exec.c@ 15531

Last change on this file since 15531 was 15284, checked in by vboxsync, 16 years ago
PGM, REM: Virtual address in TLB - this is what I meant...
Property svn:eol-style set to `native`
File size: 111.3 KB

Line
1	/*
2	* virtual page mapping and translated block handling
3	*
4	* Copyright (c) 2003 Fabrice Bellard
5	*
6	* This library is free software; you can redistribute it and/or
7	* modify it under the terms of the GNU Lesser General Public
8	* License as published by the Free Software Foundation; either
9	* version 2 of the License, or (at your option) any later version.
10	*
11	* This library is distributed in the hope that it will be useful,
12	* but WITHOUT ANY WARRANTY; without even the implied warranty of
13	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14	* Lesser General Public License for more details.
15	*
16	* You should have received a copy of the GNU Lesser General Public
17	* License along with this library; if not, write to the Free Software
18	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
19	*/
20
21	/*
22	* Sun LGPL Disclaimer: For the avoidance of doubt, except that if any license choice
23	* other than GPL or LGPL is available it will apply instead, Sun elects to use only
24	* the Lesser General Public License version 2.1 (LGPLv2) at this time for any software where
25	* a choice of LGPL license versions is made available with the language indicating
26	* that LGPLv2 or any later version may be used, or where a choice of which version
27	* of the LGPL is applied is otherwise unspecified.
28	*/
29	#include "config.h"
30	#ifndef VBOX
31	#ifdef _WIN32
32	#include <windows.h>
33	#else
34	#include <sys/types.h>
35	#include <sys/mman.h>
36	#endif
37	#include <stdlib.h>
38	#include <stdio.h>
39	#include <stdarg.h>
40	#include <string.h>
41	#include <errno.h>
42	#include <unistd.h>
43	#include <inttypes.h>
44	#else /* VBOX */
45	# include <stdlib.h>
46	# include <stdio.h>
47	# include <iprt/alloc.h>
48	# include <iprt/string.h>
49	# include <iprt/param.h>
50	# include <VBox/pgm.h> /* PGM_DYNAMIC_RAM_ALLOC */
51	#endif /* VBOX */
52
53	#include "cpu.h"
54	#include "exec-all.h"
55	#if defined(CONFIG_USER_ONLY)
56	#include <qemu.h>
57	#endif
58
59	//#define DEBUG_TB_INVALIDATE
60	//#define DEBUG_FLUSH
61	//#define DEBUG_TLB
62	//#define DEBUG_UNASSIGNED
63
64	/* make various TB consistency checks */
65	//#define DEBUG_TB_CHECK
66	//#define DEBUG_TLB_CHECK
67
68	#if !defined(CONFIG_USER_ONLY)
69	/* TB consistency checks only implemented for usermode emulation. */
70	#undef DEBUG_TB_CHECK
71	#endif
72
73	#define SMC_BITMAP_USE_THRESHOLD 10
74
75	#define MMAP_AREA_START 0x00000000
76	#define MMAP_AREA_END 0xa8000000
77
78	#if defined(TARGET_SPARC64)
79	#define TARGET_PHYS_ADDR_SPACE_BITS 41
80	#elif defined(TARGET_SPARC)
81	#define TARGET_PHYS_ADDR_SPACE_BITS 36
82	#elif defined(TARGET_ALPHA)
83	#define TARGET_PHYS_ADDR_SPACE_BITS 42
84	#define TARGET_VIRT_ADDR_SPACE_BITS 42
85	#elif defined(TARGET_PPC64)
86	#define TARGET_PHYS_ADDR_SPACE_BITS 42
87	#elif defined(TARGET_X86_64) && !defined(USE_KQEMU)
88	#define TARGET_PHYS_ADDR_SPACE_BITS 42
89	#elif defined(TARGET_I386) && !defined(USE_KQEMU)
90	#define TARGET_PHYS_ADDR_SPACE_BITS 36
91	#else
92	/* Note: for compatibility with kqemu, we use 32 bits for x86_64 */
93	#define TARGET_PHYS_ADDR_SPACE_BITS 32
94	#endif
95
96	static TranslationBlock *tbs;
97	int code_gen_max_blocks;
98	TranslationBlock *tb_phys_hash[CODE_GEN_PHYS_HASH_SIZE];
99	static int nb_tbs;
100	/* any access to the tbs or the page table must use this lock */
101	spinlock_t tb_lock = SPIN_LOCK_UNLOCKED;
102
103	#ifndef VBOX
104	#if defined(__arm__) \|\| defined(__sparc_v9__)
105	/* The prologue must be reachable with a direct jump. ARM and Sparc64
106	have limited branch ranges (possibly also PPC) so place it in a
107	section close to code segment. */
108	#define code_gen_section \
109	__attribute__((__section__(".gen_code"))) \
110	__attribute__((aligned (32)))
111	#else
112	#define code_gen_section \
113	__attribute__((aligned (32)))
114	#endif
115	uint8_t code_gen_prologue[1024] code_gen_section;
116
117	#else /* VBOX */
118	extern uint8_t* code_gen_prologue;
119	#endif /* VBOX */
120
121	static uint8_t *code_gen_buffer;
122	static unsigned long code_gen_buffer_size;
123	/* threshold to flush the translated code buffer */
124	static unsigned long code_gen_buffer_max_size;
125	uint8_t *code_gen_ptr;
126
127	#ifndef VBOX
128	#if !defined(CONFIG_USER_ONLY)
129	ram_addr_t phys_ram_size;
130	int phys_ram_fd;
131	uint8_t *phys_ram_base;
132	uint8_t *phys_ram_dirty;
133	static int in_migration;
134	static ram_addr_t phys_ram_alloc_offset = 0;
135	#endif
136	#else /* VBOX */
137	RTGCPHYS phys_ram_size;
138	/* we have memory ranges (the high PC-BIOS mapping) which
139	causes some pages to fall outside the dirty map here. */
140	uint32_t phys_ram_dirty_size;
141	#endif /* VBOX */
142	#if !defined(VBOX)
143	uint8_t *phys_ram_base;
144	#endif
145	uint8_t *phys_ram_dirty;
146
147	CPUState *first_cpu;
148	/* current CPU in the current thread. It is only valid inside
149	cpu_exec() */
150	CPUState *cpu_single_env;
151	/* 0 = Do not count executed instructions.
152	1 = Precise instruction counting.
153	2 = Adaptive rate instruction counting. */
154	int use_icount = 0;
155	/* Current instruction counter. While executing translated code this may
156	include some instructions that have not yet been executed. */
157	int64_t qemu_icount;
158
159	typedef struct PageDesc {
160	/* list of TBs intersecting this ram page */
161	TranslationBlock *first_tb;
162	/* in order to optimize self modifying code, we count the number
163	of lookups we do to a given page to use a bitmap */
164	unsigned int code_write_count;
165	uint8_t *code_bitmap;
166	#if defined(CONFIG_USER_ONLY)
167	unsigned long flags;
168	#endif
169	} PageDesc;
170
171	typedef struct PhysPageDesc {
172	/* offset in host memory of the page + io_index in the low 12 bits */
173	ram_addr_t phys_offset;
174	} PhysPageDesc;
175
176	#define L2_BITS 10
177	#if defined(CONFIG_USER_ONLY) && defined(TARGET_VIRT_ADDR_SPACE_BITS)
178	/* XXX: this is a temporary hack for alpha target.
179	* In the future, this is to be replaced by a multi-level table
180	* to actually be able to handle the complete 64 bits address space.
181	*/
182	#define L1_BITS (TARGET_VIRT_ADDR_SPACE_BITS - L2_BITS - TARGET_PAGE_BITS)
183	#else
184	#define L1_BITS (32 - L2_BITS - TARGET_PAGE_BITS)
185	#endif
186
187	#define L1_SIZE (1 << L1_BITS)
188	#define L2_SIZE (1 << L2_BITS)
189
190	static void io_mem_init(void);
191
192	unsigned long qemu_real_host_page_size;
193	unsigned long qemu_host_page_bits;
194	unsigned long qemu_host_page_size;
195	unsigned long qemu_host_page_mask;
196
197	/* XXX: for system emulation, it could just be an array */
198	static PageDesc *l1_map[L1_SIZE];
199	static PhysPageDesc **l1_phys_map;
200
201	#if !defined(CONFIG_USER_ONLY)
202	static void io_mem_init(void);
203
204	/* io memory support */
205	CPUWriteMemoryFunc *io_mem_write[IO_MEM_NB_ENTRIES][4];
206	CPUReadMemoryFunc *io_mem_read[IO_MEM_NB_ENTRIES][4];
207	void *io_mem_opaque[IO_MEM_NB_ENTRIES];
208	static int io_mem_nb;
209	static int io_mem_watch;
210	#endif
211
212	#ifndef VBOX
213	/* log support */
214	static const char *logfilename = "/tmp/qemu.log";
215	#endif /* !VBOX */
216	FILE *logfile;
217	int loglevel;
218	#ifndef VBOX
219	static int log_append = 0;
220	#endif
221
222	/* statistics */
223	static int tlb_flush_count;
224	static int tb_flush_count;
225	#ifndef VBOX
226	static int tb_phys_invalidate_count;
227	#endif /* !VBOX */
228
229	#define SUBPAGE_IDX(addr) ((addr) & ~TARGET_PAGE_MASK)
230	typedef struct subpage_t {
231	target_phys_addr_t base;
232	CPUReadMemoryFunc **mem_read[TARGET_PAGE_SIZE][4];
233	CPUWriteMemoryFunc **mem_write[TARGET_PAGE_SIZE][4];
234	void *opaque[TARGET_PAGE_SIZE][2][4];
235	} subpage_t;
236
237
238	#ifndef VBOX
239	#ifdef _WIN32
240	static void map_exec(void *addr, long size)
241	{
242	DWORD old_protect;
243	VirtualProtect(addr, size,
244	PAGE_EXECUTE_READWRITE, &old_protect);
245
246	}
247	#else
248	static void map_exec(void *addr, long size)
249	{
250	unsigned long start, end, page_size;
251
252	page_size = getpagesize();
253	start = (unsigned long)addr;
254	start &= ~(page_size - 1);
255
256	end = (unsigned long)addr + size;
257	end += page_size - 1;
258	end &= ~(page_size - 1);
259
260	mprotect((void *)start, end - start,
261	PROT_READ \| PROT_WRITE \| PROT_EXEC);
262	}
263	#endif
264	#else // VBOX
265	static void map_exec(void *addr, long size)
266	{
267	RTMemProtect(addr, size,
268	RTMEM_PROT_EXEC \| RTMEM_PROT_READ \| RTMEM_PROT_WRITE);
269	}
270	#endif
271
272	static void page_init(void)
273	{
274	/* NOTE: we can always suppose that qemu_host_page_size >=
275	TARGET_PAGE_SIZE */
276	#ifdef VBOX
277	RTMemProtect(code_gen_buffer, sizeof(code_gen_buffer),
278	RTMEM_PROT_EXEC \| RTMEM_PROT_READ \| RTMEM_PROT_WRITE);
279	qemu_real_host_page_size = PAGE_SIZE;
280	#else /* !VBOX */
281	#ifdef _WIN32
282	{
283	SYSTEM_INFO system_info;
284	DWORD old_protect;
285
286	GetSystemInfo(&system_info);
287	qemu_real_host_page_size = system_info.dwPageSize;
288	}
289	#else
290	qemu_real_host_page_size = getpagesize();
291	#endif
292	#endif /* !VBOX */
293
294	if (qemu_host_page_size == 0)
295	qemu_host_page_size = qemu_real_host_page_size;
296	if (qemu_host_page_size < TARGET_PAGE_SIZE)
297	qemu_host_page_size = TARGET_PAGE_SIZE;
298	qemu_host_page_bits = 0;
299	#ifndef VBOX
300	while ((1 << qemu_host_page_bits) < qemu_host_page_size)
301	#else
302	while ((1 << qemu_host_page_bits) < (int)qemu_host_page_size)
303	#endif
304	qemu_host_page_bits++;
305	qemu_host_page_mask = ~(qemu_host_page_size - 1);
306	l1_phys_map = qemu_vmalloc(L1_SIZE * sizeof(void *));
307	memset(l1_phys_map, 0, L1_SIZE * sizeof(void *));
308	#ifdef VBOX
309	/* We use other means to set reserved bit on our pages */
310	#else
311	#if !defined(_WIN32) && defined(CONFIG_USER_ONLY)
312	{
313	long long startaddr, endaddr;
314	FILE *f;
315	int n;
316
317	mmap_lock();
318	last_brk = (unsigned long)sbrk(0);
319	f = fopen("/proc/self/maps", "r");
320	if (f) {
321	do {
322	n = fscanf (f, "%llx-%llx %*[^\n]\n", &startaddr, &endaddr);
323	if (n == 2) {
324	startaddr = MIN(startaddr,
325	(1ULL << TARGET_PHYS_ADDR_SPACE_BITS) - 1);
326	endaddr = MIN(endaddr,
327	(1ULL << TARGET_PHYS_ADDR_SPACE_BITS) - 1);
328	page_set_flags(startaddr & TARGET_PAGE_MASK,
329	TARGET_PAGE_ALIGN(endaddr),
330	PAGE_RESERVED);
331	}
332	} while (!feof(f));
333	fclose(f);
334	}
335	mmap_unlock();
336	}
337	#endif
338	#endif
339	}
340
341	#ifndef VBOX
342	static inline PageDesc **page_l1_map(target_ulong index)
343	#else
344	DECLINLINE(PageDesc **) page_l1_map(target_ulong index)
345	#endif
346	{
347	#if TARGET_LONG_BITS > 32
348	/* Host memory outside guest VM. For 32-bit targets we have already
349	excluded high addresses. */
350	if (index > ((target_ulong)L2_SIZE * L1_SIZE))
351	return NULL;
352	#endif
353	return &l1_map[index >> L2_BITS];
354	}
355
356	#ifndef VBOX
357	static inline PageDesc *page_find_alloc(target_ulong index)
358	#else
359	DECLINLINE(PageDesc *) page_find_alloc(target_ulong index)
360	#endif
361	{
362	PageDesc *lp, p;
363	lp = page_l1_map(index);
364	if (!lp)
365	return NULL;
366
367	p = *lp;
368	if (!p) {
369	/* allocate if not found */
370	#if defined(CONFIG_USER_ONLY)
371	unsigned long addr;
372	size_t len = sizeof(PageDesc) * L2_SIZE;
373	/* Don't use qemu_malloc because it may recurse. */
374	p = mmap(0, len, PROT_READ \| PROT_WRITE,
375	MAP_PRIVATE \| MAP_ANONYMOUS, -1, 0);
376	*lp = p;
377	addr = h2g(p);
378	if (addr == (target_ulong)addr) {
379	page_set_flags(addr & TARGET_PAGE_MASK,
380	TARGET_PAGE_ALIGN(addr + len),
381	PAGE_RESERVED);
382	}
383	#else
384	p = qemu_mallocz(sizeof(PageDesc) * L2_SIZE);
385	*lp = p;
386	#endif
387	}
388	return p + (index & (L2_SIZE - 1));
389	}
390
391	#ifndef VBOX
392	static inline PageDesc *page_find(target_ulong index)
393	#else
394	DECLINLINE(PageDesc *) page_find(target_ulong index)
395	#endif
396	{
397	PageDesc *lp, p;
398	lp = page_l1_map(index);
399	if (!lp)
400	return NULL;
401
402	p = *lp;
403	if (!p)
404	return 0;
405	return p + (index & (L2_SIZE - 1));
406	}
407
408	static PhysPageDesc *phys_page_find_alloc(target_phys_addr_t index, int alloc)
409	{
410	void lp, p;
411	PhysPageDesc *pd;
412
413	p = (void **)l1_phys_map;
414	#if TARGET_PHYS_ADDR_SPACE_BITS > 32
415
416	#if TARGET_PHYS_ADDR_SPACE_BITS > (32 + L1_BITS)
417	#error unsupported TARGET_PHYS_ADDR_SPACE_BITS
418	#endif
419	lp = p + ((index >> (L1_BITS + L2_BITS)) & (L1_SIZE - 1));
420	p = *lp;
421	if (!p) {
422	/* allocate if not found */
423	if (!alloc)
424	return NULL;
425	p = qemu_vmalloc(sizeof(void ) L1_SIZE);
426	memset(p, 0, sizeof(void ) L1_SIZE);
427	*lp = p;
428	}
429	#endif
430	lp = p + ((index >> L2_BITS) & (L1_SIZE - 1));
431	pd = *lp;
432	if (!pd) {
433	int i;
434	/* allocate if not found */
435	if (!alloc)
436	return NULL;
437	pd = qemu_vmalloc(sizeof(PhysPageDesc) * L2_SIZE);
438	*lp = pd;
439	for (i = 0; i < L2_SIZE; i++)
440	pd[i].phys_offset = IO_MEM_UNASSIGNED;
441	}
442	#if defined(VBOX) && !defined(VBOX_WITH_NEW_PHYS_CODE)
443	pd = ((PhysPageDesc *)pd) + (index & (L2_SIZE - 1));
444	if (RT_UNLIKELY((pd->phys_offset & ~TARGET_PAGE_MASK) == IO_MEM_RAM_MISSING))
445	remR3GrowDynRange(pd->phys_offset & TARGET_PAGE_MASK);
446	return pd;
447	#else
448	return ((PhysPageDesc *)pd) + (index & (L2_SIZE - 1));
449	#endif
450	}
451
452	#ifndef VBOX
453	static inline PhysPageDesc *phys_page_find(target_phys_addr_t index)
454	#else
455	DECLINLINE(PhysPageDesc *) phys_page_find(target_phys_addr_t index)
456	#endif
457	{
458	return phys_page_find_alloc(index, 0);
459	}
460
461	#if !defined(CONFIG_USER_ONLY)
462	static void tlb_protect_code(ram_addr_t ram_addr);
463	static void tlb_unprotect_code_phys(CPUState *env, ram_addr_t ram_addr,
464	target_ulong vaddr);
465	#define mmap_lock() do { } while(0)
466	#define mmap_unlock() do { } while(0)
467	#endif
468
469	#ifdef VBOX
470	/** @todo nike: isn't 32M too much ? */
471	#endif
472	#define DEFAULT_CODE_GEN_BUFFER_SIZE (32 * 1024 * 1024)
473
474	#if defined(CONFIG_USER_ONLY)
475	/* Currently it is not recommanded to allocate big chunks of data in
476	user mode. It will change when a dedicated libc will be used */
477	#define USE_STATIC_CODE_GEN_BUFFER
478	#endif
479
480	/* VBox allocates codegen buffer dynamically */
481	#ifndef VBOX
482	#ifdef USE_STATIC_CODE_GEN_BUFFER
483	static uint8_t static_code_gen_buffer[DEFAULT_CODE_GEN_BUFFER_SIZE];
484	#endif
485	#endif
486
487	static void code_gen_alloc(unsigned long tb_size)
488	{
489	#ifdef USE_STATIC_CODE_GEN_BUFFER
490	code_gen_buffer = static_code_gen_buffer;
491	code_gen_buffer_size = DEFAULT_CODE_GEN_BUFFER_SIZE;
492	map_exec(code_gen_buffer, code_gen_buffer_size);
493	#else
494	code_gen_buffer_size = tb_size;
495	if (code_gen_buffer_size == 0) {
496	#if defined(CONFIG_USER_ONLY)
497	/* in user mode, phys_ram_size is not meaningful */
498	code_gen_buffer_size = DEFAULT_CODE_GEN_BUFFER_SIZE;
499	#else
500	/* XXX: needs ajustments */
501	code_gen_buffer_size = (unsigned long)(phys_ram_size / 4);
502	#endif
503	}
504	if (code_gen_buffer_size < MIN_CODE_GEN_BUFFER_SIZE)
505	code_gen_buffer_size = MIN_CODE_GEN_BUFFER_SIZE;
506	/* The code gen buffer location may have constraints depending on
507	the host cpu and OS */
508	#ifdef VBOX
509	code_gen_buffer = RTMemExecAlloc(code_gen_buffer_size);
510
511	if (!code_gen_buffer) {
512	LogRel(("REM: failed allocate codegen buffer %lld\n",
513	code_gen_buffer_size));
514	return;
515	}
516	#else //!VBOX
517	#if defined(__linux__)
518	{
519	int flags;
520	void *start = NULL;
521
522	flags = MAP_PRIVATE \| MAP_ANONYMOUS;
523	#if defined(__x86_64__)
524	flags \|= MAP_32BIT;
525	/* Cannot map more than that */
526	if (code_gen_buffer_size > (800 * 1024 * 1024))
527	code_gen_buffer_size = (800 * 1024 * 1024);
528	#elif defined(__sparc_v9__)
529	// Map the buffer below 2G, so we can use direct calls and branches
530	flags \|= MAP_FIXED;
531	start = (void *) 0x60000000UL;
532	if (code_gen_buffer_size > (512 * 1024 * 1024))
533	code_gen_buffer_size = (512 * 1024 * 1024);
534	#endif
535	code_gen_buffer = mmap(start, code_gen_buffer_size,
536	PROT_WRITE \| PROT_READ \| PROT_EXEC,
537	flags, -1, 0);
538	if (code_gen_buffer == MAP_FAILED) {
539	fprintf(stderr, "Could not allocate dynamic translator buffer\n");
540	exit(1);
541	}
542	}
543	#elif defined(__FreeBSD__)
544	{
545	int flags;
546	void *addr = NULL;
547	flags = MAP_PRIVATE \| MAP_ANONYMOUS;
548	#if defined(__x86_64__)
549	/* FreeBSD doesn't have MAP_32BIT, use MAP_FIXED and assume
550	* 0x40000000 is free */
551	flags \|= MAP_FIXED;
552	addr = (void *)0x40000000;
553	/* Cannot map more than that */
554	if (code_gen_buffer_size > (800 * 1024 * 1024))
555	code_gen_buffer_size = (800 * 1024 * 1024);
556	#endif
557	code_gen_buffer = mmap(addr, code_gen_buffer_size,
558	PROT_WRITE \| PROT_READ \| PROT_EXEC,
559	flags, -1, 0);
560	if (code_gen_buffer == MAP_FAILED) {
561	fprintf(stderr, "Could not allocate dynamic translator buffer\n");
562	exit(1);
563	}
564	}
565	#else
566	code_gen_buffer = qemu_malloc(code_gen_buffer_size);
567	if (!code_gen_buffer) {
568	fprintf(stderr, "Could not allocate dynamic translator buffer\n");
569	exit(1);
570	}
571	map_exec(code_gen_buffer, code_gen_buffer_size);
572	#endif
573	map_exec(code_gen_prologue, sizeof(code_gen_prologue));
574	#endif /* !VBOX */
575	#endif /* !USE_STATIC_CODE_GEN_BUFFER */
576	#ifndef VBOX
577	map_exec(code_gen_prologue, sizeof(code_gen_prologue));
578	#else
579	map_exec(code_gen_prologue, _1K);
580	#endif
581
582	code_gen_buffer_max_size = code_gen_buffer_size -
583	code_gen_max_block_size();
584	code_gen_max_blocks = code_gen_buffer_size / CODE_GEN_AVG_BLOCK_SIZE;
585	tbs = qemu_malloc(code_gen_max_blocks * sizeof(TranslationBlock));
586	}
587
588	/* Must be called before using the QEMU cpus. 'tb_size' is the size
589	(in bytes) allocated to the translation buffer. Zero means default
590	size. */
591	void cpu_exec_init_all(unsigned long tb_size)
592	{
593	cpu_gen_init();
594	code_gen_alloc(tb_size);
595	code_gen_ptr = code_gen_buffer;
596	page_init();
597	#if !defined(CONFIG_USER_ONLY)
598	io_mem_init();
599	#endif
600	}
601
602	#ifndef VBOX
603	#if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
604
605	#define CPU_COMMON_SAVE_VERSION 1
606
607	static void cpu_common_save(QEMUFile f, void opaque)
608	{
609	CPUState *env = opaque;
610
611	qemu_put_be32s(f, &env->halted);
612	qemu_put_be32s(f, &env->interrupt_request);
613	}
614
615	static int cpu_common_load(QEMUFile f, void opaque, int version_id)
616	{
617	CPUState *env = opaque;
618
619	if (version_id != CPU_COMMON_SAVE_VERSION)
620	return -EINVAL;
621
622	qemu_get_be32s(f, &env->halted);
623	qemu_get_be32s(f, &env->interrupt_request);
624	tlb_flush(env, 1);
625
626	return 0;
627	}
628	#endif
629	#endif //!VBOX
630
631	void cpu_exec_init(CPUState *env)
632	{
633	CPUState **penv;
634	int cpu_index;
635
636	env->next_cpu = NULL;
637	penv = &first_cpu;
638	cpu_index = 0;
639	while (*penv != NULL) {
640	penv = (CPUState *)&(penv)->next_cpu;
641	cpu_index++;
642	}
643	env->cpu_index = cpu_index;
644	env->nb_watchpoints = 0;
645	*penv = env;
646	#ifndef VBOX
647	#if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
648	register_savevm("cpu_common", cpu_index, CPU_COMMON_SAVE_VERSION,
649	cpu_common_save, cpu_common_load, env);
650	register_savevm("cpu", cpu_index, CPU_SAVE_VERSION,
651	cpu_save, cpu_load, env);
652	#endif
653	#endif // !VBOX
654	}
655
656	#ifndef VBOX
657	static inline void invalidate_page_bitmap(PageDesc *p)
658	#else
659	DECLINLINE(void) invalidate_page_bitmap(PageDesc *p)
660	#endif
661	{
662	if (p->code_bitmap) {
663	qemu_free(p->code_bitmap);
664	p->code_bitmap = NULL;
665	}
666	p->code_write_count = 0;
667	}
668
669	/* set to NULL all the 'first_tb' fields in all PageDescs */
670	static void page_flush_tb(void)
671	{
672	int i, j;
673	PageDesc *p;
674
675	for(i = 0; i < L1_SIZE; i++) {
676	p = l1_map[i];
677	if (p) {
678	for(j = 0; j < L2_SIZE; j++) {
679	p->first_tb = NULL;
680	invalidate_page_bitmap(p);
681	p++;
682	}
683	}
684	}
685	}
686
687	/* flush all the translation blocks */
688	/* XXX: tb_flush is currently not thread safe */
689	void tb_flush(CPUState *env1)
690	{
691	CPUState *env;
692	#if defined(DEBUG_FLUSH)
693	printf("qemu: flush code_size=%ld nb_tbs=%d avg_tb_size=%ld\n",
694	(unsigned long)(code_gen_ptr - code_gen_buffer),
695	nb_tbs, nb_tbs > 0 ?
696	((unsigned long)(code_gen_ptr - code_gen_buffer)) / nb_tbs : 0);
697	#endif
698	if ((unsigned long)(code_gen_ptr - code_gen_buffer) > code_gen_buffer_size)
699	cpu_abort(env1, "Internal error: code buffer overflow\n");
700
701	nb_tbs = 0;
702
703	for(env = first_cpu; env != NULL; env = env->next_cpu) {
704	memset (env->tb_jmp_cache, 0, TB_JMP_CACHE_SIZE * sizeof (void *));
705	}
706
707	memset (tb_phys_hash, 0, CODE_GEN_PHYS_HASH_SIZE * sizeof (void *));
708	page_flush_tb();
709
710	code_gen_ptr = code_gen_buffer;
711	/* XXX: flush processor icache at this point if cache flush is
712	expensive */
713	tb_flush_count++;
714	}
715
716	#ifdef DEBUG_TB_CHECK
717	static void tb_invalidate_check(target_ulong address)
718	{
719	TranslationBlock *tb;
720	int i;
721	address &= TARGET_PAGE_MASK;
722	for(i = 0;i < CODE_GEN_PHYS_HASH_SIZE; i++) {
723	for(tb = tb_phys_hash[i]; tb != NULL; tb = tb->phys_hash_next) {
724	if (!(address + TARGET_PAGE_SIZE <= tb->pc \|\|
725	address >= tb->pc + tb->size)) {
726	printf("ERROR invalidate: address=%08lx PC=%08lx size=%04x\n",
727	address, (long)tb->pc, tb->size);
728	}
729	}
730	}
731	}
732
733	/* verify that all the pages have correct rights for code */
734	static void tb_page_check(void)
735	{
736	TranslationBlock *tb;
737	int i, flags1, flags2;
738
739	for(i = 0;i < CODE_GEN_PHYS_HASH_SIZE; i++) {
740	for(tb = tb_phys_hash[i]; tb != NULL; tb = tb->phys_hash_next) {
741	flags1 = page_get_flags(tb->pc);
742	flags2 = page_get_flags(tb->pc + tb->size - 1);
743	if ((flags1 & PAGE_WRITE) \|\| (flags2 & PAGE_WRITE)) {
744	printf("ERROR page flags: PC=%08lx size=%04x f1=%x f2=%x\n",
745	(long)tb->pc, tb->size, flags1, flags2);
746	}
747	}
748	}
749	}
750
751	static void tb_jmp_check(TranslationBlock *tb)
752	{
753	TranslationBlock *tb1;
754	unsigned int n1;
755
756	/* suppress any remaining jumps to this TB */
757	tb1 = tb->jmp_first;
758	for(;;) {
759	n1 = (long)tb1 & 3;
760	tb1 = (TranslationBlock *)((long)tb1 & ~3);
761	if (n1 == 2)
762	break;
763	tb1 = tb1->jmp_next[n1];
764	}
765	/* check end of list */
766	if (tb1 != tb) {
767	printf("ERROR: jmp_list from 0x%08lx\n", (long)tb);
768	}
769	}
770	#endif // DEBUG_TB_CHECK
771
772	/* invalidate one TB */
773	#ifndef VBOX
774	static inline void tb_remove(TranslationBlock *ptb, TranslationBlock tb,
775	int next_offset)
776	#else
777	DECLINLINE(void) tb_remove(TranslationBlock *ptb, TranslationBlock tb,
778	int next_offset)
779	#endif
780	{
781	TranslationBlock *tb1;
782	for(;;) {
783	tb1 = *ptb;
784	if (tb1 == tb) {
785	ptb = (TranslationBlock *)((char )tb1 + next_offset);
786	break;
787	}
788	ptb = (TranslationBlock *)((char )tb1 + next_offset);
789	}
790	}
791
792	#ifndef VBOX
793	static inline void tb_page_remove(TranslationBlock *ptb, TranslationBlock tb)
794	#else
795	DECLINLINE(void) tb_page_remove(TranslationBlock *ptb, TranslationBlock tb)
796	#endif
797	{
798	TranslationBlock *tb1;
799	unsigned int n1;
800
801	for(;;) {
802	tb1 = *ptb;
803	n1 = (long)tb1 & 3;
804	tb1 = (TranslationBlock *)((long)tb1 & ~3);
805	if (tb1 == tb) {
806	*ptb = tb1->page_next[n1];
807	break;
808	}
809	ptb = &tb1->page_next[n1];
810	}
811	}
812
813	#ifndef VBOX
814	static inline void tb_jmp_remove(TranslationBlock *tb, int n)
815	#else
816	DECLINLINE(void) tb_jmp_remove(TranslationBlock *tb, int n)
817	#endif
818	{
819	TranslationBlock tb1, *ptb;
820	unsigned int n1;
821
822	ptb = &tb->jmp_next[n];
823	tb1 = *ptb;
824	if (tb1) {
825	/* find tb(n) in circular list */
826	for(;;) {
827	tb1 = *ptb;
828	n1 = (long)tb1 & 3;
829	tb1 = (TranslationBlock *)((long)tb1 & ~3);
830	if (n1 == n && tb1 == tb)
831	break;
832	if (n1 == 2) {
833	ptb = &tb1->jmp_first;
834	} else {
835	ptb = &tb1->jmp_next[n1];
836	}
837	}
838	/* now we can suppress tb(n) from the list */
839	*ptb = tb->jmp_next[n];
840
841	tb->jmp_next[n] = NULL;
842	}
843	}
844
845	/* reset the jump entry 'n' of a TB so that it is not chained to
846	another TB */
847	#ifndef VBOX
848	static inline void tb_reset_jump(TranslationBlock *tb, int n)
849	#else
850	DECLINLINE(void) tb_reset_jump(TranslationBlock *tb, int n)
851	#endif
852	{
853	tb_set_jmp_target(tb, n, (unsigned long)(tb->tc_ptr + tb->tb_next_offset[n]));
854	}
855
856	void tb_phys_invalidate(TranslationBlock *tb, target_ulong page_addr)
857	{
858	CPUState *env;
859	PageDesc *p;
860	unsigned int h, n1;
861	target_phys_addr_t phys_pc;
862	TranslationBlock tb1, tb2;
863
864	/* remove the TB from the hash list */
865	phys_pc = tb->page_addr[0] + (tb->pc & ~TARGET_PAGE_MASK);
866	h = tb_phys_hash_func(phys_pc);
867	tb_remove(&tb_phys_hash[h], tb,
868	offsetof(TranslationBlock, phys_hash_next));
869
870	/* remove the TB from the page list */
871	if (tb->page_addr[0] != page_addr) {
872	p = page_find(tb->page_addr[0] >> TARGET_PAGE_BITS);
873	tb_page_remove(&p->first_tb, tb);
874	invalidate_page_bitmap(p);
875	}
876	if (tb->page_addr[1] != -1 && tb->page_addr[1] != page_addr) {
877	p = page_find(tb->page_addr[1] >> TARGET_PAGE_BITS);
878	tb_page_remove(&p->first_tb, tb);
879	invalidate_page_bitmap(p);
880	}
881
882	tb_invalidated_flag = 1;
883
884	/* remove the TB from the hash list */
885	h = tb_jmp_cache_hash_func(tb->pc);
886	for(env = first_cpu; env != NULL; env = env->next_cpu) {
887	if (env->tb_jmp_cache[h] == tb)
888	env->tb_jmp_cache[h] = NULL;
889	}
890
891	/* suppress this TB from the two jump lists */
892	tb_jmp_remove(tb, 0);
893	tb_jmp_remove(tb, 1);
894
895	/* suppress any remaining jumps to this TB */
896	tb1 = tb->jmp_first;
897	for(;;) {
898	n1 = (long)tb1 & 3;
899	if (n1 == 2)
900	break;
901	tb1 = (TranslationBlock *)((long)tb1 & ~3);
902	tb2 = tb1->jmp_next[n1];
903	tb_reset_jump(tb1, n1);
904	tb1->jmp_next[n1] = NULL;
905	tb1 = tb2;
906	}
907	tb->jmp_first = (TranslationBlock )((long)tb \| 2); / fail safe */
908
909	#ifndef VBOX
910	tb_phys_invalidate_count++;
911	#endif
912	}
913
914
915	#ifdef VBOX
916	void tb_invalidate_virt(CPUState *env, uint32_t eip)
917	{
918	# if 1
919	tb_flush(env);
920	# else
921	uint8_t cs_base, pc;
922	unsigned int flags, h, phys_pc;
923	TranslationBlock tb, *ptb;
924
925	flags = env->hflags;
926	flags \|= (env->eflags & (IOPL_MASK \| TF_MASK \| VM_MASK));
927	cs_base = env->segs[R_CS].base;
928	pc = cs_base + eip;
929
930	tb = tb_find(&ptb, (unsigned long)pc, (unsigned long)cs_base,
931	flags);
932
933	if(tb)
934	{
935	# ifdef DEBUG
936	printf("invalidating TB (%08X) at %08X\n", tb, eip);
937	# endif
938	tb_invalidate(tb);
939	//Note: this will leak TBs, but the whole cache will be flushed
940	// when it happens too often
941	tb->pc = 0;
942	tb->cs_base = 0;
943	tb->flags = 0;
944	}
945	# endif
946	}
947
948	# ifdef VBOX_STRICT
949	/**
950	* Gets the page offset.
951	*/
952	unsigned long get_phys_page_offset(target_ulong addr)
953	{
954	PhysPageDesc *p = phys_page_find(addr >> TARGET_PAGE_BITS);
955	return p ? p->phys_offset : 0;
956	}
957	# endif /* VBOX_STRICT */
958	#endif /* VBOX */
959
960	#ifndef VBOX
961	static inline void set_bits(uint8_t *tab, int start, int len)
962	#else
963	DECLINLINE(void) set_bits(uint8_t *tab, int start, int len)
964	#endif
965	{
966	int end, mask, end1;
967
968	end = start + len;
969	tab += start >> 3;
970	mask = 0xff << (start & 7);
971	if ((start & ~7) == (end & ~7)) {
972	if (start < end) {
973	mask &= ~(0xff << (end & 7));
974	*tab \|= mask;
975	}
976	} else {
977	*tab++ \|= mask;
978	start = (start + 8) & ~7;
979	end1 = end & ~7;
980	while (start < end1) {
981	*tab++ = 0xff;
982	start += 8;
983	}
984	if (start < end) {
985	mask = ~(0xff << (end & 7));
986	*tab \|= mask;
987	}
988	}
989	}
990
991	static void build_page_bitmap(PageDesc *p)
992	{
993	int n, tb_start, tb_end;
994	TranslationBlock *tb;
995
996	p->code_bitmap = qemu_malloc(TARGET_PAGE_SIZE / 8);
997	if (!p->code_bitmap)
998	return;
999	memset(p->code_bitmap, 0, TARGET_PAGE_SIZE / 8);
1000
1001	tb = p->first_tb;
1002	while (tb != NULL) {
1003	n = (long)tb & 3;
1004	tb = (TranslationBlock *)((long)tb & ~3);
1005	/* NOTE: this is subtle as a TB may span two physical pages */
1006	if (n == 0) {
1007	/* NOTE: tb_end may be after the end of the page, but
1008	it is not a problem */
1009	tb_start = tb->pc & ~TARGET_PAGE_MASK;
1010	tb_end = tb_start + tb->size;
1011	if (tb_end > TARGET_PAGE_SIZE)
1012	tb_end = TARGET_PAGE_SIZE;
1013	} else {
1014	tb_start = 0;
1015	tb_end = ((tb->pc + tb->size) & ~TARGET_PAGE_MASK);
1016	}
1017	set_bits(p->code_bitmap, tb_start, tb_end - tb_start);
1018	tb = tb->page_next[n];
1019	}
1020	}
1021
1022	TranslationBlock tb_gen_code(CPUState env,
1023	target_ulong pc, target_ulong cs_base,
1024	int flags, int cflags)
1025	{
1026	TranslationBlock *tb;
1027	uint8_t *tc_ptr;
1028	target_ulong phys_pc, phys_page2, virt_page2;
1029	int code_gen_size;
1030
1031	phys_pc = get_phys_addr_code(env, pc);
1032	tb = tb_alloc(pc);
1033	if (!tb) {
1034	/* flush must be done */
1035	tb_flush(env);
1036	/* cannot fail at this point */
1037	tb = tb_alloc(pc);
1038	/* Don't forget to invalidate previous TB info. */
1039	tb_invalidated_flag = 1;
1040	}
1041	tc_ptr = code_gen_ptr;
1042	tb->tc_ptr = tc_ptr;
1043	tb->cs_base = cs_base;
1044	tb->flags = flags;
1045	tb->cflags = cflags;
1046	cpu_gen_code(env, tb, &code_gen_size);
1047	code_gen_ptr = (void *)(((unsigned long)code_gen_ptr + code_gen_size + CODE_GEN_ALIGN - 1) & ~(CODE_GEN_ALIGN - 1));
1048
1049	/* check next page if needed */
1050	virt_page2 = (pc + tb->size - 1) & TARGET_PAGE_MASK;
1051	phys_page2 = -1;
1052	if ((pc & TARGET_PAGE_MASK) != virt_page2) {
1053	phys_page2 = get_phys_addr_code(env, virt_page2);
1054	}
1055	tb_link_phys(tb, phys_pc, phys_page2);
1056	return tb;
1057	}
1058
1059	/* invalidate all TBs which intersect with the target physical page
1060	starting in range [start;end[. NOTE: start and end must refer to
1061	the same physical page. 'is_cpu_write_access' should be true if called
1062	from a real cpu write access: the virtual CPU will exit the current
1063	TB if code is modified inside this TB. */
1064	void tb_invalidate_phys_page_range(target_phys_addr_t start, target_phys_addr_t end,
1065	int is_cpu_write_access)
1066	{
1067	int n, current_tb_modified, current_tb_not_found, current_flags;
1068	CPUState *env = cpu_single_env;
1069	PageDesc *p;
1070	TranslationBlock tb, tb_next, current_tb, saved_tb;
1071	target_ulong tb_start, tb_end;
1072	target_ulong current_pc, current_cs_base;
1073
1074	p = page_find(start >> TARGET_PAGE_BITS);
1075	if (!p)
1076	return;
1077	if (!p->code_bitmap &&
1078	++p->code_write_count >= SMC_BITMAP_USE_THRESHOLD &&
1079	is_cpu_write_access) {
1080	/* build code bitmap */
1081	build_page_bitmap(p);
1082	}
1083
1084	/* we remove all the TBs in the range [start, end[ */
1085	/* XXX: see if in some cases it could be faster to invalidate all the code */
1086	current_tb_not_found = is_cpu_write_access;
1087	current_tb_modified = 0;
1088	current_tb = NULL; /* avoid warning */
1089	current_pc = 0; /* avoid warning */
1090	current_cs_base = 0; /* avoid warning */
1091	current_flags = 0; /* avoid warning */
1092	tb = p->first_tb;
1093	while (tb != NULL) {
1094	n = (long)tb & 3;
1095	tb = (TranslationBlock *)((long)tb & ~3);
1096	tb_next = tb->page_next[n];
1097	/* NOTE: this is subtle as a TB may span two physical pages */
1098	if (n == 0) {
1099	/* NOTE: tb_end may be after the end of the page, but
1100	it is not a problem */
1101	tb_start = tb->page_addr[0] + (tb->pc & ~TARGET_PAGE_MASK);
1102	tb_end = tb_start + tb->size;
1103	} else {
1104	tb_start = tb->page_addr[1];
1105	tb_end = tb_start + ((tb->pc + tb->size) & ~TARGET_PAGE_MASK);
1106	}
1107	if (!(tb_end <= start \|\| tb_start >= end)) {
1108	#ifdef TARGET_HAS_PRECISE_SMC
1109	if (current_tb_not_found) {
1110	current_tb_not_found = 0;
1111	current_tb = NULL;
1112	if (env->mem_io_pc) {
1113	/* now we have a real cpu fault */
1114	current_tb = tb_find_pc(env->mem_io_pc);
1115	}
1116	}
1117	if (current_tb == tb &&
1118	(current_tb->cflags & CF_COUNT_MASK) != 1) {
1119	/* If we are modifying the current TB, we must stop
1120	its execution. We could be more precise by checking
1121	that the modification is after the current PC, but it
1122	would require a specialized function to partially
1123	restore the CPU state */
1124
1125	current_tb_modified = 1;
1126	cpu_restore_state(current_tb, env,
1127	env->mem_io_pc, NULL);
1128	#if defined(TARGET_I386)
1129	current_flags = env->hflags;
1130	current_flags \|= (env->eflags & (IOPL_MASK \| TF_MASK \| VM_MASK));
1131	current_cs_base = (target_ulong)env->segs[R_CS].base;
1132	current_pc = current_cs_base + env->eip;
1133	#else
1134	#error unsupported CPU
1135	#endif
1136	}
1137	#endif /* TARGET_HAS_PRECISE_SMC */
1138	/* we need to do that to handle the case where a signal
1139	occurs while doing tb_phys_invalidate() */
1140	saved_tb = NULL;
1141	if (env) {
1142	saved_tb = env->current_tb;
1143	env->current_tb = NULL;
1144	}
1145	tb_phys_invalidate(tb, -1);
1146	if (env) {
1147	env->current_tb = saved_tb;
1148	if (env->interrupt_request && env->current_tb)
1149	cpu_interrupt(env, env->interrupt_request);
1150	}
1151	}
1152	tb = tb_next;
1153	}
1154	#if !defined(CONFIG_USER_ONLY)
1155	/* if no code remaining, no need to continue to use slow writes */
1156	if (!p->first_tb) {
1157	invalidate_page_bitmap(p);
1158	if (is_cpu_write_access) {
1159	tlb_unprotect_code_phys(env, start, env->mem_io_vaddr);
1160	}
1161	}
1162	#endif
1163	#ifdef TARGET_HAS_PRECISE_SMC
1164	if (current_tb_modified) {
1165	/* we generate a block containing just the instruction
1166	modifying the memory. It will ensure that it cannot modify
1167	itself */
1168	env->current_tb = NULL;
1169	tb_gen_code(env, current_pc, current_cs_base, current_flags, 1);
1170	cpu_resume_from_signal(env, NULL);
1171	}
1172	#endif
1173	}
1174
1175
1176	/* len must be <= 8 and start must be a multiple of len */
1177	#ifndef VBOX
1178	static inline void tb_invalidate_phys_page_fast(target_phys_addr_t start, int len)
1179	#else
1180	DECLINLINE(void) tb_invalidate_phys_page_fast(target_phys_addr_t start, int len)
1181	#endif
1182	{
1183	PageDesc *p;
1184	int offset, b;
1185	#if 0
1186	if (1) {
1187	if (loglevel) {
1188	fprintf(logfile, "modifying code at 0x%x size=%d EIP=%x PC=%08x\n",
1189	cpu_single_env->mem_io_vaddr, len,
1190	cpu_single_env->eip,
1191	cpu_single_env->eip + (long)cpu_single_env->segs[R_CS].base);
1192	}
1193	}
1194	#endif
1195	p = page_find(start >> TARGET_PAGE_BITS);
1196	if (!p)
1197	return;
1198	if (p->code_bitmap) {
1199	offset = start & ~TARGET_PAGE_MASK;
1200	b = p->code_bitmap[offset >> 3] >> (offset & 7);
1201	if (b & ((1 << len) - 1))
1202	goto do_invalidate;
1203	} else {
1204	do_invalidate:
1205	tb_invalidate_phys_page_range(start, start + len, 1);
1206	}
1207	}
1208
1209
1210	#if !defined(CONFIG_SOFTMMU)
1211	static void tb_invalidate_phys_page(target_phys_addr_t addr,
1212	unsigned long pc, void *puc)
1213	{
1214	int n, current_flags, current_tb_modified;
1215	target_ulong current_pc, current_cs_base;
1216	PageDesc *p;
1217	TranslationBlock tb, current_tb;
1218	#ifdef TARGET_HAS_PRECISE_SMC
1219	CPUState *env = cpu_single_env;
1220	#endif
1221
1222	addr &= TARGET_PAGE_MASK;
1223	p = page_find(addr >> TARGET_PAGE_BITS);
1224	if (!p)
1225	return;
1226	tb = p->first_tb;
1227	current_tb_modified = 0;
1228	current_tb = NULL;
1229	current_pc = 0; /* avoid warning */
1230	current_cs_base = 0; /* avoid warning */
1231	current_flags = 0; /* avoid warning */
1232	#ifdef TARGET_HAS_PRECISE_SMC
1233	if (tb && pc != 0) {
1234	current_tb = tb_find_pc(pc);
1235	}
1236	#endif
1237	while (tb != NULL) {
1238	n = (long)tb & 3;
1239	tb = (TranslationBlock *)((long)tb & ~3);
1240	#ifdef TARGET_HAS_PRECISE_SMC
1241	if (current_tb == tb &&
1242	(current_tb->cflags & CF_COUNT_MASK) != 1) {
1243	/* If we are modifying the current TB, we must stop
1244	its execution. We could be more precise by checking
1245	that the modification is after the current PC, but it
1246	would require a specialized function to partially
1247	restore the CPU state */
1248
1249	current_tb_modified = 1;
1250	cpu_restore_state(current_tb, env, pc, puc);
1251	#if defined(TARGET_I386)
1252	current_flags = env->hflags;
1253	current_flags \|= (env->eflags & (IOPL_MASK \| TF_MASK \| VM_MASK));
1254	current_cs_base = (target_ulong)env->segs[R_CS].base;
1255	current_pc = current_cs_base + env->eip;
1256	#else
1257	#error unsupported CPU
1258	#endif
1259	}
1260	#endif /* TARGET_HAS_PRECISE_SMC */
1261	tb_phys_invalidate(tb, addr);
1262	tb = tb->page_next[n];
1263	}
1264	p->first_tb = NULL;
1265	#ifdef TARGET_HAS_PRECISE_SMC
1266	if (current_tb_modified) {
1267	/* we generate a block containing just the instruction
1268	modifying the memory. It will ensure that it cannot modify
1269	itself */
1270	env->current_tb = NULL;
1271	tb_gen_code(env, current_pc, current_cs_base, current_flags, 1);
1272	cpu_resume_from_signal(env, puc);
1273	}
1274	#endif
1275	}
1276	#endif
1277
1278	/* add the tb in the target page and protect it if necessary */
1279	#ifndef VBOX
1280	static inline void tb_alloc_page(TranslationBlock *tb,
1281	unsigned int n, target_ulong page_addr)
1282	#else
1283	DECLINLINE(void) tb_alloc_page(TranslationBlock *tb,
1284	unsigned int n, target_ulong page_addr)
1285	#endif
1286	{
1287	PageDesc *p;
1288	TranslationBlock *last_first_tb;
1289
1290	tb->page_addr[n] = page_addr;
1291	p = page_find_alloc(page_addr >> TARGET_PAGE_BITS);
1292	tb->page_next[n] = p->first_tb;
1293	last_first_tb = p->first_tb;
1294	p->first_tb = (TranslationBlock *)((long)tb \| n);
1295	invalidate_page_bitmap(p);
1296
1297	#if defined(TARGET_HAS_SMC) \|\| 1
1298
1299	#if defined(CONFIG_USER_ONLY)
1300	if (p->flags & PAGE_WRITE) {
1301	target_ulong addr;
1302	PageDesc *p2;
1303	int prot;
1304
1305	/* force the host page as non writable (writes will have a
1306	page fault + mprotect overhead) */
1307	page_addr &= qemu_host_page_mask;
1308	prot = 0;
1309	for(addr = page_addr; addr < page_addr + qemu_host_page_size;
1310	addr += TARGET_PAGE_SIZE) {
1311
1312	p2 = page_find (addr >> TARGET_PAGE_BITS);
1313	if (!p2)
1314	continue;
1315	prot \|= p2->flags;
1316	p2->flags &= ~PAGE_WRITE;
1317	page_get_flags(addr);
1318	}
1319	mprotect(g2h(page_addr), qemu_host_page_size,
1320	(prot & PAGE_BITS) & ~PAGE_WRITE);
1321	#ifdef DEBUG_TB_INVALIDATE
1322	printf("protecting code page: 0x" TARGET_FMT_lx "\n",
1323	page_addr);
1324	#endif
1325	}
1326	#else
1327	/* if some code is already present, then the pages are already
1328	protected. So we handle the case where only the first TB is
1329	allocated in a physical page */
1330	if (!last_first_tb) {
1331	tlb_protect_code(page_addr);
1332	}
1333	#endif
1334
1335	#endif /* TARGET_HAS_SMC */
1336	}
1337
1338	/* Allocate a new translation block. Flush the translation buffer if
1339	too many translation blocks or too much generated code. */
1340	TranslationBlock *tb_alloc(target_ulong pc)
1341	{
1342	TranslationBlock *tb;
1343
1344	if (nb_tbs >= code_gen_max_blocks \|\|
1345	#ifndef VBOX
1346	(code_gen_ptr - code_gen_buffer) >= code_gen_buffer_max_size)
1347	#else
1348	(code_gen_ptr - code_gen_buffer) >= (int)code_gen_buffer_max_size)
1349	#endif
1350	return NULL;
1351	tb = &tbs[nb_tbs++];
1352	tb->pc = pc;
1353	tb->cflags = 0;
1354	return tb;
1355	}
1356
1357	void tb_free(TranslationBlock *tb)
1358	{
1359	/* In practice this is mostly used for single use temporary TB
1360	Ignore the hard cases and just back up if this TB happens to
1361	be the last one generated. */
1362	if (nb_tbs > 0 && tb == &tbs[nb_tbs - 1]) {
1363	code_gen_ptr = tb->tc_ptr;
1364	nb_tbs--;
1365	}
1366	}
1367
1368	/* add a new TB and link it to the physical page tables. phys_page2 is
1369	(-1) to indicate that only one page contains the TB. */
1370	void tb_link_phys(TranslationBlock *tb,
1371	target_ulong phys_pc, target_ulong phys_page2)
1372	{
1373	unsigned int h;
1374	TranslationBlock **ptb;
1375
1376	/* Grab the mmap lock to stop another thread invalidating this TB
1377	before we are done. */
1378	mmap_lock();
1379	/* add in the physical hash table */
1380	h = tb_phys_hash_func(phys_pc);
1381	ptb = &tb_phys_hash[h];
1382	tb->phys_hash_next = *ptb;
1383	*ptb = tb;
1384
1385	/* add in the page list */
1386	tb_alloc_page(tb, 0, phys_pc & TARGET_PAGE_MASK);
1387	if (phys_page2 != -1)
1388	tb_alloc_page(tb, 1, phys_page2);
1389	else
1390	tb->page_addr[1] = -1;
1391
1392	tb->jmp_first = (TranslationBlock *)((long)tb \| 2);
1393	tb->jmp_next[0] = NULL;
1394	tb->jmp_next[1] = NULL;
1395
1396	/* init original jump addresses */
1397	if (tb->tb_next_offset[0] != 0xffff)
1398	tb_reset_jump(tb, 0);
1399	if (tb->tb_next_offset[1] != 0xffff)
1400	tb_reset_jump(tb, 1);
1401
1402	#ifdef DEBUG_TB_CHECK
1403	tb_page_check();
1404	#endif
1405	mmap_unlock();
1406	}
1407
1408	/* find the TB 'tb' such that tb[0].tc_ptr <= tc_ptr <
1409	tb[1].tc_ptr. Return NULL if not found */
1410	TranslationBlock *tb_find_pc(unsigned long tc_ptr)
1411	{
1412	int m_min, m_max, m;
1413	unsigned long v;
1414	TranslationBlock *tb;
1415
1416	if (nb_tbs <= 0)
1417	return NULL;
1418	if (tc_ptr < (unsigned long)code_gen_buffer \|\|
1419	tc_ptr >= (unsigned long)code_gen_ptr)
1420	return NULL;
1421	/* binary search (cf Knuth) */
1422	m_min = 0;
1423	m_max = nb_tbs - 1;
1424	while (m_min <= m_max) {
1425	m = (m_min + m_max) >> 1;
1426	tb = &tbs[m];
1427	v = (unsigned long)tb->tc_ptr;
1428	if (v == tc_ptr)
1429	return tb;
1430	else if (tc_ptr < v) {
1431	m_max = m - 1;
1432	} else {
1433	m_min = m + 1;
1434	}
1435	}
1436	return &tbs[m_max];
1437	}
1438
1439	static void tb_reset_jump_recursive(TranslationBlock *tb);
1440
1441	#ifndef VBOX
1442	static inline void tb_reset_jump_recursive2(TranslationBlock *tb, int n)
1443	#else
1444	DECLINLINE(void) tb_reset_jump_recursive2(TranslationBlock *tb, int n)
1445	#endif
1446	{
1447	TranslationBlock tb1, tb_next, **ptb;
1448	unsigned int n1;
1449
1450	tb1 = tb->jmp_next[n];
1451	if (tb1 != NULL) {
1452	/* find head of list */
1453	for(;;) {
1454	n1 = (long)tb1 & 3;
1455	tb1 = (TranslationBlock *)((long)tb1 & ~3);
1456	if (n1 == 2)
1457	break;
1458	tb1 = tb1->jmp_next[n1];
1459	}
1460	/* we are now sure now that tb jumps to tb1 */
1461	tb_next = tb1;
1462
1463	/* remove tb from the jmp_first list */
1464	ptb = &tb_next->jmp_first;
1465	for(;;) {
1466	tb1 = *ptb;
1467	n1 = (long)tb1 & 3;
1468	tb1 = (TranslationBlock *)((long)tb1 & ~3);
1469	if (n1 == n && tb1 == tb)
1470	break;
1471	ptb = &tb1->jmp_next[n1];
1472	}
1473	*ptb = tb->jmp_next[n];
1474	tb->jmp_next[n] = NULL;
1475
1476	/* suppress the jump to next tb in generated code */
1477	tb_reset_jump(tb, n);
1478
1479	/* suppress jumps in the tb on which we could have jumped */
1480	tb_reset_jump_recursive(tb_next);
1481	}
1482	}
1483
1484	static void tb_reset_jump_recursive(TranslationBlock *tb)
1485	{
1486	tb_reset_jump_recursive2(tb, 0);
1487	tb_reset_jump_recursive2(tb, 1);
1488	}
1489
1490	#if defined(TARGET_HAS_ICE)
1491	static void breakpoint_invalidate(CPUState *env, target_ulong pc)
1492	{
1493	target_ulong addr, pd;
1494	ram_addr_t ram_addr;
1495	PhysPageDesc *p;
1496
1497	addr = cpu_get_phys_page_debug(env, pc);
1498	p = phys_page_find(addr >> TARGET_PAGE_BITS);
1499	if (!p) {
1500	pd = IO_MEM_UNASSIGNED;
1501	} else {
1502	pd = p->phys_offset;
1503	}
1504	ram_addr = (pd & TARGET_PAGE_MASK) \| (pc & ~TARGET_PAGE_MASK);
1505	tb_invalidate_phys_page_range(ram_addr, ram_addr + 1, 0);
1506	}
1507	#endif
1508
1509	/* Add a watchpoint. */
1510	int cpu_watchpoint_insert(CPUState *env, target_ulong addr, int type)
1511	{
1512	int i;
1513
1514	for (i = 0; i < env->nb_watchpoints; i++) {
1515	if (addr == env->watchpoint[i].vaddr)
1516	return 0;
1517	}
1518	if (env->nb_watchpoints >= MAX_WATCHPOINTS)
1519	return -1;
1520
1521	i = env->nb_watchpoints++;
1522	env->watchpoint[i].vaddr = addr;
1523	env->watchpoint[i].type = type;
1524	tlb_flush_page(env, addr);
1525	/* FIXME: This flush is needed because of the hack to make memory ops
1526	terminate the TB. It can be removed once the proper IO trap and
1527	re-execute bits are in. */
1528	tb_flush(env);
1529	return i;
1530	}
1531
1532	/* Remove a watchpoint. */
1533	int cpu_watchpoint_remove(CPUState *env, target_ulong addr)
1534	{
1535	int i;
1536
1537	for (i = 0; i < env->nb_watchpoints; i++) {
1538	if (addr == env->watchpoint[i].vaddr) {
1539	env->nb_watchpoints--;
1540	env->watchpoint[i] = env->watchpoint[env->nb_watchpoints];
1541	tlb_flush_page(env, addr);
1542	return 0;
1543	}
1544	}
1545	return -1;
1546	}
1547
1548	/* Remove all watchpoints. */
1549	void cpu_watchpoint_remove_all(CPUState *env) {
1550	int i;
1551
1552	for (i = 0; i < env->nb_watchpoints; i++) {
1553	tlb_flush_page(env, env->watchpoint[i].vaddr);
1554	}
1555	env->nb_watchpoints = 0;
1556	}
1557
1558	/* add a breakpoint. EXCP_DEBUG is returned by the CPU loop if a
1559	breakpoint is reached */
1560	int cpu_breakpoint_insert(CPUState *env, target_ulong pc)
1561	{
1562	#if defined(TARGET_HAS_ICE)
1563	int i;
1564
1565	for(i = 0; i < env->nb_breakpoints; i++) {
1566	if (env->breakpoints[i] == pc)
1567	return 0;
1568	}
1569
1570	if (env->nb_breakpoints >= MAX_BREAKPOINTS)
1571	return -1;
1572	env->breakpoints[env->nb_breakpoints++] = pc;
1573
1574	breakpoint_invalidate(env, pc);
1575	return 0;
1576	#else
1577	return -1;
1578	#endif
1579	}
1580
1581	/* remove all breakpoints */
1582	void cpu_breakpoint_remove_all(CPUState *env) {
1583	#if defined(TARGET_HAS_ICE)
1584	int i;
1585	for(i = 0; i < env->nb_breakpoints; i++) {
1586	breakpoint_invalidate(env, env->breakpoints[i]);
1587	}
1588	env->nb_breakpoints = 0;
1589	#endif
1590	}
1591
1592	/* remove a breakpoint */
1593	int cpu_breakpoint_remove(CPUState *env, target_ulong pc)
1594	{
1595	#if defined(TARGET_HAS_ICE)
1596	int i;
1597	for(i = 0; i < env->nb_breakpoints; i++) {
1598	if (env->breakpoints[i] == pc)
1599	goto found;
1600	}
1601	return -1;
1602	found:
1603	env->nb_breakpoints--;
1604	if (i < env->nb_breakpoints)
1605	env->breakpoints[i] = env->breakpoints[env->nb_breakpoints];
1606
1607	breakpoint_invalidate(env, pc);
1608	return 0;
1609	#else
1610	return -1;
1611	#endif
1612	}
1613
1614	/* enable or disable single step mode. EXCP_DEBUG is returned by the
1615	CPU loop after each instruction */
1616	void cpu_single_step(CPUState *env, int enabled)
1617	{
1618	#if defined(TARGET_HAS_ICE)
1619	if (env->singlestep_enabled != enabled) {
1620	env->singlestep_enabled = enabled;
1621	/* must flush all the translated code to avoid inconsistancies */
1622	/* XXX: only flush what is necessary */
1623	tb_flush(env);
1624	}
1625	#endif
1626	}
1627
1628	#ifndef VBOX
1629	/* enable or disable low levels log */
1630	void cpu_set_log(int log_flags)
1631	{
1632	loglevel = log_flags;
1633	if (loglevel && !logfile) {
1634	logfile = fopen(logfilename, "w");
1635	if (!logfile) {
1636	perror(logfilename);
1637	_exit(1);
1638	}
1639	#if !defined(CONFIG_SOFTMMU)
1640	/* must avoid mmap() usage of glibc by setting a buffer "by hand" */
1641	{
1642	static uint8_t logfile_buf[4096];
1643	setvbuf(logfile, logfile_buf, _IOLBF, sizeof(logfile_buf));
1644	}
1645	#else
1646	setvbuf(logfile, NULL, _IOLBF, 0);
1647	#endif
1648	}
1649	}
1650
1651	void cpu_set_log_filename(const char *filename)
1652	{
1653	logfilename = strdup(filename);
1654	}
1655	#endif /* !VBOX */
1656
1657	/* mask must never be zero, except for A20 change call */
1658	void cpu_interrupt(CPUState *env, int mask)
1659	{
1660	#if !defined(USE_NPTL)
1661	TranslationBlock *tb;
1662	static spinlock_t interrupt_lock = SPIN_LOCK_UNLOCKED;
1663	#endif
1664	int old_mask;
1665
1666	old_mask = env->interrupt_request;
1667	#ifdef VBOX
1668	VM_ASSERT_EMT(env->pVM);
1669	ASMAtomicOrS32((int32_t volatile *)&env->interrupt_request, mask);
1670	#else /* !VBOX */
1671	/* FIXME: This is probably not threadsafe. A different thread could
1672	be in the middle of a read-modify-write operation. */
1673	env->interrupt_request \|= mask;
1674	#endif /* !VBOX */
1675	#if defined(USE_NPTL)
1676	/* FIXME: TB unchaining isn't SMP safe. For now just ignore the
1677	problem and hope the cpu will stop of its own accord. For userspace
1678	emulation this often isn't actually as bad as it sounds. Often
1679	signals are used primarily to interrupt blocking syscalls. */
1680	#else
1681	if (use_icount) {
1682	env->icount_decr.u16.high = 0xffff;
1683	#ifndef CONFIG_USER_ONLY
1684	/* CPU_INTERRUPT_EXIT isn't a real interrupt. It just means
1685	an async event happened and we need to process it. */
1686	if (!can_do_io(env)
1687	&& (mask & ~(old_mask \| CPU_INTERRUPT_EXIT)) != 0) {
1688	cpu_abort(env, "Raised interrupt while not in I/O function");
1689	}
1690	#endif
1691	} else {
1692	tb = env->current_tb;
1693	/* if the cpu is currently executing code, we must unlink it and
1694	all the potentially executing TB */
1695	if (tb && !testandset(&interrupt_lock)) {
1696	env->current_tb = NULL;
1697	tb_reset_jump_recursive(tb);
1698	resetlock(&interrupt_lock);
1699	}
1700	}
1701	#endif
1702	}
1703
1704	void cpu_reset_interrupt(CPUState *env, int mask)
1705	{
1706	#ifdef VBOX
1707	/*
1708	* Note: the current implementation can be executed by another thread without problems; make sure this remains true
1709	* for future changes!
1710	*/
1711	ASMAtomicAndS32((int32_t volatile *)&env->interrupt_request, ~mask);
1712	#else /* !VBOX */
1713	env->interrupt_request &= ~mask;
1714	#endif /* !VBOX */
1715	}
1716
1717	#ifndef VBOX
1718	CPULogItem cpu_log_items[] = {
1719	{ CPU_LOG_TB_OUT_ASM, "out_asm",
1720	"show generated host assembly code for each compiled TB" },
1721	{ CPU_LOG_TB_IN_ASM, "in_asm",
1722	"show target assembly code for each compiled TB" },
1723	{ CPU_LOG_TB_OP, "op",
1724	"show micro ops for each compiled TB (only usable if 'in_asm' used)" },
1725	#ifdef TARGET_I386
1726	{ CPU_LOG_TB_OP_OPT, "op_opt",
1727	"show micro ops after optimization for each compiled TB" },
1728	#endif
1729	{ CPU_LOG_INT, "int",
1730	"show interrupts/exceptions in short format" },
1731	{ CPU_LOG_EXEC, "exec",
1732	"show trace before each executed TB (lots of logs)" },
1733	{ CPU_LOG_TB_CPU, "cpu",
1734	"show CPU state before bloc translation" },
1735	#ifdef TARGET_I386
1736	{ CPU_LOG_PCALL, "pcall",
1737	"show protected mode far calls/returns/exceptions" },
1738	#endif
1739	#ifdef DEBUG_IOPORT
1740	{ CPU_LOG_IOPORT, "ioport",
1741	"show all i/o ports accesses" },
1742	#endif
1743	{ 0, NULL, NULL },
1744	};
1745
1746	static int cmp1(const char s1, int n, const char s2)
1747	{
1748	if (strlen(s2) != n)
1749	return 0;
1750	return memcmp(s1, s2, n) == 0;
1751	}
1752
1753	/* takes a comma separated list of log masks. Return 0 if error. */
1754	int cpu_str_to_log_mask(const char *str)
1755	{
1756	CPULogItem *item;
1757	int mask;
1758	const char p, p1;
1759
1760	p = str;
1761	mask = 0;
1762	for(;;) {
1763	p1 = strchr(p, ',');
1764	if (!p1)
1765	p1 = p + strlen(p);
1766	if(cmp1(p,p1-p,"all")) {
1767	for(item = cpu_log_items; item->mask != 0; item++) {
1768	mask \|= item->mask;
1769	}
1770	} else {
1771	for(item = cpu_log_items; item->mask != 0; item++) {
1772	if (cmp1(p, p1 - p, item->name))
1773	goto found;
1774	}
1775	return 0;
1776	}
1777	found:
1778	mask \|= item->mask;
1779	if (*p1 != ',')
1780	break;
1781	p = p1 + 1;
1782	}
1783	return mask;
1784	}
1785	#endif /* !VBOX */
1786
1787	#ifndef VBOX /* VBOX: we have our own routine. */
1788	void cpu_abort(CPUState env, const char fmt, ...)
1789	{
1790	va_list ap;
1791
1792	va_start(ap, fmt);
1793	fprintf(stderr, "qemu: fatal: ");
1794	vfprintf(stderr, fmt, ap);
1795	fprintf(stderr, "\n");
1796	#ifdef TARGET_I386
1797	cpu_dump_state(env, stderr, fprintf, X86_DUMP_FPU \| X86_DUMP_CCOP);
1798	#else
1799	cpu_dump_state(env, stderr, fprintf, 0);
1800	#endif
1801	va_end(ap);
1802	abort();
1803	}
1804	#endif /* !VBOX */
1805
1806	#ifndef VBOX
1807	CPUState cpu_copy(CPUState env)
1808	{
1809	CPUState *new_env = cpu_init(env->cpu_model_str);
1810	/* preserve chaining and index */
1811	CPUState *next_cpu = new_env->next_cpu;
1812	int cpu_index = new_env->cpu_index;
1813	memcpy(new_env, env, sizeof(CPUState));
1814	new_env->next_cpu = next_cpu;
1815	new_env->cpu_index = cpu_index;
1816	return new_env;
1817	}
1818	#endif
1819
1820	#if !defined(CONFIG_USER_ONLY)
1821
1822	#ifndef VBOX
1823	static inline void tlb_flush_jmp_cache(CPUState *env, target_ulong addr)
1824	#else
1825	DECLINLINE(void) tlb_flush_jmp_cache(CPUState *env, target_ulong addr)
1826	#endif
1827	{
1828	unsigned int i;
1829
1830	/* Discard jump cache entries for any tb which might potentially
1831	overlap the flushed page. */
1832	i = tb_jmp_cache_hash_page(addr - TARGET_PAGE_SIZE);
1833	memset (&env->tb_jmp_cache[i], 0,
1834	TB_JMP_PAGE_SIZE * sizeof(TranslationBlock *));
1835
1836	i = tb_jmp_cache_hash_page(addr);
1837	memset (&env->tb_jmp_cache[i], 0,
1838	TB_JMP_PAGE_SIZE * sizeof(TranslationBlock *));
1839
1840	#ifdef VBOX
1841	/* inform raw mode about TLB page flush */
1842	remR3FlushPage(env, addr);
1843	#endif /* VBOX */
1844	}
1845
1846	/* NOTE: if flush_global is true, also flush global entries (not
1847	implemented yet) */
1848	void tlb_flush(CPUState *env, int flush_global)
1849	{
1850	int i;
1851
1852	#if defined(DEBUG_TLB)
1853	printf("tlb_flush:\n");
1854	#endif
1855	/* must reset current TB so that interrupts cannot modify the
1856	links while we are modifying them */
1857	env->current_tb = NULL;
1858
1859	for(i = 0; i < CPU_TLB_SIZE; i++) {
1860	env->tlb_table[0][i].addr_read = -1;
1861	env->tlb_table[0][i].addr_write = -1;
1862	env->tlb_table[0][i].addr_code = -1;
1863	env->tlb_table[1][i].addr_read = -1;
1864	env->tlb_table[1][i].addr_write = -1;
1865	env->tlb_table[1][i].addr_code = -1;
1866	#if (NB_MMU_MODES >= 3)
1867	env->tlb_table[2][i].addr_read = -1;
1868	env->tlb_table[2][i].addr_write = -1;
1869	env->tlb_table[2][i].addr_code = -1;
1870	#if (NB_MMU_MODES == 4)
1871	env->tlb_table[3][i].addr_read = -1;
1872	env->tlb_table[3][i].addr_write = -1;
1873	env->tlb_table[3][i].addr_code = -1;
1874	#endif
1875	#endif
1876	}
1877
1878	memset (env->tb_jmp_cache, 0, TB_JMP_CACHE_SIZE * sizeof (void *));
1879
1880	#ifdef VBOX
1881	/* inform raw mode about TLB flush */
1882	remR3FlushTLB(env, flush_global);
1883	#endif
1884	#ifdef USE_KQEMU
1885	if (env->kqemu_enabled) {
1886	kqemu_flush(env, flush_global);
1887	}
1888	#endif
1889	tlb_flush_count++;
1890	}
1891
1892	#ifndef VBOX
1893	static inline void tlb_flush_entry(CPUTLBEntry *tlb_entry, target_ulong addr)
1894	#else
1895	DECLINLINE(void) tlb_flush_entry(CPUTLBEntry *tlb_entry, target_ulong addr)
1896	#endif
1897	{
1898	if (addr == (tlb_entry->addr_read &
1899	(TARGET_PAGE_MASK \| TLB_INVALID_MASK)) \|\|
1900	addr == (tlb_entry->addr_write &
1901	(TARGET_PAGE_MASK \| TLB_INVALID_MASK)) \|\|
1902	addr == (tlb_entry->addr_code &
1903	(TARGET_PAGE_MASK \| TLB_INVALID_MASK))) {
1904	tlb_entry->addr_read = -1;
1905	tlb_entry->addr_write = -1;
1906	tlb_entry->addr_code = -1;
1907	}
1908	}
1909
1910	void tlb_flush_page(CPUState *env, target_ulong addr)
1911	{
1912	int i;
1913
1914	#if defined(DEBUG_TLB)
1915	printf("tlb_flush_page: " TARGET_FMT_lx "\n", addr);
1916	#endif
1917	/* must reset current TB so that interrupts cannot modify the
1918	links while we are modifying them */
1919	env->current_tb = NULL;
1920
1921	addr &= TARGET_PAGE_MASK;
1922	i = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
1923	tlb_flush_entry(&env->tlb_table[0][i], addr);
1924	tlb_flush_entry(&env->tlb_table[1][i], addr);
1925	#if (NB_MMU_MODES >= 3)
1926	tlb_flush_entry(&env->tlb_table[2][i], addr);
1927	#if (NB_MMU_MODES == 4)
1928	tlb_flush_entry(&env->tlb_table[3][i], addr);
1929	#endif
1930	#endif
1931
1932	tlb_flush_jmp_cache(env, addr);
1933
1934	#ifdef USE_KQEMU
1935	if (env->kqemu_enabled) {
1936	kqemu_flush_page(env, addr);
1937	}
1938	#endif
1939	}
1940
1941	/* update the TLBs so that writes to code in the virtual page 'addr'
1942	can be detected */
1943	static void tlb_protect_code(ram_addr_t ram_addr)
1944	{
1945	cpu_physical_memory_reset_dirty(ram_addr,
1946	ram_addr + TARGET_PAGE_SIZE,
1947	CODE_DIRTY_FLAG);
1948	#if defined(VBOX) && defined(REM_MONITOR_CODE_PAGES)
1949	/** @todo Retest this? This function has changed... */
1950	remR3ProtectCode(cpu_single_env, ram_addr);
1951	#endif
1952	}
1953
1954	/* update the TLB so that writes in physical page 'phys_addr' are no longer
1955	tested for self modifying code */
1956	static void tlb_unprotect_code_phys(CPUState *env, ram_addr_t ram_addr,
1957	target_ulong vaddr)
1958	{
1959	#ifdef VBOX
1960	if (RT_LIKELY((ram_addr >> TARGET_PAGE_BITS) < phys_ram_dirty_size))
1961	#endif
1962	phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] \|= CODE_DIRTY_FLAG;
1963	}
1964
1965	#ifndef VBOX
1966	static inline void tlb_reset_dirty_range(CPUTLBEntry *tlb_entry,
1967	unsigned long start, unsigned long length)
1968	#else
1969	DECLINLINE(void) tlb_reset_dirty_range(CPUTLBEntry *tlb_entry,
1970	unsigned long start, unsigned long length)
1971	#endif
1972	{
1973	unsigned long addr;
1974
1975	#ifdef VBOX
1976	if (start & 3)
1977	return;
1978	#endif
1979	if ((tlb_entry->addr_write & ~TARGET_PAGE_MASK) == IO_MEM_RAM) {
1980	addr = (tlb_entry->addr_write & TARGET_PAGE_MASK) + tlb_entry->addend;
1981	if ((addr - start) < length) {
1982	tlb_entry->addr_write = (tlb_entry->addr_write & TARGET_PAGE_MASK) \| IO_MEM_NOTDIRTY;
1983	}
1984	}
1985	}
1986
1987	void cpu_physical_memory_reset_dirty(ram_addr_t start, ram_addr_t end,
1988	int dirty_flags)
1989	{
1990	CPUState *env;
1991	unsigned long length, start1;
1992	int i, mask, len;
1993	uint8_t *p;
1994
1995	start &= TARGET_PAGE_MASK;
1996	end = TARGET_PAGE_ALIGN(end);
1997
1998	length = end - start;
1999	if (length == 0)
2000	return;
2001	len = length >> TARGET_PAGE_BITS;
2002	#ifdef USE_KQEMU
2003	/* XXX: should not depend on cpu context */
2004	env = first_cpu;
2005	if (env->kqemu_enabled) {
2006	ram_addr_t addr;
2007	addr = start;
2008	for(i = 0; i < len; i++) {
2009	kqemu_set_notdirty(env, addr);
2010	addr += TARGET_PAGE_SIZE;
2011	}
2012	}
2013	#endif
2014	mask = ~dirty_flags;
2015	p = phys_ram_dirty + (start >> TARGET_PAGE_BITS);
2016	#ifdef VBOX
2017	if (RT_LIKELY((start >> TARGET_PAGE_BITS) < phys_ram_dirty_size))
2018	#endif
2019	for(i = 0; i < len; i++)
2020	p[i] &= mask;
2021
2022	/* we modify the TLB cache so that the dirty bit will be set again
2023	when accessing the range */
2024	#if defined(VBOX) && defined(REM_PHYS_ADDR_IN_TLB)
2025	start1 = start;
2026	#elif !defined(VBOX)
2027	start1 = start + (unsigned long)phys_ram_base;
2028	#else
2029	start1 = (unsigned long)remR3TlbGCPhys2Ptr(first_cpu, start, 1 /fWritable/); /** @todo this can be harmful with VBOX_WITH_NEW_PHYS_CODE, fix interface/whatever. */
2030	#endif
2031	for(env = first_cpu; env != NULL; env = env->next_cpu) {
2032	for(i = 0; i < CPU_TLB_SIZE; i++)
2033	tlb_reset_dirty_range(&env->tlb_table[0][i], start1, length);
2034	for(i = 0; i < CPU_TLB_SIZE; i++)
2035	tlb_reset_dirty_range(&env->tlb_table[1][i], start1, length);
2036	#if (NB_MMU_MODES >= 3)
2037	for(i = 0; i < CPU_TLB_SIZE; i++)
2038	tlb_reset_dirty_range(&env->tlb_table[2][i], start1, length);
2039	#if (NB_MMU_MODES == 4)
2040	for(i = 0; i < CPU_TLB_SIZE; i++)
2041	tlb_reset_dirty_range(&env->tlb_table[3][i], start1, length);
2042	#endif
2043	#endif
2044	}
2045	}
2046
2047	#ifndef VBOX
2048	int cpu_physical_memory_set_dirty_tracking(int enable)
2049	{
2050	in_migration = enable;
2051	return 0;
2052	}
2053
2054	int cpu_physical_memory_get_dirty_tracking(void)
2055	{
2056	return in_migration;
2057	}
2058	#endif
2059
2060	#ifndef VBOX
2061	static inline void tlb_update_dirty(CPUTLBEntry *tlb_entry)
2062	#else
2063	DECLINLINE(void) tlb_update_dirty(CPUTLBEntry *tlb_entry)
2064	#endif
2065	{
2066	ram_addr_t ram_addr;
2067
2068	if ((tlb_entry->addr_write & ~TARGET_PAGE_MASK) == IO_MEM_RAM) {
2069	/* RAM case */
2070	#if defined(VBOX) && defined(REM_PHYS_ADDR_IN_TLB)
2071	ram_addr = (tlb_entry->addr_write & TARGET_PAGE_MASK) + tlb_entry->addend;
2072	#elif !defined(VBOX)
2073	ram_addr = (tlb_entry->addr_write & TARGET_PAGE_MASK) +
2074	tlb_entry->addend - (unsigned long)phys_ram_base;
2075	#else
2076	ram_addr = remR3HCVirt2GCPhys(first_cpu, (void*)((tlb_entry->addr_write & TARGET_PAGE_MASK) + tlb_entry->addend));
2077	#endif
2078	if (!cpu_physical_memory_is_dirty(ram_addr)) {
2079	tlb_entry->addr_write \|= TLB_NOTDIRTY;
2080	}
2081	}
2082	}
2083
2084	/* update the TLB according to the current state of the dirty bits */
2085	void cpu_tlb_update_dirty(CPUState *env)
2086	{
2087	int i;
2088	for(i = 0; i < CPU_TLB_SIZE; i++)
2089	tlb_update_dirty(&env->tlb_table[0][i]);
2090	for(i = 0; i < CPU_TLB_SIZE; i++)
2091	tlb_update_dirty(&env->tlb_table[1][i]);
2092	#if (NB_MMU_MODES >= 3)
2093	for(i = 0; i < CPU_TLB_SIZE; i++)
2094	tlb_update_dirty(&env->tlb_table[2][i]);
2095	#if (NB_MMU_MODES == 4)
2096	for(i = 0; i < CPU_TLB_SIZE; i++)
2097	tlb_update_dirty(&env->tlb_table[3][i]);
2098	#endif
2099	#endif
2100	}
2101
2102	#ifndef VBOX
2103	static inline void tlb_set_dirty1(CPUTLBEntry *tlb_entry, target_ulong vaddr)
2104	#else
2105	DECLINLINE(void) tlb_set_dirty1(CPUTLBEntry *tlb_entry, target_ulong vaddr)
2106	#endif
2107	{
2108	if (tlb_entry->addr_write == (vaddr \| TLB_NOTDIRTY))
2109	tlb_entry->addr_write = vaddr;
2110	}
2111
2112
2113	/* update the TLB corresponding to virtual page vaddr and phys addr
2114	addr so that it is no longer dirty */
2115	#ifndef VBOX
2116	static inline void tlb_set_dirty(CPUState *env,
2117	unsigned long addr, target_ulong vaddr)
2118	#else
2119	DECLINLINE(void) tlb_set_dirty(CPUState *env,
2120	unsigned long addr, target_ulong vaddr)
2121	#endif
2122	{
2123	int i;
2124
2125	addr &= TARGET_PAGE_MASK;
2126	i = (vaddr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
2127	tlb_set_dirty1(&env->tlb_table[0][i], addr);
2128	tlb_set_dirty1(&env->tlb_table[1][i], addr);
2129	#if (NB_MMU_MODES >= 3)
2130	tlb_set_dirty1(&env->tlb_table[2][i], vaddr);
2131	#if (NB_MMU_MODES == 4)
2132	tlb_set_dirty1(&env->tlb_table[3][i], vaddr);
2133	#endif
2134	#endif
2135	}
2136
2137	/* add a new TLB entry. At most one entry for a given virtual address
2138	is permitted. Return 0 if OK or 2 if the page could not be mapped
2139	(can only happen in non SOFTMMU mode for I/O pages or pages
2140	conflicting with the host address space). */
2141	int tlb_set_page_exec(CPUState *env, target_ulong vaddr,
2142	target_phys_addr_t paddr, int prot,
2143	int mmu_idx, int is_softmmu)
2144	{
2145	PhysPageDesc *p;
2146	unsigned long pd;
2147	unsigned int index;
2148	target_ulong address;
2149	target_ulong code_address;
2150	target_phys_addr_t addend;
2151	int ret;
2152	CPUTLBEntry *te;
2153	int i;
2154	target_phys_addr_t iotlb;
2155
2156	p = phys_page_find(paddr >> TARGET_PAGE_BITS);
2157	if (!p) {
2158	pd = IO_MEM_UNASSIGNED;
2159	} else {
2160	pd = p->phys_offset;
2161	}
2162	#if defined(DEBUG_TLB)
2163	printf("tlb_set_page: vaddr=" TARGET_FMT_lx " paddr=0x%08x prot=%x idx=%d smmu=%d pd=0x%08lx\n",
2164	vaddr, (int)paddr, prot, mmu_idx, is_softmmu, pd);
2165	#endif
2166
2167	ret = 0;
2168	address = vaddr;
2169	if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM && !(pd & IO_MEM_ROMD)) {
2170	/* IO memory case (romd handled later) */
2171	address \|= TLB_MMIO;
2172	}
2173	#if defined(VBOX) && defined(REM_PHYS_ADDR_IN_TLB)
2174	addend = pd & TARGET_PAGE_MASK;
2175	#elif !defined(VBOX)
2176	addend = (unsigned long)phys_ram_base + (pd & TARGET_PAGE_MASK);
2177	#else
2178	/** @todo this is racing the phys_page_find call above since it may register
2179	* a new chunk of memory... */
2180	addend = (unsigned long)remR3TlbGCPhys2Ptr(env,
2181	pd & TARGET_PAGE_MASK,
2182	!!(prot & PAGE_WRITE));
2183	#endif
2184	if ((pd & ~TARGET_PAGE_MASK) <= IO_MEM_ROM) {
2185	/* Normal RAM. */
2186	iotlb = pd & TARGET_PAGE_MASK;
2187	if ((pd & ~TARGET_PAGE_MASK) == IO_MEM_RAM)
2188	iotlb \|= IO_MEM_NOTDIRTY;
2189	else
2190	iotlb \|= IO_MEM_ROM;
2191	} else {
2192	/* IO handlers are currently passed a phsical address.
2193	It would be nice to pass an offset from the base address
2194	of that region. This would avoid having to special case RAM,
2195	and avoid full address decoding in every device.
2196	We can't use the high bits of pd for this because
2197	IO_MEM_ROMD uses these as a ram address. */
2198	iotlb = (pd & ~TARGET_PAGE_MASK) + paddr;
2199	}
2200
2201	code_address = address;
2202
2203	#ifdef VBOX
2204	# if !defined(REM_PHYS_ADDR_IN_TLB)
2205	if (addend & 0x2)
2206	{
2207	/* catch write */
2208	addend &= ~(target_ulong)0x3;
2209	if ((pd & ~TARGET_PAGE_MASK) <= IO_MEM_ROM)
2210	{
2211	/** @todo improve this, it's only avoid code reads right now! */
2212	address \|= TLB_MMIO;
2213	iotlb = env->pVM->rem.s.iHandlerMemType + paddr;
2214	}
2215	}
2216	else if (addend & 0x1)
2217	{
2218	/* catch all */
2219	addend &= ~(target_ulong)0x3;
2220	if ((pd & ~TARGET_PAGE_MASK) <= IO_MEM_ROM)
2221	{
2222	address \|= TLB_MMIO;
2223	code_address \|= TLB_MMIO;
2224	iotlb = env->pVM->rem.s.iHandlerMemType + paddr;
2225	}
2226	}
2227	# endif
2228	#endif
2229
2230	/* Make accesses to pages with watchpoints go via the
2231	watchpoint trap routines. */
2232	for (i = 0; i < env->nb_watchpoints; i++) {
2233	if (vaddr == (env->watchpoint[i].vaddr & TARGET_PAGE_MASK)) {
2234	iotlb = io_mem_watch + paddr;
2235	/* TODO: The memory case can be optimized by not trapping
2236	reads of pages with a write breakpoint. */
2237	address \|= TLB_MMIO;
2238	}
2239	}
2240
2241	index = (vaddr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
2242	env->iotlb[mmu_idx][index] = iotlb - vaddr;
2243	te = &env->tlb_table[mmu_idx][index];
2244	te->addend = addend - vaddr;
2245	if (prot & PAGE_READ) {
2246	te->addr_read = address;
2247	} else {
2248	te->addr_read = -1;
2249	}
2250
2251	if (prot & PAGE_EXEC) {
2252	te->addr_code = code_address;
2253	} else {
2254	te->addr_code = -1;
2255	}
2256	if (prot & PAGE_WRITE) {
2257	if ((pd & ~TARGET_PAGE_MASK) == IO_MEM_ROM \|\|
2258	(pd & IO_MEM_ROMD)) {
2259	/* Write access calls the I/O callback. */
2260	te->addr_write = address \| TLB_MMIO;
2261	} else if ((pd & ~TARGET_PAGE_MASK) == IO_MEM_RAM &&
2262	!cpu_physical_memory_is_dirty(pd)) {
2263	te->addr_write = address \| TLB_NOTDIRTY;
2264	} else {
2265	te->addr_write = address;
2266	}
2267	} else {
2268	te->addr_write = -1;
2269	}
2270	#ifdef VBOX
2271	/* inform raw mode about TLB page change */
2272	remR3FlushPage(env, vaddr);
2273	#endif
2274	return ret;
2275	}
2276	#if 0
2277	/* called from signal handler: invalidate the code and unprotect the
2278	page. Return TRUE if the fault was succesfully handled. */
2279	int page_unprotect(target_ulong addr, unsigned long pc, void *puc)
2280	{
2281	#if !defined(CONFIG_SOFTMMU)
2282	VirtPageDesc *vp;
2283
2284	#if defined(DEBUG_TLB)
2285	printf("page_unprotect: addr=0x%08x\n", addr);
2286	#endif
2287	addr &= TARGET_PAGE_MASK;
2288
2289	/* if it is not mapped, no need to worry here */
2290	if (addr >= MMAP_AREA_END)
2291	return 0;
2292	vp = virt_page_find(addr >> TARGET_PAGE_BITS);
2293	if (!vp)
2294	return 0;
2295	/* NOTE: in this case, validate_tag is _not_ tested as it
2296	validates only the code TLB */
2297	if (vp->valid_tag != virt_valid_tag)
2298	return 0;
2299	if (!(vp->prot & PAGE_WRITE))
2300	return 0;
2301	#if defined(DEBUG_TLB)
2302	printf("page_unprotect: addr=0x%08x phys_addr=0x%08x prot=%x\n",
2303	addr, vp->phys_addr, vp->prot);
2304	#endif
2305	if (mprotect((void *)addr, TARGET_PAGE_SIZE, vp->prot) < 0)
2306	cpu_abort(cpu_single_env, "error mprotect addr=0x%lx prot=%d\n",
2307	(unsigned long)addr, vp->prot);
2308	/* set the dirty bit */
2309	phys_ram_dirty[vp->phys_addr >> TARGET_PAGE_BITS] = 0xff;
2310	/* flush the code inside */
2311	tb_invalidate_phys_page(vp->phys_addr, pc, puc);
2312	return 1;
2313	#elif defined(VBOX)
2314	addr &= TARGET_PAGE_MASK;
2315
2316	/* if it is not mapped, no need to worry here */
2317	if (addr >= MMAP_AREA_END)
2318	return 0;
2319	return 1;
2320	#else
2321	return 0;
2322	#endif
2323	}
2324	#endif /* 0 */
2325
2326	#else
2327
2328	void tlb_flush(CPUState *env, int flush_global)
2329	{
2330	}
2331
2332	void tlb_flush_page(CPUState *env, target_ulong addr)
2333	{
2334	}
2335
2336	int tlb_set_page_exec(CPUState *env, target_ulong vaddr,
2337	target_phys_addr_t paddr, int prot,
2338	int mmu_idx, int is_softmmu)
2339	{
2340	return 0;
2341	}
2342
2343	#ifndef VBOX
2344	/* dump memory mappings */
2345	void page_dump(FILE *f)
2346	{
2347	unsigned long start, end;
2348	int i, j, prot, prot1;
2349	PageDesc *p;
2350
2351	fprintf(f, "%-8s %-8s %-8s %s\n",
2352	"start", "end", "size", "prot");
2353	start = -1;
2354	end = -1;
2355	prot = 0;
2356	for(i = 0; i <= L1_SIZE; i++) {
2357	if (i < L1_SIZE)
2358	p = l1_map[i];
2359	else
2360	p = NULL;
2361	for(j = 0;j < L2_SIZE; j++) {
2362	if (!p)
2363	prot1 = 0;
2364	else
2365	prot1 = p[j].flags;
2366	if (prot1 != prot) {
2367	end = (i << (32 - L1_BITS)) \| (j << TARGET_PAGE_BITS);
2368	if (start != -1) {
2369	fprintf(f, "%08lx-%08lx %08lx %c%c%c\n",
2370	start, end, end - start,
2371	prot & PAGE_READ ? 'r' : '-',
2372	prot & PAGE_WRITE ? 'w' : '-',
2373	prot & PAGE_EXEC ? 'x' : '-');
2374	}
2375	if (prot1 != 0)
2376	start = end;
2377	else
2378	start = -1;
2379	prot = prot1;
2380	}
2381	if (!p)
2382	break;
2383	}
2384	}
2385	}
2386	#endif /* !VBOX */
2387
2388	int page_get_flags(target_ulong address)
2389	{
2390	PageDesc *p;
2391
2392	p = page_find(address >> TARGET_PAGE_BITS);
2393	if (!p)
2394	return 0;
2395	return p->flags;
2396	}
2397
2398	/* modify the flags of a page and invalidate the code if
2399	necessary. The flag PAGE_WRITE_ORG is positionned automatically
2400	depending on PAGE_WRITE */
2401	void page_set_flags(target_ulong start, target_ulong end, int flags)
2402	{
2403	PageDesc *p;
2404	target_ulong addr;
2405
2406	start = start & TARGET_PAGE_MASK;
2407	end = TARGET_PAGE_ALIGN(end);
2408	if (flags & PAGE_WRITE)
2409	flags \|= PAGE_WRITE_ORG;
2410	#ifdef VBOX
2411	AssertMsgFailed(("We shouldn't be here, and if we should, we must have an env to do the proper locking!\n"));
2412	#endif
2413	spin_lock(&tb_lock);
2414	for(addr = start; addr < end; addr += TARGET_PAGE_SIZE) {
2415	p = page_find_alloc(addr >> TARGET_PAGE_BITS);
2416	/* if the write protection is set, then we invalidate the code
2417	inside */
2418	if (!(p->flags & PAGE_WRITE) &&
2419	(flags & PAGE_WRITE) &&
2420	p->first_tb) {
2421	tb_invalidate_phys_page(addr, 0, NULL);
2422	}
2423	p->flags = flags;
2424	}
2425	spin_unlock(&tb_lock);
2426	}
2427
2428	int page_check_range(target_ulong start, target_ulong len, int flags)
2429	{
2430	PageDesc *p;
2431	target_ulong end;
2432	target_ulong addr;
2433
2434	end = TARGET_PAGE_ALIGN(start+len); /* must do before we loose bits in the next step */
2435	start = start & TARGET_PAGE_MASK;
2436
2437	if( end < start )
2438	/* we've wrapped around */
2439	return -1;
2440	for(addr = start; addr < end; addr += TARGET_PAGE_SIZE) {
2441	p = page_find(addr >> TARGET_PAGE_BITS);
2442	if( !p )
2443	return -1;
2444	if( !(p->flags & PAGE_VALID) )
2445	return -1;
2446
2447	if ((flags & PAGE_READ) && !(p->flags & PAGE_READ))
2448	return -1;
2449	if (flags & PAGE_WRITE) {
2450	if (!(p->flags & PAGE_WRITE_ORG))
2451	return -1;
2452	/* unprotect the page if it was put read-only because it
2453	contains translated code */
2454	if (!(p->flags & PAGE_WRITE)) {
2455	if (!page_unprotect(addr, 0, NULL))
2456	return -1;
2457	}
2458	return 0;
2459	}
2460	}
2461	return 0;
2462	}
2463
2464	/* called from signal handler: invalidate the code and unprotect the
2465	page. Return TRUE if the fault was succesfully handled. */
2466	int page_unprotect(target_ulong address, unsigned long pc, void *puc)
2467	{
2468	unsigned int page_index, prot, pindex;
2469	PageDesc p, p1;
2470	target_ulong host_start, host_end, addr;
2471
2472	/* Technically this isn't safe inside a signal handler. However we
2473	know this only ever happens in a synchronous SEGV handler, so in
2474	practice it seems to be ok. */
2475	mmap_lock();
2476
2477	host_start = address & qemu_host_page_mask;
2478	page_index = host_start >> TARGET_PAGE_BITS;
2479	p1 = page_find(page_index);
2480	if (!p1) {
2481	mmap_unlock();
2482	return 0;
2483	}
2484	host_end = host_start + qemu_host_page_size;
2485	p = p1;
2486	prot = 0;
2487	for(addr = host_start;addr < host_end; addr += TARGET_PAGE_SIZE) {
2488	prot \|= p->flags;
2489	p++;
2490	}
2491	/* if the page was really writable, then we change its
2492	protection back to writable */
2493	if (prot & PAGE_WRITE_ORG) {
2494	pindex = (address - host_start) >> TARGET_PAGE_BITS;
2495	if (!(p1[pindex].flags & PAGE_WRITE)) {
2496	mprotect((void *)g2h(host_start), qemu_host_page_size,
2497	(prot & PAGE_BITS) \| PAGE_WRITE);
2498	p1[pindex].flags \|= PAGE_WRITE;
2499	/* and since the content will be modified, we must invalidate
2500	the corresponding translated code. */
2501	tb_invalidate_phys_page(address, pc, puc);
2502	#ifdef DEBUG_TB_CHECK
2503	tb_invalidate_check(address);
2504	#endif
2505	mmap_unlock();
2506	return 1;
2507	}
2508	}
2509	mmap_unlock();
2510	return 0;
2511	}
2512
2513	static inline void tlb_set_dirty(CPUState *env,
2514	unsigned long addr, target_ulong vaddr)
2515	{
2516	}
2517	#endif /* defined(CONFIG_USER_ONLY) */
2518
2519	#if !defined(CONFIG_USER_ONLY)
2520	static int subpage_register (subpage_t *mmio, uint32_t start, uint32_t end,
2521	ram_addr_t memory);
2522	static void subpage_init (target_phys_addr_t base, ram_addr_t phys,
2523	ram_addr_t orig_memory);
2524	#define CHECK_SUBPAGE(addr, start_addr, start_addr2, end_addr, end_addr2, \
2525	need_subpage) \
2526	do { \
2527	if (addr > start_addr) \
2528	start_addr2 = 0; \
2529	else { \
2530	start_addr2 = start_addr & ~TARGET_PAGE_MASK; \
2531	if (start_addr2 > 0) \
2532	need_subpage = 1; \
2533	} \
2534	\
2535	if ((start_addr + orig_size) - addr >= TARGET_PAGE_SIZE) \
2536	end_addr2 = TARGET_PAGE_SIZE - 1; \
2537	else { \
2538	end_addr2 = (start_addr + orig_size - 1) & ~TARGET_PAGE_MASK; \
2539	if (end_addr2 < TARGET_PAGE_SIZE - 1) \
2540	need_subpage = 1; \
2541	} \
2542	} while (0)
2543
2544
2545	/* register physical memory. 'size' must be a multiple of the target
2546	page size. If (phys_offset & ~TARGET_PAGE_MASK) != 0, then it is an
2547	io memory page */
2548	void cpu_register_physical_memory(target_phys_addr_t start_addr,
2549	unsigned long size,
2550	unsigned long phys_offset)
2551	{
2552	target_phys_addr_t addr, end_addr;
2553	PhysPageDesc *p;
2554	CPUState *env;
2555	ram_addr_t orig_size = size;
2556	void *subpage;
2557
2558	#ifdef USE_KQEMU
2559	/* XXX: should not depend on cpu context */
2560	env = first_cpu;
2561	if (env->kqemu_enabled) {
2562	kqemu_set_phys_mem(start_addr, size, phys_offset);
2563	}
2564	#endif
2565	size = (size + TARGET_PAGE_SIZE - 1) & TARGET_PAGE_MASK;
2566	end_addr = start_addr + (target_phys_addr_t)size;
2567	for(addr = start_addr; addr != end_addr; addr += TARGET_PAGE_SIZE) {
2568	p = phys_page_find(addr >> TARGET_PAGE_BITS);
2569	if (p && p->phys_offset != IO_MEM_UNASSIGNED) {
2570	ram_addr_t orig_memory = p->phys_offset;
2571	target_phys_addr_t start_addr2, end_addr2;
2572	int need_subpage = 0;
2573
2574	CHECK_SUBPAGE(addr, start_addr, start_addr2, end_addr, end_addr2,
2575	need_subpage);
2576	if (need_subpage \|\| phys_offset & IO_MEM_SUBWIDTH) {
2577	if (!(orig_memory & IO_MEM_SUBPAGE)) {
2578	subpage = subpage_init((addr & TARGET_PAGE_MASK),
2579	&p->phys_offset, orig_memory);
2580	} else {
2581	subpage = io_mem_opaque[(orig_memory & ~TARGET_PAGE_MASK)
2582	>> IO_MEM_SHIFT];
2583	}
2584	subpage_register(subpage, start_addr2, end_addr2, phys_offset);
2585	} else {
2586	p->phys_offset = phys_offset;
2587	#if !defined(VBOX) \|\| defined(VBOX_WITH_NEW_PHYS_CODE)
2588	if ((phys_offset & ~TARGET_PAGE_MASK) <= IO_MEM_ROM \|\|
2589	(phys_offset & IO_MEM_ROMD))
2590	#else
2591	if ( (phys_offset & ~TARGET_PAGE_MASK) <= IO_MEM_ROM
2592	\|\| (phys_offset & IO_MEM_ROMD)
2593	\|\| (phys_offset & ~TARGET_PAGE_MASK) == IO_MEM_RAM_MISSING)
2594	#endif
2595	phys_offset += TARGET_PAGE_SIZE;
2596	}
2597	} else {
2598	p = phys_page_find_alloc(addr >> TARGET_PAGE_BITS, 1);
2599	p->phys_offset = phys_offset;
2600	#if !defined(VBOX) \|\| defined(VBOX_WITH_NEW_PHYS_CODE)
2601	if ((phys_offset & ~TARGET_PAGE_MASK) <= IO_MEM_ROM \|\|
2602	(phys_offset & IO_MEM_ROMD))
2603	#else
2604	if ( (phys_offset & ~TARGET_PAGE_MASK) <= IO_MEM_ROM
2605	\|\| (phys_offset & IO_MEM_ROMD)
2606	\|\| (phys_offset & ~TARGET_PAGE_MASK) == IO_MEM_RAM_MISSING)
2607	#endif
2608	phys_offset += TARGET_PAGE_SIZE;
2609	else {
2610	target_phys_addr_t start_addr2, end_addr2;
2611	int need_subpage = 0;
2612
2613	CHECK_SUBPAGE(addr, start_addr, start_addr2, end_addr,
2614	end_addr2, need_subpage);
2615
2616	if (need_subpage \|\| phys_offset & IO_MEM_SUBWIDTH) {
2617	subpage = subpage_init((addr & TARGET_PAGE_MASK),
2618	&p->phys_offset, IO_MEM_UNASSIGNED);
2619	subpage_register(subpage, start_addr2, end_addr2,
2620	phys_offset);
2621	}
2622	}
2623	}
2624	}
2625	/* since each CPU stores ram addresses in its TLB cache, we must
2626	reset the modified entries */
2627	/* XXX: slow ! */
2628	for(env = first_cpu; env != NULL; env = env->next_cpu) {
2629	tlb_flush(env, 1);
2630	}
2631	}
2632
2633	/* XXX: temporary until new memory mapping API */
2634	uint32_t cpu_get_physical_page_desc(target_phys_addr_t addr)
2635	{
2636	PhysPageDesc *p;
2637
2638	p = phys_page_find(addr >> TARGET_PAGE_BITS);
2639	if (!p)
2640	return IO_MEM_UNASSIGNED;
2641	return p->phys_offset;
2642	}
2643
2644	#ifndef VBOX
2645	/* XXX: better than nothing */
2646	ram_addr_t qemu_ram_alloc(ram_addr_t size)
2647	{
2648	ram_addr_t addr;
2649	if ((phys_ram_alloc_offset + size) > phys_ram_size) {
2650	fprintf(stderr, "Not enough memory (requested_size = %" PRIu64 ", max memory = %" PRIu64 ")\n",
2651	(uint64_t)size, (uint64_t)phys_ram_size);
2652	abort();
2653	}
2654	addr = phys_ram_alloc_offset;
2655	phys_ram_alloc_offset = TARGET_PAGE_ALIGN(phys_ram_alloc_offset + size);
2656	return addr;
2657	}
2658
2659	void qemu_ram_free(ram_addr_t addr)
2660	{
2661	}
2662	#endif
2663
2664
2665	static uint32_t unassigned_mem_readb(void *opaque, target_phys_addr_t addr)
2666	{
2667	#ifdef DEBUG_UNASSIGNED
2668	printf("Unassigned mem read 0x%08x\n", (int)addr);
2669	#endif
2670	#if defined(TARGET_SPARC) \|\| defined(TARGET_CRIS)
2671	do_unassigned_access(addr, 0, 0, 0, 1);
2672	#endif
2673	return 0;
2674	}
2675
2676	static uint32_t unassigned_mem_readw(void *opaque, target_phys_addr_t addr)
2677	{
2678	#ifdef DEBUG_UNASSIGNED
2679	printf("Unassigned mem read " TARGET_FMT_plx "\n", addr);
2680	#endif
2681	#if defined(TARGET_SPARC) \|\| defined(TARGET_CRIS)
2682	do_unassigned_access(addr, 0, 0, 0, 2);
2683	#endif
2684	return 0;
2685	}
2686
2687	static uint32_t unassigned_mem_readl(void *opaque, target_phys_addr_t addr)
2688	{
2689	#ifdef DEBUG_UNASSIGNED
2690	printf("Unassigned mem read " TARGET_FMT_plx "\n", addr);
2691	#endif
2692	#if defined(TARGET_SPARC) \|\| defined(TARGET_CRIS)
2693	do_unassigned_access(addr, 0, 0, 0, 4);
2694	#endif
2695	return 0;
2696	}
2697
2698	static void unassigned_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
2699	{
2700	#ifdef DEBUG_UNASSIGNED
2701	printf("Unassigned mem write 0x%08x = 0x%x\n", (int)addr, val);
2702	#endif
2703	}
2704
2705	static void unassigned_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
2706	{
2707	#ifdef DEBUG_UNASSIGNED
2708	printf("Unassigned mem write " TARGET_FMT_plx " = 0x%x\n", addr, val);
2709	#endif
2710	#if defined(TARGET_SPARC) \|\| defined(TARGET_CRIS)
2711	do_unassigned_access(addr, 1, 0, 0, 2);
2712	#endif
2713	}
2714
2715	static void unassigned_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
2716	{
2717	#ifdef DEBUG_UNASSIGNED
2718	printf("Unassigned mem write " TARGET_FMT_plx " = 0x%x\n", addr, val);
2719	#endif
2720	#if defined(TARGET_SPARC) \|\| defined(TARGET_CRIS)
2721	do_unassigned_access(addr, 1, 0, 0, 4);
2722	#endif
2723	}
2724	static CPUReadMemoryFunc *unassigned_mem_read[3] = {
2725	unassigned_mem_readb,
2726	unassigned_mem_readw,
2727	unassigned_mem_readl,
2728	};
2729
2730	static CPUWriteMemoryFunc *unassigned_mem_write[3] = {
2731	unassigned_mem_writeb,
2732	unassigned_mem_writew,
2733	unassigned_mem_writel,
2734	};
2735
2736	static void notdirty_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
2737	{
2738	unsigned long ram_addr;
2739	int dirty_flags;
2740	#if defined(VBOX)
2741	ram_addr = addr;
2742	#elif
2743	ram_addr = addr - (unsigned long)phys_ram_base;
2744	#endif
2745	#ifdef VBOX
2746	if (RT_UNLIKELY((ram_addr >> TARGET_PAGE_BITS) >= phys_ram_dirty_size))
2747	dirty_flags = 0xff;
2748	else
2749	#endif /* VBOX */
2750	dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2751	if (!(dirty_flags & CODE_DIRTY_FLAG)) {
2752	#if !defined(CONFIG_USER_ONLY)
2753	tb_invalidate_phys_page_fast(ram_addr, 1);
2754	# ifdef VBOX
2755	if (RT_UNLIKELY((ram_addr >> TARGET_PAGE_BITS) >= phys_ram_dirty_size))
2756	dirty_flags = 0xff;
2757	else
2758	# endif /* VBOX */
2759	dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2760	#endif
2761	}
2762	#if defined(VBOX) && !defined(REM_PHYS_ADDR_IN_TLB)
2763	remR3PhysWriteU8(addr, val);
2764	#else
2765	stb_p((uint8_t *)(long)addr, val);
2766	#endif
2767	#ifdef USE_KQEMU
2768	if (cpu_single_env->kqemu_enabled &&
2769	(dirty_flags & KQEMU_MODIFY_PAGE_MASK) != KQEMU_MODIFY_PAGE_MASK)
2770	kqemu_modify_page(cpu_single_env, ram_addr);
2771	#endif
2772	dirty_flags \|= (0xff & ~CODE_DIRTY_FLAG);
2773	#ifdef VBOX
2774	if (RT_LIKELY((ram_addr >> TARGET_PAGE_BITS) < phys_ram_dirty_size))
2775	#endif /* !VBOX */
2776	phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] = dirty_flags;
2777	/* we remove the notdirty callback only if the code has been
2778	flushed */
2779	if (dirty_flags == 0xff)
2780	tlb_set_dirty(cpu_single_env, addr, cpu_single_env->mem_io_vaddr);
2781	}
2782
2783	static void notdirty_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
2784	{
2785	unsigned long ram_addr;
2786	int dirty_flags;
2787	#if defined(VBOX)
2788	ram_addr = addr;
2789	#else
2790	ram_addr = addr - (unsigned long)phys_ram_base;
2791	#endif
2792	#ifdef VBOX
2793	if (RT_UNLIKELY((ram_addr >> TARGET_PAGE_BITS) >= phys_ram_dirty_size))
2794	dirty_flags = 0xff;
2795	else
2796	#endif /* VBOX */
2797	dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2798	if (!(dirty_flags & CODE_DIRTY_FLAG)) {
2799	#if !defined(CONFIG_USER_ONLY)
2800	tb_invalidate_phys_page_fast(ram_addr, 2);
2801	# ifdef VBOX
2802	if (RT_UNLIKELY((ram_addr >> TARGET_PAGE_BITS) >= phys_ram_dirty_size))
2803	dirty_flags = 0xff;
2804	else
2805	# endif /* VBOX */
2806	dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2807	#endif
2808	}
2809	#if defined(VBOX) && !defined(REM_PHYS_ADDR_IN_TLB)
2810	remR3PhysWriteU16(addr, val);
2811	#else
2812	stw_p((uint8_t *)(long)addr, val);
2813	#endif
2814
2815	#ifdef USE_KQEMU
2816	if (cpu_single_env->kqemu_enabled &&
2817	(dirty_flags & KQEMU_MODIFY_PAGE_MASK) != KQEMU_MODIFY_PAGE_MASK)
2818	kqemu_modify_page(cpu_single_env, ram_addr);
2819	#endif
2820	dirty_flags \|= (0xff & ~CODE_DIRTY_FLAG);
2821	#ifdef VBOX
2822	if (RT_LIKELY((ram_addr >> TARGET_PAGE_BITS) < phys_ram_dirty_size))
2823	#endif
2824	phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] = dirty_flags;
2825	/* we remove the notdirty callback only if the code has been
2826	flushed */
2827	if (dirty_flags == 0xff)
2828	tlb_set_dirty(cpu_single_env, addr, cpu_single_env->mem_io_vaddr);
2829	}
2830
2831	static void notdirty_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
2832	{
2833	unsigned long ram_addr;
2834	int dirty_flags;
2835	#if defined(VBOX)
2836	ram_addr = addr;
2837	#else
2838	ram_addr = addr - (unsigned long)phys_ram_base;
2839	#endif
2840	#ifdef VBOX
2841	if (RT_UNLIKELY((ram_addr >> TARGET_PAGE_BITS) >= phys_ram_dirty_size))
2842	dirty_flags = 0xff;
2843	else
2844	#endif /* VBOX */
2845	dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2846	if (!(dirty_flags & CODE_DIRTY_FLAG)) {
2847	#if !defined(CONFIG_USER_ONLY)
2848	tb_invalidate_phys_page_fast(ram_addr, 4);
2849	# ifdef VBOX
2850	if (RT_UNLIKELY((ram_addr >> TARGET_PAGE_BITS) >= phys_ram_dirty_size))
2851	dirty_flags = 0xff;
2852	else
2853	# endif /* VBOX */
2854	dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2855	#endif
2856	}
2857	#if defined(VBOX) && !defined(REM_PHYS_ADDR_IN_TLB)
2858	remR3PhysWriteU32(addr, val);
2859	#else
2860	stl_p((uint8_t *)(long)addr, val);
2861	#endif
2862	#ifdef USE_KQEMU
2863	if (cpu_single_env->kqemu_enabled &&
2864	(dirty_flags & KQEMU_MODIFY_PAGE_MASK) != KQEMU_MODIFY_PAGE_MASK)
2865	kqemu_modify_page(cpu_single_env, ram_addr);
2866	#endif
2867	dirty_flags \|= (0xff & ~CODE_DIRTY_FLAG);
2868	#ifdef VBOX
2869	if (RT_LIKELY((ram_addr >> TARGET_PAGE_BITS) < phys_ram_dirty_size))
2870	#endif
2871	phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] = dirty_flags;
2872	/* we remove the notdirty callback only if the code has been
2873	flushed */
2874	if (dirty_flags == 0xff)
2875	tlb_set_dirty(cpu_single_env, addr, cpu_single_env->mem_io_vaddr);
2876	}
2877
2878	static CPUReadMemoryFunc *error_mem_read[3] = {
2879	NULL, /* never used */
2880	NULL, /* never used */
2881	NULL, /* never used */
2882	};
2883
2884	static CPUWriteMemoryFunc *notdirty_mem_write[3] = {
2885	notdirty_mem_writeb,
2886	notdirty_mem_writew,
2887	notdirty_mem_writel,
2888	};
2889
2890
2891	/* Generate a debug exception if a watchpoint has been hit. */
2892	static void check_watchpoint(int offset, int flags)
2893	{
2894	CPUState *env = cpu_single_env;
2895	target_ulong vaddr;
2896	int i;
2897
2898	vaddr = (env->mem_io_vaddr & TARGET_PAGE_MASK) + offset;
2899	for (i = 0; i < env->nb_watchpoints; i++) {
2900	if (vaddr == env->watchpoint[i].vaddr
2901	&& (env->watchpoint[i].type & flags)) {
2902	env->watchpoint_hit = i + 1;
2903	cpu_interrupt(env, CPU_INTERRUPT_DEBUG);
2904	break;
2905	}
2906	}
2907	}
2908
2909	/* Watchpoint access routines. Watchpoints are inserted using TLB tricks,
2910	so these check for a hit then pass through to the normal out-of-line
2911	phys routines. */
2912	static uint32_t watch_mem_readb(void *opaque, target_phys_addr_t addr)
2913	{
2914	check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_READ);
2915	return ldub_phys(addr);
2916	}
2917
2918	static uint32_t watch_mem_readw(void *opaque, target_phys_addr_t addr)
2919	{
2920	check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_READ);
2921	return lduw_phys(addr);
2922	}
2923
2924	static uint32_t watch_mem_readl(void *opaque, target_phys_addr_t addr)
2925	{
2926	check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_READ);
2927	return ldl_phys(addr);
2928	}
2929
2930	static void watch_mem_writeb(void *opaque, target_phys_addr_t addr,
2931	uint32_t val)
2932	{
2933	check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_WRITE);
2934	stb_phys(addr, val);
2935	}
2936
2937	static void watch_mem_writew(void *opaque, target_phys_addr_t addr,
2938	uint32_t val)
2939	{
2940	check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_WRITE);
2941	stw_phys(addr, val);
2942	}
2943
2944	static void watch_mem_writel(void *opaque, target_phys_addr_t addr,
2945	uint32_t val)
2946	{
2947	check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_WRITE);
2948	stl_phys(addr, val);
2949	}
2950
2951	static CPUReadMemoryFunc *watch_mem_read[3] = {
2952	watch_mem_readb,
2953	watch_mem_readw,
2954	watch_mem_readl,
2955	};
2956
2957	static CPUWriteMemoryFunc *watch_mem_write[3] = {
2958	watch_mem_writeb,
2959	watch_mem_writew,
2960	watch_mem_writel,
2961	};
2962
2963	static inline uint32_t subpage_readlen (subpage_t *mmio, target_phys_addr_t addr,
2964	unsigned int len)
2965	{
2966	uint32_t ret;
2967	unsigned int idx;
2968
2969	idx = SUBPAGE_IDX(addr - mmio->base);
2970	#if defined(DEBUG_SUBPAGE)
2971	printf("%s: subpage %p len %d addr " TARGET_FMT_plx " idx %d\n", __func__,
2972	mmio, len, addr, idx);
2973	#endif
2974	ret = (**mmio->mem_read[idx][len])(mmio->opaque[idx][0][len], addr);
2975
2976	return ret;
2977	}
2978
2979	static inline void subpage_writelen (subpage_t *mmio, target_phys_addr_t addr,
2980	uint32_t value, unsigned int len)
2981	{
2982	unsigned int idx;
2983
2984	idx = SUBPAGE_IDX(addr - mmio->base);
2985	#if defined(DEBUG_SUBPAGE)
2986	printf("%s: subpage %p len %d addr " TARGET_FMT_plx " idx %d value %08x\n", __func__,
2987	mmio, len, addr, idx, value);
2988	#endif
2989	(**mmio->mem_write[idx][len])(mmio->opaque[idx][1][len], addr, value);
2990	}
2991
2992	static uint32_t subpage_readb (void *opaque, target_phys_addr_t addr)
2993	{
2994	#if defined(DEBUG_SUBPAGE)
2995	printf("%s: addr " TARGET_FMT_plx "\n", __func__, addr);
2996	#endif
2997
2998	return subpage_readlen(opaque, addr, 0);
2999	}
3000
3001	static void subpage_writeb (void *opaque, target_phys_addr_t addr,
3002	uint32_t value)
3003	{
3004	#if defined(DEBUG_SUBPAGE)
3005	printf("%s: addr " TARGET_FMT_plx " val %08x\n", __func__, addr, value);
3006	#endif
3007	subpage_writelen(opaque, addr, value, 0);
3008	}
3009
3010	static uint32_t subpage_readw (void *opaque, target_phys_addr_t addr)
3011	{
3012	#if defined(DEBUG_SUBPAGE)
3013	printf("%s: addr " TARGET_FMT_plx "\n", __func__, addr);
3014	#endif
3015
3016	return subpage_readlen(opaque, addr, 1);
3017	}
3018
3019	static void subpage_writew (void *opaque, target_phys_addr_t addr,
3020	uint32_t value)
3021	{
3022	#if defined(DEBUG_SUBPAGE)
3023	printf("%s: addr " TARGET_FMT_plx " val %08x\n", __func__, addr, value);
3024	#endif
3025	subpage_writelen(opaque, addr, value, 1);
3026	}
3027
3028	static uint32_t subpage_readl (void *opaque, target_phys_addr_t addr)
3029	{
3030	#if defined(DEBUG_SUBPAGE)
3031	printf("%s: addr " TARGET_FMT_plx "\n", __func__, addr);
3032	#endif
3033
3034	return subpage_readlen(opaque, addr, 2);
3035	}
3036
3037	static void subpage_writel (void *opaque,
3038	target_phys_addr_t addr, uint32_t value)
3039	{
3040	#if defined(DEBUG_SUBPAGE)
3041	printf("%s: addr " TARGET_FMT_plx " val %08x\n", __func__, addr, value);
3042	#endif
3043	subpage_writelen(opaque, addr, value, 2);
3044	}
3045
3046	static CPUReadMemoryFunc *subpage_read[] = {
3047	&subpage_readb,
3048	&subpage_readw,
3049	&subpage_readl,
3050	};
3051
3052	static CPUWriteMemoryFunc *subpage_write[] = {
3053	&subpage_writeb,
3054	&subpage_writew,
3055	&subpage_writel,
3056	};
3057
3058	static int subpage_register (subpage_t *mmio, uint32_t start, uint32_t end,
3059	ram_addr_t memory)
3060	{
3061	int idx, eidx;
3062	unsigned int i;
3063
3064	if (start >= TARGET_PAGE_SIZE \|\| end >= TARGET_PAGE_SIZE)
3065	return -1;
3066	idx = SUBPAGE_IDX(start);
3067	eidx = SUBPAGE_IDX(end);
3068	#if defined(DEBUG_SUBPAGE)
3069	printf("%s: %p start %08x end %08x idx %08x eidx %08x mem %d\n", __func__,
3070	mmio, start, end, idx, eidx, memory);
3071	#endif
3072	memory >>= IO_MEM_SHIFT;
3073	for (; idx <= eidx; idx++) {
3074	for (i = 0; i < 4; i++) {
3075	if (io_mem_read[memory][i]) {
3076	mmio->mem_read[idx][i] = &io_mem_read[memory][i];
3077	mmio->opaque[idx][0][i] = io_mem_opaque[memory];
3078	}
3079	if (io_mem_write[memory][i]) {
3080	mmio->mem_write[idx][i] = &io_mem_write[memory][i];
3081	mmio->opaque[idx][1][i] = io_mem_opaque[memory];
3082	}
3083	}
3084	}
3085
3086	return 0;
3087	}
3088
3089	static void subpage_init (target_phys_addr_t base, ram_addr_t phys,
3090	ram_addr_t orig_memory)
3091	{
3092	subpage_t *mmio;
3093	int subpage_memory;
3094
3095	mmio = qemu_mallocz(sizeof(subpage_t));
3096	if (mmio != NULL) {
3097	mmio->base = base;
3098	subpage_memory = cpu_register_io_memory(0, subpage_read, subpage_write, mmio);
3099	#if defined(DEBUG_SUBPAGE)
3100	printf("%s: %p base " TARGET_FMT_plx " len %08x %d\n", __func__,
3101	mmio, base, TARGET_PAGE_SIZE, subpage_memory);
3102	#endif
3103	*phys = subpage_memory \| IO_MEM_SUBPAGE;
3104	subpage_register(mmio, 0, TARGET_PAGE_SIZE - 1, orig_memory);
3105	}
3106
3107	return mmio;
3108	}
3109
3110	static void io_mem_init(void)
3111	{
3112	cpu_register_io_memory(IO_MEM_ROM >> IO_MEM_SHIFT, error_mem_read, unassigned_mem_write, NULL);
3113	cpu_register_io_memory(IO_MEM_UNASSIGNED >> IO_MEM_SHIFT, unassigned_mem_read, unassigned_mem_write, NULL);
3114	cpu_register_io_memory(IO_MEM_NOTDIRTY >> IO_MEM_SHIFT, error_mem_read, notdirty_mem_write, NULL);
3115	#if defined(VBOX) && !defined(VBOX_WITH_NEW_PHYS_CODE)
3116	cpu_register_io_memory(IO_MEM_RAM_MISSING >> IO_MEM_SHIFT, unassigned_mem_read, unassigned_mem_write, NULL);
3117	io_mem_nb = 6;
3118	#else
3119	io_mem_nb = 5;
3120	#endif
3121
3122	io_mem_watch = cpu_register_io_memory(0, watch_mem_read,
3123	watch_mem_write, NULL);
3124
3125	#ifndef VBOX /* VBOX: we do this later when the RAM is allocated. */
3126	/* alloc dirty bits array */
3127	phys_ram_dirty = qemu_vmalloc(phys_ram_size >> TARGET_PAGE_BITS);
3128	memset(phys_ram_dirty, 0xff, phys_ram_size >> TARGET_PAGE_BITS);
3129	#endif /* !VBOX */
3130	}
3131
3132	/* mem_read and mem_write are arrays of functions containing the
3133	function to access byte (index 0), word (index 1) and dword (index
3134	2). Functions can be omitted with a NULL function pointer. The
3135	registered functions may be modified dynamically later.
3136	If io_index is non zero, the corresponding io zone is
3137	modified. If it is zero, a new io zone is allocated. The return
3138	value can be used with cpu_register_physical_memory(). (-1) is
3139	returned if error. */
3140	int cpu_register_io_memory(int io_index,
3141	CPUReadMemoryFunc **mem_read,
3142	CPUWriteMemoryFunc **mem_write,
3143	void *opaque)
3144	{
3145	int i, subwidth = 0;
3146
3147	if (io_index <= 0) {
3148	if (io_mem_nb >= IO_MEM_NB_ENTRIES)
3149	return -1;
3150	io_index = io_mem_nb++;
3151	} else {
3152	if (io_index >= IO_MEM_NB_ENTRIES)
3153	return -1;
3154	}
3155
3156	for(i = 0;i < 3; i++) {
3157	if (!mem_read[i] \|\| !mem_write[i])
3158	subwidth = IO_MEM_SUBWIDTH;
3159	io_mem_read[io_index][i] = mem_read[i];
3160	io_mem_write[io_index][i] = mem_write[i];
3161	}
3162	io_mem_opaque[io_index] = opaque;
3163	return (io_index << IO_MEM_SHIFT) \| subwidth;
3164	}
3165
3166	CPUWriteMemoryFunc **cpu_get_io_memory_write(int io_index)
3167	{
3168	return io_mem_write[io_index >> IO_MEM_SHIFT];
3169	}
3170
3171	CPUReadMemoryFunc **cpu_get_io_memory_read(int io_index)
3172	{
3173	return io_mem_read[io_index >> IO_MEM_SHIFT];
3174	}
3175	#endif /* !defined(CONFIG_USER_ONLY) */
3176
3177	/* physical memory access (slow version, mainly for debug) */
3178	#if defined(CONFIG_USER_ONLY)
3179	void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
3180	int len, int is_write)
3181	{
3182	int l, flags;
3183	target_ulong page;
3184	void * p;
3185
3186	while (len > 0) {
3187	page = addr & TARGET_PAGE_MASK;
3188	l = (page + TARGET_PAGE_SIZE) - addr;
3189	if (l > len)
3190	l = len;
3191	flags = page_get_flags(page);
3192	if (!(flags & PAGE_VALID))
3193	return;
3194	if (is_write) {
3195	if (!(flags & PAGE_WRITE))
3196	return;
3197	/* XXX: this code should not depend on lock_user */
3198	if (!(p = lock_user(VERIFY_WRITE, addr, l, 0)))
3199	/* FIXME - should this return an error rather than just fail? */
3200	return;
3201	memcpy(p, buf, len);
3202	unlock_user(p, addr, len);
3203	} else {
3204	if (!(flags & PAGE_READ))
3205	return;
3206	if (!(p = lock_user(VERIFY_READ, addr, l, 1)))
3207	/* FIXME - should this return an error rather than just fail? */
3208	return;
3209	memcpy(buf, p, len);
3210	unlock_user(p, addr, 0);
3211	}
3212	len -= l;
3213	buf += l;
3214	addr += l;
3215	}
3216	}
3217
3218	#else
3219	void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
3220	int len, int is_write)
3221	{
3222	int l, io_index;
3223	uint8_t *ptr;
3224	uint32_t val;
3225	target_phys_addr_t page;
3226	unsigned long pd;
3227	PhysPageDesc *p;
3228
3229	while (len > 0) {
3230	page = addr & TARGET_PAGE_MASK;
3231	l = (page + TARGET_PAGE_SIZE) - addr;
3232	if (l > len)
3233	l = len;
3234	p = phys_page_find(page >> TARGET_PAGE_BITS);
3235	if (!p) {
3236	pd = IO_MEM_UNASSIGNED;
3237	} else {
3238	pd = p->phys_offset;
3239	}
3240
3241	if (is_write) {
3242	if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
3243	io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3244	/* XXX: could force cpu_single_env to NULL to avoid
3245	potential bugs */
3246	if (l >= 4 && ((addr & 3) == 0)) {
3247	/* 32 bit write access */
3248	#if !defined(VBOX) \|\| !defined(REM_PHYS_ADDR_IN_TLB)
3249	val = ldl_p(buf);
3250	#else
3251	val = (const uint32_t )buf;
3252	#endif
3253	io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val);
3254	l = 4;
3255	} else if (l >= 2 && ((addr & 1) == 0)) {
3256	/* 16 bit write access */
3257	#if !defined(VBOX) \|\| !defined(REM_PHYS_ADDR_IN_TLB)
3258	val = lduw_p(buf);
3259	#else
3260	val = (const uint16_t )buf;
3261	#endif
3262	io_mem_write[io_index][1](io_mem_opaque[io_index], addr, val);
3263	l = 2;
3264	} else {
3265	/* 8 bit write access */
3266	#if !defined(VBOX) \|\| !defined(REM_PHYS_ADDR_IN_TLB)
3267	val = ldub_p(buf);
3268	#else
3269	val = (const uint8_t )buf;
3270	#endif
3271	io_mem_write[io_index][0](io_mem_opaque[io_index], addr, val);
3272	l = 1;
3273	}
3274	} else {
3275	unsigned long addr1;
3276	addr1 = (pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK);
3277	/* RAM case */
3278	#ifdef VBOX
3279	remR3PhysWrite(addr1, buf, l); NOREF(ptr);
3280	#else
3281	ptr = phys_ram_base + addr1;
3282	memcpy(ptr, buf, l);
3283	#endif
3284	if (!cpu_physical_memory_is_dirty(addr1)) {
3285	/* invalidate code */
3286	tb_invalidate_phys_page_range(addr1, addr1 + l, 0);
3287	/* set dirty bit */
3288	#ifdef VBOX
3289	if (RT_LIKELY((addr1 >> TARGET_PAGE_BITS) < phys_ram_dirty_size))
3290	#endif
3291	phys_ram_dirty[addr1 >> TARGET_PAGE_BITS] \|=
3292	(0xff & ~CODE_DIRTY_FLAG);
3293	}
3294	}
3295	} else {
3296	if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM &&
3297	!(pd & IO_MEM_ROMD)) {
3298	/* I/O case */
3299	io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3300	if (l >= 4 && ((addr & 3) == 0)) {
3301	/* 32 bit read access */
3302	val = io_mem_read[io_index][2](io_mem_opaque[io_index], addr);
3303	#if !defined(VBOX) \|\| !defined(REM_PHYS_ADDR_IN_TLB)
3304	stl_p(buf, val);
3305	#else
3306	(uint32_t )buf = val;
3307	#endif
3308	l = 4;
3309	} else if (l >= 2 && ((addr & 1) == 0)) {
3310	/* 16 bit read access */
3311	val = io_mem_read[io_index][1](io_mem_opaque[io_index], addr);
3312	#if !defined(VBOX) \|\| !defined(REM_PHYS_ADDR_IN_TLB)
3313	stw_p(buf, val);
3314	#else
3315	(uint16_t )buf = val;
3316	#endif
3317	l = 2;
3318	} else {
3319	/* 8 bit read access */
3320	val = io_mem_read[io_index][0](io_mem_opaque[io_index], addr);
3321	#if !defined(VBOX) \|\| !defined(REM_PHYS_ADDR_IN_TLB)
3322	stb_p(buf, val);
3323	#else
3324	(uint8_t )buf = val;
3325	#endif
3326	l = 1;
3327	}
3328	} else {
3329	/* RAM case */
3330	#ifdef VBOX
3331	remR3PhysRead((pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK), buf, l); NOREF(ptr);
3332	#else
3333	ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) +
3334	(addr & ~TARGET_PAGE_MASK);
3335	memcpy(buf, ptr, l);
3336	#endif
3337	}
3338	}
3339	len -= l;
3340	buf += l;
3341	addr += l;
3342	}
3343	}
3344
3345	#ifndef VBOX
3346	/* used for ROM loading : can write in RAM and ROM */
3347	void cpu_physical_memory_write_rom(target_phys_addr_t addr,
3348	const uint8_t *buf, int len)
3349	{
3350	int l;
3351	uint8_t *ptr;
3352	target_phys_addr_t page;
3353	unsigned long pd;
3354	PhysPageDesc *p;
3355
3356	while (len > 0) {
3357	page = addr & TARGET_PAGE_MASK;
3358	l = (page + TARGET_PAGE_SIZE) - addr;
3359	if (l > len)
3360	l = len;
3361	p = phys_page_find(page >> TARGET_PAGE_BITS);
3362	if (!p) {
3363	pd = IO_MEM_UNASSIGNED;
3364	} else {
3365	pd = p->phys_offset;
3366	}
3367
3368	if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM &&
3369	(pd & ~TARGET_PAGE_MASK) != IO_MEM_ROM &&
3370	!(pd & IO_MEM_ROMD)) {
3371	/* do nothing */
3372	} else {
3373	unsigned long addr1;
3374	addr1 = (pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK);
3375	/* ROM/RAM case */
3376	ptr = phys_ram_base + addr1;
3377	memcpy(ptr, buf, l);
3378	}
3379	len -= l;
3380	buf += l;
3381	addr += l;
3382	}
3383	}
3384	#endif /* !VBOX */
3385
3386
3387	/* warning: addr must be aligned */
3388	uint32_t ldl_phys(target_phys_addr_t addr)
3389	{
3390	int io_index;
3391	uint8_t *ptr;
3392	uint32_t val;
3393	unsigned long pd;
3394	PhysPageDesc *p;
3395
3396	p = phys_page_find(addr >> TARGET_PAGE_BITS);
3397	if (!p) {
3398	pd = IO_MEM_UNASSIGNED;
3399	} else {
3400	pd = p->phys_offset;
3401	}
3402
3403	if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM &&
3404	!(pd & IO_MEM_ROMD)) {
3405	/* I/O case */
3406	io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3407	val = io_mem_read[io_index][2](io_mem_opaque[io_index], addr);
3408	} else {
3409	/* RAM case */
3410	#ifndef VBOX
3411	ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) +
3412	(addr & ~TARGET_PAGE_MASK);
3413	val = ldl_p(ptr);
3414	#else
3415	val = remR3PhysReadU32((pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK)); NOREF(ptr);
3416	#endif
3417	}
3418	return val;
3419	}
3420
3421	/* warning: addr must be aligned */
3422	uint64_t ldq_phys(target_phys_addr_t addr)
3423	{
3424	int io_index;
3425	uint8_t *ptr;
3426	uint64_t val;
3427	unsigned long pd;
3428	PhysPageDesc *p;
3429
3430	p = phys_page_find(addr >> TARGET_PAGE_BITS);
3431	if (!p) {
3432	pd = IO_MEM_UNASSIGNED;
3433	} else {
3434	pd = p->phys_offset;
3435	}
3436
3437	if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM &&
3438	!(pd & IO_MEM_ROMD)) {
3439	/* I/O case */
3440	io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3441	#ifdef TARGET_WORDS_BIGENDIAN
3442	val = (uint64_t)io_mem_read[io_index][2](io_mem_opaque[io_index], addr) << 32;
3443	val \|= io_mem_read[io_index][2](io_mem_opaque[io_index], addr + 4);
3444	#else
3445	val = io_mem_read[io_index][2](io_mem_opaque[io_index], addr);
3446	val \|= (uint64_t)io_mem_read[io_index][2](io_mem_opaque[io_index], addr + 4) << 32;
3447	#endif
3448	} else {
3449	/* RAM case */
3450	#ifndef VBOX
3451	ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) +
3452	(addr & ~TARGET_PAGE_MASK);
3453	val = ldq_p(ptr);
3454	#else
3455	val = remR3PhysReadU64((pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK)); NOREF(ptr);
3456	#endif
3457	}
3458	return val;
3459	}
3460
3461	/* XXX: optimize */
3462	uint32_t ldub_phys(target_phys_addr_t addr)
3463	{
3464	uint8_t val;
3465	cpu_physical_memory_read(addr, &val, 1);
3466	return val;
3467	}
3468
3469	/* XXX: optimize */
3470	uint32_t lduw_phys(target_phys_addr_t addr)
3471	{
3472	uint16_t val;
3473	cpu_physical_memory_read(addr, (uint8_t *)&val, 2);
3474	return tswap16(val);
3475	}
3476
3477	/* warning: addr must be aligned. The ram page is not masked as dirty
3478	and the code inside is not invalidated. It is useful if the dirty
3479	bits are used to track modified PTEs */
3480	void stl_phys_notdirty(target_phys_addr_t addr, uint32_t val)
3481	{
3482	int io_index;
3483	uint8_t *ptr;
3484	unsigned long pd;
3485	PhysPageDesc *p;
3486
3487	p = phys_page_find(addr >> TARGET_PAGE_BITS);
3488	if (!p) {
3489	pd = IO_MEM_UNASSIGNED;
3490	} else {
3491	pd = p->phys_offset;
3492	}
3493
3494	if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
3495	io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3496	io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val);
3497	} else {
3498	#ifndef VBOX
3499	ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) +
3500	(addr & ~TARGET_PAGE_MASK);
3501	stl_p(ptr, val);
3502	#else
3503	remR3PhysWriteU32((pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK), val); NOREF(ptr);
3504	#endif
3505	#ifndef VBOX
3506	if (unlikely(in_migration)) {
3507	if (!cpu_physical_memory_is_dirty(addr1)) {
3508	/* invalidate code */
3509	tb_invalidate_phys_page_range(addr1, addr1 + 4, 0);
3510	/* set dirty bit */
3511	phys_ram_dirty[addr1 >> TARGET_PAGE_BITS] \|=
3512	(0xff & ~CODE_DIRTY_FLAG);
3513	}
3514	}
3515	#endif
3516	}
3517	}
3518
3519	void stq_phys_notdirty(target_phys_addr_t addr, uint64_t val)
3520	{
3521	int io_index;
3522	uint8_t *ptr;
3523	unsigned long pd;
3524	PhysPageDesc *p;
3525
3526	p = phys_page_find(addr >> TARGET_PAGE_BITS);
3527	if (!p) {
3528	pd = IO_MEM_UNASSIGNED;
3529	} else {
3530	pd = p->phys_offset;
3531	}
3532
3533	if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
3534	io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3535	#ifdef TARGET_WORDS_BIGENDIAN
3536	io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val >> 32);
3537	io_mem_write[io_index][2](io_mem_opaque[io_index], addr + 4, val);
3538	#else
3539	io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val);
3540	io_mem_write[io_index][2](io_mem_opaque[io_index], addr + 4, val >> 32);
3541	#endif
3542	} else {
3543	#ifndef VBOX
3544	ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) +
3545	(addr & ~TARGET_PAGE_MASK);
3546	stq_p(ptr, val);
3547	#else
3548	remR3PhysWriteU64((pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK), val); NOREF(ptr);
3549	#endif
3550	}
3551	}
3552
3553
3554	/* warning: addr must be aligned */
3555	void stl_phys(target_phys_addr_t addr, uint32_t val)
3556	{
3557	int io_index;
3558	uint8_t *ptr;
3559	unsigned long pd;
3560	PhysPageDesc *p;
3561
3562	p = phys_page_find(addr >> TARGET_PAGE_BITS);
3563	if (!p) {
3564	pd = IO_MEM_UNASSIGNED;
3565	} else {
3566	pd = p->phys_offset;
3567	}
3568
3569	if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
3570	io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3571	io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val);
3572	} else {
3573	unsigned long addr1;
3574	addr1 = (pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK);
3575	/* RAM case */
3576	#ifndef VBOX
3577	ptr = phys_ram_base + addr1;
3578	stl_p(ptr, val);
3579	#else
3580	remR3PhysWriteU32((pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK), val); NOREF(ptr);
3581	#endif
3582	if (!cpu_physical_memory_is_dirty(addr1)) {
3583	/* invalidate code */
3584	tb_invalidate_phys_page_range(addr1, addr1 + 4, 0);
3585	/* set dirty bit */
3586	#ifdef VBOX
3587	if (RT_LIKELY((addr1 >> TARGET_PAGE_BITS) < phys_ram_dirty_size))
3588	#endif
3589	phys_ram_dirty[addr1 >> TARGET_PAGE_BITS] \|=
3590	(0xff & ~CODE_DIRTY_FLAG);
3591	}
3592	}
3593	}
3594
3595	/* XXX: optimize */
3596	void stb_phys(target_phys_addr_t addr, uint32_t val)
3597	{
3598	uint8_t v = val;
3599	cpu_physical_memory_write(addr, &v, 1);
3600	}
3601
3602	/* XXX: optimize */
3603	void stw_phys(target_phys_addr_t addr, uint32_t val)
3604	{
3605	uint16_t v = tswap16(val);
3606	cpu_physical_memory_write(addr, (const uint8_t *)&v, 2);
3607	}
3608
3609	/* XXX: optimize */
3610	void stq_phys(target_phys_addr_t addr, uint64_t val)
3611	{
3612	val = tswap64(val);
3613	cpu_physical_memory_write(addr, (const uint8_t *)&val, 8);
3614	}
3615
3616	#endif
3617
3618	/* virtual memory access for debug */
3619	int cpu_memory_rw_debug(CPUState *env, target_ulong addr,
3620	uint8_t *buf, int len, int is_write)
3621	{
3622	int l;
3623	target_ulong page, phys_addr;
3624
3625	while (len > 0) {
3626	page = addr & TARGET_PAGE_MASK;
3627	phys_addr = cpu_get_phys_page_debug(env, page);
3628	/* if no physical page mapped, return an error */
3629	if (phys_addr == -1)
3630	return -1;
3631	l = (page + TARGET_PAGE_SIZE) - addr;
3632	if (l > len)
3633	l = len;
3634	cpu_physical_memory_rw(phys_addr + (addr & ~TARGET_PAGE_MASK),
3635	buf, l, is_write);
3636	len -= l;
3637	buf += l;
3638	addr += l;
3639	}
3640	return 0;
3641	}
3642
3643	/* in deterministic execution mode, instructions doing device I/Os
3644	must be at the end of the TB */
3645	void cpu_io_recompile(CPUState env, void retaddr)
3646	{
3647	TranslationBlock *tb;
3648	uint32_t n, cflags;
3649	target_ulong pc, cs_base;
3650	uint64_t flags;
3651
3652	tb = tb_find_pc((unsigned long)retaddr);
3653	if (!tb) {
3654	cpu_abort(env, "cpu_io_recompile: could not find TB for pc=%p",
3655	retaddr);
3656	}
3657	n = env->icount_decr.u16.low + tb->icount;
3658	cpu_restore_state(tb, env, (unsigned long)retaddr, NULL);
3659	/* Calculate how many instructions had been executed before the fault
3660	occurred. */
3661	n = n - env->icount_decr.u16.low;
3662	/* Generate a new TB ending on the I/O insn. */
3663	n++;
3664	/* On MIPS and SH, delay slot instructions can only be restarted if
3665	they were already the first instruction in the TB. If this is not
3666	the first instruction in a TB then re-execute the preceding
3667	branch. */
3668	#if defined(TARGET_MIPS)
3669	if ((env->hflags & MIPS_HFLAG_BMASK) != 0 && n > 1) {
3670	env->active_tc.PC -= 4;
3671	env->icount_decr.u16.low++;
3672	env->hflags &= ~MIPS_HFLAG_BMASK;
3673	}
3674	#elif defined(TARGET_SH4)
3675	if ((env->flags & ((DELAY_SLOT \| DELAY_SLOT_CONDITIONAL))) != 0
3676	&& n > 1) {
3677	env->pc -= 2;
3678	env->icount_decr.u16.low++;
3679	env->flags &= ~(DELAY_SLOT \| DELAY_SLOT_CONDITIONAL);
3680	}
3681	#endif
3682	/* This should never happen. */
3683	if (n > CF_COUNT_MASK)
3684	cpu_abort(env, "TB too big during recompile");
3685
3686	cflags = n \| CF_LAST_IO;
3687	pc = tb->pc;
3688	cs_base = tb->cs_base;
3689	flags = tb->flags;
3690	tb_phys_invalidate(tb, -1);
3691	/* FIXME: In theory this could raise an exception. In practice
3692	we have already translated the block once so it's probably ok. */
3693	tb_gen_code(env, pc, cs_base, flags, cflags);
3694	/* TODO: If env->pc != tb->pc (i.e. the faulting instruction was not
3695	the first in the TB) then we end up generating a whole new TB and
3696	repeating the fault, which is horribly inefficient.
3697	Better would be to execute just this insn uncached, or generate a
3698	second new TB. */
3699	cpu_resume_from_signal(env, NULL);
3700	}
3701
3702	#ifndef VBOX
3703	void dump_exec_info(FILE *f,
3704	int (cpu_fprintf)(FILE f, const char *fmt, ...))
3705	{
3706	int i, target_code_size, max_target_code_size;
3707	int direct_jmp_count, direct_jmp2_count, cross_page;
3708	TranslationBlock *tb;
3709
3710	target_code_size = 0;
3711	max_target_code_size = 0;
3712	cross_page = 0;
3713	direct_jmp_count = 0;
3714	direct_jmp2_count = 0;
3715	for(i = 0; i < nb_tbs; i++) {
3716	tb = &tbs[i];
3717	target_code_size += tb->size;
3718	if (tb->size > max_target_code_size)
3719	max_target_code_size = tb->size;
3720	if (tb->page_addr[1] != -1)
3721	cross_page++;
3722	if (tb->tb_next_offset[0] != 0xffff) {
3723	direct_jmp_count++;
3724	if (tb->tb_next_offset[1] != 0xffff) {
3725	direct_jmp2_count++;
3726	}
3727	}
3728	}
3729	/* XXX: avoid using doubles ? */
3730	cpu_fprintf(f, "Translation buffer state:\n");
3731	cpu_fprintf(f, "gen code size %ld/%ld\n",
3732	code_gen_ptr - code_gen_buffer, code_gen_buffer_max_size);
3733	cpu_fprintf(f, "TB count %d/%d\n",
3734	nb_tbs, code_gen_max_blocks);
3735	cpu_fprintf(f, "TB avg target size %d max=%d bytes\n",
3736	nb_tbs ? target_code_size / nb_tbs : 0,
3737	max_target_code_size);
3738	cpu_fprintf(f, "TB avg host size %d bytes (expansion ratio: %0.1f)\n",
3739	nb_tbs ? (code_gen_ptr - code_gen_buffer) / nb_tbs : 0,
3740	target_code_size ? (double) (code_gen_ptr - code_gen_buffer) / target_code_size : 0);
3741	cpu_fprintf(f, "cross page TB count %d (%d%%)\n",
3742	cross_page,
3743	nb_tbs ? (cross_page * 100) / nb_tbs : 0);
3744	cpu_fprintf(f, "direct jump count %d (%d%%) (2 jumps=%d %d%%)\n",
3745	direct_jmp_count,
3746	nb_tbs ? (direct_jmp_count * 100) / nb_tbs : 0,
3747	direct_jmp2_count,
3748	nb_tbs ? (direct_jmp2_count * 100) / nb_tbs : 0);
3749	cpu_fprintf(f, "\nStatistics:\n");
3750	cpu_fprintf(f, "TB flush count %d\n", tb_flush_count);
3751	cpu_fprintf(f, "TB invalidate count %d\n", tb_phys_invalidate_count);
3752	cpu_fprintf(f, "TLB flush count %d\n", tlb_flush_count);
3753	tcg_dump_info(f, cpu_fprintf);
3754	}
3755	#endif /* !VBOX */
3756
3757	#if !defined(CONFIG_USER_ONLY)
3758
3759	#define MMUSUFFIX _cmmu
3760	#define GETPC() NULL
3761	#define env cpu_single_env
3762	#define SOFTMMU_CODE_ACCESS
3763
3764	#define SHIFT 0
3765	#include "softmmu_template.h"
3766
3767	#define SHIFT 1
3768	#include "softmmu_template.h"
3769
3770	#define SHIFT 2
3771	#include "softmmu_template.h"
3772
3773	#define SHIFT 3
3774	#include "softmmu_template.h"
3775
3776	#undef env
3777
3778	#endif

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/recompiler_new/exec.c@ 15531

Download in other formats: