
4336	"sys_restart_syscall", /* 0 - old "setup()" system call, used for restarting */
4337	"sys_exit",
4338	"sys_fork",
4339	"sys_read",
4340	"sys_write",
4341	"sys_open", /* 5 */
4342	"sys_close",
4343	"sys_waitpid",
4344	"sys_creat",
4345	"sys_link",
4346	"sys_unlink", /* 10 */
4347	"sys_execve",
4348	"sys_chdir",
4349	"sys_time",
4350	"sys_mknod",
4351	"sys_chmod", /* 15 */
4352	"sys_lchown16",
4353	"sys_ni_syscall", /* old break syscall holder */
4354	"sys_stat",
4355	"sys_lseek",
4356	"sys_getpid", /* 20 */
4357	"sys_mount",
4358	"sys_oldumount",
4359	"sys_setuid16",
4360	"sys_getuid16",
4361	"sys_stime", /* 25 */
4362	"sys_ptrace",
4363	"sys_alarm",
4364	"sys_fstat",
4365	"sys_pause",
4366	"sys_utime", /* 30 */
4367	"sys_ni_syscall", /* old stty syscall holder */
4368	"sys_ni_syscall", /* old gtty syscall holder */
4369	"sys_access",
4370	"sys_nice",
4371	"sys_ni_syscall", /* 35 - old ftime syscall holder */
4372	"sys_sync",
4373	"sys_kill",
4374	"sys_rename",
4375	"sys_mkdir",
4376	"sys_rmdir", /* 40 */
4377	"sys_dup",
4378	"sys_pipe",
4379	"sys_times",
4380	"sys_ni_syscall", /* old prof syscall holder */
4381	"sys_brk", /* 45 */
4382	"sys_setgid16",
4383	"sys_getgid16",
4384	"sys_signal",
4385	"sys_geteuid16",
4386	"sys_getegid16", /* 50 */
4387	"sys_acct",
4388	"sys_umount", /* recycled never used phys() */
4389	"sys_ni_syscall", /* old lock syscall holder */
4390	"sys_ioctl",
4391	"sys_fcntl", /* 55 */
4392	"sys_ni_syscall", /* old mpx syscall holder */
4393	"sys_setpgid",
4394	"sys_ni_syscall", /* old ulimit syscall holder */
4395	"sys_olduname",
4396	"sys_umask", /* 60 */
4397	"sys_chroot",
4398	"sys_ustat",
4399	"sys_dup2",
4400	"sys_getppid",
4401	"sys_getpgrp", /* 65 */
4402	"sys_setsid",
4403	"sys_sigaction",
4404	"sys_sgetmask",
4405	"sys_ssetmask",
4406	"sys_setreuid16", /* 70 */
4407	"sys_setregid16",
4408	"sys_sigsuspend",
4409	"sys_sigpending",
4410	"sys_sethostname",
4411	"sys_setrlimit", /* 75 */
4412	"sys_old_getrlimit",
4413	"sys_getrusage",
4414	"sys_gettimeofday",
4415	"sys_settimeofday",
4416	"sys_getgroups16", /* 80 */
4417	"sys_setgroups16",
4418	"old_select",
4419	"sys_symlink",
4420	"sys_lstat",
4421	"sys_readlink", /* 85 */
4422	"sys_uselib",
4423	"sys_swapon",
4424	"sys_reboot",
4425	"old_readdir",
4426	"old_mmap", /* 90 */
4427	"sys_munmap",
4428	"sys_truncate",
4429	"sys_ftruncate",
4430	"sys_fchmod",
4431	"sys_fchown16", /* 95 */
4432	"sys_getpriority",
4433	"sys_setpriority",
4434	"sys_ni_syscall", /* old profil syscall holder */
4435	"sys_statfs",
4436	"sys_fstatfs", /* 100 */
4437	"sys_ioperm",
4438	"sys_socketcall",
4439	"sys_syslog",
4440	"sys_setitimer",
4441	"sys_getitimer", /* 105 */
4442	"sys_newstat",
4443	"sys_newlstat",
4444	"sys_newfstat",
4445	"sys_uname",
4446	"sys_iopl", /* 110 */
4447	"sys_vhangup",
4448	"sys_ni_syscall", /* old "idle" system call */
4449	"sys_vm86old",
4450	"sys_wait4",
4451	"sys_swapoff", /* 115 */
4452	"sys_sysinfo",
4453	"sys_ipc",
4454	"sys_fsync",
4455	"sys_sigreturn",
4456	"sys_clone", /* 120 */
4457	"sys_setdomainname",
4458	"sys_newuname",
4459	"sys_modify_ldt",
4460	"sys_adjtimex",
4461	"sys_mprotect", /* 125 */
4462	"sys_sigprocmask",
4463	"sys_ni_syscall", /* old "create_module" */
4464	"sys_init_module",
4465	"sys_delete_module",
4466	"sys_ni_syscall", /* 130: old "get_kernel_syms" */
4467	"sys_quotactl",
4468	"sys_getpgid",
4469	"sys_fchdir",
4470	"sys_bdflush",
4471	"sys_sysfs", /* 135 */
4472	"sys_personality",
4473	"sys_ni_syscall", /* reserved for afs_syscall */
4474	"sys_setfsuid16",
4475	"sys_setfsgid16",
4476	"sys_llseek", /* 140 */
4477	"sys_getdents",
4478	"sys_select",
4479	"sys_flock",
4480	"sys_msync",
4481	"sys_readv", /* 145 */
4482	"sys_writev",
4483	"sys_getsid",
4484	"sys_fdatasync",
4485	"sys_sysctl",
4486	"sys_mlock", /* 150 */
4487	"sys_munlock",
4488	"sys_mlockall",
4489	"sys_munlockall",
4490	"sys_sched_setparam",
4491	"sys_sched_getparam", /* 155 */
4492	"sys_sched_setscheduler",
4493	"sys_sched_getscheduler",
4494	"sys_sched_yield",
4495	"sys_sched_get_priority_max",
4496	"sys_sched_get_priority_min", /* 160 */
4497	"sys_sched_rr_get_interval",
4498	"sys_nanosleep",
4499	"sys_mremap",
4500	"sys_setresuid16",
4501	"sys_getresuid16", /* 165 */
4502	"sys_vm86",
4503	"sys_ni_syscall", /* Old sys_query_module */
4504	"sys_poll",
4505	"sys_nfsservctl",
4506	"sys_setresgid16", /* 170 */
4507	"sys_getresgid16",
4508	"sys_prctl",
4509	"sys_rt_sigreturn",
4510	"sys_rt_sigaction",
4511	"sys_rt_sigprocmask", /* 175 */
4512	"sys_rt_sigpending",
4513	"sys_rt_sigtimedwait",
4514	"sys_rt_sigqueueinfo",
4515	"sys_rt_sigsuspend",
4516	"sys_pread64", /* 180 */
4517	"sys_pwrite64",
4518	"sys_chown16",
4519	"sys_getcwd",
4520	"sys_capget",
4521	"sys_capset", /* 185 */
4522	"sys_sigaltstack",
4523	"sys_sendfile",
4524	"sys_ni_syscall", /* reserved for streams1 */
4525	"sys_ni_syscall", /* reserved for streams2 */
4526	"sys_vfork", /* 190 */
4527	"sys_getrlimit",
4528	"sys_mmap2",
4529	"sys_truncate64",
4530	"sys_ftruncate64",
4531	"sys_stat64", /* 195 */
4532	"sys_lstat64",
4533	"sys_fstat64",
4534	"sys_lchown",
4535	"sys_getuid",
4536	"sys_getgid", /* 200 */
4537	"sys_geteuid",
4538	"sys_getegid",
4539	"sys_setreuid",
4540	"sys_setregid",
4541	"sys_getgroups", /* 205 */
4542	"sys_setgroups",
4543	"sys_fchown",
4544	"sys_setresuid",
4545	"sys_getresuid",
4546	"sys_setresgid", /* 210 */
4547	"sys_getresgid",
4548	"sys_chown",
4549	"sys_setuid",
4550	"sys_setgid",
4551	"sys_setfsuid", /* 215 */
4552	"sys_setfsgid",
4553	"sys_pivot_root",
4554	"sys_mincore",
4555	"sys_madvise",
4556	"sys_getdents64", /* 220 */
4557	"sys_fcntl64",
4558	"sys_ni_syscall", /* reserved for TUX */
4559	"sys_ni_syscall",
4560	"sys_gettid",
4561	"sys_readahead", /* 225 */
4562	"sys_setxattr",
4563	"sys_lsetxattr",
4564	"sys_fsetxattr",
4565	"sys_getxattr",
4566	"sys_lgetxattr", /* 230 */
4567	"sys_fgetxattr",
4568	"sys_listxattr",
4569	"sys_llistxattr",
4570	"sys_flistxattr",
4571	"sys_removexattr", /* 235 */
4572	"sys_lremovexattr",
4573	"sys_fremovexattr",
4574	"sys_tkill",
4575	"sys_sendfile64",
4576	"sys_futex", /* 240 */
4577	"sys_sched_setaffinity",
4578	"sys_sched_getaffinity",
4579	"sys_set_thread_area",
4580	"sys_get_thread_area",
4581	"sys_io_setup", /* 245 */
4582	"sys_io_destroy",
4583	"sys_io_getevents",
4584	"sys_io_submit",
4585	"sys_io_cancel",
4586	"sys_fadvise64", /* 250 */
4587	"sys_ni_syscall",
4588	"sys_exit_group",
4589	"sys_lookup_dcookie",
4590	"sys_epoll_create",
4591	"sys_epoll_ctl", /* 255 */
4592	"sys_epoll_wait",
4593	"sys_remap_file_pages",
4594	"sys_set_tid_address",
4595	"sys_timer_create",
4596	"sys_timer_settime", /* 260 */
4597	"sys_timer_gettime",
4598	"sys_timer_getoverrun",
4599	"sys_timer_delete",
4600	"sys_clock_settime",
4601	"sys_clock_gettime", /* 265 */
4602	"sys_clock_getres",
4603	"sys_clock_nanosleep",
4604	"sys_statfs64",
4605	"sys_fstatfs64",
4606	"sys_tgkill", /* 270 */
4607	"sys_utimes",
4608	"sys_fadvise64_64",
4609	"sys_ni_syscall" /* sys_vserver */
4610	};
4611
4612	uint32_t uEAX = CPUMGetGuestEAX(pVM);
4613	switch (uEAX)
4614	{
4615	default:
4616	if (uEAX < ELEMENTS(apsz))
4617	Log(("REM: linux syscall %3d: %s (eip=%VGv ebx=%08x ecx=%08x edx=%08x esi=%08x edi=%08x ebp=%08x)\n",
4618	uEAX, apsz[uEAX], CPUMGetGuestEIP(pVM), CPUMGetGuestEBX(pVM), CPUMGetGuestECX(pVM),
4619	CPUMGetGuestEDX(pVM), CPUMGetGuestESI(pVM), CPUMGetGuestEDI(pVM), CPUMGetGuestEBP(pVM)));
4620	else
4621	Log(("eip=%08x: linux syscall %d (#%x) unknown\n", CPUMGetGuestEIP(pVM), uEAX, uEAX));
4622	break;
4623
4624	}
4625	}
4626
4627
4628	/**
4629	* Dumps an OpenBSD system call.
4630	* @param pVM VM handle.
4631	*/
4632	void remR3DumpOBsdSyscall(PVM pVM)
4633	{
4634	static const char *apsz[] =
4635	{
4636	"SYS_syscall", //0
4637	"SYS_exit", //1
4638	"SYS_fork", //2
4639	"SYS_read", //3
4640	"SYS_write", //4
4641	"SYS_open", //5
4642	"SYS_close", //6
4643	"SYS_wait4", //7
4644	"SYS_8",
4645	"SYS_link", //9
4646	"SYS_unlink", //10
4647	"SYS_11",
4648	"SYS_chdir", //12
4649	"SYS_fchdir", //13
4650	"SYS_mknod", //14
4651	"SYS_chmod", //15
4652	"SYS_chown", //16
4653	"SYS_break", //17
4654	"SYS_18",
4655	"SYS_19",
4656	"SYS_getpid", //20
4657	"SYS_mount", //21
4658	"SYS_unmount", //22
4659	"SYS_setuid", //23
4660	"SYS_getuid", //24
4661	"SYS_geteuid", //25
4662	"SYS_ptrace", //26
4663	"SYS_recvmsg", //27
4664	"SYS_sendmsg", //28
4665	"SYS_recvfrom", //29
4666	"SYS_accept", //30
4667	"SYS_getpeername", //31
4668	"SYS_getsockname", //32
4669	"SYS_access", //33
4670	"SYS_chflags", //34
4671	"SYS_fchflags", //35
4672	"SYS_sync", //36
4673	"SYS_kill", //37
4674	"SYS_38",
4675	"SYS_getppid", //39
4676	"SYS_40",
4677	"SYS_dup", //41
4678	"SYS_opipe", //42
4679	"SYS_getegid", //43
4680	"SYS_profil", //44
4681	"SYS_ktrace", //45
4682	"SYS_sigaction", //46
4683	"SYS_getgid", //47
4684	"SYS_sigprocmask", //48
4685	"SYS_getlogin", //49
4686	"SYS_setlogin", //50
4687	"SYS_acct", //51
4688	"SYS_sigpending", //52
4689	"SYS_osigaltstack", //53
4690	"SYS_ioctl", //54
4691	"SYS_reboot", //55
4692	"SYS_revoke", //56
4693	"SYS_symlink", //57
4694	"SYS_readlink", //58
4695	"SYS_execve", //59
4696	"SYS_umask", //60
4697	"SYS_chroot", //61
4698	"SYS_62",
4699	"SYS_63",
4700	"SYS_64",
4701	"SYS_65",
4702	"SYS_vfork", //66
4703	"SYS_67",
4704	"SYS_68",
4705	"SYS_sbrk", //69
4706	"SYS_sstk", //70
4707	"SYS_61",
4708	"SYS_vadvise", //72
4709	"SYS_munmap", //73
4710	"SYS_mprotect", //74
4711	"SYS_madvise", //75
4712	"SYS_76",
4713	"SYS_77",
4714	"SYS_mincore", //78
4715	"SYS_getgroups", //79
4716	"SYS_setgroups", //80
4717	"SYS_getpgrp", //81
4718	"SYS_setpgid", //82
4719	"SYS_setitimer", //83
4720	"SYS_84",
4721	"SYS_85",
4722	"SYS_getitimer", //86
4723	"SYS_87",
4724	"SYS_88",
4725	"SYS_89",
4726	"SYS_dup2", //90
4727	"SYS_91",
4728	"SYS_fcntl", //92
4729	"SYS_select", //93
4730	"SYS_94",
4731	"SYS_fsync", //95
4732	"SYS_setpriority", //96
4733	"SYS_socket", //97
4734	"SYS_connect", //98
4735	"SYS_99",
4736	"SYS_getpriority", //100
4737	"SYS_101",
4738	"SYS_102",
4739	"SYS_sigreturn", //103
4740	"SYS_bind", //104
4741	"SYS_setsockopt", //105
4742	"SYS_listen", //106
4743	"SYS_107",
4744	"SYS_108",
4745	"SYS_109",
4746	"SYS_110",
4747	"SYS_sigsuspend", //111
4748	"SYS_112",
4749	"SYS_113",
4750	"SYS_114",
4751	"SYS_115",
4752	"SYS_gettimeofday", //116
4753	"SYS_getrusage", //117
4754	"SYS_getsockopt", //118
4755	"SYS_119",
4756	"SYS_readv", //120
4757	"SYS_writev", //121
4758	"SYS_settimeofday", //122
4759	"SYS_fchown", //123
4760	"SYS_fchmod", //124
4761	"SYS_125",
4762	"SYS_setreuid", //126
4763	"SYS_setregid", //127
4764	"SYS_rename", //128
4765	"SYS_129",
4766	"SYS_130",
4767	"SYS_flock", //131
4768	"SYS_mkfifo", //132
4769	"SYS_sendto", //133
4770	"SYS_shutdown", //134
4771	"SYS_socketpair", //135
4772	"SYS_mkdir", //136
4773	"SYS_rmdir", //137
4774	"SYS_utimes", //138
4775	"SYS_139",
4776	"SYS_adjtime", //140
4777	"SYS_141",
4778	"SYS_142",
4779	"SYS_143",
4780	"SYS_144",
4781	"SYS_145",
4782	"SYS_146",
4783	"SYS_setsid", //147
4784	"SYS_quotactl", //148
4785	"SYS_149",
4786	"SYS_150",
4787	"SYS_151",
4788	"SYS_152",
4789	"SYS_153",
4790	"SYS_154",
4791	"SYS_nfssvc", //155
4792	"SYS_156",
4793	"SYS_157",
4794	"SYS_158",
4795	"SYS_159",
4796	"SYS_160",
4797	"SYS_getfh", //161
4798	"SYS_162",
4799	"SYS_163",
4800	"SYS_164",
4801	"SYS_sysarch", //165
4802	"SYS_166",
4803	"SYS_167",
4804	"SYS_168",
4805	"SYS_169",
4806	"SYS_170",
4807	"SYS_171",
4808	"SYS_172",
4809	"SYS_pread", //173
4810	"SYS_pwrite", //174
4811	"SYS_175",
4812	"SYS_176",
4813	"SYS_177",
4814	"SYS_178",
4815	"SYS_179",
4816	"SYS_180",
4817	"SYS_setgid", //181
4818	"SYS_setegid", //182
4819	"SYS_seteuid", //183
4820	"SYS_lfs_bmapv", //184
4821	"SYS_lfs_markv", //185
4822	"SYS_lfs_segclean", //186
4823	"SYS_lfs_segwait", //187
4824	"SYS_188",
4825	"SYS_189",
4826	"SYS_190",
4827	"SYS_pathconf", //191
4828	"SYS_fpathconf", //192
4829	"SYS_swapctl", //193
4830	"SYS_getrlimit", //194
4831	"SYS_setrlimit", //195
4832	"SYS_getdirentries", //196
4833	"SYS_mmap", //197
4834	"SYS___syscall", //198
4835	"SYS_lseek", //199
4836	"SYS_truncate", //200
4837	"SYS_ftruncate", //201
4838	"SYS___sysctl", //202
4839	"SYS_mlock", //203
4840	"SYS_munlock", //204
4841	"SYS_205",
4842	"SYS_futimes", //206
4843	"SYS_getpgid", //207
4844	"SYS_xfspioctl", //208
4845	"SYS_209",
4846	"SYS_210",
4847	"SYS_211",
4848	"SYS_212",
4849	"SYS_213",
4850	"SYS_214",
4851	"SYS_215",
4852	"SYS_216",
4853	"SYS_217",
4854	"SYS_218",
4855	"SYS_219",
4856	"SYS_220",
4857	"SYS_semget", //221
4858	"SYS_222",
4859	"SYS_223",
4860	"SYS_224",
4861	"SYS_msgget", //225
4862	"SYS_msgsnd", //226
4863	"SYS_msgrcv", //227
4864	"SYS_shmat", //228
4865	"SYS_229",
4866	"SYS_shmdt", //230
4867	"SYS_231",
4868	"SYS_clock_gettime", //232
4869	"SYS_clock_settime", //233
4870	"SYS_clock_getres", //234
4871	"SYS_235",
4872	"SYS_236",
4873	"SYS_237",
4874	"SYS_238",
4875	"SYS_239",
4876	"SYS_nanosleep", //240
4877	"SYS_241",
4878	"SYS_242",
4879	"SYS_243",
4880	"SYS_244",
4881	"SYS_245",
4882	"SYS_246",
4883	"SYS_247",
4884	"SYS_248",
4885	"SYS_249",
4886	"SYS_minherit", //250
4887	"SYS_rfork", //251
4888	"SYS_poll", //252
4889	"SYS_issetugid", //253
4890	"SYS_lchown", //254
4891	"SYS_getsid", //255
4892	"SYS_msync", //256
4893	"SYS_257",
4894	"SYS_258",
4895	"SYS_259",
4896	"SYS_getfsstat", //260
4897	"SYS_statfs", //261
4898	"SYS_fstatfs", //262
4899	"SYS_pipe", //263
4900	"SYS_fhopen", //264
4901	"SYS_265",
4902	"SYS_fhstatfs", //266
4903	"SYS_preadv", //267
4904	"SYS_pwritev", //268
4905	"SYS_kqueue", //269
4906	"SYS_kevent", //270
4907	"SYS_mlockall", //271
4908	"SYS_munlockall", //272
4909	"SYS_getpeereid", //273
4910	"SYS_274",
4911	"SYS_275",
4912	"SYS_276",
4913	"SYS_277",
4914	"SYS_278",
4915	"SYS_279",
4916	"SYS_280",
4917	"SYS_getresuid", //281
4918	"SYS_setresuid", //282
4919	"SYS_getresgid", //283
4920	"SYS_setresgid", //284
4921	"SYS_285",
4922	"SYS_mquery", //286
4923	"SYS_closefrom", //287
4924	"SYS_sigaltstack", //288
4925	"SYS_shmget", //289
4926	"SYS_semop", //290
4927	"SYS_stat", //291
4928	"SYS_fstat", //292
4929	"SYS_lstat", //293
4930	"SYS_fhstat", //294
4931	"SYS___semctl", //295
4932	"SYS_shmctl", //296
4933	"SYS_msgctl", //297
4934	"SYS_MAXSYSCALL", //298
4935	//299
4936	//300
4937	};
4938	uint32_t uEAX;
4939	#ifndef DEBUG_bird
4940	if (!LogIsEnabled())
4941	return;
4942	#endif
4943	uEAX = CPUMGetGuestEAX(pVM);
4944	switch (uEAX)
4945	{
4946	default:
4947	if (uEAX < ELEMENTS(apsz))
4948	{
4949	uint32_t au32Args[8] = {0};
4950	PGMPhysReadGCPtr(pVM, au32Args, CPUMGetGuestESP(pVM), sizeof(au32Args));
4951	RTLogPrintf("REM: OpenBSD syscall %3d: %s (eip=%08x %08x %08x %08x %08x %08x %08x %08x %08x)\n",
4952	uEAX, apsz[uEAX], CPUMGetGuestEIP(pVM), au32Args[0], au32Args[1], au32Args[2], au32Args[3],
4953	au32Args[4], au32Args[5], au32Args[6], au32Args[7]);
4954	}
4955	else
4956	RTLogPrintf("eip=%08x: OpenBSD syscall %d (#%x) unknown!!\n", CPUMGetGuestEIP(pVM), uEAX, uEAX);
4957	break;
4958	}
4959	}

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/recompiler/VBoxRecompiler.c@ 1057

Download in other formats: