VBoxRecompiler.c@ 2241

Last change on this file since 2241 was 2223, checked in by vboxsync, 18 years ago
Incorrect check for valid hidden selector registers.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 154.3 KB

Line
1	/** @file
2	*
3	* VBox Recompiler - QEMU.
4	*/
5
6	/*
7	* Copyright (C) 2006 InnoTek Systemberatung GmbH
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License as published by the Free Software Foundation,
13	* in version 2 as it comes in the "COPYING" file of the VirtualBox OSE
14	* distribution. VirtualBox OSE is distributed in the hope that it will
15	* be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* If you received this file as part of a commercial VirtualBox
18	* distribution, then only the terms of your commercial VirtualBox
19	* license agreement apply instead of the previous paragraph.
20	*/
21
22
23	/*******************************************************************************
24	* Header Files *
25	*******************************************************************************/
26	#include "vl.h"
27	#include "exec-all.h"
28
29	#include <VBox/rem.h>
30	#include <VBox/vmapi.h>
31	#include <VBox/tm.h>
32	#include <VBox/ssm.h>
33	#include <VBox/em.h>
34	#include <VBox/trpm.h>
35	#include <VBox/iom.h>
36	#include <VBox/mm.h>
37	#include <VBox/pgm.h>
38	#include <VBox/pdm.h>
39	#include <VBox/dbgf.h>
40	#include <VBox/dbg.h>
41	#include <VBox/hwaccm.h>
42	#include <VBox/patm.h>
43	#include <VBox/csam.h>
44	#include "REMInternal.h"
45	#include <VBox/vm.h>
46	#include <VBox/param.h>
47	#include <VBox/err.h>
48
49	#define LOG_GROUP LOG_GROUP_REM
50	#include <VBox/log.h>
51	#include <iprt/semaphore.h>
52	#include <iprt/asm.h>
53	#include <iprt/assert.h>
54	#include <iprt/thread.h>
55	#include <iprt/string.h>
56
57
58	/* Don't wanna include everything. */
59	extern void cpu_x86_update_cr3(CPUX86State *env, target_ulong new_cr3);
60	extern void cpu_x86_update_cr0(CPUX86State *env, uint32_t new_cr0);
61	extern void cpu_x86_update_cr4(CPUX86State *env, uint32_t new_cr4);
62	extern void tlb_flush_page(CPUX86State *env, uint32_t addr);
63	extern void tlb_flush(CPUState *env, int flush_global);
64	extern void sync_seg(CPUX86State *env1, int seg_reg, int selector);
65	extern void sync_ldtr(CPUX86State *env1, int selector);
66	extern int sync_tr(CPUX86State *env1, int selector);
67
68	#ifdef VBOX_STRICT
69	unsigned long get_phys_page_offset(target_ulong addr);
70	#endif
71
72
73	/*******************************************************************************
74	* Defined Constants And Macros *
75	*******************************************************************************/
76
77	/** Copy 80-bit fpu register at pSrc to pDst.
78	* This is probably faster than calling memcpy.
79	*/
80	#define REM_COPY_FPU_REG(pDst, pSrc) \
81	do { (PX86FPUMMX)(pDst) = (const X86FPUMMX *)(pSrc); } while (0)
82
83
84	/*******************************************************************************
85	* Internal Functions *
86	*******************************************************************************/
87	static DECLCALLBACK(int) remR3Save(PVM pVM, PSSMHANDLE pSSM);
88	static DECLCALLBACK(int) remR3Load(PVM pVM, PSSMHANDLE pSSM, uint32_t u32Version);
89	static void remR3StateUpdate(PVM pVM);
90	static uint32_t remR3MMIOReadU8(void *pvVM, target_phys_addr_t GCPhys);
91	static uint32_t remR3MMIOReadU16(void *pvVM, target_phys_addr_t GCPhys);
92	static uint32_t remR3MMIOReadU32(void *pvVM, target_phys_addr_t GCPhys);
93	static void remR3MMIOWriteU8(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32);
94	static void remR3MMIOWriteU16(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32);
95	static void remR3MMIOWriteU32(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32);
96
97	static uint32_t remR3HandlerReadU8(void *pvVM, target_phys_addr_t GCPhys);
98	static uint32_t remR3HandlerReadU16(void *pvVM, target_phys_addr_t GCPhys);
99	static uint32_t remR3HandlerReadU32(void *pvVM, target_phys_addr_t GCPhys);
100	static void remR3HandlerWriteU8(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32);
101	static void remR3HandlerWriteU16(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32);
102	static void remR3HandlerWriteU32(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32);
103
104
105	/*******************************************************************************
106	* Global Variables *
107	*******************************************************************************/
108
109	/** The log level of the recompiler. */
110	#if 1
111	extern int loglevel;
112	#else
113	int loglevel = ~0;
114	FILE *logfile = NULL;
115	#endif
116
117
118	/** @todo Move stats to REM::s some rainy day we have nothing do to. */
119	#ifdef VBOX_WITH_STATISTICS
120	static STAMPROFILEADV gStatExecuteSingleInstr;
121	static STAMPROFILEADV gStatCompilationQEmu;
122	static STAMPROFILEADV gStatRunCodeQEmu;
123	static STAMPROFILEADV gStatTotalTimeQEmu;
124	static STAMPROFILEADV gStatTimers;
125	static STAMPROFILEADV gStatTBLookup;
126	static STAMPROFILEADV gStatIRQ;
127	static STAMPROFILEADV gStatRawCheck;
128	static STAMPROFILEADV gStatMemRead;
129	static STAMPROFILEADV gStatMemWrite;
130	static STAMCOUNTER gStatRefuseTFInhibit;
131	static STAMCOUNTER gStatRefuseVM86;
132	static STAMCOUNTER gStatRefusePaging;
133	static STAMCOUNTER gStatRefusePAE;
134	static STAMCOUNTER gStatRefuseIOPLNot0;
135	static STAMCOUNTER gStatRefuseIF0;
136	static STAMCOUNTER gStatRefuseCode16;
137	static STAMCOUNTER gStatRefuseWP0;
138	static STAMCOUNTER gStatRefuseRing1or2;
139	static STAMCOUNTER gStatRefuseCanExecute;
140	static STAMCOUNTER gStatREMGDTChange;
141	static STAMCOUNTER gStatREMIDTChange;
142	static STAMCOUNTER gStatREMLDTRChange;
143	static STAMCOUNTER gStatREMTRChange;
144	static STAMCOUNTER gStatSelOutOfSync[6];
145	static STAMCOUNTER gStatSelOutOfSyncStateBack[6];
146	#endif
147
148	/*
149	* Global stuff.
150	*/
151
152	/** MMIO read callbacks. */
153	CPUReadMemoryFunc *g_apfnMMIORead[3] =
154	{
155	remR3MMIOReadU8,
156	remR3MMIOReadU16,
157	remR3MMIOReadU32
158	};
159
160	/** MMIO write callbacks. */
161	CPUWriteMemoryFunc *g_apfnMMIOWrite[3] =
162	{
163	remR3MMIOWriteU8,
164	remR3MMIOWriteU16,
165	remR3MMIOWriteU32
166	};
167
168	/** Handler read callbacks. */
169	CPUReadMemoryFunc *g_apfnHandlerRead[3] =
170	{
171	remR3HandlerReadU8,
172	remR3HandlerReadU16,
173	remR3HandlerReadU32
174	};
175
176	/** Handler write callbacks. */
177	CPUWriteMemoryFunc *g_apfnHandlerWrite[3] =
178	{
179	remR3HandlerWriteU8,
180	remR3HandlerWriteU16,
181	remR3HandlerWriteU32
182	};
183
184	#ifndef PGM_DYNAMIC_RAM_ALLOC
185	/* Guest physical RAM base. Not to be used in external code. */
186	static uint8_t *phys_ram_base;
187	#endif
188
189	/*
190	* Instance stuff.
191	*/
192	/** Pointer to the cpu state. */
193	CPUState *cpu_single_env;
194
195
196	#ifdef VBOX_WITH_DEBUGGER
197	/*
198	* Debugger commands.
199	*/
200	static DECLCALLBACK(int) remR3CmdDisasEnableStepping(PCDBGCCMD pCmd, PDBGCCMDHLP pCmdHlp, PVM pVM, PCDBGCVAR paArgs, unsigned cArgs, PDBGCVAR pResult);
201
202	/** '.remstep' arguments. */
203	static const DBGCVARDESC g_aArgRemStep[] =
204	{
205	/* cTimesMin, cTimesMax, enmCategory, fFlags, pszName, pszDescription */
206	{ 0, ~0, DBGCVAR_CAT_NUMBER, 0, "on/off", "Boolean value/mnemonic indicating the new state." },
207	};
208
209	/** Command descriptors. */
210	static const DBGCCMD g_aCmds[] =
211	{
212	{
213	.pszCmd ="remstep",
214	.cArgsMin = 0,
215	.cArgsMax = 1,
216	.paArgDescs = &g_aArgRemStep[0],
217	.cArgDescs = ELEMENTS(g_aArgRemStep),
218	.pResultDesc = NULL,
219	.fFlags = 0,
220	.pfnHandler = remR3CmdDisasEnableStepping,
221	.pszSyntax = "[on/off]",
222	.pszDescription = "Enable or disable the single stepping with logged disassembly. "
223	"If no arguments show the current state."
224	}
225	};
226	#endif
227
228
229	/*******************************************************************************
230	* Internal Functions *
231	*******************************************************************************/
232	static void remAbort(int rc, const char *pszTip);
233
234
235	/* Put them here to avoid unused variable warning. */
236	AssertCompile(RT_SIZEOFMEMB(VM, rem.padding) >= RT_SIZEOFMEMB(VM, rem.s));
237	//AssertCompileMemberSize(REM, Env, REM_ENV_SIZE);
238	//AssertCompile(RT_SIZEOFMEMB(REM, Env) <= REM_ENV_SIZE);
239
240	/**
241	* Initializes the REM.
242	*
243	* @returns VBox status code.
244	* @param pVM The VM to operate on.
245	*/
246	REMR3DECL(int) REMR3Init(PVM pVM)
247	{
248	uint32_t u32Dummy;
249	AssertReleaseMsg(sizeof(pVM->rem.padding) >= sizeof(pVM->rem.s), ("%#x >= %#x; sizeof(Env)=%#x\n", sizeof(pVM->rem.padding), sizeof(pVM->rem.s), sizeof(pVM->rem.s.Env)));
250	//AssertReleaseMsg(sizeof(pVM->rem.s.Env) <= REM_ENV_SIZE, ("%#x == %#x\n", sizeof(pVM->rem.s.Env), REM_ENV_SIZE));
251	AssertReleaseMsg(!(RT_OFFSETOF(VM, rem) & 31), ("off=%#x\n", RT_OFFSETOF(VM, rem)));
252	#if 0 /* not merged yet */
253	Assert(!testmath());
254	#endif
255
256	/*
257	* Init some internal data members.
258	*/
259	pVM->rem.s.offVM = RT_OFFSETOF(VM, rem.s);
260	pVM->rem.s.Env.pVM = pVM;
261	#ifdef CPU_RAW_MODE_INIT
262	pVM->rem.s.state \|= CPU_RAW_MODE_INIT;
263	#endif
264
265	/* ctx. */
266	int rc = CPUMQueryGuestCtxPtr(pVM, &pVM->rem.s.pCtx);
267	if (VBOX_FAILURE(rc))
268	{
269	AssertMsgFailed(("Failed to obtain guest ctx pointer. rc=%Vrc\n", rc));
270	return rc;
271	}
272	AssertMsg(MMR3PhysGetRamSize(pVM) == 0, ("Init order have changed! REM depends on notification about ALL physical memory registrations\n"));
273
274	/*
275	* Init the recompiler.
276	*/
277	if (!cpu_x86_init(&pVM->rem.s.Env))
278	{
279	AssertMsgFailed(("cpu_x86_init failed - impossible!\n"));
280	return VERR_GENERAL_FAILURE;
281	}
282	CPUMGetGuestCpuId(pVM, 1, &u32Dummy, &u32Dummy, &pVM->rem.s.Env.cpuid_ext_features, &pVM->rem.s.Env.cpuid_features);
283
284	/* allocate code buffer for single instruction emulation. */
285	pVM->rem.s.Env.cbCodeBuffer = 4096;
286	pVM->rem.s.Env.pvCodeBuffer = RTMemExecAlloc(pVM->rem.s.Env.cbCodeBuffer);
287	AssertMsgReturn(pVM->rem.s.Env.pvCodeBuffer, ("Failed to allocate code buffer!\n"), VERR_NO_MEMORY);
288
289	/* finally, set the cpu_single_env global. */
290	cpu_single_env = &pVM->rem.s.Env;
291
292	/* Nothing is pending by default */
293	pVM->rem.s.u32PendingInterrupt = REM_NO_PENDING_IRQ;
294
295	#ifdef DEBUG_bird
296	//cpu_breakpoint_insert(&pVM->rem.s.Env, some-address);
297	#endif
298
299	/*
300	* Register ram types.
301	*/
302	pVM->rem.s.iMMIOMemType = cpu_register_io_memory(0, g_apfnMMIORead, g_apfnMMIOWrite, pVM);
303	AssertReleaseMsg(pVM->rem.s.iMMIOMemType > 0, ("pVM->rem.s.iMMIOMemType=%d\n", pVM->rem.s.iMMIOMemType));
304	pVM->rem.s.iHandlerMemType = cpu_register_io_memory(0, g_apfnHandlerRead, g_apfnHandlerWrite, pVM);
305	AssertReleaseMsg(pVM->rem.s.iHandlerMemType > 0, ("pVM->rem.s.iHandlerMemType=%d\n", pVM->rem.s.iHandlerMemType));
306	Log2(("REM: iMMIOMemType=%d iHandlerMemType=%d\n", pVM->rem.s.iMMIOMemType, pVM->rem.s.iHandlerMemType));
307
308	/*
309	* Register the saved state data unit.
310	*/
311	rc = SSMR3RegisterInternal(pVM, "rem", 1, REM_SAVED_STATE_VERSION, sizeof(uint32_t) * 10,
312	NULL, remR3Save, NULL,
313	NULL, remR3Load, NULL);
314	if (VBOX_FAILURE(rc))
315	return rc;
316
317	#ifdef VBOX_WITH_DEBUGGER
318	/*
319	* Debugger commands.
320	*/
321	static bool fRegisteredCmds = false;
322	if (!fRegisteredCmds)
323	{
324	int rc = DBGCRegisterCommands(&g_aCmds[0], ELEMENTS(g_aCmds));
325	if (VBOX_SUCCESS(rc))
326	fRegisteredCmds = true;
327	}
328	#endif
329
330	#ifdef VBOX_WITH_STATISTICS
331	/*
332	* Statistics.
333	*/
334	STAM_REG(pVM, &gStatExecuteSingleInstr, STAMTYPE_PROFILE, "/PROF/REM/SingleInstr",STAMUNIT_TICKS_PER_CALL, "Profiling single instruction emulation.");
335	STAM_REG(pVM, &gStatCompilationQEmu, STAMTYPE_PROFILE, "/PROF/REM/Compile", STAMUNIT_TICKS_PER_CALL, "Profiling QEmu compilation.");
336	STAM_REG(pVM, &gStatRunCodeQEmu, STAMTYPE_PROFILE, "/PROF/REM/Runcode", STAMUNIT_TICKS_PER_CALL, "Profiling QEmu code execution.");
337	STAM_REG(pVM, &gStatTotalTimeQEmu, STAMTYPE_PROFILE, "/PROF/REM/Emulate", STAMUNIT_TICKS_PER_CALL, "Profiling code emulation.");
338	STAM_REG(pVM, &gStatTimers, STAMTYPE_PROFILE, "/PROF/REM/Timers", STAMUNIT_TICKS_PER_CALL, "Profiling timer scheduling.");
339	STAM_REG(pVM, &gStatTBLookup, STAMTYPE_PROFILE, "/PROF/REM/TBLookup", STAMUNIT_TICKS_PER_CALL, "Profiling timer scheduling.");
340	STAM_REG(pVM, &gStatIRQ, STAMTYPE_PROFILE, "/PROF/REM/IRQ", STAMUNIT_TICKS_PER_CALL, "Profiling timer scheduling.");
341	STAM_REG(pVM, &gStatRawCheck, STAMTYPE_PROFILE, "/PROF/REM/RawCheck", STAMUNIT_TICKS_PER_CALL, "Profiling timer scheduling.");
342	STAM_REG(pVM, &gStatMemRead, STAMTYPE_PROFILE, "/PROF/REM/MemRead", STAMUNIT_TICKS_PER_CALL, "Profiling memory access.");
343	STAM_REG(pVM, &gStatMemWrite, STAMTYPE_PROFILE, "/PROF/REM/MemWrite", STAMUNIT_TICKS_PER_CALL, "Profiling memory access.");
344
345	STAM_REG(pVM, &gStatRefuseTFInhibit, STAMTYPE_COUNTER, "/REM/Refuse/TFInibit", STAMUNIT_OCCURENCES, "Raw mode refused because of TF or irq inhibit");
346	STAM_REG(pVM, &gStatRefuseVM86, STAMTYPE_COUNTER, "/REM/Refuse/VM86", STAMUNIT_OCCURENCES, "Raw mode refused because of VM86");
347	STAM_REG(pVM, &gStatRefusePaging, STAMTYPE_COUNTER, "/REM/Refuse/Paging", STAMUNIT_OCCURENCES, "Raw mode refused because of disabled paging/pm");
348	STAM_REG(pVM, &gStatRefusePAE, STAMTYPE_COUNTER, "/REM/Refuse/PAE", STAMUNIT_OCCURENCES, "Raw mode refused because of PAE");
349	STAM_REG(pVM, &gStatRefuseIOPLNot0, STAMTYPE_COUNTER, "/REM/Refuse/IOPLNot0", STAMUNIT_OCCURENCES, "Raw mode refused because of IOPL != 0");
350	STAM_REG(pVM, &gStatRefuseIF0, STAMTYPE_COUNTER, "/REM/Refuse/IF0", STAMUNIT_OCCURENCES, "Raw mode refused because of IF=0");
351	STAM_REG(pVM, &gStatRefuseCode16, STAMTYPE_COUNTER, "/REM/Refuse/Code16", STAMUNIT_OCCURENCES, "Raw mode refused because of 16 bit code");
352	STAM_REG(pVM, &gStatRefuseWP0, STAMTYPE_COUNTER, "/REM/Refuse/WP0", STAMUNIT_OCCURENCES, "Raw mode refused because of WP=0");
353	STAM_REG(pVM, &gStatRefuseRing1or2, STAMTYPE_COUNTER, "/REM/Refuse/Ring1or2", STAMUNIT_OCCURENCES, "Raw mode refused because of ring 1/2 execution");
354	STAM_REG(pVM, &gStatRefuseCanExecute, STAMTYPE_COUNTER, "/REM/Refuse/CanExecuteRaw", STAMUNIT_OCCURENCES, "Raw mode refused because of cCanExecuteRaw");
355
356	STAM_REG(pVM, &gStatREMGDTChange, STAMTYPE_COUNTER, "/REM/Change/GDTBase", STAMUNIT_OCCURENCES, "GDT base changes");
357	STAM_REG(pVM, &gStatREMLDTRChange, STAMTYPE_COUNTER, "/REM/Change/LDTR", STAMUNIT_OCCURENCES, "LDTR changes");
358	STAM_REG(pVM, &gStatREMIDTChange, STAMTYPE_COUNTER, "/REM/Change/IDTBase", STAMUNIT_OCCURENCES, "IDT base changes");
359	STAM_REG(pVM, &gStatREMTRChange, STAMTYPE_COUNTER, "/REM/Change/TR", STAMUNIT_OCCURENCES, "TR selector changes");
360
361	STAM_REG(pVM, &gStatSelOutOfSync[0], STAMTYPE_COUNTER, "/REM/State/SelOutOfSync/ES", STAMUNIT_OCCURENCES, "ES out of sync");
362	STAM_REG(pVM, &gStatSelOutOfSync[1], STAMTYPE_COUNTER, "/REM/State/SelOutOfSync/CS", STAMUNIT_OCCURENCES, "CS out of sync");
363	STAM_REG(pVM, &gStatSelOutOfSync[2], STAMTYPE_COUNTER, "/REM/State/SelOutOfSync/SS", STAMUNIT_OCCURENCES, "SS out of sync");
364	STAM_REG(pVM, &gStatSelOutOfSync[3], STAMTYPE_COUNTER, "/REM/State/SelOutOfSync/DS", STAMUNIT_OCCURENCES, "DS out of sync");
365	STAM_REG(pVM, &gStatSelOutOfSync[4], STAMTYPE_COUNTER, "/REM/State/SelOutOfSync/FS", STAMUNIT_OCCURENCES, "FS out of sync");
366	STAM_REG(pVM, &gStatSelOutOfSync[5], STAMTYPE_COUNTER, "/REM/State/SelOutOfSync/GS", STAMUNIT_OCCURENCES, "GS out of sync");
367
368	STAM_REG(pVM, &gStatSelOutOfSyncStateBack[0], STAMTYPE_COUNTER, "/REM/StateBack/SelOutOfSync/ES", STAMUNIT_OCCURENCES, "ES out of sync");
369	STAM_REG(pVM, &gStatSelOutOfSyncStateBack[1], STAMTYPE_COUNTER, "/REM/StateBack/SelOutOfSync/CS", STAMUNIT_OCCURENCES, "CS out of sync");
370	STAM_REG(pVM, &gStatSelOutOfSyncStateBack[2], STAMTYPE_COUNTER, "/REM/StateBack/SelOutOfSync/SS", STAMUNIT_OCCURENCES, "SS out of sync");
371	STAM_REG(pVM, &gStatSelOutOfSyncStateBack[3], STAMTYPE_COUNTER, "/REM/StateBack/SelOutOfSync/DS", STAMUNIT_OCCURENCES, "DS out of sync");
372	STAM_REG(pVM, &gStatSelOutOfSyncStateBack[4], STAMTYPE_COUNTER, "/REM/StateBack/SelOutOfSync/FS", STAMUNIT_OCCURENCES, "FS out of sync");
373	STAM_REG(pVM, &gStatSelOutOfSyncStateBack[5], STAMTYPE_COUNTER, "/REM/StateBack/SelOutOfSync/GS", STAMUNIT_OCCURENCES, "GS out of sync");
374
375	#endif
376	return rc;
377	}
378
379
380	/**
381	* Terminates the REM.
382	*
383	* Termination means cleaning up and freeing all resources,
384	* the VM it self is at this point powered off or suspended.
385	*
386	* @returns VBox status code.
387	* @param pVM The VM to operate on.
388	*/
389	REMR3DECL(int) REMR3Term(PVM pVM)
390	{
391	return VINF_SUCCESS;
392	}
393
394
395	/**
396	* The VM is being reset.
397	*
398	* For the REM component this means to call the cpu_reset() and
399	* reinitialize some state variables.
400	*
401	* @param pVM VM handle.
402	*/
403	REMR3DECL(void) REMR3Reset(PVM pVM)
404	{
405	pVM->rem.s.fIgnoreCR3Load = true;
406	pVM->rem.s.fIgnoreInvlPg = true;
407	pVM->rem.s.fIgnoreCpuMode = true;
408
409	/*
410	* Reset the REM cpu.
411	*/
412	cpu_reset(&pVM->rem.s.Env);
413	pVM->rem.s.cInvalidatedPages = 0;
414
415	pVM->rem.s.fIgnoreCR3Load = false;
416	pVM->rem.s.fIgnoreInvlPg = false;
417	pVM->rem.s.fIgnoreCpuMode = false;
418	}
419
420
421	/**
422	* Execute state save operation.
423	*
424	* @returns VBox status code.
425	* @param pVM VM Handle.
426	* @param pSSM SSM operation handle.
427	*/
428	static DECLCALLBACK(int) remR3Save(PVM pVM, PSSMHANDLE pSSM)
429	{
430	LogFlow(("remR3Save:\n"));
431
432	/*
433	* Save the required CPU Env bits.
434	* (Not much because we're never in REM when doing the save.)
435	*/
436	PREM pRem = &pVM->rem.s;
437	Assert(!pRem->fInREM);
438	SSMR3PutU32(pSSM, pRem->Env.hflags);
439	SSMR3PutMem(pSSM, &pRem->Env, RT_OFFSETOF(CPUState, jmp_env));
440	SSMR3PutU32(pSSM, ~0); /* separator */
441
442	/* Remember if we've entered raw mode (vital for ring 1 checks in e.g. iret emulation). */
443	SSMR3PutUInt(pSSM, !!(pRem->Env.state & CPU_RAW_RING0));
444
445	/*
446	* Save the REM stuff.
447	*/
448	SSMR3PutUInt(pSSM, pRem->cInvalidatedPages);
449	unsigned i;
450	for (i = 0; i < pRem->cInvalidatedPages; i++)
451	SSMR3PutGCPtr(pSSM, pRem->aGCPtrInvalidatedPages[i]);
452
453	SSMR3PutUInt(pSSM, pVM->rem.s.u32PendingInterrupt);
454
455	return SSMR3PutU32(pSSM, ~0); /* terminator */
456	}
457
458
459	/**
460	* Execute state load operation.
461	*
462	* @returns VBox status code.
463	* @param pVM VM Handle.
464	* @param pSSM SSM operation handle.
465	* @param u32Version Data layout version.
466	*/
467	static DECLCALLBACK(int) remR3Load(PVM pVM, PSSMHANDLE pSSM, uint32_t u32Version)
468	{
469	uint32_t u32Dummy;
470	uint32_t fRawRing0 = false;
471
472	LogFlow(("remR3Load:\n"));
473
474	/*
475	* Validate version.
476	*/
477	if (u32Version != REM_SAVED_STATE_VERSION)
478	{
479	Log(("remR3Load: Invalid version u32Version=%d!\n", u32Version));
480	return VERR_SSM_UNSUPPORTED_DATA_UNIT_VERSION;
481	}
482
483	/*
484	* Do a reset to be on the safe side...
485	*/
486	REMR3Reset(pVM);
487
488	/*
489	* Ignore all ignorable notifications.
490	* Not doing this will cause big trouble.
491	*/
492	pVM->rem.s.fIgnoreCR3Load = true;
493	pVM->rem.s.fIgnoreInvlPg = true;
494	pVM->rem.s.fIgnoreCpuMode = true;
495
496	/*
497	* Load the required CPU Env bits.
498	* (Not much because we're never in REM when doing the save.)
499	*/
500	PREM pRem = &pVM->rem.s;
501	Assert(!pRem->fInREM);
502	SSMR3GetU32(pSSM, &pRem->Env.hflags);
503	SSMR3GetMem(pSSM, &pRem->Env, RT_OFFSETOF(CPUState, jmp_env));
504	uint32_t u32Sep;
505	int rc = SSMR3GetU32(pSSM, &u32Sep); /* separator */
506	if (VBOX_FAILURE(rc))
507	return rc;
508	if (u32Sep != ~0)
509	{
510	AssertMsgFailed(("u32Sep=%#x\n", u32Sep));
511	return VERR_SSM_DATA_UNIT_FORMAT_CHANGED;
512	}
513
514	/* Remember if we've entered raw mode (vital for ring 1 checks in e.g. iret emulation). */
515	SSMR3GetUInt(pSSM, &fRawRing0);
516	if (fRawRing0)
517	pRem->Env.state \|= CPU_RAW_RING0;
518
519	/*
520	* Load the REM stuff.
521	*/
522	rc = SSMR3GetUInt(pSSM, &pRem->cInvalidatedPages);
523	if (VBOX_FAILURE(rc))
524	return rc;
525	if (pRem->cInvalidatedPages > ELEMENTS(pRem->aGCPtrInvalidatedPages))
526	{
527	AssertMsgFailed(("cInvalidatedPages=%#x\n", pRem->cInvalidatedPages));
528	return VERR_SSM_DATA_UNIT_FORMAT_CHANGED;
529	}
530	unsigned i;
531	for (i = 0; i < pRem->cInvalidatedPages; i++)
532	SSMR3GetGCPtr(pSSM, &pRem->aGCPtrInvalidatedPages[i]);
533
534	rc = SSMR3GetUInt(pSSM, &pVM->rem.s.u32PendingInterrupt);
535	if (VBOX_FAILURE(rc))
536	return rc;
537
538	/* check the terminator. */
539	rc = SSMR3GetU32(pSSM, &u32Sep);
540	if (VBOX_FAILURE(rc))
541	return rc;
542	if (u32Sep != ~0)
543	{
544	AssertMsgFailed(("u32Sep=%#x (term)\n", u32Sep));
545	return VERR_SSM_DATA_UNIT_FORMAT_CHANGED;
546	}
547
548	/*
549	* Get the CPUID features.
550	*/
551	CPUMGetGuestCpuId(pVM, 1, &u32Dummy, &u32Dummy, &pVM->rem.s.Env.cpuid_ext_features, &pVM->rem.s.Env.cpuid_features);
552
553	/*
554	* Sync the Load Flush the TLB
555	*/
556	tlb_flush(&pRem->Env, 1);
557
558	#if 0 /** @todo r=bird: this doesn't make sense. WHY? */
559	/*
560	* Clear all lazy flags (only FPU sync for now).
561	*/
562	CPUMGetAndClearFPUUsedREM(pVM);
563	#endif
564
565	/*
566	* Stop ignoring ignornable notifications.
567	*/
568	pVM->rem.s.fIgnoreCpuMode = false;
569	pVM->rem.s.fIgnoreInvlPg = false;
570	pVM->rem.s.fIgnoreCR3Load = false;
571
572	return VINF_SUCCESS;
573	}
574
575
576
577	#undef LOG_GROUP
578	#define LOG_GROUP LOG_GROUP_REM_RUN
579
580	/**
581	* Single steps an instruction in recompiled mode.
582	*
583	* Before calling this function the REM state needs to be in sync with
584	* the VM. Call REMR3State() to perform the sync. It's only necessary
585	* (and permitted) to sync at the first call to REMR3Step()/REMR3Run()
586	* and after calling REMR3StateBack().
587	*
588	* @returns VBox status code.
589	*
590	* @param pVM VM Handle.
591	*/
592	REMR3DECL(int) REMR3Step(PVM pVM)
593	{
594	/*
595	* Lock the REM - we don't wanna have anyone interrupting us
596	* while stepping - and enabled single stepping. We also ignore
597	* pending interrupts and suchlike.
598	*/
599	int interrupt_request = pVM->rem.s.Env.interrupt_request;
600	Assert(!(interrupt_request & ~(CPU_INTERRUPT_HARD \| CPU_INTERRUPT_EXIT \| CPU_INTERRUPT_EXITTB \| CPU_INTERRUPT_TIMER \| CPU_INTERRUPT_EXTERNAL_HARD \| CPU_INTERRUPT_EXTERNAL_EXIT \| CPU_INTERRUPT_EXTERNAL_TIMER)));
601	pVM->rem.s.Env.interrupt_request = 0;
602	cpu_single_step(&pVM->rem.s.Env, 1);
603
604	/*
605	* If we're standing at a breakpoint, that have to be disabled before we start stepping.
606	*/
607	RTGCPTR GCPtrPC = pVM->rem.s.Env.eip + pVM->rem.s.Env.segs[R_CS].base;
608	bool fBp = !cpu_breakpoint_remove(&pVM->rem.s.Env, GCPtrPC);
609
610	/*
611	* Execute and handle the return code.
612	* We execute without enabling the cpu tick, so on success we'll
613	* just flip it on and off to make sure it moves
614	*/
615	int rc = cpu_exec(&pVM->rem.s.Env);
616	if (rc == EXCP_DEBUG)
617	{
618	TMCpuTickResume(pVM);
619	TMCpuTickPause(pVM);
620	TMVirtualResume(pVM);
621	TMVirtualPause(pVM);
622	rc = VINF_EM_DBG_STEPPED;
623	}
624	else
625	{
626	AssertMsgFailed(("Damn, this shouldn't happen! cpu_exec returned %d while singlestepping\n", rc));
627	switch (rc)
628	{
629	case EXCP_INTERRUPT: rc = VINF_SUCCESS; break;
630	case EXCP_HLT: rc = VINF_EM_HALT; break;
631	case EXCP_RC:
632	rc = pVM->rem.s.rc;
633	pVM->rem.s.rc = VERR_INTERNAL_ERROR;
634	break;
635	default:
636	AssertReleaseMsgFailed(("This really shouldn't happen, rc=%d!\n", rc));
637	rc = VERR_INTERNAL_ERROR;
638	break;
639	}
640	}
641
642	/*
643	* Restore the stuff we changed to prevent interruption.
644	* Unlock the REM.
645	*/
646	if (fBp)
647	{
648	int rc2 = cpu_breakpoint_insert(&pVM->rem.s.Env, GCPtrPC);
649	Assert(rc2 == 0); NOREF(rc2);
650	}
651	cpu_single_step(&pVM->rem.s.Env, 0);
652	pVM->rem.s.Env.interrupt_request = interrupt_request;
653
654	return rc;
655	}
656
657
658	/**
659	* Set a breakpoint using the REM facilities.
660	*
661	* @returns VBox status code.
662	* @param pVM The VM handle.
663	* @param Address The breakpoint address.
664	* @thread The emulation thread.
665	*/
666	REMR3DECL(int) REMR3BreakpointSet(PVM pVM, RTGCUINTPTR Address)
667	{
668	VM_ASSERT_EMT(pVM);
669	if (!cpu_breakpoint_insert(&pVM->rem.s.Env, Address))
670	{
671	LogFlow(("REMR3BreakpointSet: Address=%VGv\n", Address));
672	return VINF_SUCCESS;
673	}
674	LogFlow(("REMR3BreakpointSet: Address=%VGv - failed!\n", Address));
675	return VERR_REM_NO_MORE_BP_SLOTS;
676	}
677
678
679	/**
680	* Clears a breakpoint set by REMR3BreakpointSet().
681	*
682	* @returns VBox status code.
683	* @param pVM The VM handle.
684	* @param Address The breakpoint address.
685	* @thread The emulation thread.
686	*/
687	REMR3DECL(int) REMR3BreakpointClear(PVM pVM, RTGCUINTPTR Address)
688	{
689	VM_ASSERT_EMT(pVM);
690	if (!cpu_breakpoint_remove(&pVM->rem.s.Env, Address))
691	{
692	LogFlow(("REMR3BreakpointClear: Address=%VGv\n", Address));
693	return VINF_SUCCESS;
694	}
695	LogFlow(("REMR3BreakpointClear: Address=%VGv - not found!\n", Address));
696	return VERR_REM_BP_NOT_FOUND;
697	}
698
699
700	/**
701	* Emulate an instruction.
702	*
703	* This function executes one instruction without letting anyone
704	* interrupt it. This is intended for being called while being in
705	* raw mode and thus will take care of all the state syncing between
706	* REM and the rest.
707	*
708	* @returns VBox status code.
709	* @param pVM VM handle.
710	*/
711	REMR3DECL(int) REMR3EmulateInstruction(PVM pVM)
712	{
713	Log2(("REMR3EmulateInstruction: (cs:eip=%04x:%08x)\n", pVM->rem.s.Env.segs[R_CS].selector, pVM->rem.s.Env.eip));
714
715	/*
716	* Sync the state and enable single instruction / single stepping.
717	*/
718	int rc = REMR3State(pVM);
719	if (VBOX_SUCCESS(rc))
720	{
721	int interrupt_request = pVM->rem.s.Env.interrupt_request;
722	Assert(!(interrupt_request & ~(CPU_INTERRUPT_HARD \| CPU_INTERRUPT_EXIT \| CPU_INTERRUPT_EXITTB \| CPU_INTERRUPT_TIMER \| CPU_INTERRUPT_EXTERNAL_HARD \| CPU_INTERRUPT_EXTERNAL_EXIT \| CPU_INTERRUPT_EXTERNAL_TIMER)));
723	Assert(!pVM->rem.s.Env.singlestep_enabled);
724	#if 1
725
726	/*
727	* Now we set the execute single instruction flag and enter the cpu_exec loop.
728	*/
729	pVM->rem.s.Env.interrupt_request = CPU_INTERRUPT_SINGLE_INSTR;
730	rc = cpu_exec(&pVM->rem.s.Env);
731	switch (rc)
732	{
733	/*
734	* Executed without anything out of the way happening.
735	*/
736	case EXCP_SINGLE_INSTR:
737	rc = VINF_EM_RESCHEDULE;
738	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_SINGLE_INSTR\n"));
739	break;
740
741	/*
742	* If we take a trap or start servicing a pending interrupt, we might end up here.
743	* (Timer thread or some other thread wishing EMT's attention.)
744	*/
745	case EXCP_INTERRUPT:
746	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_INTERRUPT\n"));
747	rc = VINF_EM_RESCHEDULE;
748	break;
749
750	/*
751	* Single step, we assume!
752	* If there was a breakpoint there we're fucked now.
753	*/
754	case EXCP_DEBUG:
755	{
756	/* breakpoint or single step? */
757	RTGCPTR GCPtrPC = pVM->rem.s.Env.eip + pVM->rem.s.Env.segs[R_CS].base;
758	int iBP;
759	rc = VINF_EM_DBG_STEPPED;
760	for (iBP = 0; iBP < pVM->rem.s.Env.nb_breakpoints; iBP++)
761	if (pVM->rem.s.Env.breakpoints[iBP] == GCPtrPC)
762	{
763	rc = VINF_EM_DBG_BREAKPOINT;
764	break;
765	}
766	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_DEBUG rc=%Vrc iBP=%d GCPtrPC=%VGv\n", rc, iBP, GCPtrPC));
767	break;
768	}
769
770	/*
771	* hlt instruction.
772	*/
773	case EXCP_HLT:
774	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_HLT\n"));
775	rc = VINF_EM_HALT;
776	break;
777
778	/*
779	* Switch to RAW-mode.
780	*/
781	case EXCP_EXECUTE_RAW:
782	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_EXECUTE_RAW\n"));
783	rc = VINF_EM_RESCHEDULE_RAW;
784	break;
785
786	/*
787	* Switch to hardware accelerated RAW-mode.
788	*/
789	case EXCP_EXECUTE_HWACC:
790	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_EXECUTE_HWACC\n"));
791	rc = VINF_EM_RESCHEDULE_HWACC;
792	break;
793
794	/*
795	* An EM RC was raised (VMR3Reset/Suspend/PowerOff).
796	*/
797	case EXCP_RC:
798	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_RC\n"));
799	rc = pVM->rem.s.rc;
800	pVM->rem.s.rc = VERR_INTERNAL_ERROR;
801	break;
802
803	/*
804	* Figure out the rest when they arrive....
805	*/
806	default:
807	AssertMsgFailed(("rc=%d\n", rc));
808	Log2(("REMR3EmulateInstruction: cpu_exec -> %d\n", rc));
809	rc = VINF_EM_RESCHEDULE;
810	break;
811	}
812
813	/*
814	* Switch back the state.
815	*/
816	#else
817	pVM->rem.s.Env.interrupt_request = 0;
818	cpu_single_step(&pVM->rem.s.Env, 1);
819
820	/*
821	* Execute and handle the return code.
822	* We execute without enabling the cpu tick, so on success we'll
823	* just flip it on and off to make sure it moves.
824	*
825	* (We do not use emulate_single_instr() because that doesn't enter the
826	* right way in will cause serious trouble if a longjmp was attempted.)
827	*/
828	#ifdef DEBUG_bird
829	remR3DisasInstr(&pVM->rem.s.Env, 1, "REMR3EmulateInstruction");
830	#endif
831	int cTimesMax = 16384;
832	uint32_t eip = pVM->rem.s.Env.eip;
833	do
834	{
835	rc = cpu_exec(&pVM->rem.s.Env);
836	} while ( eip == pVM->rem.s.Env.eip
837	&& (rc == EXCP_DEBUG \|\| rc == EXCP_EXECUTE_RAW)
838	&& --cTimesMax > 0);
839	switch (rc)
840	{
841	/*
842	* Single step, we assume!
843	* If there was a breakpoint there we're fucked now.
844	*/
845	case EXCP_DEBUG:
846	{
847	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_DEBUG\n"));
848	rc = VINF_EM_RESCHEDULE;
849	break;
850	}
851
852	/*
853	* We cannot be interrupted!
854	*/
855	case EXCP_INTERRUPT:
856	AssertMsgFailed(("Shouldn't happen! Everything was locked!\n"));
857	rc = VERR_INTERNAL_ERROR;
858	break;
859
860	/*
861	* hlt instruction.
862	*/
863	case EXCP_HLT:
864	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_HLT\n"));
865	rc = VINF_EM_HALT;
866	break;
867
868	/*
869	* Switch to RAW-mode.
870	*/
871	case EXCP_EXECUTE_RAW:
872	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_EXECUTE_RAW\n"));
873	rc = VINF_EM_RESCHEDULE_RAW;
874	break;
875
876	/*
877	* Switch to hardware accelerated RAW-mode.
878	*/
879	case EXCP_EXECUTE_HWACC:
880	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_EXECUTE_HWACC\n"));
881	rc = VINF_EM_RESCHEDULE_HWACC;
882	break;
883
884	/*
885	* An EM RC was raised (VMR3Reset/Suspend/PowerOff).
886	*/
887	case EXCP_RC:
888	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_RC rc=%Vrc\n", pVM->rem.s.rc));
889	rc = pVM->rem.s.rc;
890	pVM->rem.s.rc = VERR_INTERNAL_ERROR;
891	break;
892
893	/*
894	* Figure out the rest when they arrive....
895	*/
896	default:
897	AssertMsgFailed(("rc=%d\n", rc));
898	Log2(("REMR3EmulateInstruction: cpu_exec -> %d\n", rc));
899	rc = VINF_SUCCESS;
900	break;
901	}
902
903	/*
904	* Switch back the state.
905	*/
906	cpu_single_step(&pVM->rem.s.Env, 0);
907	#endif
908	pVM->rem.s.Env.interrupt_request = interrupt_request;
909	int rc2 = REMR3StateBack(pVM);
910	AssertRC(rc2);
911	}
912
913	Log2(("REMR3EmulateInstruction: returns %Vrc (cs:eip=%04x:%08x)\n",
914	rc, pVM->rem.s.Env.segs[R_CS].selector, pVM->rem.s.Env.eip));
915	return rc;
916	}
917
918
919	/**
920	* Runs code in recompiled mode.
921	*
922	* Before calling this function the REM state needs to be in sync with
923	* the VM. Call REMR3State() to perform the sync. It's only necessary
924	* (and permitted) to sync at the first call to REMR3Step()/REMR3Run()
925	* and after calling REMR3StateBack().
926	*
927	* @returns VBox status code.
928	*
929	* @param pVM VM Handle.
930	*/
931	REMR3DECL(int) REMR3Run(PVM pVM)
932	{
933	Log2(("REMR3Run: (cs:eip=%04x:%08x)\n", pVM->rem.s.Env.segs[R_CS].selector, pVM->rem.s.Env.eip));
934	Assert(pVM->rem.s.fInREM);
935	////Keyboard / tb stuff:
936	//if ( pVM->rem.s.Env.segs[R_CS].selector == 0xf000
937	// && pVM->rem.s.Env.eip >= 0xe860
938	// && pVM->rem.s.Env.eip <= 0xe880)
939	// pVM->rem.s.Env.state \|= CPU_EMULATE_SINGLE_STEP;
940	////A20:
941	//if ( pVM->rem.s.Env.segs[R_CS].selector == 0x9020
942	// && pVM->rem.s.Env.eip >= 0x970
943	// && pVM->rem.s.Env.eip <= 0x9a0)
944	// pVM->rem.s.Env.state \|= CPU_EMULATE_SINGLE_STEP;
945	////Speaker (port 61h)
946	//if ( pVM->rem.s.Env.segs[R_CS].selector == 0x0010
947	// && ( (pVM->rem.s.Env.eip >= 0x90278c10 && pVM->rem.s.Env.eip <= 0x90278c30)
948	// \|\| (pVM->rem.s.Env.eip >= 0x9010e250 && pVM->rem.s.Env.eip <= 0x9010e260)
949	// )
950	// )
951	// pVM->rem.s.Env.state \|= CPU_EMULATE_SINGLE_STEP;
952	//DBGFR3InfoLog(pVM, "timers", NULL);
953
954
955	int rc = cpu_exec(&pVM->rem.s.Env);
956	switch (rc)
957	{
958	/*
959	* This happens when the execution was interrupted
960	* by an external event, like pending timers.
961	*/
962	case EXCP_INTERRUPT:
963	Log2(("REMR3Run: cpu_exec -> EXCP_INTERRUPT\n"));
964	rc = VINF_SUCCESS;
965	break;
966
967	/*
968	* hlt instruction.
969	*/
970	case EXCP_HLT:
971	Log2(("REMR3Run: cpu_exec -> EXCP_HLT\n"));
972	rc = VINF_EM_HALT;
973	break;
974
975	/*
976	* Breakpoint/single step.
977	*/
978	case EXCP_DEBUG:
979	{
980	#if 0//def DEBUG_bird
981	static int iBP = 0;
982	printf("howdy, breakpoint! iBP=%d\n", iBP);
983	switch (iBP)
984	{
985	case 0:
986	cpu_breakpoint_remove(&pVM->rem.s.Env, pVM->rem.s.Env.eip + pVM->rem.s.Env.segs[R_CS].base);
987	pVM->rem.s.Env.state \|= CPU_EMULATE_SINGLE_STEP;
988	//pVM->rem.s.Env.interrupt_request = 0;
989	//pVM->rem.s.Env.exception_index = -1;
990	//g_fInterruptDisabled = 1;
991	rc = VINF_SUCCESS;
992	asm("int3");
993	break;
994	default:
995	asm("int3");
996	break;
997	}
998	iBP++;
999	#else
1000	/* breakpoint or single step? */
1001	RTGCPTR GCPtrPC = pVM->rem.s.Env.eip + pVM->rem.s.Env.segs[R_CS].base;
1002	int iBP;
1003	rc = VINF_EM_DBG_STEPPED;
1004	for (iBP = 0; iBP < pVM->rem.s.Env.nb_breakpoints; iBP++)
1005	if (pVM->rem.s.Env.breakpoints[iBP] == GCPtrPC)
1006	{
1007	rc = VINF_EM_DBG_BREAKPOINT;
1008	break;
1009	}
1010	Log2(("REMR3Run: cpu_exec -> EXCP_DEBUG rc=%Vrc iBP=%d GCPtrPC=%VGv\n", rc, iBP, GCPtrPC));
1011	#endif
1012	break;
1013	}
1014
1015	/*
1016	* Switch to RAW-mode.
1017	*/
1018	case EXCP_EXECUTE_RAW:
1019	Log2(("REMR3Run: cpu_exec -> EXCP_EXECUTE_RAW\n"));
1020	rc = VINF_EM_RESCHEDULE_RAW;
1021	break;
1022
1023	/*
1024	* Switch to hardware accelerated RAW-mode.
1025	*/
1026	case EXCP_EXECUTE_HWACC:
1027	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_EXECUTE_HWACC\n"));
1028	rc = VINF_EM_RESCHEDULE_HWACC;
1029	break;
1030
1031	/*
1032	* An EM RC was raised (VMR3Reset/Suspend/PowerOff).
1033	*/
1034	case EXCP_RC:
1035	Log2(("REMR3Run: cpu_exec -> EXCP_RC rc=%Vrc\n", pVM->rem.s.rc));
1036	rc = pVM->rem.s.rc;
1037	pVM->rem.s.rc = VERR_INTERNAL_ERROR;
1038	break;
1039
1040	/*
1041	* Figure out the rest when they arrive....
1042	*/
1043	default:
1044	AssertMsgFailed(("rc=%d\n", rc));
1045	Log2(("REMR3Run: cpu_exec -> %d\n", rc));
1046	rc = VINF_SUCCESS;
1047	break;
1048	}
1049
1050	Log2(("REMR3Run: returns %Vrc (cs:eip=%04x:%08x)\n", rc, pVM->rem.s.Env.segs[R_CS].selector, pVM->rem.s.Env.eip));
1051	return rc;
1052	}
1053
1054
1055	/**
1056	* Check if the cpu state is suitable for Raw execution.
1057	*
1058	* @returns boolean
1059	* @param env The CPU env struct.
1060	* @param eip The EIP to check this for (might differ from env->eip).
1061	* @param fFlags hflags OR'ed with IOPL, TF and VM from eflags.
1062	* @param pExceptionIndex Stores EXCP_EXECUTE_RAW/HWACC in case raw mode is supported in this context
1063	*
1064	* @remark This function must be kept in perfect sync with the scheduler in EM.cpp!
1065	*/
1066	bool remR3CanExecuteRaw(CPUState env, RTGCPTR eip, unsigned fFlags, uint32_t pExceptionIndex)
1067	{
1068	/* !!! THIS MUST BE IN SYNC WITH emR3Reschedule !!! */
1069	/* !!! THIS MUST BE IN SYNC WITH emR3Reschedule !!! */
1070	/* !!! THIS MUST BE IN SYNC WITH emR3Reschedule !!! */
1071
1072	/* Update counter. */
1073	env->pVM->rem.s.cCanExecuteRaw++;
1074
1075	if (HWACCMIsEnabled(env->pVM))
1076	{
1077	env->state \|= CPU_RAW_HWACC;
1078
1079	/*
1080	* Create partial context for HWACCMR3CanExecuteGuest
1081	*/
1082	CPUMCTX Ctx;
1083	Ctx.cr0 = env->cr[0];
1084	Ctx.cr3 = env->cr[3];
1085	Ctx.cr4 = env->cr[4];
1086
1087	Ctx.tr = env->tr.selector;
1088	Ctx.trHid.u32Base = (uint32_t)env->tr.base;
1089	Ctx.trHid.u32Limit = env->tr.limit;
1090	Ctx.trHid.Attr.u = (env->tr.flags >> 8) & 0xF0FF;
1091
1092	Ctx.idtr.cbIdt = env->idt.limit;
1093	Ctx.idtr.pIdt = (uint32_t)env->idt.base;
1094
1095	Ctx.eflags.u32 = env->eflags;
1096
1097	Ctx.cs = env->segs[R_CS].selector;
1098	Ctx.csHid.u32Base = (uint32_t)env->segs[R_CS].base;
1099	Ctx.csHid.u32Limit = env->segs[R_CS].limit;
1100	Ctx.csHid.Attr.u = (env->segs[R_CS].flags >> 8) & 0xF0FF;
1101
1102	Ctx.ss = env->segs[R_SS].selector;
1103	Ctx.ssHid.u32Base = (uint32_t)env->segs[R_SS].base;
1104	Ctx.ssHid.u32Limit = env->segs[R_SS].limit;
1105	Ctx.ssHid.Attr.u = (env->segs[R_SS].flags >> 8) & 0xF0FF;
1106
1107	/* Hardware accelerated raw-mode:
1108	*
1109	* Typically only 32-bits protected mode, with paging enabled, code is allowed here.
1110	*/
1111	if (HWACCMR3CanExecuteGuest(env->pVM, &Ctx) == true)
1112	{
1113	*pExceptionIndex = EXCP_EXECUTE_HWACC;
1114	return true;
1115	}
1116	return false;
1117	}
1118
1119	/*
1120	* Here we only support 16 & 32 bits protected mode ring 3 code that has no IO privileges
1121	* or 32 bits protected mode ring 0 code
1122	*
1123	* The tests are ordered by the likelyhood of being true during normal execution.
1124	*/
1125	if (fFlags & (HF_TF_MASK \| HF_INHIBIT_IRQ_MASK))
1126	{
1127	STAM_COUNTER_INC(&gStatRefuseTFInhibit);
1128	Log2(("raw mode refused: fFlags=%#x\n", fFlags));
1129	return false;
1130	}
1131
1132	#ifndef VBOX_RAW_V86
1133	if (fFlags & VM_MASK) {
1134	STAM_COUNTER_INC(&gStatRefuseVM86);
1135	Log2(("raw mode refused: VM_MASK\n"));
1136	return false;
1137	}
1138	#endif
1139
1140	if (env->state & CPU_EMULATE_SINGLE_INSTR)
1141	{
1142	#ifndef DEBUG_bird
1143	Log2(("raw mode refused: CPU_EMULATE_SINGLE_INSTR\n"));
1144	#endif
1145	return false;
1146	}
1147
1148	if (env->singlestep_enabled)
1149	{
1150	//Log2(("raw mode refused: Single step\n"));
1151	return false;
1152	}
1153
1154	if (env->nb_breakpoints > 0)
1155	{
1156	//Log2(("raw mode refused: Breakpoints\n"));
1157	return false;
1158	}
1159
1160	uint32_t u32CR0 = env->cr[0];
1161	if ((u32CR0 & (X86_CR0_PG \| X86_CR0_PE)) != (X86_CR0_PG \| X86_CR0_PE))
1162	{
1163	STAM_COUNTER_INC(&gStatRefusePaging);
1164	//Log2(("raw mode refused: %s%s%s\n", (u32CR0 & X86_CR0_PG) ? "" : " !PG", (u32CR0 & X86_CR0_PE) ? "" : " !PE", (u32CR0 & X86_CR0_AM) ? "" : " !AM"));
1165	return false;
1166	}
1167
1168	if (env->cr[4] & CR4_PAE_MASK)
1169	{
1170	STAM_COUNTER_INC(&gStatRefusePAE);
1171	//Log2(("raw mode refused: PAE\n"));
1172	return false;
1173	}
1174
1175	if (((fFlags >> HF_CPL_SHIFT) & 3) == 3)
1176	{
1177	if (!EMIsRawRing3Enabled(env->pVM))
1178	return false;
1179
1180	if (!(env->eflags & IF_MASK))
1181	{
1182	STAM_COUNTER_INC(&gStatRefuseIF0);
1183	Log2(("raw mode refused: IF (RawR3)\n"));
1184	return false;
1185	}
1186
1187	if (!(u32CR0 & CR0_WP_MASK) && EMIsRawRing0Enabled(env->pVM))
1188	{
1189	STAM_COUNTER_INC(&gStatRefuseWP0);
1190	Log2(("raw mode refused: CR0.WP + RawR0\n"));
1191	return false;
1192	}
1193	}
1194	else
1195	{
1196	if (!EMIsRawRing0Enabled(env->pVM))
1197	return false;
1198
1199	// Let's start with pure 32 bits ring 0 code first
1200	if ((fFlags & (HF_SS32_MASK \| HF_CS32_MASK)) != (HF_SS32_MASK \| HF_CS32_MASK))
1201	{
1202	STAM_COUNTER_INC(&gStatRefuseCode16);
1203	Log2(("raw r0 mode refused: HF_[S\|C]S32_MASK fFlags=%#x\n", fFlags));
1204	return false;
1205	}
1206
1207	// Only R0
1208	if (((fFlags >> HF_CPL_SHIFT) & 3) != 0)
1209	{
1210	STAM_COUNTER_INC(&gStatRefuseRing1or2);
1211	Log2(("raw r0 mode refused: CPL %d\n", ((fFlags >> HF_CPL_SHIFT) & 3) ));
1212	return false;
1213	}
1214
1215	if (!(u32CR0 & CR0_WP_MASK))
1216	{
1217	STAM_COUNTER_INC(&gStatRefuseWP0);
1218	Log2(("raw r0 mode refused: CR0.WP=0!\n"));
1219	return false;
1220	}
1221
1222	if (PATMIsPatchGCAddr(env->pVM, eip))
1223	{
1224	Log2(("raw r0 mode forced: patch code\n"));
1225	*pExceptionIndex = EXCP_EXECUTE_RAW;
1226	return true;
1227	}
1228
1229	#if !defined(VBOX_ALLOW_IF0) && !defined(VBOX_RUN_INTERRUPT_GATE_HANDLERS)
1230	if (!(env->eflags & IF_MASK))
1231	{
1232	STAM_COUNTER_INC(&gStatRefuseIF0);
1233	////Log2(("R0: IF=0 VIF=%d %08X\n", eip, *env->pVMeflags));
1234	//Log2(("RR0: Interrupts turned off; fall back to emulation\n"));
1235	return false;
1236	}
1237	#endif
1238
1239	env->state \|= CPU_RAW_RING0;
1240	}
1241
1242	/*
1243	* Don't reschedule the first time we're called, because there might be
1244	* special reasons why we're here that is not covered by the above checks.
1245	*/
1246	if (env->pVM->rem.s.cCanExecuteRaw == 1)
1247	{
1248	Log2(("raw mode refused: first scheduling\n"));
1249	STAM_COUNTER_INC(&gStatRefuseCanExecute);
1250	return false;
1251	}
1252
1253	Assert(PGMPhysIsA20Enabled(env->pVM));
1254	*pExceptionIndex = EXCP_EXECUTE_RAW;
1255	return true;
1256	}
1257
1258
1259	/**
1260	* Fetches a code byte.
1261	*
1262	* @returns Success indicator (bool) for ease of use.
1263	* @param env The CPU environment structure.
1264	* @param GCPtrInstr Where to fetch code.
1265	* @param pu8Byte Where to store the byte on success
1266	*/
1267	bool remR3GetOpcode(CPUState env, RTGCPTR GCPtrInstr, uint8_t pu8Byte)
1268	{
1269	int rc = PATMR3QueryOpcode(env->pVM, GCPtrInstr, pu8Byte);
1270	if (VBOX_SUCCESS(rc))
1271	return true;
1272	return false;
1273	}
1274
1275
1276	/**
1277	* Flush (or invalidate if you like) page table/dir entry.
1278	*
1279	* (invlpg instruction; tlb_flush_page)
1280	*
1281	* @param env Pointer to cpu environment.
1282	* @param GCPtr The virtual address which page table/dir entry should be invalidated.
1283	*/
1284	void remR3FlushPage(CPUState *env, RTGCPTR GCPtr)
1285	{
1286	PVM pVM = env->pVM;
1287
1288	/*
1289	* When we're replaying invlpg instructions or restoring a saved
1290	* state we disable this path.
1291	*/
1292	if (pVM->rem.s.fIgnoreInvlPg)
1293	return;
1294	Log(("remR3FlushPage: GCPtr=%VGv\n", GCPtr));
1295
1296	//RAWEx_ProfileStop(env, STATS_QEMU_TOTAL);
1297
1298	/*
1299	* Update the control registers before calling PGMFlushPage.
1300	*/
1301	PCPUMCTX pCtx = (PCPUMCTX)pVM->rem.s.pCtx;
1302	pCtx->cr0 = env->cr[0];
1303	pCtx->cr3 = env->cr[3];
1304	pCtx->cr4 = env->cr[4];
1305
1306	/*
1307	* Let PGM do the rest.
1308	*/
1309	int rc = PGMInvalidatePage(pVM, GCPtr);
1310	if (VBOX_FAILURE(rc))
1311	{
1312	AssertMsgFailed(("remR3FlushPage %x %x %x %d failed!!\n", GCPtr));
1313	VM_FF_SET(pVM, VM_FF_PGM_SYNC_CR3);
1314	}
1315	//RAWEx_ProfileStart(env, STATS_QEMU_TOTAL);
1316	}
1317
1318	/**
1319	* Set page table/dir entry. (called from tlb_set_page)
1320	*
1321	* @param env Pointer to cpu environment.
1322	*/
1323	void remR3SetPage(CPUState env, CPUTLBEntry pRead, CPUTLBEntry *pWrite, int prot, int is_user)
1324	{
1325	uint32_t virt_addr, addend;
1326
1327	Log2(("tlb_set_page_raw read (%x-%x) write (%x-%x) prot %x is_user %d\n", pRead->address, pRead->addend, pWrite->address, pWrite->addend, prot, is_user));
1328
1329	if (prot & PAGE_WRITE)
1330	{
1331	addend = pWrite->addend;
1332	virt_addr = pWrite->address;
1333	}
1334	else
1335	if (prot & PAGE_READ)
1336	{
1337	addend = pRead->addend;
1338	virt_addr = pRead->address;
1339	}
1340	else
1341	{
1342	// Should never happen!
1343	AssertMsgFailed(("tlb_set_page_raw unexpected protection flags %x\n", prot));
1344	return;
1345	}
1346
1347	// Clear IO_* flags (TODO: are they actually useful for us??)
1348	virt_addr &= ~0xFFF;
1349
1350	/*
1351	* Update the control registers before calling PGMFlushPage.
1352	*/
1353	PCPUMCTX pCtx = (PCPUMCTX)env->pVM->rem.s.pCtx;
1354	pCtx->cr0 = env->cr[0];
1355	pCtx->cr3 = env->cr[3];
1356	pCtx->cr4 = env->cr[4];
1357
1358	/*
1359	* Let PGM do the rest.
1360	*/
1361	int rc = PGMInvalidatePage(env->pVM, (RTGCPTR)virt_addr);
1362	if (VBOX_FAILURE(rc))
1363	{
1364	AssertMsgFailed(("RAWEx_SetPageEntry %x %x %d failed!!\n", virt_addr, prot, is_user));
1365	VM_FF_SET(env->pVM, VM_FF_PGM_SYNC_CR3);
1366	}
1367	}
1368
1369	/**
1370	* Called from tlb_protect_code in order to write monitor a code page.
1371	*
1372	* @param env Pointer to the CPU environment.
1373	* @param GCPtr Code page to monitor
1374	*/
1375	void remR3ProtectCode(CPUState *env, RTGCPTR GCPtr)
1376	{
1377	if ( (env->cr[0] & X86_CR0_PG) /* paging must be enabled */
1378	&& !(env->state & CPU_EMULATE_SINGLE_INSTR) /* ignore during single instruction execution */
1379	&& (((env->hflags >> HF_CPL_SHIFT) & 3) == 0) /* supervisor mode only */
1380	&& !(env->eflags & VM_MASK) /* no V86 mode */
1381	&& !HWACCMIsEnabled(env->pVM))
1382	CSAMR3MonitorPage(env->pVM, GCPtr, CSAM_TAG_REM);
1383	}
1384
1385	/**
1386	* Called when the CPU is initialized, any of the CRx registers are changed or
1387	* when the A20 line is modified.
1388	*
1389	* @param env Pointer to the CPU environment.
1390	* @param fGlobal Set if the flush is global.
1391	*/
1392	void remR3FlushTLB(CPUState *env, bool fGlobal)
1393	{
1394	PVM pVM = env->pVM;
1395
1396	/*
1397	* When we're replaying invlpg instructions or restoring a saved
1398	* state we disable this path.
1399	*/
1400	if (pVM->rem.s.fIgnoreCR3Load)
1401	return;
1402
1403	/*
1404	* The caller doesn't check cr4, so we have to do that for ourselves.
1405	*/
1406	if (!fGlobal && !(env->cr[4] & X86_CR4_PGE))
1407	fGlobal = true;
1408	Log(("remR3FlushTLB: CR0=%VGp CR3=%VGp CR4=%VGp %s\n", env->cr[0], env->cr[3], env->cr[4], fGlobal ? " global" : ""));
1409
1410	/*
1411	* Update the control registers before calling PGMR3FlushTLB.
1412	*/
1413	PCPUMCTX pCtx = (PCPUMCTX)pVM->rem.s.pCtx;
1414	pCtx->cr0 = env->cr[0];
1415	pCtx->cr3 = env->cr[3];
1416	pCtx->cr4 = env->cr[4];
1417
1418	/*
1419	* Let PGM do the rest.
1420	*/
1421	PGMFlushTLB(pVM, env->cr[3], fGlobal);
1422	}
1423
1424
1425	/**
1426	* Called when any of the cr0, cr4 or efer registers is updated.
1427	*
1428	* @param env Pointer to the CPU environment.
1429	*/
1430	void remR3ChangeCpuMode(CPUState *env)
1431	{
1432	int rc;
1433	PVM pVM = env->pVM;
1434
1435	/*
1436	* When we're replaying loads or restoring a saved
1437	* state this path is disabled.
1438	*/
1439	if (pVM->rem.s.fIgnoreCpuMode)
1440	return;
1441
1442	/*
1443	* Update the control registers before calling PGMR3ChangeMode()
1444	* as it may need to map whatever cr3 is pointing to.
1445	*/
1446	PCPUMCTX pCtx = (PCPUMCTX)pVM->rem.s.pCtx;
1447	pCtx->cr0 = env->cr[0];
1448	pCtx->cr3 = env->cr[3];
1449	pCtx->cr4 = env->cr[4];
1450
1451	#ifdef TARGET_X86_64
1452	rc = PGMChangeMode(pVM, env->cr[0], env->cr[4], env->efer);
1453	if (rc != VINF_SUCCESS)
1454	cpu_abort(env, "PGMChangeMode(, %08x, %08x, %016llx) -> %Vrc\n", env->cr[0], env->cr[4], env->efer, rc);
1455	#else
1456	rc = PGMChangeMode(pVM, env->cr[0], env->cr[4], 0);
1457	if (rc != VINF_SUCCESS)
1458	cpu_abort(env, "PGMChangeMode(, %08x, %08x, %016llx) -> %Vrc\n", env->cr[0], env->cr[4], 0LL, rc);
1459	#endif
1460	}
1461
1462
1463	/**
1464	* Called from compiled code to run dma.
1465	*
1466	* @param env Pointer to the CPU environment.
1467	*/
1468	void remR3DmaRun(CPUState *env)
1469	{
1470	remR3ProfileStop(STATS_QEMU_RUN_EMULATED_CODE);
1471	PDMR3DmaRun(env->pVM);
1472	remR3ProfileStart(STATS_QEMU_RUN_EMULATED_CODE);
1473	}
1474
1475	/**
1476	* Called from compiled code to schedule pending timers in VMM
1477	*
1478	* @param env Pointer to the CPU environment.
1479	*/
1480	void remR3TimersRun(CPUState *env)
1481	{
1482	remR3ProfileStop(STATS_QEMU_RUN_EMULATED_CODE);
1483	remR3ProfileStart(STATS_QEMU_RUN_TIMERS);
1484	TMR3TimerQueuesDo(env->pVM);
1485	remR3ProfileStop(STATS_QEMU_RUN_TIMERS);
1486	remR3ProfileStart(STATS_QEMU_RUN_EMULATED_CODE);
1487	}
1488
1489	/**
1490	* Record trap occurance
1491	*
1492	* @returns VBox status code
1493	* @param env Pointer to the CPU environment.
1494	* @param uTrap Trap nr
1495	* @param uErrorCode Error code
1496	* @param pvNextEIP Next EIP
1497	*/
1498	int remR3NotifyTrap(CPUState *env, uint32_t uTrap, uint32_t uErrorCode, uint32_t pvNextEIP)
1499	{
1500	PVM pVM = (PVM)env->pVM;
1501	#ifdef VBOX_WITH_STATISTICS
1502	static STAMCOUNTER aStatTrap[255];
1503	static bool aRegisters[ELEMENTS(aStatTrap)];
1504	#endif
1505
1506	#ifdef VBOX_WITH_STATISTICS
1507	if (uTrap < 255)
1508	{
1509	if (!aRegisters[uTrap])
1510	{
1511	aRegisters[uTrap] = true;
1512	char szStatName[64];
1513	RTStrPrintf(szStatName, sizeof(szStatName), "/REM/Trap/0x%02X", uTrap);
1514	STAM_REG(env->pVM, &aStatTrap[uTrap], STAMTYPE_COUNTER, szStatName, STAMUNIT_OCCURENCES, "Trap stats.");
1515	}
1516	STAM_COUNTER_INC(&aStatTrap[uTrap]);
1517	}
1518	#endif
1519	Log(("remR3NotifyTrap: uTrap=%x error=%x next_eip=%VGv eip=%VGv cr2=%08x\n", uTrap, uErrorCode, pvNextEIP, env->eip, env->cr[2]));
1520	if(uTrap < 0x20)
1521	{
1522	remR3DisasInstr(env, 1, "remR3NotifyTrap: ");
1523
1524	if(pVM->rem.s.uPendingException == uTrap && ++pVM->rem.s.cPendingExceptions > 128)
1525	{
1526	LogRel(("VERR_REM_TOO_MANY_TRAPS -> uTrap=%x error=%x next_eip=%VGv eip=%VGv cr2=%08x\n", uTrap, uErrorCode, pvNextEIP, env->eip, env->cr[2]));
1527	remR3RaiseRC(env->pVM, VERR_REM_TOO_MANY_TRAPS);
1528	return VERR_REM_TOO_MANY_TRAPS;
1529	}
1530	if(pVM->rem.s.uPendingException != uTrap \|\| pVM->rem.s.uPendingExcptEIP != env->eip \|\| pVM->rem.s.uPendingExcptCR2 != env->cr[2])
1531	pVM->rem.s.cPendingExceptions = 1;
1532	pVM->rem.s.uPendingException = uTrap;
1533	pVM->rem.s.uPendingExcptEIP = env->eip;
1534	pVM->rem.s.uPendingExcptCR2 = env->cr[2];
1535	}
1536	else
1537	{
1538	pVM->rem.s.cPendingExceptions = 0;
1539	pVM->rem.s.uPendingException = uTrap;
1540	pVM->rem.s.uPendingExcptEIP = env->eip;
1541	pVM->rem.s.uPendingExcptCR2 = env->cr[2];
1542	}
1543	return VINF_SUCCESS;
1544	}
1545
1546	/*
1547	* Clear current active trap
1548	*
1549	* @param pVM VM Handle.
1550	*/
1551	void remR3TrapClear(PVM pVM)
1552	{
1553	pVM->rem.s.cPendingExceptions = 0;
1554	pVM->rem.s.uPendingException = 0;
1555	pVM->rem.s.uPendingExcptEIP = 0;
1556	pVM->rem.s.uPendingExcptCR2 = 0;
1557	}
1558
1559
1560	/**
1561	* Syncs the internal REM state with the VM.
1562	*
1563	* This must be called before REMR3Run() is invoked whenever when the REM
1564	* state is not up to date. Calling it several times in a row is not
1565	* permitted.
1566	*
1567	* @returns VBox status code.
1568	*
1569	* @param pVM VM Handle.
1570	*
1571	* @remark The caller has to check for important FFs before calling REMR3Run. REMR3State will
1572	* no do this since the majority of the callers don't want any unnecessary of events
1573	* pending that would immediatly interrupt execution.
1574	*/
1575	REMR3DECL(int) REMR3State(PVM pVM)
1576	{
1577	Assert(!pVM->rem.s.fInREM);
1578	Log2(("REMR3State:\n"));
1579	STAM_PROFILE_START(&pVM->rem.s.StatsState, a);
1580	register const CPUMCTX *pCtx = pVM->rem.s.pCtx;
1581	register unsigned fFlags;
1582	bool fHiddenSelRegsValid = CPUMAreHiddenSelRegsValid(pVM);
1583
1584	/*
1585	* Copy the registers which requires no special handling.
1586	*/
1587	Assert(R_EAX == 0);
1588	pVM->rem.s.Env.regs[R_EAX] = pCtx->eax;
1589	Assert(R_ECX == 1);
1590	pVM->rem.s.Env.regs[R_ECX] = pCtx->ecx;
1591	Assert(R_EDX == 2);
1592	pVM->rem.s.Env.regs[R_EDX] = pCtx->edx;
1593	Assert(R_EBX == 3);
1594	pVM->rem.s.Env.regs[R_EBX] = pCtx->ebx;
1595	Assert(R_ESP == 4);
1596	pVM->rem.s.Env.regs[R_ESP] = pCtx->esp;
1597	Assert(R_EBP == 5);
1598	pVM->rem.s.Env.regs[R_EBP] = pCtx->ebp;
1599	Assert(R_ESI == 6);
1600	pVM->rem.s.Env.regs[R_ESI] = pCtx->esi;
1601	Assert(R_EDI == 7);
1602	pVM->rem.s.Env.regs[R_EDI] = pCtx->edi;
1603	pVM->rem.s.Env.eip = pCtx->eip;
1604
1605	pVM->rem.s.Env.eflags = pCtx->eflags.u32;
1606
1607	pVM->rem.s.Env.cr[2] = pCtx->cr2;
1608
1609	/** @todo we could probably benefit from using a CPUM_CHANGED_DRx flag too! */
1610	pVM->rem.s.Env.dr[0] = pCtx->dr0;
1611	pVM->rem.s.Env.dr[1] = pCtx->dr1;
1612	pVM->rem.s.Env.dr[2] = pCtx->dr2;
1613	pVM->rem.s.Env.dr[3] = pCtx->dr3;
1614	pVM->rem.s.Env.dr[4] = pCtx->dr4;
1615	pVM->rem.s.Env.dr[5] = pCtx->dr5;
1616	pVM->rem.s.Env.dr[6] = pCtx->dr6;
1617	pVM->rem.s.Env.dr[7] = pCtx->dr7;
1618
1619	/*
1620	* Replay invlpg?
1621	*/
1622	if (pVM->rem.s.cInvalidatedPages)
1623	{
1624	pVM->rem.s.fIgnoreInvlPg = true;
1625	RTUINT i;
1626	for (i = 0; i < pVM->rem.s.cInvalidatedPages; i++)
1627	{
1628	Log2(("REMR3State: invlpg %VGv\n", pVM->rem.s.aGCPtrInvalidatedPages[i]));
1629	tlb_flush_page(&pVM->rem.s.Env, pVM->rem.s.aGCPtrInvalidatedPages[i]);
1630	}
1631	pVM->rem.s.fIgnoreInvlPg = false;
1632	pVM->rem.s.cInvalidatedPages = 0;
1633	}
1634
1635	/*
1636	* Registers which are seldomly changed and require special handling / order when changed.
1637	*/
1638	fFlags = CPUMGetAndClearChangedFlagsREM(pVM);
1639	if (fFlags & ( CPUM_CHANGED_CR4 \| CPUM_CHANGED_CR3 \| CPUM_CHANGED_CR0
1640	\| CPUM_CHANGED_GDTR \| CPUM_CHANGED_IDTR \| CPUM_CHANGED_LDTR \| CPUM_CHANGED_TR
1641	\| CPUM_CHANGED_FPU_REM \| CPUM_CHANGED_SYSENTER_MSR))
1642	{
1643	if (fFlags & CPUM_CHANGED_FPU_REM)
1644	save_raw_fp_state(&pVM->rem.s.Env, (uint8_t )&pCtx->fpu); / 'save' is an excellent name. */
1645
1646	if (fFlags & CPUM_CHANGED_GLOBAL_TLB_FLUSH)
1647	{
1648	pVM->rem.s.fIgnoreCR3Load = true;
1649	tlb_flush(&pVM->rem.s.Env, true);
1650	pVM->rem.s.fIgnoreCR3Load = false;
1651	}
1652
1653	if (fFlags & CPUM_CHANGED_CR4)
1654	{
1655	pVM->rem.s.fIgnoreCR3Load = true;
1656	pVM->rem.s.fIgnoreCpuMode = true;
1657	cpu_x86_update_cr4(&pVM->rem.s.Env, pCtx->cr4);
1658	pVM->rem.s.fIgnoreCpuMode = false;
1659	pVM->rem.s.fIgnoreCR3Load = false;
1660	}
1661
1662	if (fFlags & CPUM_CHANGED_CR0)
1663	{
1664	pVM->rem.s.fIgnoreCR3Load = true;
1665	pVM->rem.s.fIgnoreCpuMode = true;
1666	cpu_x86_update_cr0(&pVM->rem.s.Env, pCtx->cr0);
1667	pVM->rem.s.fIgnoreCpuMode = false;
1668	pVM->rem.s.fIgnoreCR3Load = false;
1669	}
1670
1671	if (fFlags & CPUM_CHANGED_CR3)
1672	{
1673	pVM->rem.s.fIgnoreCR3Load = true;
1674	cpu_x86_update_cr3(&pVM->rem.s.Env, pCtx->cr3);
1675	pVM->rem.s.fIgnoreCR3Load = false;
1676	}
1677
1678	if (fFlags & CPUM_CHANGED_GDTR)
1679	{
1680	pVM->rem.s.Env.gdt.base = pCtx->gdtr.pGdt;
1681	pVM->rem.s.Env.gdt.limit = pCtx->gdtr.cbGdt;
1682	}
1683
1684	if (fFlags & CPUM_CHANGED_IDTR)
1685	{
1686	pVM->rem.s.Env.idt.base = pCtx->idtr.pIdt;
1687	pVM->rem.s.Env.idt.limit = pCtx->idtr.cbIdt;
1688	}
1689
1690	if (fFlags & CPUM_CHANGED_SYSENTER_MSR)
1691	{
1692	pVM->rem.s.Env.sysenter_cs = pCtx->SysEnter.cs;
1693	pVM->rem.s.Env.sysenter_eip = pCtx->SysEnter.eip;
1694	pVM->rem.s.Env.sysenter_esp = pCtx->SysEnter.esp;
1695	}
1696
1697	if (fFlags & CPUM_CHANGED_LDTR)
1698	{
1699	if (fHiddenSelRegsValid)
1700	{
1701	pVM->rem.s.Env.ldt.selector = pCtx->ldtr;
1702	pVM->rem.s.Env.ldt.base = pCtx->ldtrHid.u32Base;
1703	pVM->rem.s.Env.ldt.limit = pCtx->ldtrHid.u32Limit;
1704	pVM->rem.s.Env.ldt.flags = (pCtx->ldtrHid.Attr.u << 8) & 0xFFFFFF;;
1705	}
1706	else
1707	sync_ldtr(&pVM->rem.s.Env, pCtx->ldtr);
1708	}
1709
1710	if (fFlags & CPUM_CHANGED_TR)
1711	{
1712	if (fHiddenSelRegsValid)
1713	{
1714	pVM->rem.s.Env.tr.selector = pCtx->tr;
1715	pVM->rem.s.Env.tr.base = pCtx->trHid.u32Base;
1716	pVM->rem.s.Env.tr.limit = pCtx->trHid.u32Limit;
1717	pVM->rem.s.Env.tr.flags = (pCtx->trHid.Attr.u << 8) & 0xFFFFFF;;
1718	}
1719	else
1720	sync_tr(&pVM->rem.s.Env, pCtx->tr);
1721
1722	/** @note do_interrupt will fault if the busy flag is still set.... */
1723	pVM->rem.s.Env.tr.flags &= ~DESC_TSS_BUSY_MASK;
1724	}
1725	}
1726
1727	/*
1728	* Update selector registers.
1729	* This must be done after we've synced gdt, ldt and crX registers
1730	* since we're reading the GDT/LDT om sync_seg. This will happen with
1731	* saved state which takes a quick dip into rawmode for instance.
1732	*/
1733	/*
1734	* Stack; Note first check this one as the CPL might have changed. The
1735	* wrong CPL can cause QEmu to raise an exception in sync_seg!!
1736	*/
1737
1738	if (fHiddenSelRegsValid)
1739	{
1740	/* The hidden selector registers are valid in the CPU context. */
1741	/** @note QEmu saves the 2nd dword of the descriptor; we should convert the attribute word back! */
1742
1743	cpu_x86_load_seg_cache(&pVM->rem.s.Env, R_CS, pCtx->cs, pCtx->csHid.u32Base, pCtx->csHid.u32Limit, (pCtx->csHid.Attr.u << 8) & 0xFFFFFF);
1744	cpu_x86_load_seg_cache(&pVM->rem.s.Env, R_SS, pCtx->ss, pCtx->ssHid.u32Base, pCtx->ssHid.u32Limit, (pCtx->ssHid.Attr.u << 8) & 0xFFFFFF);
1745	cpu_x86_load_seg_cache(&pVM->rem.s.Env, R_DS, pCtx->ds, pCtx->dsHid.u32Base, pCtx->dsHid.u32Limit, (pCtx->dsHid.Attr.u << 8) & 0xFFFFFF);
1746	cpu_x86_load_seg_cache(&pVM->rem.s.Env, R_ES, pCtx->es, pCtx->esHid.u32Base, pCtx->esHid.u32Limit, (pCtx->esHid.Attr.u << 8) & 0xFFFFFF);
1747	cpu_x86_load_seg_cache(&pVM->rem.s.Env, R_FS, pCtx->fs, pCtx->fsHid.u32Base, pCtx->fsHid.u32Limit, (pCtx->fsHid.Attr.u << 8) & 0xFFFFFF);
1748	cpu_x86_load_seg_cache(&pVM->rem.s.Env, R_GS, pCtx->gs, pCtx->gsHid.u32Base, pCtx->gsHid.u32Limit, (pCtx->gsHid.Attr.u << 8) & 0xFFFFFF);
1749
1750	/* Set current CPL. */
1751	if (pCtx->eflags.Bits.u1VM == 1)
1752	cpu_x86_set_cpl(&pVM->rem.s.Env, 3);
1753	else
1754	cpu_x86_set_cpl(&pVM->rem.s.Env, pCtx->ss & 3);
1755	}
1756	else
1757	{
1758	/* In 'normal' raw mode we don't have access to the hidden selector registers. */
1759	if (pVM->rem.s.Env.segs[R_SS].selector != (uint16_t)pCtx->ss)
1760	{
1761	Log2(("REMR3State: SS changed from %04x to %04x!\n", pVM->rem.s.Env.segs[R_SS].selector, pCtx->ss));
1762
1763	cpu_x86_set_cpl(&pVM->rem.s.Env, (pCtx->eflags.Bits.u1VM) ? 3 : (pCtx->ss & 3));
1764	sync_seg(&pVM->rem.s.Env, R_SS, pCtx->ss);
1765	#ifdef VBOX_WITH_STATISTICS
1766	if (pVM->rem.s.Env.segs[R_SS].newselector)
1767	{
1768	STAM_COUNTER_INC(&gStatSelOutOfSync[R_SS]);
1769	}
1770	#endif
1771	}
1772	else
1773	pVM->rem.s.Env.segs[R_SS].newselector = 0;
1774
1775	if (pVM->rem.s.Env.segs[R_ES].selector != pCtx->es)
1776	{
1777	Log2(("REMR3State: ES changed from %04x to %04x!\n", pVM->rem.s.Env.segs[R_ES].selector, pCtx->es));
1778	sync_seg(&pVM->rem.s.Env, R_ES, pCtx->es);
1779	#ifdef VBOX_WITH_STATISTICS
1780	if (pVM->rem.s.Env.segs[R_ES].newselector)
1781	{
1782	STAM_COUNTER_INC(&gStatSelOutOfSync[R_ES]);
1783	}
1784	#endif
1785	}
1786	else
1787	pVM->rem.s.Env.segs[R_ES].newselector = 0;
1788
1789	if (pVM->rem.s.Env.segs[R_CS].selector != pCtx->cs)
1790	{
1791	Log2(("REMR3State: CS changed from %04x to %04x!\n", pVM->rem.s.Env.segs[R_CS].selector, pCtx->cs));
1792	sync_seg(&pVM->rem.s.Env, R_CS, pCtx->cs);
1793	#ifdef VBOX_WITH_STATISTICS
1794	if (pVM->rem.s.Env.segs[R_CS].newselector)
1795	{
1796	STAM_COUNTER_INC(&gStatSelOutOfSync[R_CS]);
1797	}
1798	#endif
1799	}
1800	else
1801	pVM->rem.s.Env.segs[R_CS].newselector = 0;
1802
1803	if (pVM->rem.s.Env.segs[R_DS].selector != pCtx->ds)
1804	{
1805	Log2(("REMR3State: DS changed from %04x to %04x!\n", pVM->rem.s.Env.segs[R_DS].selector, pCtx->ds));
1806	sync_seg(&pVM->rem.s.Env, R_DS, pCtx->ds);
1807	#ifdef VBOX_WITH_STATISTICS
1808	if (pVM->rem.s.Env.segs[R_DS].newselector)
1809	{
1810	STAM_COUNTER_INC(&gStatSelOutOfSync[R_DS]);
1811	}
1812	#endif
1813	}
1814	else
1815	pVM->rem.s.Env.segs[R_DS].newselector = 0;
1816
1817	/** @todo need to find a way to communicate potential GDT/LDT changes and thread switches. The selector might
1818	* be the same but not the base/limit. */
1819	if (pVM->rem.s.Env.segs[R_FS].selector != pCtx->fs)
1820	{
1821	Log2(("REMR3State: FS changed from %04x to %04x!\n", pVM->rem.s.Env.segs[R_FS].selector, pCtx->fs));
1822	sync_seg(&pVM->rem.s.Env, R_FS, pCtx->fs);
1823	#ifdef VBOX_WITH_STATISTICS
1824	if (pVM->rem.s.Env.segs[R_FS].newselector)
1825	{
1826	STAM_COUNTER_INC(&gStatSelOutOfSync[R_FS]);
1827	}
1828	#endif
1829	}
1830	else
1831	pVM->rem.s.Env.segs[R_FS].newselector = 0;
1832
1833	if (pVM->rem.s.Env.segs[R_GS].selector != pCtx->gs)
1834	{
1835	Log2(("REMR3State: GS changed from %04x to %04x!\n", pVM->rem.s.Env.segs[R_GS].selector, pCtx->gs));
1836	sync_seg(&pVM->rem.s.Env, R_GS, pCtx->gs);
1837	#ifdef VBOX_WITH_STATISTICS
1838	if (pVM->rem.s.Env.segs[R_GS].newselector)
1839	{
1840	STAM_COUNTER_INC(&gStatSelOutOfSync[R_GS]);
1841	}
1842	#endif
1843	}
1844	else
1845	pVM->rem.s.Env.segs[R_GS].newselector = 0;
1846	}
1847
1848	/*
1849	* Check for traps.
1850	*/
1851	pVM->rem.s.Env.exception_index = -1; /** @todo this won't work :/ */
1852	TRPMEVENT enmType;
1853	uint8_t u8TrapNo;
1854	int rc = TRPMQueryTrap(pVM, &u8TrapNo, &enmType);
1855	if (VBOX_SUCCESS(rc))
1856	{
1857	#ifdef DEBUG
1858	if (u8TrapNo == 0x80)
1859	{
1860	remR3DumpLnxSyscall(pVM);
1861	remR3DumpOBsdSyscall(pVM);
1862	}
1863	#endif
1864
1865	pVM->rem.s.Env.exception_index = u8TrapNo;
1866	if (enmType != TRPM_SOFTWARE_INT)
1867	{
1868	pVM->rem.s.Env.exception_is_int = 0;
1869	pVM->rem.s.Env.exception_next_eip = pVM->rem.s.Env.eip;
1870	}
1871	else
1872	{
1873	/*
1874	* The there are two 1 byte opcodes and one 2 byte opcode for software interrupts.
1875	* We ASSUME that there are no prefixes and sets the default to 2 byte, and checks
1876	* for int03 and into.
1877	*/
1878	pVM->rem.s.Env.exception_is_int = 1;
1879	pVM->rem.s.Env.exception_next_eip = pCtx->eip + 2;
1880	/* int 3 may be generated by one-byte 0xcc */
1881	if (u8TrapNo == 3)
1882	{
1883	if (read_byte(&pVM->rem.s.Env, pVM->rem.s.Env.segs[R_CS].base + pCtx->eip) == 0xcc)
1884	pVM->rem.s.Env.exception_next_eip = pCtx->eip + 1;
1885	}
1886	/* int 4 may be generated by one-byte 0xce */
1887	else if (u8TrapNo == 4)
1888	{
1889	if (read_byte(&pVM->rem.s.Env, pVM->rem.s.Env.segs[R_CS].base + pCtx->eip) == 0xce)
1890	pVM->rem.s.Env.exception_next_eip = pCtx->eip + 1;
1891	}
1892	}
1893
1894	/* get error code and cr2 if needed. */
1895	switch (u8TrapNo)
1896	{
1897	case 0x0e:
1898	pVM->rem.s.Env.cr[2] = TRPMGetFaultAddress(pVM);
1899	/* fallthru */
1900	case 0x0a: case 0x0b: case 0x0c: case 0x0d:
1901	pVM->rem.s.Env.error_code = TRPMGetErrorCode(pVM);
1902	break;
1903
1904	case 0x11: case 0x08:
1905	default:
1906	pVM->rem.s.Env.error_code = 0;
1907	break;
1908	}
1909
1910	/*
1911	* We can now reset the active trap since the recompiler is gonna have a go at it.
1912	*/
1913	rc = TRPMResetTrap(pVM);
1914	AssertRC(rc);
1915	Log2(("REMR3State: trap=%02x errcd=%VGv cr2=%VGv nexteip=%VGv%s\n", pVM->rem.s.Env.exception_index, pVM->rem.s.Env.error_code,
1916	pVM->rem.s.Env.cr[2], pVM->rem.s.Env.exception_next_eip, pVM->rem.s.Env.exception_is_int ? " software" : ""));
1917	}
1918
1919	/*
1920	* Clear old interrupt request flags; Check for pending hardware interrupts.
1921	* (See @remark for why we don't check for other FFs.)
1922	*/
1923	pVM->rem.s.Env.interrupt_request &= ~(CPU_INTERRUPT_HARD \| CPU_INTERRUPT_EXIT \| CPU_INTERRUPT_EXITTB \| CPU_INTERRUPT_TIMER);
1924	if ( pVM->rem.s.u32PendingInterrupt != REM_NO_PENDING_IRQ
1925	\|\| VM_FF_ISPENDING(pVM, VM_FF_INTERRUPT_APIC \| VM_FF_INTERRUPT_PIC))
1926	pVM->rem.s.Env.interrupt_request \|= CPU_INTERRUPT_HARD;
1927
1928	/*
1929	* We're now in REM mode.
1930	*/
1931	pVM->rem.s.fInREM = true;
1932	pVM->rem.s.cCanExecuteRaw = 0;
1933	STAM_PROFILE_STOP(&pVM->rem.s.StatsState, a);
1934	Log2(("REMR3State: returns VINF_SUCCESS\n"));
1935	return VINF_SUCCESS;
1936	}
1937
1938
1939	/**
1940	* Syncs back changes in the REM state to the the VM state.
1941	*
1942	* This must be called after invoking REMR3Run().
1943	* Calling it several times in a row is not permitted.
1944	*
1945	* @returns VBox status code.
1946	*
1947	* @param pVM VM Handle.
1948	*/
1949	REMR3DECL(int) REMR3StateBack(PVM pVM)
1950	{
1951	Log2(("REMR3StateBack:\n"));
1952	Assert(pVM->rem.s.fInREM);
1953	STAM_PROFILE_START(&pVM->rem.s.StatsStateBack, a);
1954	register PCPUMCTX pCtx = pVM->rem.s.pCtx;
1955
1956	/*
1957	* Copy back the registers.
1958	* This is done in the order they are declared in the CPUMCTX structure.
1959	*/
1960
1961	/** @todo FOP */
1962	/** @todo FPUIP */
1963	/** @todo CS */
1964	/** @todo FPUDP */
1965	/** @todo DS */
1966	/** @todo Fix MXCSR support in QEMU so we don't overwrite MXCSR with 0 when we shouldn't! */
1967	pCtx->fpu.MXCSR = 0;
1968	pCtx->fpu.MXCSR_MASK = 0;
1969
1970	/** @todo check if FPU/XMM was actually used in the recompiler */
1971	restore_raw_fp_state(&pVM->rem.s.Env, (uint8_t *)&pCtx->fpu);
1972	//// dprintf2(("FPU state CW=%04X TT=%04X SW=%04X (%04X)\n", env->fpuc, env->fpstt, env->fpus, pVMCtx->fpu.FSW));
1973
1974	pCtx->edi = pVM->rem.s.Env.regs[R_EDI];
1975	pCtx->esi = pVM->rem.s.Env.regs[R_ESI];
1976	pCtx->ebp = pVM->rem.s.Env.regs[R_EBP];
1977	pCtx->eax = pVM->rem.s.Env.regs[R_EAX];
1978	pCtx->ebx = pVM->rem.s.Env.regs[R_EBX];
1979	pCtx->edx = pVM->rem.s.Env.regs[R_EDX];
1980	pCtx->ecx = pVM->rem.s.Env.regs[R_ECX];
1981
1982	pCtx->esp = pVM->rem.s.Env.regs[R_ESP];
1983	pCtx->ss = pVM->rem.s.Env.segs[R_SS].selector;
1984
1985	#ifdef VBOX_WITH_STATISTICS
1986	if (pVM->rem.s.Env.segs[R_SS].newselector)
1987	{
1988	STAM_COUNTER_INC(&gStatSelOutOfSyncStateBack[R_SS]);
1989	}
1990	if (pVM->rem.s.Env.segs[R_GS].newselector)
1991	{
1992	STAM_COUNTER_INC(&gStatSelOutOfSyncStateBack[R_GS]);
1993	}
1994	if (pVM->rem.s.Env.segs[R_FS].newselector)
1995	{
1996	STAM_COUNTER_INC(&gStatSelOutOfSyncStateBack[R_FS]);
1997	}
1998	if (pVM->rem.s.Env.segs[R_ES].newselector)
1999	{
2000	STAM_COUNTER_INC(&gStatSelOutOfSyncStateBack[R_ES]);
2001	}
2002	if (pVM->rem.s.Env.segs[R_DS].newselector)
2003	{
2004	STAM_COUNTER_INC(&gStatSelOutOfSyncStateBack[R_DS]);
2005	}
2006	if (pVM->rem.s.Env.segs[R_CS].newselector)
2007	{
2008	STAM_COUNTER_INC(&gStatSelOutOfSyncStateBack[R_CS]);
2009	}
2010	#endif
2011	pCtx->gs = pVM->rem.s.Env.segs[R_GS].selector;
2012	pCtx->fs = pVM->rem.s.Env.segs[R_FS].selector;
2013	pCtx->es = pVM->rem.s.Env.segs[R_ES].selector;
2014	pCtx->ds = pVM->rem.s.Env.segs[R_DS].selector;
2015	pCtx->cs = pVM->rem.s.Env.segs[R_CS].selector;
2016
2017	pCtx->eip = pVM->rem.s.Env.eip;
2018	pCtx->eflags.u32 = pVM->rem.s.Env.eflags;
2019
2020	pCtx->cr0 = pVM->rem.s.Env.cr[0];
2021	pCtx->cr2 = pVM->rem.s.Env.cr[2];
2022	pCtx->cr3 = pVM->rem.s.Env.cr[3];
2023	pCtx->cr4 = pVM->rem.s.Env.cr[4];
2024
2025	pCtx->dr0 = pVM->rem.s.Env.dr[0];
2026	pCtx->dr1 = pVM->rem.s.Env.dr[1];
2027	pCtx->dr2 = pVM->rem.s.Env.dr[2];
2028	pCtx->dr3 = pVM->rem.s.Env.dr[3];
2029	pCtx->dr4 = pVM->rem.s.Env.dr[4];
2030	pCtx->dr5 = pVM->rem.s.Env.dr[5];
2031	pCtx->dr6 = pVM->rem.s.Env.dr[6];
2032	pCtx->dr7 = pVM->rem.s.Env.dr[7];
2033
2034	pCtx->gdtr.cbGdt = pVM->rem.s.Env.gdt.limit;
2035	if (pCtx->gdtr.pGdt != (uint32_t)pVM->rem.s.Env.gdt.base)
2036	{
2037	pCtx->gdtr.pGdt = (uint32_t)pVM->rem.s.Env.gdt.base;
2038	STAM_COUNTER_INC(&gStatREMGDTChange);
2039	VM_FF_SET(pVM, VM_FF_SELM_SYNC_GDT);
2040	}
2041
2042	pCtx->idtr.cbIdt = pVM->rem.s.Env.idt.limit;
2043	if (pCtx->idtr.pIdt != (uint32_t)pVM->rem.s.Env.idt.base)
2044	{
2045	pCtx->idtr.pIdt = (uint32_t)pVM->rem.s.Env.idt.base;
2046	STAM_COUNTER_INC(&gStatREMIDTChange);
2047	VM_FF_SET(pVM, VM_FF_TRPM_SYNC_IDT);
2048	}
2049
2050	if (pCtx->ldtr != pVM->rem.s.Env.ldt.selector)
2051	{
2052	pCtx->ldtr = pVM->rem.s.Env.ldt.selector;
2053	STAM_COUNTER_INC(&gStatREMLDTRChange);
2054	VM_FF_SET(pVM, VM_FF_SELM_SYNC_LDT);
2055	}
2056	if (pCtx->tr != pVM->rem.s.Env.tr.selector)
2057	{
2058	pCtx->tr = pVM->rem.s.Env.tr.selector;
2059	STAM_COUNTER_INC(&gStatREMTRChange);
2060	VM_FF_SET(pVM, VM_FF_SELM_SYNC_TSS);
2061	}
2062
2063	/** @todo These values could still be out of sync! */
2064	pCtx->csHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_CS].base;
2065	pCtx->csHid.u32Limit = pVM->rem.s.Env.segs[R_CS].limit;
2066	/** @note QEmu saves the 2nd dword of the descriptor; we should store the attribute word only! */
2067	pCtx->csHid.Attr.u = (pVM->rem.s.Env.segs[R_CS].flags >> 8) & 0xF0FF;
2068
2069	pCtx->dsHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_DS].base;
2070	pCtx->dsHid.u32Limit = pVM->rem.s.Env.segs[R_DS].limit;
2071	pCtx->dsHid.Attr.u = (pVM->rem.s.Env.segs[R_DS].flags >> 8) & 0xF0FF;
2072
2073	pCtx->esHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_ES].base;
2074	pCtx->esHid.u32Limit = pVM->rem.s.Env.segs[R_ES].limit;
2075	pCtx->esHid.Attr.u = (pVM->rem.s.Env.segs[R_ES].flags >> 8) & 0xF0FF;
2076
2077	pCtx->fsHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_FS].base;
2078	pCtx->fsHid.u32Limit = pVM->rem.s.Env.segs[R_FS].limit;
2079	pCtx->fsHid.Attr.u = (pVM->rem.s.Env.segs[R_FS].flags >> 8) & 0xF0FF;
2080
2081	pCtx->gsHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_GS].base;
2082	pCtx->gsHid.u32Limit = pVM->rem.s.Env.segs[R_GS].limit;
2083	pCtx->gsHid.Attr.u = (pVM->rem.s.Env.segs[R_GS].flags >> 8) & 0xF0FF;
2084
2085	pCtx->ssHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_SS].base;
2086	pCtx->ssHid.u32Limit = pVM->rem.s.Env.segs[R_SS].limit;
2087	pCtx->ssHid.Attr.u = (pVM->rem.s.Env.segs[R_SS].flags >> 8) & 0xF0FF;
2088
2089	pCtx->ldtrHid.u32Base = (uint32_t)pVM->rem.s.Env.ldt.base;
2090	pCtx->ldtrHid.u32Limit = pVM->rem.s.Env.ldt.limit;
2091	pCtx->ldtrHid.Attr.u = (pVM->rem.s.Env.ldt.flags >> 8) & 0xF0FF;
2092
2093	pCtx->trHid.u32Base = (uint32_t)pVM->rem.s.Env.tr.base;
2094	pCtx->trHid.u32Limit = pVM->rem.s.Env.tr.limit;
2095	pCtx->trHid.Attr.u = (pVM->rem.s.Env.tr.flags >> 8) & 0xF0FF;
2096
2097	/* Sysenter MSR */
2098	pCtx->SysEnter.cs = pVM->rem.s.Env.sysenter_cs;
2099	pCtx->SysEnter.eip = pVM->rem.s.Env.sysenter_eip;
2100	pCtx->SysEnter.esp = pVM->rem.s.Env.sysenter_esp;
2101
2102	remR3TrapClear(pVM);
2103
2104	/*
2105	* Check for traps.
2106	*/
2107	if ( pVM->rem.s.Env.exception_index >= 0
2108	&& pVM->rem.s.Env.exception_index < 256)
2109	{
2110	Log(("REMR3StateBack: Pending trap %x %d\n", pVM->rem.s.Env.exception_index, pVM->rem.s.Env.exception_is_int));
2111	int rc = TRPMAssertTrap(pVM, pVM->rem.s.Env.exception_index, (pVM->rem.s.Env.exception_is_int) ? TRPM_SOFTWARE_INT : TRPM_HARDWARE_INT);
2112	AssertRC(rc);
2113	switch (pVM->rem.s.Env.exception_index)
2114	{
2115	case 0x0e:
2116	TRPMSetFaultAddress(pVM, pCtx->cr2);
2117	/* fallthru */
2118	case 0x0a: case 0x0b: case 0x0c: case 0x0d:
2119	case 0x11: case 0x08: /* 0 */
2120	TRPMSetErrorCode(pVM, pVM->rem.s.Env.error_code);
2121	break;
2122	}
2123
2124	}
2125
2126	/*
2127	* We're not longer in REM mode.
2128	*/
2129	pVM->rem.s.fInREM = false;
2130	STAM_PROFILE_STOP(&pVM->rem.s.StatsStateBack, a);
2131	Log2(("REMR3StateBack: returns VINF_SUCCESS\n"));
2132	return VINF_SUCCESS;
2133	}
2134
2135
2136	/**
2137	* This is called by the disassembler when it wants to update the cpu state
2138	* before for instance doing a register dump.
2139	*/
2140	static void remR3StateUpdate(PVM pVM)
2141	{
2142	Assert(pVM->rem.s.fInREM);
2143	register PCPUMCTX pCtx = pVM->rem.s.pCtx;
2144
2145	/*
2146	* Copy back the registers.
2147	* This is done in the order they are declared in the CPUMCTX structure.
2148	*/
2149
2150	/** @todo FOP */
2151	/** @todo FPUIP */
2152	/** @todo CS */
2153	/** @todo FPUDP */
2154	/** @todo DS */
2155	/** @todo Fix MXCSR support in QEMU so we don't overwrite MXCSR with 0 when we shouldn't! */
2156	pCtx->fpu.MXCSR = 0;
2157	pCtx->fpu.MXCSR_MASK = 0;
2158
2159	/** @todo check if FPU/XMM was actually used in the recompiler */
2160	restore_raw_fp_state(&pVM->rem.s.Env, (uint8_t *)&pCtx->fpu);
2161	//// dprintf2(("FPU state CW=%04X TT=%04X SW=%04X (%04X)\n", env->fpuc, env->fpstt, env->fpus, pVMCtx->fpu.FSW));
2162
2163	pCtx->edi = pVM->rem.s.Env.regs[R_EDI];
2164	pCtx->esi = pVM->rem.s.Env.regs[R_ESI];
2165	pCtx->ebp = pVM->rem.s.Env.regs[R_EBP];
2166	pCtx->eax = pVM->rem.s.Env.regs[R_EAX];
2167	pCtx->ebx = pVM->rem.s.Env.regs[R_EBX];
2168	pCtx->edx = pVM->rem.s.Env.regs[R_EDX];
2169	pCtx->ecx = pVM->rem.s.Env.regs[R_ECX];
2170
2171	pCtx->esp = pVM->rem.s.Env.regs[R_ESP];
2172	pCtx->ss = pVM->rem.s.Env.segs[R_SS].selector;
2173
2174	pCtx->gs = pVM->rem.s.Env.segs[R_GS].selector;
2175	pCtx->fs = pVM->rem.s.Env.segs[R_FS].selector;
2176	pCtx->es = pVM->rem.s.Env.segs[R_ES].selector;
2177	pCtx->ds = pVM->rem.s.Env.segs[R_DS].selector;
2178	pCtx->cs = pVM->rem.s.Env.segs[R_CS].selector;
2179
2180	pCtx->eip = pVM->rem.s.Env.eip;
2181	pCtx->eflags.u32 = pVM->rem.s.Env.eflags;
2182
2183	pCtx->cr0 = pVM->rem.s.Env.cr[0];
2184	pCtx->cr2 = pVM->rem.s.Env.cr[2];
2185	pCtx->cr3 = pVM->rem.s.Env.cr[3];
2186	pCtx->cr4 = pVM->rem.s.Env.cr[4];
2187
2188	pCtx->dr0 = pVM->rem.s.Env.dr[0];
2189	pCtx->dr1 = pVM->rem.s.Env.dr[1];
2190	pCtx->dr2 = pVM->rem.s.Env.dr[2];
2191	pCtx->dr3 = pVM->rem.s.Env.dr[3];
2192	pCtx->dr4 = pVM->rem.s.Env.dr[4];
2193	pCtx->dr5 = pVM->rem.s.Env.dr[5];
2194	pCtx->dr6 = pVM->rem.s.Env.dr[6];
2195	pCtx->dr7 = pVM->rem.s.Env.dr[7];
2196
2197	pCtx->gdtr.cbGdt = pVM->rem.s.Env.gdt.limit;
2198	if (pCtx->gdtr.pGdt != (uint32_t)pVM->rem.s.Env.gdt.base)
2199	{
2200	pCtx->gdtr.pGdt = (uint32_t)pVM->rem.s.Env.gdt.base;
2201	STAM_COUNTER_INC(&gStatREMGDTChange);
2202	VM_FF_SET(pVM, VM_FF_SELM_SYNC_GDT);
2203	}
2204
2205	pCtx->idtr.cbIdt = pVM->rem.s.Env.idt.limit;
2206	if (pCtx->idtr.pIdt != (uint32_t)pVM->rem.s.Env.idt.base)
2207	{
2208	pCtx->idtr.pIdt = (uint32_t)pVM->rem.s.Env.idt.base;
2209	STAM_COUNTER_INC(&gStatREMIDTChange);
2210	VM_FF_SET(pVM, VM_FF_TRPM_SYNC_IDT);
2211	}
2212
2213	if (pCtx->ldtr != pVM->rem.s.Env.ldt.selector)
2214	{
2215	pCtx->ldtr = pVM->rem.s.Env.ldt.selector;
2216	STAM_COUNTER_INC(&gStatREMLDTRChange);
2217	VM_FF_SET(pVM, VM_FF_SELM_SYNC_LDT);
2218	}
2219	if (pCtx->tr != pVM->rem.s.Env.tr.selector)
2220	{
2221	pCtx->tr = pVM->rem.s.Env.tr.selector;
2222	STAM_COUNTER_INC(&gStatREMTRChange);
2223	VM_FF_SET(pVM, VM_FF_SELM_SYNC_TSS);
2224	}
2225
2226	/** @todo These values could still be out of sync! */
2227	pCtx->csHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_CS].base;
2228	pCtx->csHid.u32Limit = pVM->rem.s.Env.segs[R_CS].limit;
2229	/** @note QEmu saves the 2nd dword of the descriptor; we should store the attribute word only! */
2230	pCtx->csHid.Attr.u = (pVM->rem.s.Env.segs[R_CS].flags >> 8) & 0xFFFF;
2231
2232	pCtx->dsHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_DS].base;
2233	pCtx->dsHid.u32Limit = pVM->rem.s.Env.segs[R_DS].limit;
2234	pCtx->dsHid.Attr.u = (pVM->rem.s.Env.segs[R_DS].flags >> 8) & 0xFFFF;
2235
2236	pCtx->esHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_ES].base;
2237	pCtx->esHid.u32Limit = pVM->rem.s.Env.segs[R_ES].limit;
2238	pCtx->esHid.Attr.u = (pVM->rem.s.Env.segs[R_ES].flags >> 8) & 0xFFFF;
2239
2240	pCtx->fsHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_FS].base;
2241	pCtx->fsHid.u32Limit = pVM->rem.s.Env.segs[R_FS].limit;
2242	pCtx->fsHid.Attr.u = (pVM->rem.s.Env.segs[R_FS].flags >> 8) & 0xFFFF;
2243
2244	pCtx->gsHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_GS].base;
2245	pCtx->gsHid.u32Limit = pVM->rem.s.Env.segs[R_GS].limit;
2246	pCtx->gsHid.Attr.u = (pVM->rem.s.Env.segs[R_GS].flags >> 8) & 0xFFFF;
2247
2248	pCtx->ssHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_SS].base;
2249	pCtx->ssHid.u32Limit = pVM->rem.s.Env.segs[R_SS].limit;
2250	pCtx->ssHid.Attr.u = (pVM->rem.s.Env.segs[R_SS].flags >> 8) & 0xFFFF;
2251
2252	pCtx->ldtrHid.u32Base = (uint32_t)pVM->rem.s.Env.ldt.base;
2253	pCtx->ldtrHid.u32Limit = pVM->rem.s.Env.ldt.limit;
2254	pCtx->ldtrHid.Attr.u = (pVM->rem.s.Env.ldt.flags >> 8) & 0xFFFF;
2255
2256	pCtx->trHid.u32Base = (uint32_t)pVM->rem.s.Env.tr.base;
2257	pCtx->trHid.u32Limit = pVM->rem.s.Env.tr.limit;
2258	pCtx->trHid.Attr.u = (pVM->rem.s.Env.tr.flags >> 8) & 0xFFFF;
2259
2260	/* Sysenter MSR */
2261	pCtx->SysEnter.cs = pVM->rem.s.Env.sysenter_cs;
2262	pCtx->SysEnter.eip = pVM->rem.s.Env.sysenter_eip;
2263	pCtx->SysEnter.esp = pVM->rem.s.Env.sysenter_esp;
2264	}
2265
2266
2267	/**
2268	* Update the VMM state information if we're currently in REM.
2269	*
2270	* This method is used by the DBGF and PDMDevice when there is any uncertainty of whether
2271	* we're currently executing in REM and the VMM state is invalid. This method will of
2272	* course check that we're executing in REM before syncing any data over to the VMM.
2273	*
2274	* @param pVM The VM handle.
2275	*/
2276	REMR3DECL(void) REMR3StateUpdate(PVM pVM)
2277	{
2278	if (pVM->rem.s.fInREM)
2279	remR3StateUpdate(pVM);
2280	}
2281
2282
2283	#undef LOG_GROUP
2284	#define LOG_GROUP LOG_GROUP_REM
2285
2286
2287	/**
2288	* Notify the recompiler about Address Gate 20 state change.
2289	*
2290	* This notification is required since A20 gate changes are
2291	* initialized from a device driver and the VM might just as
2292	* well be in REM mode as in RAW mode.
2293	*
2294	* @param pVM VM handle.
2295	* @param fEnable True if the gate should be enabled.
2296	* False if the gate should be disabled.
2297	*/
2298	REMR3DECL(void) REMR3A20Set(PVM pVM, bool fEnable)
2299	{
2300	LogFlow(("REMR3A20Set: fEnable=%d\n", fEnable));
2301	VM_ASSERT_EMT(pVM);
2302	cpu_x86_set_a20(&pVM->rem.s.Env, fEnable);
2303	}
2304
2305
2306	/**
2307	* Replays the invalidated recorded pages.
2308	* Called in response to VERR_REM_FLUSHED_PAGES_OVERFLOW from the RAW execution loop.
2309	*
2310	* @param pVM VM handle.
2311	*/
2312	REMR3DECL(void) REMR3ReplayInvalidatedPages(PVM pVM)
2313	{
2314	VM_ASSERT_EMT(pVM);
2315
2316	/*
2317	* Sync the required registers.
2318	*/
2319	pVM->rem.s.Env.cr[0] = pVM->rem.s.pCtx->cr0;
2320	pVM->rem.s.Env.cr[2] = pVM->rem.s.pCtx->cr2;
2321	pVM->rem.s.Env.cr[3] = pVM->rem.s.pCtx->cr3;
2322	pVM->rem.s.Env.cr[4] = pVM->rem.s.pCtx->cr4;
2323
2324	/*
2325	* Replay the flushes.
2326	*/
2327	pVM->rem.s.fIgnoreInvlPg = true;
2328	RTUINT i;
2329	for (i = 0; i < pVM->rem.s.cInvalidatedPages; i++)
2330	{
2331	Log2(("REMR3ReplayInvalidatedPages: invlpg %VGv\n", pVM->rem.s.aGCPtrInvalidatedPages[i]));
2332	tlb_flush_page(&pVM->rem.s.Env, pVM->rem.s.aGCPtrInvalidatedPages[i]);
2333	}
2334	pVM->rem.s.fIgnoreInvlPg = false;
2335	pVM->rem.s.cInvalidatedPages = 0;
2336	}
2337
2338
2339	/**
2340	* Replays the invalidated recorded pages.
2341	* Called in response to VERR_REM_FLUSHED_PAGES_OVERFLOW from the RAW execution loop.
2342	*
2343	* @param pVM VM handle.
2344	*/
2345	REMR3DECL(void) REMR3ReplayHandlerNotifications(PVM pVM)
2346	{
2347	LogFlow(("REMR3ReplayInvalidatedPages:\n"));
2348	VM_ASSERT_EMT(pVM);
2349
2350	/*
2351	* Replay the flushes.
2352	*/
2353	RTUINT i;
2354	const RTUINT c = pVM->rem.s.cHandlerNotifications;
2355	pVM->rem.s.cHandlerNotifications = 0;
2356	for (i = 0; i < c; i++)
2357	{
2358	PREMHANDLERNOTIFICATION pRec = &pVM->rem.s.aHandlerNotifications[i];
2359	switch (pRec->enmKind)
2360	{
2361	case REMHANDLERNOTIFICATIONKIND_PHYSICAL_REGISTER:
2362	REMR3NotifyHandlerPhysicalRegister(pVM,
2363	pRec->u.PhysicalRegister.enmType,
2364	pRec->u.PhysicalRegister.GCPhys,
2365	pRec->u.PhysicalRegister.cb,
2366	pRec->u.PhysicalRegister.fHasHCHandler);
2367	break;
2368
2369	case REMHANDLERNOTIFICATIONKIND_PHYSICAL_DEREGISTER:
2370	REMR3NotifyHandlerPhysicalDeregister(pVM,
2371	pRec->u.PhysicalDeregister.enmType,
2372	pRec->u.PhysicalDeregister.GCPhys,
2373	pRec->u.PhysicalDeregister.cb,
2374	pRec->u.PhysicalDeregister.fHasHCHandler,
2375	pRec->u.PhysicalDeregister.pvHCPtr);
2376	break;
2377
2378	case REMHANDLERNOTIFICATIONKIND_PHYSICAL_MODIFY:
2379	REMR3NotifyHandlerPhysicalModify(pVM,
2380	pRec->u.PhysicalModify.enmType,
2381	pRec->u.PhysicalModify.GCPhysOld,
2382	pRec->u.PhysicalModify.GCPhysNew,
2383	pRec->u.PhysicalModify.cb,
2384	pRec->u.PhysicalModify.fHasHCHandler,
2385	pRec->u.PhysicalModify.pvHCPtr);
2386	break;
2387
2388	default:
2389	AssertReleaseMsgFailed(("enmKind=%d\n", pRec->enmKind));
2390	break;
2391	}
2392	}
2393	}
2394
2395
2396	/**
2397	* Notify REM about changed code page.
2398	*
2399	* @returns VBox status code.
2400	* @param pVM VM handle.
2401	* @param pvCodePage Code page address
2402	*/
2403	REMR3DECL(int) REMR3NotifyCodePageChanged(PVM pVM, RTGCPTR pvCodePage)
2404	{
2405	int rc;
2406	RTGCPHYS PhysGC;
2407	uint64_t flags;
2408
2409	VM_ASSERT_EMT(pVM);
2410
2411	/*
2412	* Get the physical page address.
2413	*/
2414	rc = PGMGstGetPage(pVM, pvCodePage, &flags, &PhysGC);
2415	if (rc == VINF_SUCCESS)
2416	{
2417	/*
2418	* Sync the required registers and flush the whole page.
2419	* (Easier to do the whole page than notifying it about each physical
2420	* byte that was changed.
2421	*/
2422	pVM->rem.s.Env.cr[0] = pVM->rem.s.pCtx->cr0;
2423	pVM->rem.s.Env.cr[2] = pVM->rem.s.pCtx->cr2;
2424	pVM->rem.s.Env.cr[3] = pVM->rem.s.pCtx->cr3;
2425	pVM->rem.s.Env.cr[4] = pVM->rem.s.pCtx->cr4;
2426
2427	tb_invalidate_phys_page_range(PhysGC, PhysGC + PAGE_SIZE - 1, 0);
2428	}
2429	return VINF_SUCCESS;
2430	}
2431
2432	/**
2433	* Notification about a successful MMR3PhysRegister() call.
2434	*
2435	* @param pVM VM handle.
2436	* @param GCPhys The physical address the RAM.
2437	* @param cb Size of the memory.
2438	* @param pvRam The HC address of the RAM.
2439	* @param fFlags Flags of the MM_RAM_FLAGS_* defines.
2440	*/
2441	REMR3DECL(void) REMR3NotifyPhysRamRegister(PVM pVM, RTGCPHYS GCPhys, RTUINT cb, void *pvRam, unsigned fFlags)
2442	{
2443	Log(("REMR3NotifyPhysRamRegister: GCPhys=%VGp cb=%d pvRam=%p fFlags=%d\n", GCPhys, cb, pvRam, fFlags));
2444	VM_ASSERT_EMT(pVM);
2445
2446	/*
2447	* Validate input - we trust the caller.
2448	*/
2449	Assert(!GCPhys \|\| pvRam);
2450	Assert(RT_ALIGN_P(pvRam, PAGE_SIZE) == pvRam);
2451	Assert(RT_ALIGN_T(GCPhys, PAGE_SIZE, RTGCPHYS) == GCPhys);
2452	Assert(cb);
2453	Assert(RT_ALIGN_Z(cb, PAGE_SIZE) == cb);
2454
2455	/*
2456	* Base ram?
2457	*/
2458	if (!GCPhys)
2459	{
2460	#ifndef PGM_DYNAMIC_RAM_ALLOC
2461	AssertRelease(!phys_ram_base);
2462	phys_ram_base = pvRam;
2463	#endif
2464	phys_ram_size = cb;
2465	phys_ram_dirty = MMR3HeapAllocZ(pVM, MM_TAG_REM, cb >> PAGE_SHIFT);
2466	AssertReleaseMsg(phys_ram_dirty, ("failed to allocate %d bytes of dirty bytes\n", cb >> PAGE_SHIFT));
2467	}
2468	#ifndef PGM_DYNAMIC_RAM_ALLOC
2469	AssertRelease(phys_ram_base);
2470	#endif
2471
2472	/*
2473	* Register the ram.
2474	*/
2475	#ifdef PGM_DYNAMIC_RAM_ALLOC
2476	if (!GCPhys)
2477	cpu_register_physical_memory(GCPhys, cb, GCPhys \| IO_MEM_RAM_MISSING);
2478	else
2479	{
2480	uint32_t i;
2481
2482	cpu_register_physical_memory(GCPhys, cb, GCPhys \| (fFlags & MM_RAM_FLAGS_RESERVED ? IO_MEM_UNASSIGNED : 0));
2483
2484	AssertRelease(pVM->rem.s.cPhysRegistrations < REM_MAX_PHYS_REGISTRATIONS);
2485	for (i=0;i<pVM->rem.s.cPhysRegistrations;i++)
2486	{
2487	if (pVM->rem.s.aPhysReg[i].GCPhys == GCPhys)
2488	{
2489	pVM->rem.s.aPhysReg[i].HCVirt = (RTHCUINTPTR)pvRam;
2490	pVM->rem.s.aPhysReg[i].cb = cb;
2491	break;
2492	}
2493	}
2494	if (i == pVM->rem.s.cPhysRegistrations)
2495	{
2496	pVM->rem.s.aPhysReg[i].GCPhys = GCPhys;
2497	pVM->rem.s.aPhysReg[i].HCVirt = (RTHCUINTPTR)pvRam;
2498	pVM->rem.s.aPhysReg[i].cb = cb;
2499	pVM->rem.s.cPhysRegistrations++;
2500	}
2501	}
2502	#else
2503	cpu_register_physical_memory(GCPhys, cb, ((uintptr_t)pvRam - (uintptr_t)phys_ram_base)
2504	\| (fFlags & MM_RAM_FLAGS_RESERVED ? IO_MEM_UNASSIGNED : 0));
2505	#endif
2506	}
2507
2508
2509	/**
2510	* Notification about a successful PGMR3PhysRegisterChunk() call.
2511	*
2512	* @param pVM VM handle.
2513	* @param GCPhys The physical address the RAM.
2514	* @param cb Size of the memory.
2515	* @param pvRam The HC address of the RAM.
2516	* @param fFlags Flags of the MM_RAM_FLAGS_* defines.
2517	*/
2518	REMR3DECL(void) REMR3NotifyPhysRamChunkRegister(PVM pVM, RTGCPHYS GCPhys, RTUINT cb, RTHCUINTPTR pvRam, unsigned fFlags)
2519	{
2520	uint32_t idx;
2521
2522	Log(("REMR3NotifyPhysRamChunkRegister: GCPhys=%VGp cb=%d pvRam=%p fFlags=%d\n", GCPhys, cb, pvRam, fFlags));
2523	VM_ASSERT_EMT(pVM);
2524
2525	/*
2526	* Validate input - we trust the caller.
2527	*/
2528	Assert(pvRam);
2529	Assert(RT_ALIGN(pvRam, PAGE_SIZE) == pvRam);
2530	Assert(RT_ALIGN_T(GCPhys, PAGE_SIZE, RTGCPHYS) == GCPhys);
2531	Assert(cb == PGM_DYNAMIC_CHUNK_SIZE);
2532	Assert(fFlags == 0 /* normal RAM */);
2533
2534	if (!pVM->rem.s.paHCVirtToGCPhys)
2535	{
2536	uint32_t size = (_4G >> PGM_DYNAMIC_CHUNK_SHIFT) * sizeof(REMCHUNKINFO);
2537
2538	Assert(phys_ram_size);
2539
2540	pVM->rem.s.paHCVirtToGCPhys = (PREMCHUNKINFO)MMR3HeapAllocZ(pVM, MM_TAG_REM, size);
2541	pVM->rem.s.paGCPhysToHCVirt = (RTHCPTR)MMR3HeapAllocZ(pVM, MM_TAG_REM, (phys_ram_size >> PGM_DYNAMIC_CHUNK_SHIFT)*sizeof(RTHCPTR));
2542	}
2543	pVM->rem.s.paGCPhysToHCVirt[GCPhys >> PGM_DYNAMIC_CHUNK_SHIFT] = pvRam;
2544
2545	idx = (pvRam >> PGM_DYNAMIC_CHUNK_SHIFT);
2546	if (!pVM->rem.s.paHCVirtToGCPhys[idx].pChunk1)
2547	{
2548	pVM->rem.s.paHCVirtToGCPhys[idx].pChunk1 = pvRam;
2549	pVM->rem.s.paHCVirtToGCPhys[idx].GCPhys1 = GCPhys;
2550	}
2551	else
2552	{
2553	Assert(!pVM->rem.s.paHCVirtToGCPhys[idx].pChunk2);
2554	pVM->rem.s.paHCVirtToGCPhys[idx].pChunk2 = pvRam;
2555	pVM->rem.s.paHCVirtToGCPhys[idx].GCPhys2 = GCPhys;
2556	}
2557	/* Does the region spawn two chunks? */
2558	if (pvRam & PGM_DYNAMIC_CHUNK_OFFSET_MASK)
2559	{
2560	if (!pVM->rem.s.paHCVirtToGCPhys[idx+1].pChunk1)
2561	{
2562	pVM->rem.s.paHCVirtToGCPhys[idx+1].pChunk1 = pvRam;
2563	pVM->rem.s.paHCVirtToGCPhys[idx+1].GCPhys1 = GCPhys;
2564	}
2565	else
2566	{
2567	Assert(!pVM->rem.s.paHCVirtToGCPhys[idx+1].pChunk2);
2568	pVM->rem.s.paHCVirtToGCPhys[idx+1].pChunk2 = pvRam;
2569	pVM->rem.s.paHCVirtToGCPhys[idx+1].GCPhys2 = GCPhys;
2570	}
2571	}
2572	cpu_register_physical_memory(GCPhys, cb, GCPhys);
2573	}
2574
2575	/**
2576	* Convert GC physical address to HC virt
2577	*
2578	* @returns The HC virt address corresponding to addr.
2579	* @param env The cpu environment.
2580	* @param addr The physical address.
2581	*/
2582	void remR3GCPhys2HCVirt(void env, target_ulong addr)
2583	{
2584	#ifdef PGM_DYNAMIC_RAM_ALLOC
2585	PVM pVM = ((CPUState *)env)->pVM;
2586	uint32_t i;
2587
2588	/* lookup in pVM->rem.s.aPhysReg array first (for ROM range(s) inside the guest's RAM) */
2589	for (i=0;i<pVM->rem.s.cPhysRegistrations;i++)
2590	{
2591	uint32_t off = addr - pVM->rem.s.aPhysReg[i].GCPhys;
2592	if (off < pVM->rem.s.aPhysReg[i].cb)
2593	{
2594	Log2(("remR3GCPhys2HCVirt: %x -> %x\n", addr, pVM->rem.s.aPhysReg[i].HCVirt + off));
2595	return (void *)(pVM->rem.s.aPhysReg[i].HCVirt + off);
2596	}
2597	}
2598	AssertMsg(addr < phys_ram_size, ("remR3GCPhys2HCVirt: unknown physical address %x\n", addr));
2599	Log2(("remR3GCPhys2HCVirt: %x -> %x\n", addr, pVM->rem.s.paGCPhysToHCVirt[addr >> PGM_DYNAMIC_CHUNK_SHIFT] + (addr & PGM_DYNAMIC_CHUNK_OFFSET_MASK)));
2600	return (void *)(pVM->rem.s.paGCPhysToHCVirt[addr >> PGM_DYNAMIC_CHUNK_SHIFT] + (addr & PGM_DYNAMIC_CHUNK_OFFSET_MASK));
2601	#else
2602	return phys_ram_base + addr;
2603	#endif
2604	}
2605
2606	/**
2607	* Convert GC physical address to HC virt
2608	*
2609	* @returns The HC virt address corresponding to addr.
2610	* @param env The cpu environment.
2611	* @param addr The physical address.
2612	*/
2613	target_ulong remR3HCVirt2GCPhys(void env, void addr)
2614	{
2615	#ifdef PGM_DYNAMIC_RAM_ALLOC
2616	PVM pVM = ((CPUState *)env)->pVM;
2617	RTHCUINTPTR HCVirt = (RTHCUINTPTR)addr;
2618	uint32_t idx = (HCVirt >> PGM_DYNAMIC_CHUNK_SHIFT);
2619	RTHCUINTPTR off;
2620	RTUINT i;
2621
2622	off = HCVirt - pVM->rem.s.paHCVirtToGCPhys[idx].pChunk1;
2623
2624	if ( pVM->rem.s.paHCVirtToGCPhys[idx].pChunk1
2625	&& off < PGM_DYNAMIC_CHUNK_SIZE)
2626	{
2627	Log2(("remR3HCVirt2GCPhys %x -> %x\n", addr, pVM->rem.s.paHCVirtToGCPhys[idx].GCPhys1 + off));
2628	return pVM->rem.s.paHCVirtToGCPhys[idx].GCPhys1 + off;
2629	}
2630
2631	off = HCVirt - pVM->rem.s.paHCVirtToGCPhys[idx].pChunk2;
2632	if ( pVM->rem.s.paHCVirtToGCPhys[idx].pChunk2
2633	&& off < PGM_DYNAMIC_CHUNK_SIZE)
2634	{
2635	Log2(("remR3HCVirt2GCPhys %x -> %x\n", addr, pVM->rem.s.paHCVirtToGCPhys[idx].GCPhys2 + off));
2636	return pVM->rem.s.paHCVirtToGCPhys[idx].GCPhys2 + off;
2637	}
2638
2639	/* Must be externally registered RAM/ROM range */
2640	for (i=0;i<pVM->rem.s.cPhysRegistrations;i++)
2641	{
2642	uint32_t off = HCVirt - pVM->rem.s.aPhysReg[i].HCVirt;
2643	if (off < pVM->rem.s.aPhysReg[i].cb)
2644	{
2645	Log2(("remR3HCVirt2GCPhys %x -> %x\n", addr, pVM->rem.s.aPhysReg[i].GCPhys + off));
2646	return pVM->rem.s.aPhysReg[i].GCPhys + off;
2647	}
2648	}
2649	AssertReleaseMsgFailed(("No translation for physical address %VHv???\n", addr));
2650	return 0;
2651	#else
2652	return (target_ulong)addr - (target_ulong)phys_ram_base;
2653	#endif
2654	}
2655
2656	/**
2657	* Grows dynamically allocated guest RAM.
2658	* Will raise a fatal error if the operation fails.
2659	*
2660	* @param physaddr The physical address.
2661	*/
2662	void remR3GrowDynRange(unsigned long physaddr)
2663	{
2664	int rc;
2665	PVM pVM = cpu_single_env->pVM;
2666
2667	Log(("remR3GrowDynRange %VGp\n", physaddr));
2668	rc = PGM3PhysGrowRange(pVM, (RTGCPHYS)physaddr);
2669	if (VBOX_SUCCESS(rc))
2670	return;
2671
2672	LogRel(("\nUnable to allocate guest RAM chunk at %VGp\n", physaddr));
2673	cpu_abort(cpu_single_env, "Unable to allocate guest RAM chunk at %VGp\n", physaddr);
2674	AssertFatalFailed();
2675	}
2676
2677	/**
2678	* Notification about a successful MMR3PhysRomRegister() call.
2679	*
2680	* @param pVM VM handle.
2681	* @param GCPhys The physical address of the ROM.
2682	* @param cb The size of the ROM.
2683	* @param pvCopy Pointer to the ROM copy.
2684	*/
2685	REMR3DECL(void) REMR3NotifyPhysRomRegister(PVM pVM, RTGCPHYS GCPhys, RTUINT cb, void *pvCopy)
2686	{
2687	#ifdef PGM_DYNAMIC_RAM_ALLOC
2688	uint32_t i;
2689	#endif
2690	Log(("REMR3NotifyPhysRomRegister: GCPhys=%VGp cb=%d pvCopy=%p\n", GCPhys, cb, pvCopy));
2691	VM_ASSERT_EMT(pVM);
2692
2693	/*
2694	* Validate input - we trust the caller.
2695	*/
2696	Assert(RT_ALIGN_T(GCPhys, PAGE_SIZE, RTGCPHYS) == GCPhys);
2697	Assert(cb);
2698	Assert(RT_ALIGN_Z(cb, PAGE_SIZE) == cb);
2699	Assert(pvCopy);
2700	Assert(RT_ALIGN_P(pvCopy, PAGE_SIZE) == pvCopy);
2701
2702	/*
2703	* Register the rom.
2704	*/
2705	#ifdef PGM_DYNAMIC_RAM_ALLOC
2706	cpu_register_physical_memory(GCPhys, cb, GCPhys \| IO_MEM_ROM);
2707	AssertRelease(pVM->rem.s.cPhysRegistrations < REM_MAX_PHYS_REGISTRATIONS);
2708	for (i=0;i<pVM->rem.s.cPhysRegistrations;i++)
2709	{
2710	if (pVM->rem.s.aPhysReg[i].GCPhys == GCPhys)
2711	{
2712	pVM->rem.s.aPhysReg[i].HCVirt = (RTHCUINTPTR)pvCopy;
2713	pVM->rem.s.aPhysReg[i].cb = cb;
2714	break;
2715	}
2716	}
2717	if (i == pVM->rem.s.cPhysRegistrations)
2718	{
2719	pVM->rem.s.aPhysReg[i].GCPhys = GCPhys;
2720	pVM->rem.s.aPhysReg[i].HCVirt = (RTHCUINTPTR)pvCopy;
2721	pVM->rem.s.aPhysReg[i].cb = cb;
2722	pVM->rem.s.cPhysRegistrations++;
2723	}
2724	#else
2725	AssertRelease(phys_ram_base);
2726	cpu_register_physical_memory(GCPhys, cb, ((uintptr_t)pvCopy - (uintptr_t)phys_ram_base) \| IO_MEM_ROM);
2727	#endif
2728	Log2(("%.64Vhxd\n", (char *)pvCopy + cb - 64));
2729	}
2730
2731
2732	/**
2733	* Notification about a successful MMR3PhysRegister() call.
2734	*
2735	* @param pVM VM Handle.
2736	* @param GCPhys Start physical address.
2737	* @param cb The size of the range.
2738	*/
2739	REMR3DECL(void) REMR3NotifyPhysReserve(PVM pVM, RTGCPHYS GCPhys, RTUINT cb)
2740	{
2741	LogFlow(("REMR3NotifyPhysReserve: GCPhys=%VGp cb=%d\n", GCPhys, cb));
2742	VM_ASSERT_EMT(pVM);
2743
2744	/*
2745	* Validate input - we trust the caller.
2746	*/
2747	Assert(RT_ALIGN_T(GCPhys, PAGE_SIZE, RTGCPHYS) == GCPhys);
2748	Assert(cb);
2749	Assert(RT_ALIGN_Z(cb, PAGE_SIZE) == cb);
2750
2751	/*
2752	* Unassigning the memory.
2753	*/
2754	cpu_register_physical_memory(GCPhys, cb, IO_MEM_UNASSIGNED);
2755	}
2756
2757
2758	/**
2759	* Notification about a successful PGMR3HandlerPhysicalRegister() call.
2760	*
2761	* @param pVM VM Handle.
2762	* @param enmType Handler type.
2763	* @param GCPhys Handler range address.
2764	* @param cb Size of the handler range.
2765	* @param fHasHCHandler Set if the handler has a HC callback function.
2766	*
2767	* @remark MMR3PhysRomRegister assumes that this function will not apply the
2768	* Handler memory type to memory which has no HC handler.
2769	*/
2770	REMR3DECL(void) REMR3NotifyHandlerPhysicalRegister(PVM pVM, PGMPHYSHANDLERTYPE enmType, RTGCPHYS GCPhys, RTGCPHYS cb, bool fHasHCHandler)
2771	{
2772	LogFlow(("REMR3NotifyHandlerPhysicalRegister: enmType=%d GCPhys=%VGp cb=%d fHasHCHandler=%d\n",
2773	enmType, GCPhys, cb, fHasHCHandler));
2774	VM_ASSERT_EMT(pVM);
2775	Assert(RT_ALIGN_T(GCPhys, PAGE_SIZE, RTGCPHYS) == GCPhys);
2776	Assert(RT_ALIGN_T(cb, PAGE_SIZE, RTGCPHYS) == cb);
2777
2778	if (pVM->rem.s.cHandlerNotifications)
2779	REMR3ReplayHandlerNotifications(pVM);
2780
2781	if (enmType == PGMPHYSHANDLERTYPE_MMIO)
2782	cpu_register_physical_memory(GCPhys, cb, pVM->rem.s.iMMIOMemType);
2783	else if (fHasHCHandler)
2784	cpu_register_physical_memory(GCPhys, cb, pVM->rem.s.iHandlerMemType);
2785	}
2786
2787
2788	/**
2789	* Notification about a successful PGMR3HandlerPhysicalDeregister() operation.
2790	*
2791	* @param pVM VM Handle.
2792	* @param enmType Handler type.
2793	* @param GCPhys Handler range address.
2794	* @param cb Size of the handler range.
2795	* @param fHasHCHandler Set if the handler has a HC callback function.
2796	* @param pvHCPtr The HC virtual address corresponding to GCPhys if available.
2797	*/
2798	REMR3DECL(void) REMR3NotifyHandlerPhysicalDeregister(PVM pVM, PGMPHYSHANDLERTYPE enmType, RTGCPHYS GCPhys, RTGCPHYS cb, bool fHasHCHandler, void *pvHCPtr)
2799	{
2800	LogFlow(("REMR3NotifyHandlerPhysicalDeregister: enmType=%d GCPhys=%VGp cb=%d fHasHCHandler=%d pvHCPtr=%p RAM=%08x\n",
2801	enmType, GCPhys, cb, fHasHCHandler, pvHCPtr, MMR3PhysGetRamSize(pVM)));
2802	VM_ASSERT_EMT(pVM);
2803
2804	if (pVM->rem.s.cHandlerNotifications)
2805	REMR3ReplayHandlerNotifications(pVM);
2806
2807	if (enmType == PGMPHYSHANDLERTYPE_MMIO)
2808	cpu_register_physical_memory(GCPhys, cb, IO_MEM_UNASSIGNED);
2809	else if (fHasHCHandler)
2810	{
2811	if (!pvHCPtr)
2812	{
2813	Assert(GCPhys > MMR3PhysGetRamSize(pVM));
2814	cpu_register_physical_memory(GCPhys, cb, IO_MEM_UNASSIGNED);
2815	}
2816	else
2817	{
2818	/* This is not prefect, but it'll do for PD monitoring... */
2819	Assert(cb == PAGE_SIZE);
2820	Assert(RT_ALIGN_T(GCPhys, PAGE_SIZE, RTGCPHYS) == GCPhys);
2821	Assert(remR3HCVirt2GCPhys(cpu_single_env, pvHCPtr) < MMR3PhysGetRamSize(pVM));
2822	#ifdef PGM_DYNAMIC_RAM_ALLOC
2823	cpu_register_physical_memory(GCPhys, cb, GCPhys);
2824	#else
2825	cpu_register_physical_memory(GCPhys, cb, remR3HCVirt2GCPhys(cpu_single_env, pvHCPtr));
2826	#endif
2827	}
2828	}
2829	}
2830
2831
2832	/**
2833	* Notification about a successful PGMR3HandlerPhysicalModify() call.
2834	*
2835	* @param pVM VM Handle.
2836	* @param enmType Handler type.
2837	* @param GCPhysOld Old handler range address.
2838	* @param GCPhysNew New handler range address.
2839	* @param cb Size of the handler range.
2840	* @param fHasHCHandler Set if the handler has a HC callback function.
2841	* @param pvHCPtr The HC virtual address corresponding to GCPhys if available.
2842	*/
2843	REMR3DECL(void) REMR3NotifyHandlerPhysicalModify(PVM pVM, PGMPHYSHANDLERTYPE enmType, RTGCPHYS GCPhysOld, RTGCPHYS GCPhysNew, RTGCPHYS cb, bool fHasHCHandler, void *pvHCPtr)
2844	{
2845	LogFlow(("REMR3NotifyHandlerPhysicalModify: enmType=%d GCPhysOld=%VGp GCPhysNew=%VGp cb=%d fHasHCHandler=%d pvHCPtr=%p\n",
2846	enmType, GCPhysOld, GCPhysNew, cb, fHasHCHandler, pvHCPtr));
2847	VM_ASSERT_EMT(pVM);
2848	AssertReleaseMsg(enmType != PGMPHYSHANDLERTYPE_MMIO, ("enmType=%d\n", enmType));
2849
2850	if (pVM->rem.s.cHandlerNotifications)
2851	REMR3ReplayHandlerNotifications(pVM);
2852
2853	if (fHasHCHandler)
2854	{
2855	/*
2856	* Reset the old page.
2857	*/
2858	if (!pvHCPtr)
2859	cpu_register_physical_memory(GCPhysOld, cb, IO_MEM_UNASSIGNED);
2860	else
2861	{
2862	/* This is not prefect, but it'll do for PD monitoring... */
2863	Assert(cb == PAGE_SIZE);
2864	Assert(RT_ALIGN_T(GCPhysOld, PAGE_SIZE, RTGCPHYS) == GCPhysOld);
2865	Assert(remR3HCVirt2GCPhys(cpu_single_env, pvHCPtr) < MMR3PhysGetRamSize(pVM));
2866	#ifdef PGM_DYNAMIC_RAM_ALLOC
2867	cpu_register_physical_memory(GCPhysOld, cb, GCPhysOld);
2868	#else
2869	cpu_register_physical_memory(GCPhysOld, cb, remR3HCVirt2GCPhys(cpu_single_env, pvHCPtr));
2870	#endif
2871	}
2872
2873	/*
2874	* Update the new page.
2875	*/
2876	Assert(RT_ALIGN_T(GCPhysNew, PAGE_SIZE, RTGCPHYS) == GCPhysNew);
2877	Assert(RT_ALIGN_T(cb, PAGE_SIZE, RTGCPHYS) == cb);
2878	cpu_register_physical_memory(GCPhysNew, cb, pVM->rem.s.iHandlerMemType);
2879	}
2880	}
2881
2882
2883	/**
2884	* Checks if we're handling access to this page or not.
2885	*
2886	* @returns true if we're trapping access.
2887	* @returns false if we aren't.
2888	* @param pVM The VM handle.
2889	* @param GCPhys The physical address.
2890	*
2891	* @remark This function will only work correctly in VBOX_STRICT builds!
2892	*/
2893	REMDECL(bool) REMR3IsPageAccessHandled(PVM pVM, RTGCPHYS GCPhys)
2894	{
2895	#ifdef VBOX_STRICT
2896	if (pVM->rem.s.cHandlerNotifications)
2897	REMR3ReplayHandlerNotifications(pVM);
2898
2899	unsigned long off = get_phys_page_offset(GCPhys);
2900	return (off & PAGE_OFFSET_MASK) == pVM->rem.s.iHandlerMemType
2901	\|\| (off & PAGE_OFFSET_MASK) == pVM->rem.s.iMMIOMemType
2902	\|\| (off & PAGE_OFFSET_MASK) == IO_MEM_ROM;
2903	#else
2904	return false;
2905	#endif
2906	}
2907
2908
2909	/**
2910	* Deals with a rare case in get_phys_addr_code where the code
2911	* is being monitored.
2912	*
2913	* It could also be an MMIO page, in which case we will raise a fatal error.
2914	*
2915	* @returns The physical address corresponding to addr.
2916	* @param env The cpu environment.
2917	* @param addr The virtual address.
2918	* @param pTLBEntry The TLB entry.
2919	*/
2920	target_ulong remR3PhysGetPhysicalAddressCode(CPUState env, target_ulong addr, CPUTLBEntry pTLBEntry)
2921	{
2922	PVM pVM = env->pVM;
2923	if ((pTLBEntry->address & ~TARGET_PAGE_MASK) == pVM->rem.s.iHandlerMemType)
2924	{
2925	target_ulong ret = pTLBEntry->addend + addr;
2926	AssertMsg2("remR3PhysGetPhysicalAddressCode: addr=%VGv address=%VGv addend=%VGp ret=%VGp\n",
2927	(RTGCPTR)addr, (RTGCPTR)pTLBEntry->address, (RTGCPHYS)pTLBEntry->addend, ret);
2928	return ret;
2929	}
2930	LogRel(("\nTrying to execute code with memory type address=%VGv addend=%VGp at %VGv! (iHandlerMemType=%#x iMMIOMemType=%#x)\n"
2931	"*** handlers\n",
2932	(RTGCPTR)pTLBEntry->address, (RTGCPHYS)pTLBEntry->addend, (RTGCPTR)addr, pVM->rem.s.iHandlerMemType, pVM->rem.s.iMMIOMemType));
2933	DBGFR3Info(pVM, "handlers", NULL, DBGFR3InfoLogRelHlp());
2934	LogRel(("*** mmio\n"));
2935	DBGFR3Info(pVM, "mmio", NULL, DBGFR3InfoLogRelHlp());
2936	LogRel(("*** phys\n"));
2937	DBGFR3Info(pVM, "phys", NULL, DBGFR3InfoLogRelHlp());
2938	cpu_abort(env, "Trying to execute code with memory type address=%VGv addend=%VGp at %VGv. (iHandlerMemType=%#x iMMIOMemType=%#x)\n",
2939	(RTGCPTR)pTLBEntry->address, (RTGCPHYS)pTLBEntry->addend, (RTGCPTR)addr, pVM->rem.s.iHandlerMemType, pVM->rem.s.iMMIOMemType);
2940	AssertFatalFailed();
2941	}
2942
2943	/**
2944	* Read guest RAM and ROM.
2945	*
2946	* @param pbSrcPhys The source address. Relative to guest RAM.
2947	* @param pvDst The destination address.
2948	* @param cb Number of bytes
2949	*/
2950	void remR3PhysReadBytes(uint8_t pbSrcPhys, void pvDst, unsigned cb)
2951	{
2952	STAM_PROFILE_ADV_START(&gStatMemRead, a);
2953
2954	/*
2955	* Calc the physical address ('off') and check that it's within the RAM.
2956	* ROM is accessed this way, even if it's not part of the RAM.
2957	*/
2958	/** @todo This is rather ugly, but there's no other way when we don't wish to touch many other files. */
2959	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbSrcPhys);
2960	if (off < (uintptr_t)phys_ram_size)
2961	PGMPhysRead(cpu_single_env->pVM, (RTGCPHYS)off, pvDst, cb);
2962	else
2963	{
2964	/* ROM range outside physical RAM, HC address passed directly */
2965	Log4(("remR3PhysReadBytes ROM: %p\n", pbSrcPhys));
2966	memcpy(pvDst, pbSrcPhys, cb);
2967	}
2968	STAM_PROFILE_ADV_STOP(&gStatMemRead, a);
2969	}
2970
2971	/** @todo r=bird: s/Byte/U8/ s/Word/U16/ s/Dword/U32/, see MMIO and other functions.
2972	* It could be an idea to inline these wrapper functions... */
2973
2974	/**
2975	* Read guest RAM and ROM.
2976	*
2977	* @param pbSrcPhys The source address. Relative to guest RAM.
2978	*/
2979	uint8_t remR3PhysReadUByte(uint8_t *pbSrcPhys)
2980	{
2981	uint8_t val;
2982
2983	STAM_PROFILE_ADV_START(&gStatMemRead, a);
2984
2985	/*
2986	* Calc the physical address ('off') and check that it's within the RAM.
2987	* ROM is accessed this way, even if it's not part of the RAM.
2988	*/
2989	/** @todo This is rather ugly, but there's no other way when we don't wish to touch many other files. */
2990	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbSrcPhys);
2991	if (off < (uintptr_t)phys_ram_size)
2992	val = PGMR3PhysReadByte(cpu_single_env->pVM, (RTGCPHYS)off);
2993	else
2994	{
2995	/* ROM range outside physical RAM, HC address passed directly */
2996	Log4(("remR3PhysReadBytes ROM: %p\n", pbSrcPhys));
2997	val = *pbSrcPhys;
2998	}
2999	STAM_PROFILE_ADV_STOP(&gStatMemRead, a);
3000	return val;
3001	}
3002
3003	/**
3004	* Read guest RAM and ROM.
3005	*
3006	* @param pbSrcPhys The source address. Relative to guest RAM.
3007	*/
3008	int8_t remR3PhysReadSByte(uint8_t *pbSrcPhys)
3009	{
3010	int8_t val;
3011
3012	STAM_PROFILE_ADV_START(&gStatMemRead, a);
3013
3014	/*
3015	* Calc the physical address ('off') and check that it's within the RAM.
3016	* ROM is accessed this way, even if it's not part of the RAM.
3017	*/
3018	/** @todo This is rather ugly, but there's no other way when we don't wish to touch many other files. */
3019	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbSrcPhys);
3020	if (off < (uintptr_t)phys_ram_size)
3021	val = PGMR3PhysReadByte(cpu_single_env->pVM, (RTGCPHYS)off);
3022	else
3023	{
3024	/* ROM range outside physical RAM, HC address passed directly */
3025	Log4(("remR3PhysReadBytes ROM: %p\n", pbSrcPhys));
3026	val = (int8_t )pbSrcPhys;
3027	}
3028	STAM_PROFILE_ADV_STOP(&gStatMemRead, a);
3029	return val;
3030	}
3031
3032	/**
3033	* Read guest RAM and ROM.
3034	*
3035	* @param pbSrcPhys The source address. Relative to guest RAM.
3036	*/
3037	uint16_t remR3PhysReadUWord(uint8_t *pbSrcPhys)
3038	{
3039	uint16_t val;
3040
3041	STAM_PROFILE_ADV_START(&gStatMemRead, a);
3042
3043	/*
3044	* Calc the physical address ('off') and check that it's within the RAM.
3045	* ROM is accessed this way, even if it's not part of the RAM.
3046	*/
3047	/** @todo This is rather ugly, but there's no other way when we don't wish to touch many other files. */
3048	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbSrcPhys);
3049	if (off < (uintptr_t)phys_ram_size)
3050	val = PGMR3PhysReadWord(cpu_single_env->pVM, (RTGCPHYS)off);
3051	else
3052	{
3053	/* ROM range outside physical RAM, HC address passed directly */
3054	Log4(("remR3PhysReadBytes ROM: %p\n", pbSrcPhys));
3055	val = (uint16_t )pbSrcPhys;
3056	}
3057	STAM_PROFILE_ADV_STOP(&gStatMemRead, a);
3058	return val;
3059	}
3060
3061	/**
3062	* Read guest RAM and ROM.
3063	*
3064	* @param pbSrcPhys The source address. Relative to guest RAM.
3065	*/
3066	int16_t remR3PhysReadSWord(uint8_t *pbSrcPhys)
3067	{
3068	int16_t val;
3069
3070	STAM_PROFILE_ADV_START(&gStatMemRead, a);
3071
3072	/*
3073	* Calc the physical address ('off') and check that it's within the RAM.
3074	* ROM is accessed this way, even if it's not part of the RAM.
3075	*/
3076	/** @todo This is rather ugly, but there's no other way when we don't wish to touch many other files. */
3077	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbSrcPhys);
3078	if (off < (uintptr_t)phys_ram_size)
3079	val = PGMR3PhysReadWord(cpu_single_env->pVM, (RTGCPHYS)off);
3080	else
3081	{
3082	/* ROM range outside physical RAM, HC address passed directly */
3083	Log4(("remR3PhysReadBytes ROM: %p\n", pbSrcPhys));
3084	val = (int16_t )pbSrcPhys;
3085	}
3086	STAM_PROFILE_ADV_STOP(&gStatMemRead, a);
3087	return val;
3088	}
3089
3090	/**
3091	* Read guest RAM and ROM.
3092	*
3093	* @param pbSrcPhys The source address. Relative to guest RAM.
3094	*/
3095	uint32_t remR3PhysReadULong(uint8_t *pbSrcPhys)
3096	{
3097	uint32_t val;
3098
3099	STAM_PROFILE_ADV_START(&gStatMemRead, a);
3100
3101	/*
3102	* Calc the physical address ('off') and check that it's within the RAM.
3103	* ROM is accessed this way, even if it's not part of the RAM.
3104	*/
3105	/** @todo This is rather ugly, but there's no other way when we don't wish to touch many other files. */
3106	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbSrcPhys);
3107	if (off < (uintptr_t)phys_ram_size)
3108	val = PGMR3PhysReadDword(cpu_single_env->pVM, (RTGCPHYS)off);
3109	else
3110	{
3111	/* ROM range outside physical RAM, HC address passed directly */
3112	Log4(("remR3PhysReadBytes ROM: %p\n", pbSrcPhys));
3113	val = (uint32_t )pbSrcPhys;
3114	}
3115	STAM_PROFILE_ADV_STOP(&gStatMemRead, a);
3116	return val;
3117	}
3118
3119	/**
3120	* Read guest RAM and ROM.
3121	*
3122	* @param pbSrcPhys The source address. Relative to guest RAM.
3123	*/
3124	int32_t remR3PhysReadSLong(uint8_t *pbSrcPhys)
3125	{
3126	int32_t val;
3127
3128	STAM_PROFILE_ADV_START(&gStatMemRead, a);
3129
3130	/*
3131	* Calc the physical address ('off') and check that it's within the RAM.
3132	* ROM is accessed this way, even if it's not part of the RAM.
3133	*/
3134	/** @todo This is rather ugly, but there's no other way when we don't wish to touch many other files. */
3135	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbSrcPhys);
3136	if (off < (uintptr_t)phys_ram_size)
3137	val = PGMR3PhysReadDword(cpu_single_env->pVM, (RTGCPHYS)off);
3138	else
3139	{
3140	/* ROM range outside physical RAM, HC address passed directly */
3141	Log4(("remR3PhysReadBytes ROM: %p\n", pbSrcPhys));
3142	val = (int32_t )pbSrcPhys;
3143	}
3144	STAM_PROFILE_ADV_STOP(&gStatMemRead, a);
3145	return val;
3146	}
3147
3148	/**
3149	* Write guest RAM.
3150	*
3151	* @param pbDstPhys The destination address. Relative to guest RAM.
3152	* @param pvSrc The source address.
3153	* @param cb Number of bytes to write
3154	*/
3155	void remR3PhysWriteBytes(uint8_t pbDstPhys, const void pvSrc, unsigned cb)
3156	{
3157	STAM_PROFILE_ADV_START(&gStatMemWrite, a);
3158	/*
3159	* Calc the physical address ('off') and check that it's within the RAM.
3160	*/
3161	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbDstPhys);
3162	if (off < (uintptr_t)phys_ram_size)
3163	PGMPhysWrite(cpu_single_env->pVM, (RTGCPHYS)off, pvSrc, cb);
3164	else
3165	AssertMsgFailed(("pbDstPhys=%p off=%p cb=%d\n", pbDstPhys, off, cb));
3166	STAM_PROFILE_ADV_STOP(&gStatMemWrite, a);
3167	}
3168
3169
3170	/**
3171	* Write guest RAM.
3172	*
3173	* @param pbDstPhys The destination address. Relative to guest RAM.
3174	* @param val Value
3175	*/
3176	void remR3PhysWriteByte(uint8_t *pbDstPhys, uint8_t val)
3177	{
3178	STAM_PROFILE_ADV_START(&gStatMemWrite, a);
3179	/*
3180	* Calc the physical address ('off') and check that it's within the RAM.
3181	*/
3182	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbDstPhys);
3183	if (off < (uintptr_t)phys_ram_size)
3184	PGMR3PhysWriteByte(cpu_single_env->pVM, (RTGCPHYS)off, val);
3185	else
3186	AssertMsgFailed(("pbDstPhys=%p off=%p cb=%d\n", pbDstPhys, off, 1));
3187	STAM_PROFILE_ADV_STOP(&gStatMemWrite, a);
3188	}
3189
3190	/**
3191	* Write guest RAM.
3192	*
3193	* @param pbDstPhys The destination address. Relative to guest RAM.
3194	* @param val Value
3195	*/
3196	void remR3PhysWriteWord(uint8_t *pbDstPhys, uint16_t val)
3197	{
3198	STAM_PROFILE_ADV_START(&gStatMemWrite, a);
3199	/*
3200	* Calc the physical address ('off') and check that it's within the RAM.
3201	*/
3202	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbDstPhys);
3203	if (off < (uintptr_t)phys_ram_size)
3204	PGMR3PhysWriteWord(cpu_single_env->pVM, (RTGCPHYS)off, val);
3205	else
3206	AssertMsgFailed(("pbDstPhys=%p off=%p cb=%d\n", pbDstPhys, off, 2));
3207	STAM_PROFILE_ADV_STOP(&gStatMemWrite, a);
3208	}
3209
3210	/**
3211	* Write guest RAM.
3212	*
3213	* @param pbDstPhys The destination address. Relative to guest RAM.
3214	* @param val Value
3215	*/
3216	void remR3PhysWriteDword(uint8_t *pbDstPhys, uint32_t val)
3217	{
3218	STAM_PROFILE_ADV_START(&gStatMemWrite, a);
3219	/*
3220	* Calc the physical address ('off') and check that it's within the RAM.
3221	*/
3222	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbDstPhys);
3223	if (off < (uintptr_t)phys_ram_size)
3224	PGMR3PhysWriteDword(cpu_single_env->pVM, (RTGCPHYS)off, val);
3225	else
3226	AssertMsgFailed(("pbDstPhys=%p off=%p cb=%d\n", pbDstPhys, off, 4));
3227	STAM_PROFILE_ADV_STOP(&gStatMemWrite, a);
3228	}
3229
3230
3231
3232	#undef LOG_GROUP
3233	#define LOG_GROUP LOG_GROUP_REM_MMIO
3234
3235	/** Read MMIO memory. */
3236	static uint32_t remR3MMIOReadU8(void *pvVM, target_phys_addr_t GCPhys)
3237	{
3238	uint32_t u32 = 0;
3239	int rc = IOMMMIORead((PVM)pvVM, GCPhys, &u32, 1);
3240	AssertMsg(rc == VINF_SUCCESS, ("rc=%Vrc\n", rc)); NOREF(rc);
3241	Log2(("remR3MMIOReadU8: GCPhys=%VGp -> %02x\n", GCPhys, u32));
3242	return u32;
3243	}
3244
3245	/** Read MMIO memory. */
3246	static uint32_t remR3MMIOReadU16(void *pvVM, target_phys_addr_t GCPhys)
3247	{
3248	uint32_t u32 = 0;
3249	int rc = IOMMMIORead((PVM)pvVM, GCPhys, &u32, 2);
3250	AssertMsg(rc == VINF_SUCCESS, ("rc=%Vrc\n", rc)); NOREF(rc);
3251	Log2(("remR3MMIOReadU16: GCPhys=%VGp -> %04x\n", GCPhys, u32));
3252	return u32;
3253	}
3254
3255	/** Read MMIO memory. */
3256	static uint32_t remR3MMIOReadU32(void *pvVM, target_phys_addr_t GCPhys)
3257	{
3258	uint32_t u32 = 0;
3259	int rc = IOMMMIORead((PVM)pvVM, GCPhys, &u32, 4);
3260	AssertMsg(rc == VINF_SUCCESS, ("rc=%Vrc\n", rc)); NOREF(rc);
3261	Log2(("remR3MMIOReadU32: GCPhys=%VGp -> %08x\n", GCPhys, u32));
3262	return u32;
3263	}
3264
3265	/** Write to MMIO memory. */
3266	static void remR3MMIOWriteU8(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32)
3267	{
3268	Log2(("remR3MMIOWriteU8: GCPhys=%VGp u32=%#x\n", GCPhys, u32));
3269	int rc = IOMMMIOWrite((PVM)pvVM, GCPhys, u32, 1);
3270	AssertMsg(rc == VINF_SUCCESS, ("rc=%Vrc\n", rc)); NOREF(rc);
3271	}
3272
3273	/** Write to MMIO memory. */
3274	static void remR3MMIOWriteU16(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32)
3275	{
3276	Log2(("remR3MMIOWriteU16: GCPhys=%VGp u32=%#x\n", GCPhys, u32));
3277	int rc = IOMMMIOWrite((PVM)pvVM, GCPhys, u32, 2);
3278	AssertMsg(rc == VINF_SUCCESS, ("rc=%Vrc\n", rc)); NOREF(rc);
3279	}
3280
3281	/** Write to MMIO memory. */
3282	static void remR3MMIOWriteU32(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32)
3283	{
3284	Log2(("remR3MMIOWriteU32: GCPhys=%VGp u32=%#x\n", GCPhys, u32));
3285	int rc = IOMMMIOWrite((PVM)pvVM, GCPhys, u32, 4);
3286	AssertMsg(rc == VINF_SUCCESS, ("rc=%Vrc\n", rc)); NOREF(rc);
3287	}
3288
3289
3290	#undef LOG_GROUP
3291	#define LOG_GROUP LOG_GROUP_REM_HANDLER
3292
3293	/* !!!WARNING!!! This is extremely hackish right now, we assume it's only for LFB access! !!!WARNING!!! */
3294
3295	static uint32_t remR3HandlerReadU8(void *pvVM, target_phys_addr_t GCPhys)
3296	{
3297	Log2(("remR3HandlerReadU8: GCPhys=%VGp\n", GCPhys));
3298	uint8_t u8;
3299	PGMPhysRead((PVM)pvVM, GCPhys, &u8, sizeof(u8));
3300	return u8;
3301	}
3302
3303	static uint32_t remR3HandlerReadU16(void *pvVM, target_phys_addr_t GCPhys)
3304	{
3305	Log2(("remR3HandlerReadU16: GCPhys=%VGp\n", GCPhys));
3306	uint16_t u16;
3307	PGMPhysRead((PVM)pvVM, GCPhys, &u16, sizeof(u16));
3308	return u16;
3309	}
3310
3311	static uint32_t remR3HandlerReadU32(void *pvVM, target_phys_addr_t GCPhys)
3312	{
3313	Log2(("remR3HandlerReadU32: GCPhys=%VGp\n", GCPhys));
3314	uint32_t u32;
3315	PGMPhysRead((PVM)pvVM, GCPhys, &u32, sizeof(u32));
3316	return u32;
3317	}
3318
3319	static void remR3HandlerWriteU8(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32)
3320	{
3321	Log2(("remR3HandlerWriteU8: GCPhys=%VGp u32=%#x\n", GCPhys, u32));
3322	PGMPhysWrite((PVM)pvVM, GCPhys, &u32, sizeof(uint8_t));
3323	}
3324
3325	static void remR3HandlerWriteU16(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32)
3326	{
3327	Log2(("remR3HandlerWriteU16: GCPhys=%VGp u32=%#x\n", GCPhys, u32));
3328	PGMPhysWrite((PVM)pvVM, GCPhys, &u32, sizeof(uint16_t));
3329	}
3330
3331	static void remR3HandlerWriteU32(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32)
3332	{
3333	Log2(("remR3HandlerWriteU32: GCPhys=%VGp u32=%#x\n", GCPhys, u32));
3334	PGMPhysWrite((PVM)pvVM, GCPhys, &u32, sizeof(uint32_t));
3335	}
3336
3337	/* -+- disassembly -+- */
3338
3339	#undef LOG_GROUP
3340	#define LOG_GROUP LOG_GROUP_REM_DISAS
3341
3342
3343	/**
3344	* Enables or disables singled stepped disassembly.
3345	*
3346	* @returns VBox status code.
3347	* @param pVM VM handle.
3348	* @param fEnable To enable set this flag, to disable clear it.
3349	*/
3350	static DECLCALLBACK(int) remR3DisasEnableStepping(PVM pVM, bool fEnable)
3351	{
3352	LogFlow(("remR3DisasEnableStepping: fEnable=%d\n", fEnable));
3353	VM_ASSERT_EMT(pVM);
3354
3355	if (fEnable)
3356	pVM->rem.s.Env.state \|= CPU_EMULATE_SINGLE_STEP;
3357	else
3358	pVM->rem.s.Env.state &= ~CPU_EMULATE_SINGLE_STEP;
3359	return VINF_SUCCESS;
3360	}
3361
3362
3363	/**
3364	* Enables or disables singled stepped disassembly.
3365	*
3366	* @returns VBox status code.
3367	* @param pVM VM handle.
3368	* @param fEnable To enable set this flag, to disable clear it.
3369	*/
3370	REMR3DECL(int) REMR3DisasEnableStepping(PVM pVM, bool fEnable)
3371	{
3372	PVMREQ pReq;
3373	int rc;
3374
3375	LogFlow(("REMR3DisasEnableStepping: fEnable=%d\n", fEnable));
3376	if (VM_IS_EMT(pVM))
3377	return remR3DisasEnableStepping(pVM, fEnable);
3378
3379	rc = VMR3ReqCall(pVM, &pReq, RT_INDEFINITE_WAIT, (PFNRT)remR3DisasEnableStepping, 2, pVM, fEnable);
3380	AssertRC(rc);
3381	if (VBOX_SUCCESS(rc))
3382	rc = pReq->iStatus;
3383	VMR3ReqFree(pReq);
3384	return rc;
3385	}
3386
3387
3388	#ifdef VBOX_WITH_DEBUGGER
3389	/**
3390	* External Debugger Command: .remstep [on\|off\|1\|0]
3391	*/
3392	static DECLCALLBACK(int) remR3CmdDisasEnableStepping(PCDBGCCMD pCmd, PDBGCCMDHLP pCmdHlp, PVM pVM, PCDBGCVAR paArgs, unsigned cArgs, PDBGCVAR pResult)
3393	{
3394	bool fEnable;
3395	int rc;
3396
3397	/* print status */
3398	if (cArgs == 0)
3399	return pCmdHlp->pfnPrintf(pCmdHlp, NULL, "DisasStepping is %s\n",
3400	pVM->rem.s.Env.state & CPU_EMULATE_SINGLE_STEP ? "enabled" : "disabled");
3401
3402	/* convert the argument and change the mode. */
3403	rc = pCmdHlp->pfnVarToBool(pCmdHlp, &paArgs[0], &fEnable);
3404	if (VBOX_FAILURE(rc))
3405	return pCmdHlp->pfnVBoxError(pCmdHlp, rc, "boolean conversion failed!\n");
3406	rc = REMR3DisasEnableStepping(pVM, fEnable);
3407	if (VBOX_FAILURE(rc))
3408	return pCmdHlp->pfnVBoxError(pCmdHlp, rc, "REMR3DisasEnableStepping failed!\n");
3409	return rc;
3410	}
3411	#endif
3412
3413
3414	/**
3415	* Disassembles n instructions and prints them to the log.
3416	*
3417	* @returns Success indicator.
3418	* @param env Pointer to the recompiler CPU structure.
3419	* @param f32BitCode Indicates that whether or not the code should
3420	* be disassembled as 16 or 32 bit. If -1 the CS
3421	* selector will be inspected.
3422	* @param nrInstructions Nr of instructions to disassemble
3423	* @param pszPrefix
3424	* @remark not currently used for anything but ad-hoc debugging.
3425	*/
3426	bool remR3DisasBlock(CPUState env, int f32BitCode, int nrInstructions, char pszPrefix)
3427	{
3428	int i;
3429
3430	/*
3431	* Determin 16/32 bit mode.
3432	*/
3433	if (f32BitCode == -1)
3434	f32BitCode = !!(env->segs[R_CS].flags & X86_DESC_DB); /** @todo is this right?!!?!?!?!? */
3435
3436	/*
3437	* Convert cs:eip to host context address.
3438	* We don't care to much about cross page correctness presently.
3439	*/
3440	RTGCPTR GCPtrPC = env->segs[R_CS].base + env->eip;
3441	void *pvPC;
3442	if (f32BitCode && (env->cr[0] & (X86_CR0_PE \| X86_CR0_PG)) == (X86_CR0_PE \| X86_CR0_PG))
3443	{
3444	/* convert eip to physical address. */
3445	int rc = PGMPhysGCPtr2HCPtrByGstCR3(env->pVM,
3446	GCPtrPC,
3447	env->cr[3],
3448	env->cr[4] & (X86_CR4_PSE \| X86_CR4_PAE), /** @todo add longmode flag */
3449	&pvPC);
3450	if (VBOX_FAILURE(rc))
3451	{
3452	if (!PATMIsPatchGCAddr(env->pVM, GCPtrPC))
3453	return false;
3454	pvPC = (char *)PATMR3QueryPatchMemHC(env->pVM, NULL)
3455	+ (GCPtrPC - PATMR3QueryPatchMemGC(env->pVM, NULL));
3456	}
3457	}
3458	else
3459	{
3460	/* physical address */
3461	int rc = PGMPhysGCPhys2HCPtr(env->pVM, (RTGCPHYS)GCPtrPC, nrInstructions*16, &pvPC);
3462	if (VBOX_FAILURE(rc))
3463	return false;
3464	}
3465
3466	/*
3467	* Disassemble.
3468	*/
3469	RTINTPTR off = env->eip - (RTINTPTR)pvPC;
3470	DISCPUSTATE Cpu;
3471	Cpu.mode = f32BitCode ? CPUMODE_32BIT : CPUMODE_16BIT;
3472	Cpu.pfnReadBytes = NULL; /** @todo make cs:eip reader for the disassembler. */
3473	//Cpu.dwUserData[0] = (uintptr_t)pVM;
3474	//Cpu.dwUserData[1] = (uintptr_t)pvPC;
3475	//Cpu.dwUserData[2] = GCPtrPC;
3476
3477	for (i=0;i<nrInstructions;i++)
3478	{
3479	char szOutput[256];
3480	uint32_t cbOp;
3481	if (!DISInstr(&Cpu, (uintptr_t)pvPC, off, &cbOp, &szOutput[0]))
3482	return false;
3483	if (pszPrefix)
3484	Log(("%s: %s", pszPrefix, szOutput));
3485	else
3486	Log(("%s", szOutput));
3487
3488	pvPC += cbOp;
3489	}
3490	return true;
3491	}
3492
3493
3494	/** @todo need to test the new code, using the old code in the mean while. */
3495	#define USE_OLD_DUMP_AND_DISASSEMBLY
3496
3497	/**
3498	* Disassembles one instruction and prints it to the log.
3499	*
3500	* @returns Success indicator.
3501	* @param env Pointer to the recompiler CPU structure.
3502	* @param f32BitCode Indicates that whether or not the code should
3503	* be disassembled as 16 or 32 bit. If -1 the CS
3504	* selector will be inspected.
3505	* @param pszPrefix
3506	*/
3507	bool remR3DisasInstr(CPUState env, int f32BitCode, char pszPrefix)
3508	{
3509	#ifdef USE_OLD_DUMP_AND_DISASSEMBLY
3510	PVM pVM = env->pVM;
3511
3512	/*
3513	* Determin 16/32 bit mode.
3514	*/
3515	if (f32BitCode == -1)
3516	f32BitCode = !!(env->segs[R_CS].flags & X86_DESC_DB); /** @todo is this right?!!?!?!?!? */
3517
3518	/*
3519	* Log registers
3520	*/
3521	if (LogIs2Enabled())
3522	{
3523	remR3StateUpdate(pVM);
3524	DBGFR3InfoLog(pVM, "cpumguest", pszPrefix);
3525	}
3526
3527	/*
3528	* Convert cs:eip to host context address.
3529	* We don't care to much about cross page correctness presently.
3530	*/
3531	RTGCPTR GCPtrPC = env->segs[R_CS].base + env->eip;
3532	void *pvPC;
3533	if ((env->cr[0] & (X86_CR0_PE \| X86_CR0_PG)) == (X86_CR0_PE \| X86_CR0_PG))
3534	{
3535	/* convert eip to physical address. */
3536	int rc = PGMPhysGCPtr2HCPtrByGstCR3(pVM,
3537	GCPtrPC,
3538	env->cr[3],
3539	env->cr[4] & (X86_CR4_PSE \| X86_CR4_PAE),
3540	&pvPC);
3541	if (VBOX_FAILURE(rc))
3542	{
3543	if (!PATMIsPatchGCAddr(pVM, GCPtrPC))
3544	return false;
3545	pvPC = (char *)PATMR3QueryPatchMemHC(pVM, NULL)
3546	+ (GCPtrPC - PATMR3QueryPatchMemGC(pVM, NULL));
3547	}
3548	}
3549	else
3550	{
3551
3552	/* physical address */
3553	int rc = PGMPhysGCPhys2HCPtr(pVM, (RTGCPHYS)GCPtrPC, 16, &pvPC);
3554	if (VBOX_FAILURE(rc))
3555	return false;
3556	}
3557
3558	/*
3559	* Disassemble.
3560	*/
3561	RTINTPTR off = env->eip - (RTINTPTR)pvPC;
3562	DISCPUSTATE Cpu;
3563	Cpu.mode = f32BitCode ? CPUMODE_32BIT : CPUMODE_16BIT;
3564	Cpu.pfnReadBytes = NULL; /** @todo make cs:eip reader for the disassembler. */
3565	//Cpu.dwUserData[0] = (uintptr_t)pVM;
3566	//Cpu.dwUserData[1] = (uintptr_t)pvPC;
3567	//Cpu.dwUserData[2] = GCPtrPC;
3568	char szOutput[256];
3569	uint32_t cbOp;
3570	if (!DISInstr(&Cpu, (uintptr_t)pvPC, off, &cbOp, &szOutput[0]))
3571	return false;
3572
3573	if (!f32BitCode)
3574	{
3575	if (pszPrefix)
3576	Log(("%s: %04X:%s", pszPrefix, env->segs[R_CS].selector, szOutput));
3577	else
3578	Log(("%04X:%s", env->segs[R_CS].selector, szOutput));
3579	}
3580	else
3581	{
3582	if (pszPrefix)
3583	Log(("%s: %s", pszPrefix, szOutput));
3584	else
3585	Log(("%s", szOutput));
3586	}
3587	return true;
3588
3589	#else /* !USE_OLD_DUMP_AND_DISASSEMBLY */
3590	PVM pVM = env->pVM;
3591	const bool fLog = LogIsEnabled();
3592	const bool fLog2 = LogIs2Enabled();
3593	int rc = VINF_SUCCESS;
3594
3595	/*
3596	* Don't bother if there ain't any log output to do.
3597	*/
3598	if (!fLog && !fLog2)
3599	return true;
3600
3601	/*
3602	* Update the state so DBGF reads the correct register values.
3603	*/
3604	remR3StateUpdate(pVM);
3605
3606	/*
3607	* Log registers if requested.
3608	*/
3609	if (!fLog2)
3610	DBGFR3InfoLog(pVM, "cpumguest", pszPrefix);
3611
3612	/*
3613	* Disassemble to log.
3614	*/
3615	if (fLog)
3616	rc = DBGFR3DisasInstrCurrentLogInternal(pVM, pszPrefix);
3617
3618	return VBOX_SUCCESS(rc);
3619	#endif
3620	}
3621
3622
3623	/**
3624	* Disassemble recompiled code.
3625	*
3626	* @param phFileIgnored Ignored, logfile usually.
3627	* @param pvCode Pointer to the code block.
3628	* @param cb Size of the code block.
3629	*/
3630	void disas(FILE phFileIgnored, void pvCode, unsigned long cb)
3631	{
3632	if (LogIs2Enabled())
3633	{
3634	unsigned off = 0;
3635	char szOutput[256];
3636	DISCPUSTATE Cpu = {0};
3637	Cpu.mode = CPUMODE_32BIT;
3638
3639	RTLogPrintf("Recompiled Code: %p %#lx (%ld) bytes\n", pvCode, cb, cb);
3640	while (off < cb)
3641	{
3642	uint32_t cbInstr;
3643	if (DISInstr(&Cpu, (uintptr_t)pvCode + off, 0, &cbInstr, szOutput))
3644	RTLogPrintf("%s", szOutput);
3645	else
3646	{
3647	RTLogPrintf("disas error\n");
3648	cbInstr = 1;
3649	}
3650	off += cbInstr;
3651	}
3652	}
3653	NOREF(phFileIgnored);
3654	}
3655
3656
3657	/**
3658	* Disassemble guest code.
3659	*
3660	* @param phFileIgnored Ignored, logfile usually.
3661	* @param uCode The guest address of the code to disassemble. (flat?)
3662	* @param cb Number of bytes to disassemble.
3663	* @param fFlags Flags, probably something which tells if this is 16, 32 or 64 bit code.
3664	*/
3665	void target_disas(FILE *phFileIgnored, target_ulong uCode, target_ulong cb, int fFlags)
3666	{
3667	if (LogIs2Enabled())
3668	{
3669	PVM pVM = cpu_single_env->pVM;
3670
3671	/*
3672	* Update the state so DBGF reads the correct register values (flags).
3673	*/
3674	remR3StateUpdate(pVM);
3675
3676	/*
3677	* Do the disassembling.
3678	*/
3679	RTLogPrintf("Guest Code: PC=%VGp #VGp (%VGp) bytes fFlags=%d\n", uCode, cb, cb, fFlags);
3680	RTSEL cs = cpu_single_env->segs[R_CS].selector;
3681	RTGCUINTPTR eip = uCode - cpu_single_env->segs[R_CS].base;
3682	for (;;)
3683	{
3684	char szBuf[256];
3685	size_t cbInstr;
3686	int rc = DBGFR3DisasInstrEx(pVM,
3687	cs,
3688	eip,
3689	0,
3690	szBuf, sizeof(szBuf),
3691	&cbInstr);
3692	if (VBOX_SUCCESS(rc))
3693	RTLogPrintf("%VGp %s\n", uCode, szBuf);
3694	else
3695	{
3696	RTLogPrintf("%VGp %04x:%VGp: %s\n", uCode, cs, eip, szBuf);
3697	cbInstr = 1;
3698	}
3699
3700	/* next */
3701	if (cb <= cbInstr)
3702	break;
3703	cb -= cbInstr;
3704	uCode += cbInstr;
3705	eip += cbInstr;
3706	}
3707	}
3708	NOREF(phFileIgnored);
3709	}
3710
3711
3712	/**
3713	* Looks up a guest symbol.
3714	*
3715	* @returns Pointer to symbol name. This is a static buffer.
3716	* @param orig_addr The address in question.
3717	*/
3718	const char *lookup_symbol(target_ulong orig_addr)
3719	{
3720	RTGCINTPTR off = 0;
3721	DBGFSYMBOL Sym;
3722	PVM pVM = cpu_single_env->pVM;
3723	int rc = DBGFR3SymbolByAddr(pVM, orig_addr, &off, &Sym);
3724	if (VBOX_SUCCESS(rc))
3725	{
3726	static char szSym[sizeof(Sym.szName) + 48];
3727	if (!off)
3728	RTStrPrintf(szSym, sizeof(szSym), "%s\n", Sym.szName);
3729	else if (off > 0)
3730	RTStrPrintf(szSym, sizeof(szSym), "%s+%x\n", Sym.szName, off);
3731	else
3732	RTStrPrintf(szSym, sizeof(szSym), "%s-%x\n", Sym.szName, -off);
3733	return szSym;
3734	}
3735	return "<N/A>";
3736	}
3737
3738
3739	#undef LOG_GROUP
3740	#define LOG_GROUP LOG_GROUP_REM
3741
3742
3743	/* -+- FF notifications -+- */
3744
3745
3746	/**
3747	* Notification about a pending interrupt.
3748	*
3749	* @param pVM VM Handle.
3750	* @param u8Interrupt Interrupt
3751	* @thread The emulation thread.
3752	*/
3753	REMR3DECL(void) REMR3NotifyPendingInterrupt(PVM pVM, uint8_t u8Interrupt)
3754	{
3755	Assert(pVM->rem.s.u32PendingInterrupt == REM_NO_PENDING_IRQ);
3756	pVM->rem.s.u32PendingInterrupt = u8Interrupt;
3757	}
3758
3759	/**
3760	* Notification about a pending interrupt.
3761	*
3762	* @returns Pending interrupt or REM_NO_PENDING_IRQ
3763	* @param pVM VM Handle.
3764	* @thread The emulation thread.
3765	*/
3766	REMR3DECL(uint32_t) REMR3QueryPendingInterrupt(PVM pVM)
3767	{
3768	return pVM->rem.s.u32PendingInterrupt;
3769	}
3770
3771	/**
3772	* Notification about the interrupt FF being set.
3773	*
3774	* @param pVM VM Handle.
3775	* @thread The emulation thread.
3776	*/
3777	REMR3DECL(void) REMR3NotifyInterruptSet(PVM pVM)
3778	{
3779	LogFlow(("REMR3NotifyInterruptSet: fInRem=%d interrupts %s\n", pVM->rem.s.fInREM,
3780	(pVM->rem.s.Env.eflags & IF_MASK) && !(pVM->rem.s.Env.hflags & HF_INHIBIT_IRQ_MASK) ? "enabled" : "disabled"));
3781	if (pVM->rem.s.fInREM)
3782	{
3783	if (VM_IS_EMT(pVM))
3784	cpu_interrupt(cpu_single_env, CPU_INTERRUPT_HARD);
3785	else
3786	ASMAtomicOrS32(&cpu_single_env->interrupt_request, CPU_INTERRUPT_EXTERNAL_HARD);
3787	}
3788	}
3789
3790
3791	/**
3792	* Notification about the interrupt FF being set.
3793	*
3794	* @param pVM VM Handle.
3795	* @thread The emulation thread.
3796	*/
3797	REMR3DECL(void) REMR3NotifyInterruptClear(PVM pVM)
3798	{
3799	LogFlow(("REMR3NotifyInterruptClear:\n"));
3800	VM_ASSERT_EMT(pVM);
3801	if (pVM->rem.s.fInREM)
3802	cpu_reset_interrupt(cpu_single_env, CPU_INTERRUPT_HARD);
3803	}
3804
3805
3806	/**
3807	* Notification about pending timer(s).
3808	*
3809	* @param pVM VM Handle.
3810	* @thread Any.
3811	*/
3812	REMR3DECL(void) REMR3NotifyTimerPending(PVM pVM)
3813	{
3814	#ifndef DEBUG_bird
3815	LogFlow(("REMR3NotifyTimerPending: fInRem=%d\n", pVM->rem.s.fInREM));
3816	#endif
3817	if (pVM->rem.s.fInREM)
3818	{
3819	if (VM_IS_EMT(pVM))
3820	cpu_interrupt(cpu_single_env, CPU_INTERRUPT_EXIT);
3821	else
3822	ASMAtomicOrS32(&cpu_single_env->interrupt_request, CPU_INTERRUPT_EXTERNAL_TIMER);
3823	}
3824	}
3825
3826
3827	/**
3828	* Notification about pending DMA transfers.
3829	*
3830	* @param pVM VM Handle.
3831	* @thread Any.
3832	*/
3833	REMR3DECL(void) REMR3NotifyDmaPending(PVM pVM)
3834	{
3835	LogFlow(("REMR3NotifyDmaPending: fInRem=%d\n", pVM->rem.s.fInREM));
3836	if (pVM->rem.s.fInREM)
3837	{
3838	if (VM_IS_EMT(pVM))
3839	cpu_interrupt(cpu_single_env, CPU_INTERRUPT_EXIT);
3840	else
3841	ASMAtomicOrS32(&cpu_single_env->interrupt_request, CPU_INTERRUPT_EXTERNAL_DMA);
3842	}
3843	}
3844
3845
3846	/**
3847	* Notification about pending timer(s).
3848	*
3849	* @param pVM VM Handle.
3850	* @thread Any.
3851	*/
3852	REMR3DECL(void) REMR3NotifyQueuePending(PVM pVM)
3853	{
3854	LogFlow(("REMR3NotifyQueuePending: fInRem=%d\n", pVM->rem.s.fInREM));
3855	if (pVM->rem.s.fInREM)
3856	{
3857	if (VM_IS_EMT(pVM))
3858	cpu_interrupt(cpu_single_env, CPU_INTERRUPT_EXIT);
3859	else
3860	ASMAtomicOrS32(&cpu_single_env->interrupt_request, CPU_INTERRUPT_EXTERNAL_EXIT);
3861	}
3862	}
3863
3864
3865	/**
3866	* Notification about pending FF set by an external thread.
3867	*
3868	* @param pVM VM handle.
3869	* @thread Any.
3870	*/
3871	REMR3DECL(void) REMR3NotifyFF(PVM pVM)
3872	{
3873	LogFlow(("REMR3NotifyFF: fInRem=%d\n", pVM->rem.s.fInREM));
3874	if (pVM->rem.s.fInREM)
3875	{
3876	if (VM_IS_EMT(pVM))
3877	cpu_interrupt(cpu_single_env, CPU_INTERRUPT_EXIT);
3878	else
3879	ASMAtomicOrS32(&cpu_single_env->interrupt_request, CPU_INTERRUPT_EXTERNAL_EXIT);
3880	}
3881	}
3882
3883
3884	#ifdef VBOX_WITH_STATISTICS
3885	void remR3ProfileStart(int statcode)
3886	{
3887	STAMPROFILEADV *pStat;
3888	switch(statcode)
3889	{
3890	case STATS_EMULATE_SINGLE_INSTR:
3891	pStat = &gStatExecuteSingleInstr;
3892	break;
3893	case STATS_QEMU_COMPILATION:
3894	pStat = &gStatCompilationQEmu;
3895	break;
3896	case STATS_QEMU_RUN_EMULATED_CODE:
3897	pStat = &gStatRunCodeQEmu;
3898	break;
3899	case STATS_QEMU_TOTAL:
3900	pStat = &gStatTotalTimeQEmu;
3901	break;
3902	case STATS_QEMU_RUN_TIMERS:
3903	pStat = &gStatTimers;
3904	break;
3905	case STATS_TLB_LOOKUP:
3906	pStat= &gStatTBLookup;
3907	break;
3908	case STATS_IRQ_HANDLING:
3909	pStat= &gStatIRQ;
3910	break;
3911	case STATS_RAW_CHECK:
3912	pStat = &gStatRawCheck;
3913	break;
3914
3915	default:
3916	AssertMsgFailed(("unknown stat %d\n", statcode));
3917	return;
3918	}
3919	STAM_PROFILE_ADV_START(pStat, a);
3920	}
3921
3922
3923	void remR3ProfileStop(int statcode)
3924	{
3925	STAMPROFILEADV *pStat;
3926	switch(statcode)
3927	{
3928	case STATS_EMULATE_SINGLE_INSTR:
3929	pStat = &gStatExecuteSingleInstr;
3930	break;
3931	case STATS_QEMU_COMPILATION:
3932	pStat = &gStatCompilationQEmu;
3933	break;
3934	case STATS_QEMU_RUN_EMULATED_CODE:
3935	pStat = &gStatRunCodeQEmu;
3936	break;
3937	case STATS_QEMU_TOTAL:
3938	pStat = &gStatTotalTimeQEmu;
3939	break;
3940	case STATS_QEMU_RUN_TIMERS:
3941	pStat = &gStatTimers;
3942	break;
3943	case STATS_TLB_LOOKUP:
3944	pStat= &gStatTBLookup;
3945	break;
3946	case STATS_IRQ_HANDLING:
3947	pStat= &gStatIRQ;
3948	break;
3949	case STATS_RAW_CHECK:
3950	pStat = &gStatRawCheck;
3951	break;
3952	default:
3953	AssertMsgFailed(("unknown stat %d\n", statcode));
3954	return;
3955	}
3956	STAM_PROFILE_ADV_STOP(pStat, a);
3957	}
3958	#endif
3959
3960	/**
3961	* Raise an RC, force rem exit.
3962	*
3963	* @param pVM VM handle.
3964	* @param rc The rc.
3965	*/
3966	void remR3RaiseRC(PVM pVM, int rc)
3967	{
3968	Log(("remR3RaiseRC: rc=%Vrc\n", rc));
3969	Assert(pVM->rem.s.fInREM);
3970	VM_ASSERT_EMT(pVM);
3971	pVM->rem.s.rc = rc;
3972	cpu_interrupt(&pVM->rem.s.Env, CPU_INTERRUPT_RC);
3973	}
3974
3975
3976	/* -+- timers -+- */
3977
3978	uint64_t cpu_get_tsc(CPUX86State *env)
3979	{
3980	return TMCpuTickGet(env->pVM);
3981	}
3982
3983
3984	/* -+- interrupts -+- */
3985
3986	void cpu_set_ferr(CPUX86State *env)
3987	{
3988	int rc = PDMIsaSetIrq(env->pVM, 13, 1);
3989	LogFlow(("cpu_set_ferr: rc=%d\n", rc)); NOREF(rc);
3990	}
3991
3992	int cpu_get_pic_interrupt(CPUState *env)
3993	{
3994	uint8_t u8Interrupt;
3995	int rc;
3996
3997	/* When we fail to forward interrupts directly in raw mode, we fall back to the recompiler.
3998	* In that case we can't call PDMGetInterrupt anymore, because it has already cleared the interrupt
3999	* with the (a)pic.
4000	*/
4001	/** @note We assume we will go directly to the recompiler to handle the pending interrupt! */
4002	/** @todo r=bird: In the long run we should just do the interrupt handling in EM/CPUM/TRPM/somewhere and
4003	* if we cannot execute the interrupt handler in raw-mode just reschedule to REM. Once that is done we
4004	* remove this kludge. */
4005	if (env->pVM->rem.s.u32PendingInterrupt != REM_NO_PENDING_IRQ)
4006	{
4007	rc = VINF_SUCCESS;
4008	Assert(env->pVM->rem.s.u32PendingInterrupt >= 0 && env->pVM->rem.s.u32PendingInterrupt <= 255);
4009	u8Interrupt = env->pVM->rem.s.u32PendingInterrupt;
4010	env->pVM->rem.s.u32PendingInterrupt = REM_NO_PENDING_IRQ;
4011	}
4012	else
4013	rc = PDMGetInterrupt(env->pVM, &u8Interrupt);
4014
4015	LogFlow(("cpu_get_pic_interrupt: u8Interrupt=%d rc=%Vrc\n", u8Interrupt, rc));
4016	if (VBOX_SUCCESS(rc))
4017	{
4018	if (VM_FF_ISPENDING(env->pVM, VM_FF_INTERRUPT_APIC \| VM_FF_INTERRUPT_PIC))
4019	env->interrupt_request \|= CPU_INTERRUPT_HARD;
4020	return u8Interrupt;
4021	}
4022	return -1;
4023	}
4024
4025
4026	/* -+- local apic -+- */
4027
4028	void cpu_set_apic_base(CPUX86State *env, uint64_t val)
4029	{
4030	int rc = PDMApicSetBase(env->pVM, val);
4031	LogFlow(("cpu_set_apic_base: val=%#llx rc=%Vrc\n", val, rc)); NOREF(rc);
4032	}
4033
4034	uint64_t cpu_get_apic_base(CPUX86State *env)
4035	{
4036	uint64_t u64;
4037	int rc = PDMApicGetBase(env->pVM, &u64);
4038	if (VBOX_SUCCESS(rc))
4039	{
4040	LogFlow(("cpu_get_apic_base: returns %#llx \n", u64));
4041	return u64;
4042	}
4043	LogFlow(("cpu_get_apic_base: returns 0 (rc=%Vrc)\n", rc));
4044	return 0;
4045	}
4046
4047	void cpu_set_apic_tpr(CPUX86State *env, uint8_t val)
4048	{
4049	int rc = PDMApicSetTPR(env->pVM, val);
4050	LogFlow(("cpu_set_apic_tpr: val=%#x rc=%Vrc\n", val, rc)); NOREF(rc);
4051	}
4052
4053	uint8_t cpu_get_apic_tpr(CPUX86State *env)
4054	{
4055	uint8_t u8;
4056	int rc = PDMApicGetTPR(env->pVM, &u8);
4057	if (VBOX_SUCCESS(rc))
4058	{
4059	LogFlow(("cpu_get_apic_tpr: returns %#x\n", u8));
4060	return u8;
4061	}
4062	LogFlow(("cpu_get_apic_tpr: returns 0 (rc=%Vrc)\n", rc));
4063	return 0;
4064	}
4065
4066
4067	/* -+- I/O Ports -+- */
4068
4069	#undef LOG_GROUP
4070	#define LOG_GROUP LOG_GROUP_REM_IOPORT
4071
4072	void cpu_outb(CPUState *env, int addr, int val)
4073	{
4074	if (addr != 0x80 && addr != 0x70 && addr != 0x61)
4075	Log2(("cpu_outb: addr=%#06x val=%#x\n", addr, val));
4076
4077	int rc = IOMIOPortWrite(env->pVM, (RTIOPORT)addr, val, 1);
4078	if (rc == VINF_SUCCESS)
4079	return;
4080	if (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST)
4081	{
4082	Log(("cpu_outb: addr=%#06x val=%#x -> %Vrc\n", addr, val, rc));
4083	remR3RaiseRC(env->pVM, rc);
4084	return;
4085	}
4086	remAbort(rc, __FUNCTION__);
4087	}
4088
4089	void cpu_outw(CPUState *env, int addr, int val)
4090	{
4091	//Log2(("cpu_outw: addr=%#06x val=%#x\n", addr, val));
4092	int rc = IOMIOPortWrite(env->pVM, (RTIOPORT)addr, val, 2);
4093	if (rc == VINF_SUCCESS)
4094	return;
4095	if (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST)
4096	{
4097	Log(("cpu_outw: addr=%#06x val=%#x -> %Vrc\n", addr, val, rc));
4098	remR3RaiseRC(env->pVM, rc);
4099	return;
4100	}
4101	remAbort(rc, __FUNCTION__);
4102	}
4103
4104	void cpu_outl(CPUState *env, int addr, int val)
4105	{
4106	Log2(("cpu_outl: addr=%#06x val=%#x\n", addr, val));
4107	int rc = IOMIOPortWrite(env->pVM, (RTIOPORT)addr, val, 4);
4108	if (rc == VINF_SUCCESS)
4109	return;
4110	if (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST)
4111	{
4112	Log(("cpu_outl: addr=%#06x val=%#x -> %Vrc\n", addr, val, rc));
4113	remR3RaiseRC(env->pVM, rc);
4114	return;
4115	}
4116	remAbort(rc, __FUNCTION__);
4117	}
4118
4119	int cpu_inb(CPUState *env, int addr)
4120	{
4121	uint32_t u32 = 0;
4122	int rc = IOMIOPortRead(env->pVM, (RTIOPORT)addr, &u32, 1);
4123	if (rc == VINF_SUCCESS)
4124	{
4125	if (/addr != 0x61 && /addr != 0x71)
4126	Log2(("cpu_inb: addr=%#06x -> %#x\n", addr, u32));
4127	return (int)u32;
4128	}
4129	if (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST)
4130	{
4131	Log(("cpu_inb: addr=%#06x -> %#x rc=%Vrc\n", addr, u32, rc));
4132	remR3RaiseRC(env->pVM, rc);
4133	return (int)u32;
4134	}
4135	remAbort(rc, __FUNCTION__);
4136	return 0xff;
4137	}
4138
4139	int cpu_inw(CPUState *env, int addr)
4140	{
4141	uint32_t u32 = 0;
4142	int rc = IOMIOPortRead(env->pVM, (RTIOPORT)addr, &u32, 2);
4143	if (rc == VINF_SUCCESS)
4144	{
4145	Log2(("cpu_inw: addr=%#06x -> %#x\n", addr, u32));
4146	return (int)u32;
4147	}
4148	if (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST)
4149	{
4150	Log(("cpu_inw: addr=%#06x -> %#x rc=%Vrc\n", addr, u32, rc));
4151	remR3RaiseRC(env->pVM, rc);
4152	return (int)u32;
4153	}
4154	remAbort(rc, __FUNCTION__);
4155	return 0xffff;
4156	}
4157
4158	int cpu_inl(CPUState *env, int addr)
4159	{
4160	uint32_t u32 = 0;
4161	int rc = IOMIOPortRead(env->pVM, (RTIOPORT)addr, &u32, 4);
4162	if (rc == VINF_SUCCESS)
4163	{
4164	//if (addr==0x01f0 && u32 == 0x6b6d)
4165	// loglevel = ~0;
4166	Log2(("cpu_inl: addr=%#06x -> %#x\n", addr, u32));
4167	return (int)u32;
4168	}
4169	if (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST)
4170	{
4171	Log(("cpu_inl: addr=%#06x -> %#x rc=%Vrc\n", addr, u32, rc));
4172	remR3RaiseRC(env->pVM, rc);
4173	return (int)u32;
4174	}
4175	remAbort(rc, __FUNCTION__);
4176	return 0xffffffff;
4177	}
4178
4179	#undef LOG_GROUP
4180	#define LOG_GROUP LOG_GROUP_REM
4181
4182
4183	/* -+- helpers and misc other interfaces -+- */
4184
4185	/**
4186	* Perform the CPUID instruction.
4187	*
4188	* ASMCpuId cannot be invoked from some source files where this is used because of global
4189	* register allocations.
4190	*
4191	* @param env Pointer to the recompiler CPU structure.
4192	* @param uOperator CPUID operation (eax).
4193	* @param pvEAX Where to store eax.
4194	* @param pvEBX Where to store ebx.
4195	* @param pvECX Where to store ecx.
4196	* @param pvEDX Where to store edx.
4197	*/
4198	void remR3CpuId(CPUState env, unsigned uOperator, void pvEAX, void pvEBX, void pvECX, void *pvEDX)
4199	{
4200	CPUMGetGuestCpuId(env->pVM, uOperator, (uint32_t )pvEAX, (uint32_t )pvEBX, (uint32_t )pvECX, (uint32_t )pvEDX);
4201	}
4202
4203
4204	#if 0 /* not used */
4205	/**
4206	* Interface for qemu hardware to report back fatal errors.
4207	*/
4208	void hw_error(const char *pszFormat, ...)
4209	{
4210	/*
4211	* Bitch about it.
4212	*/
4213	/** @todo Add support for nested arg lists in the LogPrintfV routine! I've code for
4214	* this in my Odin32 tree at home! */
4215	va_list args;
4216	va_start(args, pszFormat);
4217	RTLogPrintf("fatal error in virtual hardware:");
4218	RTLogPrintfV(pszFormat, args);
4219	va_end(args);
4220	AssertReleaseMsgFailed(("fatal error in virtual hardware: %s\n", pszFormat));
4221
4222	/*
4223	* If we're in REM context we'll sync back the state before 'jumping' to
4224	* the EMs failure handling.
4225	*/
4226	PVM pVM = cpu_single_env->pVM;
4227	if (pVM->rem.s.fInREM)
4228	REMR3StateBack(pVM);
4229	EMR3FatalError(pVM, VERR_REM_VIRTUAL_HARDWARE_ERROR);
4230	AssertMsgFailed(("EMR3FatalError returned!\n"));
4231	}
4232	#endif
4233
4234	/**
4235	* Interface for the qemu cpu to report unhandled situation
4236	* raising a fatal VM error.
4237	*/
4238	void cpu_abort(CPUState env, const char pszFormat, ...)
4239	{
4240	/*
4241	* Bitch about it.
4242	*/
4243	RTLogFlags(NULL, "nodisabled nobuffered");
4244	va_list args;
4245	va_start(args, pszFormat);
4246	RTLogPrintf("fatal error in recompiler cpu: %N\n", pszFormat, &args);
4247	va_end(args);
4248	va_start(args, pszFormat);
4249	AssertReleaseMsgFailed(("fatal error in recompiler cpu: %N\n", pszFormat, &args));
4250	va_end(args);
4251
4252	/*
4253	* If we're in REM context we'll sync back the state before 'jumping' to
4254	* the EMs failure handling.
4255	*/
4256	PVM pVM = cpu_single_env->pVM;
4257	if (pVM->rem.s.fInREM)
4258	REMR3StateBack(pVM);
4259	EMR3FatalError(pVM, VERR_REM_VIRTUAL_CPU_ERROR);
4260	AssertMsgFailed(("EMR3FatalError returned!\n"));
4261	}
4262
4263
4264	/**
4265	* Aborts the VM.
4266	*
4267	* @param rc VBox error code.
4268	* @param pszTip Hint about why/when this happend.
4269	*/
4270	static void remAbort(int rc, const char *pszTip)
4271	{
4272	/*
4273	* Bitch about it.
4274	*/
4275	RTLogPrintf("internal REM fatal error: rc=%Vrc %s\n", rc, pszTip);
4276	AssertReleaseMsgFailed(("internal REM fatal error: rc=%Vrc %s\n", rc, pszTip));
4277
4278	/*
4279	* Jump back to where we entered the recompiler.
4280	*/
4281	PVM pVM = cpu_single_env->pVM;
4282	if (pVM->rem.s.fInREM)
4283	REMR3StateBack(pVM);
4284	EMR3FatalError(pVM, rc);
4285	AssertMsgFailed(("EMR3FatalError returned!\n"));
4286	}
4287
4288
4289	/**
4290	* Dumps a linux system call.
4291	* @param pVM VM handle.
4292	*/
4293	void remR3DumpLnxSyscall(PVM pVM)
4294	{
4295	static const char *apsz[] =
4296	{
4297	"sys_restart_syscall", /* 0 - old "setup()" system call, used for restarting */
4298	"sys_exit",
4299	"sys_fork",
4300	"sys_read",
4301	"sys_write",
4302	"sys_open", /* 5 */
4303	"sys_close",
4304	"sys_waitpid",
4305	"sys_creat",
4306	"sys_link",
4307	"sys_unlink", /* 10 */
4308	"sys_execve",
4309	"sys_chdir",
4310	"sys_time",
4311	"sys_mknod",
4312	"sys_chmod", /* 15 */
4313	"sys_lchown16",
4314	"sys_ni_syscall", /* old break syscall holder */
4315	"sys_stat",
4316	"sys_lseek",
4317	"sys_getpid", /* 20 */
4318	"sys_mount",
4319	"sys_oldumount",
4320	"sys_setuid16",
4321	"sys_getuid16",
4322	"sys_stime", /* 25 */
4323	"sys_ptrace",
4324	"sys_alarm",
4325	"sys_fstat",
4326	"sys_pause",
4327	"sys_utime", /* 30 */
4328	"sys_ni_syscall", /* old stty syscall holder */
4329	"sys_ni_syscall", /* old gtty syscall holder */
4330	"sys_access",
4331	"sys_nice",
4332	"sys_ni_syscall", /* 35 - old ftime syscall holder */
4333	"sys_sync",
4334	"sys_kill",
4335	"sys_rename",
4336	"sys_mkdir",
4337	"sys_rmdir", /* 40 */
4338	"sys_dup",
4339	"sys_pipe",
4340	"sys_times",
4341	"sys_ni_syscall", /* old prof syscall holder */
4342	"sys_brk", /* 45 */
4343	"sys_setgid16",
4344	"sys_getgid16",
4345	"sys_signal",
4346	"sys_geteuid16",
4347	"sys_getegid16", /* 50 */
4348	"sys_acct",
4349	"sys_umount", /* recycled never used phys() */
4350	"sys_ni_syscall", /* old lock syscall holder */
4351	"sys_ioctl",
4352	"sys_fcntl", /* 55 */
4353	"sys_ni_syscall", /* old mpx syscall holder */
4354	"sys_setpgid",
4355	"sys_ni_syscall", /* old ulimit syscall holder */
4356	"sys_olduname",
4357	"sys_umask", /* 60 */
4358	"sys_chroot",
4359	"sys_ustat",
4360	"sys_dup2",
4361	"sys_getppid",
4362	"sys_getpgrp", /* 65 */
4363	"sys_setsid",
4364	"sys_sigaction",
4365	"sys_sgetmask",
4366	"sys_ssetmask",
4367	"sys_setreuid16", /* 70 */
4368	"sys_setregid16",
4369	"sys_sigsuspend",
4370	"sys_sigpending",
4371	"sys_sethostname",
4372	"sys_setrlimit", /* 75 */
4373	"sys_old_getrlimit",
4374	"sys_getrusage",
4375	"sys_gettimeofday",
4376	"sys_settimeofday",
4377	"sys_getgroups16", /* 80 */
4378	"sys_setgroups16",
4379	"old_select",
4380	"sys_symlink",
4381	"sys_lstat",
4382	"sys_readlink", /* 85 */
4383	"sys_uselib",
4384	"sys_swapon",
4385	"sys_reboot",
4386	"old_readdir",
4387	"old_mmap", /* 90 */
4388	"sys_munmap",
4389	"sys_truncate",
4390	"sys_ftruncate",
4391	"sys_fchmod",
4392	"sys_fchown16", /* 95 */
4393	"sys_getpriority",
4394	"sys_setpriority",
4395	"sys_ni_syscall", /* old profil syscall holder */
4396	"sys_statfs",
4397	"sys_fstatfs", /* 100 */
4398	"sys_ioperm",
4399	"sys_socketcall",
4400	"sys_syslog",
4401	"sys_setitimer",
4402	"sys_getitimer", /* 105 */
4403	"sys_newstat",
4404	"sys_newlstat",
4405	"sys_newfstat",
4406	"sys_uname",
4407	"sys_iopl", /* 110 */
4408	"sys_vhangup",
4409	"sys_ni_syscall", /* old "idle" system call */
4410	"sys_vm86old",
4411	"sys_wait4",
4412	"sys_swapoff", /* 115 */
4413	"sys_sysinfo",
4414	"sys_ipc",
4415	"sys_fsync",
4416	"sys_sigreturn",
4417	"sys_clone", /* 120 */
4418	"sys_setdomainname",
4419	"sys_newuname",
4420	"sys_modify_ldt",
4421	"sys_adjtimex",
4422	"sys_mprotect", /* 125 */
4423	"sys_sigprocmask",
4424	"sys_ni_syscall", /* old "create_module" */
4425	"sys_init_module",
4426	"sys_delete_module",
4427	"sys_ni_syscall", /* 130: old "get_kernel_syms" */
4428	"sys_quotactl",
4429	"sys_getpgid",
4430	"sys_fchdir",
4431	"sys_bdflush",
4432	"sys_sysfs", /* 135 */
4433	"sys_personality",
4434	"sys_ni_syscall", /* reserved for afs_syscall */
4435	"sys_setfsuid16",
4436	"sys_setfsgid16",
4437	"sys_llseek", /* 140 */
4438	"sys_getdents",
4439	"sys_select",
4440	"sys_flock",
4441	"sys_msync",
4442	"sys_readv", /* 145 */
4443	"sys_writev",
4444	"sys_getsid",
4445	"sys_fdatasync",
4446	"sys_sysctl",
4447	"sys_mlock", /* 150 */
4448	"sys_munlock",
4449	"sys_mlockall",
4450	"sys_munlockall",
4451	"sys_sched_setparam",
4452	"sys_sched_getparam", /* 155 */
4453	"sys_sched_setscheduler",
4454	"sys_sched_getscheduler",
4455	"sys_sched_yield",
4456	"sys_sched_get_priority_max",
4457	"sys_sched_get_priority_min", /* 160 */
4458	"sys_sched_rr_get_interval",
4459	"sys_nanosleep",
4460	"sys_mremap",
4461	"sys_setresuid16",
4462	"sys_getresuid16", /* 165 */
4463	"sys_vm86",
4464	"sys_ni_syscall", /* Old sys_query_module */
4465	"sys_poll",
4466	"sys_nfsservctl",
4467	"sys_setresgid16", /* 170 */
4468	"sys_getresgid16",
4469	"sys_prctl",
4470	"sys_rt_sigreturn",
4471	"sys_rt_sigaction",
4472	"sys_rt_sigprocmask", /* 175 */
4473	"sys_rt_sigpending",
4474	"sys_rt_sigtimedwait",
4475	"sys_rt_sigqueueinfo",
4476	"sys_rt_sigsuspend",
4477	"sys_pread64", /* 180 */
4478	"sys_pwrite64",
4479	"sys_chown16",
4480	"sys_getcwd",
4481	"sys_capget",
4482	"sys_capset", /* 185 */
4483	"sys_sigaltstack",
4484	"sys_sendfile",
4485	"sys_ni_syscall", /* reserved for streams1 */
4486	"sys_ni_syscall", /* reserved for streams2 */
4487	"sys_vfork", /* 190 */
4488	"sys_getrlimit",
4489	"sys_mmap2",
4490	"sys_truncate64",
4491	"sys_ftruncate64",
4492	"sys_stat64", /* 195 */
4493	"sys_lstat64",
4494	"sys_fstat64",
4495	"sys_lchown",
4496	"sys_getuid",
4497	"sys_getgid", /* 200 */
4498	"sys_geteuid",
4499	"sys_getegid",
4500	"sys_setreuid",
4501	"sys_setregid",
4502	"sys_getgroups", /* 205 */
4503	"sys_setgroups",
4504	"sys_fchown",
4505	"sys_setresuid",
4506	"sys_getresuid",
4507	"sys_setresgid", /* 210 */
4508	"sys_getresgid",
4509	"sys_chown",
4510	"sys_setuid",
4511	"sys_setgid",
4512	"sys_setfsuid", /* 215 */
4513	"sys_setfsgid",
4514	"sys_pivot_root",
4515	"sys_mincore",
4516	"sys_madvise",
4517	"sys_getdents64", /* 220 */
4518	"sys_fcntl64",
4519	"sys_ni_syscall", /* reserved for TUX */
4520	"sys_ni_syscall",
4521	"sys_gettid",
4522	"sys_readahead", /* 225 */
4523	"sys_setxattr",
4524	"sys_lsetxattr",
4525	"sys_fsetxattr",
4526	"sys_getxattr",
4527	"sys_lgetxattr", /* 230 */
4528	"sys_fgetxattr",
4529	"sys_listxattr",
4530	"sys_llistxattr",
4531	"sys_flistxattr",
4532	"sys_removexattr", /* 235 */
4533	"sys_lremovexattr",
4534	"sys_fremovexattr",
4535	"sys_tkill",
4536	"sys_sendfile64",
4537	"sys_futex", /* 240 */
4538	"sys_sched_setaffinity",
4539	"sys_sched_getaffinity",
4540	"sys_set_thread_area",
4541	"sys_get_thread_area",
4542	"sys_io_setup", /* 245 */
4543	"sys_io_destroy",
4544	"sys_io_getevents",
4545	"sys_io_submit",
4546	"sys_io_cancel",
4547	"sys_fadvise64", /* 250 */
4548	"sys_ni_syscall",
4549	"sys_exit_group",
4550	"sys_lookup_dcookie",
4551	"sys_epoll_create",
4552	"sys_epoll_ctl", /* 255 */
4553	"sys_epoll_wait",
4554	"sys_remap_file_pages",
4555	"sys_set_tid_address",
4556	"sys_timer_create",
4557	"sys_timer_settime", /* 260 */
4558	"sys_timer_gettime",
4559	"sys_timer_getoverrun",
4560	"sys_timer_delete",
4561	"sys_clock_settime",
4562	"sys_clock_gettime", /* 265 */
4563	"sys_clock_getres",
4564	"sys_clock_nanosleep",
4565	"sys_statfs64",
4566	"sys_fstatfs64",
4567	"sys_tgkill", /* 270 */
4568	"sys_utimes",
4569	"sys_fadvise64_64",
4570	"sys_ni_syscall" /* sys_vserver */
4571	};
4572
4573	uint32_t uEAX = CPUMGetGuestEAX(pVM);
4574	switch (uEAX)
4575	{
4576	default:
4577	if (uEAX < ELEMENTS(apsz))
4578	Log(("REM: linux syscall %3d: %s (eip=%VGv ebx=%08x ecx=%08x edx=%08x esi=%08x edi=%08x ebp=%08x)\n",
4579	uEAX, apsz[uEAX], CPUMGetGuestEIP(pVM), CPUMGetGuestEBX(pVM), CPUMGetGuestECX(pVM),
4580	CPUMGetGuestEDX(pVM), CPUMGetGuestESI(pVM), CPUMGetGuestEDI(pVM), CPUMGetGuestEBP(pVM)));
4581	else
4582	Log(("eip=%08x: linux syscall %d (#%x) unknown\n", CPUMGetGuestEIP(pVM), uEAX, uEAX));
4583	break;
4584
4585	}
4586	}
4587
4588
4589	/**
4590	* Dumps an OpenBSD system call.
4591	* @param pVM VM handle.
4592	*/
4593	void remR3DumpOBsdSyscall(PVM pVM)
4594	{
4595	static const char *apsz[] =
4596	{
4597	"SYS_syscall", //0
4598	"SYS_exit", //1
4599	"SYS_fork", //2
4600	"SYS_read", //3
4601	"SYS_write", //4
4602	"SYS_open", //5
4603	"SYS_close", //6
4604	"SYS_wait4", //7
4605	"SYS_8",
4606	"SYS_link", //9
4607	"SYS_unlink", //10
4608	"SYS_11",
4609	"SYS_chdir", //12
4610	"SYS_fchdir", //13
4611	"SYS_mknod", //14
4612	"SYS_chmod", //15
4613	"SYS_chown", //16
4614	"SYS_break", //17
4615	"SYS_18",
4616	"SYS_19",
4617	"SYS_getpid", //20
4618	"SYS_mount", //21
4619	"SYS_unmount", //22
4620	"SYS_setuid", //23
4621	"SYS_getuid", //24
4622	"SYS_geteuid", //25
4623	"SYS_ptrace", //26
4624	"SYS_recvmsg", //27
4625	"SYS_sendmsg", //28
4626	"SYS_recvfrom", //29
4627	"SYS_accept", //30
4628	"SYS_getpeername", //31
4629	"SYS_getsockname", //32
4630	"SYS_access", //33
4631	"SYS_chflags", //34
4632	"SYS_fchflags", //35
4633	"SYS_sync", //36
4634	"SYS_kill", //37
4635	"SYS_38",
4636	"SYS_getppid", //39
4637	"SYS_40",
4638	"SYS_dup", //41
4639	"SYS_opipe", //42
4640	"SYS_getegid", //43
4641	"SYS_profil", //44
4642	"SYS_ktrace", //45
4643	"SYS_sigaction", //46
4644	"SYS_getgid", //47
4645	"SYS_sigprocmask", //48
4646	"SYS_getlogin", //49
4647	"SYS_setlogin", //50
4648	"SYS_acct", //51
4649	"SYS_sigpending", //52
4650	"SYS_osigaltstack", //53
4651	"SYS_ioctl", //54
4652	"SYS_reboot", //55
4653	"SYS_revoke", //56
4654	"SYS_symlink", //57
4655	"SYS_readlink", //58
4656	"SYS_execve", //59
4657	"SYS_umask", //60
4658	"SYS_chroot", //61
4659	"SYS_62",
4660	"SYS_63",
4661	"SYS_64",
4662	"SYS_65",
4663	"SYS_vfork", //66
4664	"SYS_67",
4665	"SYS_68",
4666	"SYS_sbrk", //69
4667	"SYS_sstk", //70
4668	"SYS_61",
4669	"SYS_vadvise", //72
4670	"SYS_munmap", //73
4671	"SYS_mprotect", //74
4672	"SYS_madvise", //75
4673	"SYS_76",
4674	"SYS_77",
4675	"SYS_mincore", //78
4676	"SYS_getgroups", //79
4677	"SYS_setgroups", //80
4678	"SYS_getpgrp", //81
4679	"SYS_setpgid", //82
4680	"SYS_setitimer", //83
4681	"SYS_84",
4682	"SYS_85",
4683	"SYS_getitimer", //86
4684	"SYS_87",
4685	"SYS_88",
4686	"SYS_89",
4687	"SYS_dup2", //90
4688	"SYS_91",
4689	"SYS_fcntl", //92
4690	"SYS_select", //93
4691	"SYS_94",
4692	"SYS_fsync", //95
4693	"SYS_setpriority", //96
4694	"SYS_socket", //97
4695	"SYS_connect", //98
4696	"SYS_99",
4697	"SYS_getpriority", //100
4698	"SYS_101",
4699	"SYS_102",
4700	"SYS_sigreturn", //103
4701	"SYS_bind", //104
4702	"SYS_setsockopt", //105
4703	"SYS_listen", //106
4704	"SYS_107",
4705	"SYS_108",
4706	"SYS_109",
4707	"SYS_110",
4708	"SYS_sigsuspend", //111
4709	"SYS_112",
4710	"SYS_113",
4711	"SYS_114",
4712	"SYS_115",
4713	"SYS_gettimeofday", //116
4714	"SYS_getrusage", //117
4715	"SYS_getsockopt", //118
4716	"SYS_119",
4717	"SYS_readv", //120
4718	"SYS_writev", //121
4719	"SYS_settimeofday", //122
4720	"SYS_fchown", //123
4721	"SYS_fchmod", //124
4722	"SYS_125",
4723	"SYS_setreuid", //126
4724	"SYS_setregid", //127
4725	"SYS_rename", //128
4726	"SYS_129",
4727	"SYS_130",
4728	"SYS_flock", //131
4729	"SYS_mkfifo", //132
4730	"SYS_sendto", //133
4731	"SYS_shutdown", //134
4732	"SYS_socketpair", //135
4733	"SYS_mkdir", //136
4734	"SYS_rmdir", //137
4735	"SYS_utimes", //138
4736	"SYS_139",
4737	"SYS_adjtime", //140
4738	"SYS_141",
4739	"SYS_142",
4740	"SYS_143",
4741	"SYS_144",
4742	"SYS_145",
4743	"SYS_146",
4744	"SYS_setsid", //147
4745	"SYS_quotactl", //148
4746	"SYS_149",
4747	"SYS_150",
4748	"SYS_151",
4749	"SYS_152",
4750	"SYS_153",
4751	"SYS_154",
4752	"SYS_nfssvc", //155
4753	"SYS_156",
4754	"SYS_157",
4755	"SYS_158",
4756	"SYS_159",
4757	"SYS_160",
4758	"SYS_getfh", //161
4759	"SYS_162",
4760	"SYS_163",
4761	"SYS_164",
4762	"SYS_sysarch", //165
4763	"SYS_166",
4764	"SYS_167",
4765	"SYS_168",
4766	"SYS_169",
4767	"SYS_170",
4768	"SYS_171",
4769	"SYS_172",
4770	"SYS_pread", //173
4771	"SYS_pwrite", //174
4772	"SYS_175",
4773	"SYS_176",
4774	"SYS_177",
4775	"SYS_178",
4776	"SYS_179",
4777	"SYS_180",
4778	"SYS_setgid", //181
4779	"SYS_setegid", //182
4780	"SYS_seteuid", //183
4781	"SYS_lfs_bmapv", //184
4782	"SYS_lfs_markv", //185
4783	"SYS_lfs_segclean", //186
4784	"SYS_lfs_segwait", //187
4785	"SYS_188",
4786	"SYS_189",
4787	"SYS_190",
4788	"SYS_pathconf", //191
4789	"SYS_fpathconf", //192
4790	"SYS_swapctl", //193
4791	"SYS_getrlimit", //194
4792	"SYS_setrlimit", //195
4793	"SYS_getdirentries", //196
4794	"SYS_mmap", //197
4795	"SYS___syscall", //198
4796	"SYS_lseek", //199
4797	"SYS_truncate", //200
4798	"SYS_ftruncate", //201
4799	"SYS___sysctl", //202
4800	"SYS_mlock", //203
4801	"SYS_munlock", //204
4802	"SYS_205",
4803	"SYS_futimes", //206
4804	"SYS_getpgid", //207
4805	"SYS_xfspioctl", //208
4806	"SYS_209",
4807	"SYS_210",
4808	"SYS_211",
4809	"SYS_212",
4810	"SYS_213",
4811	"SYS_214",
4812	"SYS_215",
4813	"SYS_216",
4814	"SYS_217",
4815	"SYS_218",
4816	"SYS_219",
4817	"SYS_220",
4818	"SYS_semget", //221
4819	"SYS_222",
4820	"SYS_223",
4821	"SYS_224",
4822	"SYS_msgget", //225
4823	"SYS_msgsnd", //226
4824	"SYS_msgrcv", //227
4825	"SYS_shmat", //228
4826	"SYS_229",
4827	"SYS_shmdt", //230
4828	"SYS_231",
4829	"SYS_clock_gettime", //232
4830	"SYS_clock_settime", //233
4831	"SYS_clock_getres", //234
4832	"SYS_235",
4833	"SYS_236",
4834	"SYS_237",
4835	"SYS_238",
4836	"SYS_239",
4837	"SYS_nanosleep", //240
4838	"SYS_241",
4839	"SYS_242",
4840	"SYS_243",
4841	"SYS_244",
4842	"SYS_245",
4843	"SYS_246",
4844	"SYS_247",
4845	"SYS_248",
4846	"SYS_249",
4847	"SYS_minherit", //250
4848	"SYS_rfork", //251
4849	"SYS_poll", //252
4850	"SYS_issetugid", //253
4851	"SYS_lchown", //254
4852	"SYS_getsid", //255
4853	"SYS_msync", //256
4854	"SYS_257",
4855	"SYS_258",
4856	"SYS_259",
4857	"SYS_getfsstat", //260
4858	"SYS_statfs", //261
4859	"SYS_fstatfs", //262
4860	"SYS_pipe", //263
4861	"SYS_fhopen", //264
4862	"SYS_265",
4863	"SYS_fhstatfs", //266
4864	"SYS_preadv", //267
4865	"SYS_pwritev", //268
4866	"SYS_kqueue", //269
4867	"SYS_kevent", //270
4868	"SYS_mlockall", //271
4869	"SYS_munlockall", //272
4870	"SYS_getpeereid", //273
4871	"SYS_274",
4872	"SYS_275",
4873	"SYS_276",
4874	"SYS_277",
4875	"SYS_278",
4876	"SYS_279",
4877	"SYS_280",
4878	"SYS_getresuid", //281
4879	"SYS_setresuid", //282
4880	"SYS_getresgid", //283
4881	"SYS_setresgid", //284
4882	"SYS_285",
4883	"SYS_mquery", //286
4884	"SYS_closefrom", //287
4885	"SYS_sigaltstack", //288
4886	"SYS_shmget", //289
4887	"SYS_semop", //290
4888	"SYS_stat", //291
4889	"SYS_fstat", //292
4890	"SYS_lstat", //293
4891	"SYS_fhstat", //294
4892	"SYS___semctl", //295
4893	"SYS_shmctl", //296
4894	"SYS_msgctl", //297
4895	"SYS_MAXSYSCALL", //298
4896	//299
4897	//300
4898	};
4899	uint32_t uEAX;
4900	#ifndef DEBUG_bird
4901	if (!LogIsEnabled())
4902	return;
4903	#endif
4904	uEAX = CPUMGetGuestEAX(pVM);
4905	switch (uEAX)
4906	{
4907	default:
4908	if (uEAX < ELEMENTS(apsz))
4909	{
4910	uint32_t au32Args[8] = {0};
4911	PGMPhysReadGCPtr(pVM, au32Args, CPUMGetGuestESP(pVM), sizeof(au32Args));
4912	RTLogPrintf("REM: OpenBSD syscall %3d: %s (eip=%08x %08x %08x %08x %08x %08x %08x %08x %08x)\n",
4913	uEAX, apsz[uEAX], CPUMGetGuestEIP(pVM), au32Args[0], au32Args[1], au32Args[2], au32Args[3],
4914	au32Args[4], au32Args[5], au32Args[6], au32Args[7]);
4915	}
4916	else
4917	RTLogPrintf("eip=%08x: OpenBSD syscall %d (#%x) unknown!!\n", CPUMGetGuestEIP(pVM), uEAX, uEAX);
4918	break;
4919	}
4920	}

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/recompiler/VBoxRecompiler.c@ 2241

Download in other formats: