exec.c@ 13872

最後變更在這個檔案從13872是 13731,由 vboxsync 提交於 16 年前
more cleanup, 32-bit mode still doesn't work. Very hard to tell why.
屬性 svn:eol-style 設為 `native`
檔案大小: 110.4 KB

行
1	/*
2	* virtual page mapping and translated block handling
3	*
4	* Copyright (c) 2003 Fabrice Bellard
5	*
6	* This library is free software; you can redistribute it and/or
7	* modify it under the terms of the GNU Lesser General Public
8	* License as published by the Free Software Foundation; either
9	* version 2 of the License, or (at your option) any later version.
10	*
11	* This library is distributed in the hope that it will be useful,
12	* but WITHOUT ANY WARRANTY; without even the implied warranty of
13	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14	* Lesser General Public License for more details.
15	*
16	* You should have received a copy of the GNU Lesser General Public
17	* License along with this library; if not, write to the Free Software
18	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
19	*/
20
21	/*
22	* Sun LGPL Disclaimer: For the avoidance of doubt, except that if any license choice
23	* other than GPL or LGPL is available it will apply instead, Sun elects to use only
24	* the Lesser General Public License version 2.1 (LGPLv2) at this time for any software where
25	* a choice of LGPL license versions is made available with the language indicating
26	* that LGPLv2 or any later version may be used, or where a choice of which version
27	* of the LGPL is applied is otherwise unspecified.
28	*/
29	#include "config.h"
30	#ifndef VBOX
31	#ifdef _WIN32
32	#include <windows.h>
33	#else
34	#include <sys/types.h>
35	#include <sys/mman.h>
36	#endif
37	#include <stdlib.h>
38	#include <stdio.h>
39	#include <stdarg.h>
40	#include <string.h>
41	#include <errno.h>
42	#include <unistd.h>
43	#include <inttypes.h>
44	#else /* VBOX */
45	# include <stdlib.h>
46	# include <stdio.h>
47	# include <iprt/alloc.h>
48	# include <iprt/string.h>
49	# include <iprt/param.h>
50	# include <VBox/pgm.h> /* PGM_DYNAMIC_RAM_ALLOC */
51	#endif /* VBOX */
52
53	#include "cpu.h"
54	#include "exec-all.h"
55	#if defined(CONFIG_USER_ONLY)
56	#include <qemu.h>
57	#endif
58
59	//#define DEBUG_TB_INVALIDATE
60	//#define DEBUG_FLUSH
61	//#define DEBUG_TLB
62	//#define DEBUG_UNASSIGNED
63
64	/* make various TB consistency checks */
65	//#define DEBUG_TB_CHECK
66	//#define DEBUG_TLB_CHECK
67
68	#if !defined(CONFIG_USER_ONLY)
69	/* TB consistency checks only implemented for usermode emulation. */
70	#undef DEBUG_TB_CHECK
71	#endif
72
73	#define SMC_BITMAP_USE_THRESHOLD 10
74
75	#define MMAP_AREA_START 0x00000000
76	#define MMAP_AREA_END 0xa8000000
77
78	#if defined(TARGET_SPARC64)
79	#define TARGET_PHYS_ADDR_SPACE_BITS 41
80	#elif defined(TARGET_SPARC)
81	#define TARGET_PHYS_ADDR_SPACE_BITS 36
82	#elif defined(TARGET_ALPHA)
83	#define TARGET_PHYS_ADDR_SPACE_BITS 42
84	#define TARGET_VIRT_ADDR_SPACE_BITS 42
85	#elif defined(TARGET_PPC64)
86	#define TARGET_PHYS_ADDR_SPACE_BITS 42
87	#elif defined(TARGET_X86_64) && !defined(USE_KQEMU)
88	#define TARGET_PHYS_ADDR_SPACE_BITS 42
89	#elif defined(TARGET_I386) && !defined(USE_KQEMU)
90	#define TARGET_PHYS_ADDR_SPACE_BITS 36
91	#else
92	/* Note: for compatibility with kqemu, we use 32 bits for x86_64 */
93	#define TARGET_PHYS_ADDR_SPACE_BITS 32
94	#endif
95
96	static TranslationBlock *tbs;
97	int code_gen_max_blocks;
98	TranslationBlock *tb_phys_hash[CODE_GEN_PHYS_HASH_SIZE];
99	static int nb_tbs;
100	/* any access to the tbs or the page table must use this lock */
101	spinlock_t tb_lock = SPIN_LOCK_UNLOCKED;
102
103	#ifndef VBOX
104	#if defined(__arm__) \|\| defined(__sparc_v9__)
105	/* The prologue must be reachable with a direct jump. ARM and Sparc64
106	have limited branch ranges (possibly also PPC) so place it in a
107	section close to code segment. */
108	#define code_gen_section \
109	__attribute__((__section__(".gen_code"))) \
110	__attribute__((aligned (32)))
111	#else
112	#define code_gen_section \
113	__attribute__((aligned (32)))
114	#endif
115	uint8_t code_gen_prologue[1024] code_gen_section;
116
117	#else /* VBOX */
118	extern uint8_t* code_gen_prologue;
119	#endif /* VBOX */
120
121	static uint8_t *code_gen_buffer;
122	static unsigned long code_gen_buffer_size;
123	/* threshold to flush the translated code buffer */
124	static unsigned long code_gen_buffer_max_size;
125	uint8_t *code_gen_ptr;
126
127	#ifndef VBOX
128	#if !defined(CONFIG_USER_ONLY)
129	ram_addr_t phys_ram_size;
130	int phys_ram_fd;
131	uint8_t *phys_ram_base;
132	uint8_t *phys_ram_dirty;
133	static int in_migration;
134	static ram_addr_t phys_ram_alloc_offset = 0;
135	#endif
136	#else /* VBOX */
137	RTGCPHYS phys_ram_size;
138	/* we have memory ranges (the high PC-BIOS mapping) which
139	causes some pages to fall outside the dirty map here. */
140	uint32_t phys_ram_dirty_size;
141	#endif /* VBOX */
142	#if !defined(VBOX)
143	uint8_t *phys_ram_base;
144	#endif
145	uint8_t *phys_ram_dirty;
146
147	CPUState *first_cpu;
148	/* current CPU in the current thread. It is only valid inside
149	cpu_exec() */
150	CPUState *cpu_single_env;
151	/* 0 = Do not count executed instructions.
152	1 = Precise instruction counting.
153	2 = Adaptive rate instruction counting. */
154	int use_icount = 0;
155	/* Current instruction counter. While executing translated code this may
156	include some instructions that have not yet been executed. */
157	int64_t qemu_icount;
158
159	typedef struct PageDesc {
160	/* list of TBs intersecting this ram page */
161	TranslationBlock *first_tb;
162	/* in order to optimize self modifying code, we count the number
163	of lookups we do to a given page to use a bitmap */
164	unsigned int code_write_count;
165	uint8_t *code_bitmap;
166	#if defined(CONFIG_USER_ONLY)
167	unsigned long flags;
168	#endif
169	} PageDesc;
170
171	typedef struct PhysPageDesc {
172	/* offset in host memory of the page + io_index in the low 12 bits */
173	ram_addr_t phys_offset;
174	} PhysPageDesc;
175
176	#define L2_BITS 10
177	#if defined(CONFIG_USER_ONLY) && defined(TARGET_VIRT_ADDR_SPACE_BITS)
178	/* XXX: this is a temporary hack for alpha target.
179	* In the future, this is to be replaced by a multi-level table
180	* to actually be able to handle the complete 64 bits address space.
181	*/
182	#define L1_BITS (TARGET_VIRT_ADDR_SPACE_BITS - L2_BITS - TARGET_PAGE_BITS)
183	#else
184	#define L1_BITS (32 - L2_BITS - TARGET_PAGE_BITS)
185	#endif
186
187	#define L1_SIZE (1 << L1_BITS)
188	#define L2_SIZE (1 << L2_BITS)
189
190	static void io_mem_init(void);
191
192	unsigned long qemu_real_host_page_size;
193	unsigned long qemu_host_page_bits;
194	unsigned long qemu_host_page_size;
195	unsigned long qemu_host_page_mask;
196
197	/* XXX: for system emulation, it could just be an array */
198	static PageDesc *l1_map[L1_SIZE];
199	static PhysPageDesc **l1_phys_map;
200
201	#if !defined(CONFIG_USER_ONLY)
202	static void io_mem_init(void);
203
204	/* io memory support */
205	CPUWriteMemoryFunc *io_mem_write[IO_MEM_NB_ENTRIES][4];
206	CPUReadMemoryFunc *io_mem_read[IO_MEM_NB_ENTRIES][4];
207	void *io_mem_opaque[IO_MEM_NB_ENTRIES];
208	static int io_mem_nb;
209	static int io_mem_watch;
210	#endif
211
212	#ifndef VBOX
213	/* log support */
214	static const char *logfilename = "/tmp/qemu.log";
215	#endif /* !VBOX */
216	FILE *logfile;
217	int loglevel;
218	#ifndef VBOX
219	static int log_append = 0;
220	#endif
221
222	/* statistics */
223	static int tlb_flush_count;
224	static int tb_flush_count;
225	#ifndef VBOX
226	static int tb_phys_invalidate_count;
227	#endif /* !VBOX */
228
229	#define SUBPAGE_IDX(addr) ((addr) & ~TARGET_PAGE_MASK)
230	typedef struct subpage_t {
231	target_phys_addr_t base;
232	CPUReadMemoryFunc **mem_read[TARGET_PAGE_SIZE][4];
233	CPUWriteMemoryFunc **mem_write[TARGET_PAGE_SIZE][4];
234	void *opaque[TARGET_PAGE_SIZE][2][4];
235	} subpage_t;
236
237
238	#ifndef VBOX
239	#ifdef _WIN32
240	static void map_exec(void *addr, long size)
241	{
242	DWORD old_protect;
243	VirtualProtect(addr, size,
244	PAGE_EXECUTE_READWRITE, &old_protect);
245
246	}
247	#else
248	static void map_exec(void *addr, long size)
249	{
250	unsigned long start, end, page_size;
251
252	page_size = getpagesize();
253	start = (unsigned long)addr;
254	start &= ~(page_size - 1);
255
256	end = (unsigned long)addr + size;
257	end += page_size - 1;
258	end &= ~(page_size - 1);
259
260	mprotect((void *)start, end - start,
261	PROT_READ \| PROT_WRITE \| PROT_EXEC);
262	}
263	#endif
264	#else // VBOX
265	static void map_exec(void *addr, long size)
266	{
267	RTMemProtect(addr, size,
268	RTMEM_PROT_EXEC \| RTMEM_PROT_READ \| RTMEM_PROT_WRITE);
269	}
270	#endif
271
272	static void page_init(void)
273	{
274	/* NOTE: we can always suppose that qemu_host_page_size >=
275	TARGET_PAGE_SIZE */
276	#ifdef VBOX
277	RTMemProtect(code_gen_buffer, sizeof(code_gen_buffer),
278	RTMEM_PROT_EXEC \| RTMEM_PROT_READ \| RTMEM_PROT_WRITE);
279	qemu_real_host_page_size = PAGE_SIZE;
280	#else /* !VBOX */
281	#ifdef _WIN32
282	{
283	SYSTEM_INFO system_info;
284	DWORD old_protect;
285
286	GetSystemInfo(&system_info);
287	qemu_real_host_page_size = system_info.dwPageSize;
288	}
289	#else
290	qemu_real_host_page_size = getpagesize();
291	#endif
292	#endif /* !VBOX */
293
294	if (qemu_host_page_size == 0)
295	qemu_host_page_size = qemu_real_host_page_size;
296	if (qemu_host_page_size < TARGET_PAGE_SIZE)
297	qemu_host_page_size = TARGET_PAGE_SIZE;
298	qemu_host_page_bits = 0;
299	#ifndef VBOX
300	while ((1 << qemu_host_page_bits) < qemu_host_page_size)
301	#else
302	while ((1 << qemu_host_page_bits) < (int)qemu_host_page_size)
303	#endif
304	qemu_host_page_bits++;
305	qemu_host_page_mask = ~(qemu_host_page_size - 1);
306	l1_phys_map = qemu_vmalloc(L1_SIZE * sizeof(void *));
307	memset(l1_phys_map, 0, L1_SIZE * sizeof(void *));
308	#ifdef VBOX
309	/* We use other means to set reserved bit on our pages */
310	#else
311	#if !defined(_WIN32) && defined(CONFIG_USER_ONLY)
312	{
313	long long startaddr, endaddr;
314	FILE *f;
315	int n;
316
317	mmap_lock();
318	last_brk = (unsigned long)sbrk(0);
319	f = fopen("/proc/self/maps", "r");
320	if (f) {
321	do {
322	n = fscanf (f, "%llx-%llx %*[^\n]\n", &startaddr, &endaddr);
323	if (n == 2) {
324	startaddr = MIN(startaddr,
325	(1ULL << TARGET_PHYS_ADDR_SPACE_BITS) - 1);
326	endaddr = MIN(endaddr,
327	(1ULL << TARGET_PHYS_ADDR_SPACE_BITS) - 1);
328	page_set_flags(startaddr & TARGET_PAGE_MASK,
329	TARGET_PAGE_ALIGN(endaddr),
330	PAGE_RESERVED);
331	}
332	} while (!feof(f));
333	fclose(f);
334	}
335	mmap_unlock();
336	}
337	#endif
338	#endif
339	}
340
341	#ifndef VBOX
342	static inline PageDesc **page_l1_map(target_ulong index)
343	#else
344	DECLINLINE(PageDesc **) page_l1_map(target_ulong index)
345	#endif
346	{
347	#if TARGET_LONG_BITS > 32
348	/* Host memory outside guest VM. For 32-bit targets we have already
349	excluded high addresses. */
350	if (index > ((target_ulong)L2_SIZE * L1_SIZE))
351	return NULL;
352	#endif
353	return &l1_map[index >> L2_BITS];
354	}
355
356	#ifndef VBOX
357	static inline PageDesc *page_find_alloc(target_ulong index)
358	#else
359	DECLINLINE(PageDesc *) page_find_alloc(target_ulong index)
360	#endif
361	{
362	PageDesc *lp, p;
363	lp = page_l1_map(index);
364	if (!lp)
365	return NULL;
366
367	p = *lp;
368	if (!p) {
369	/* allocate if not found */
370	#if defined(CONFIG_USER_ONLY)
371	unsigned long addr;
372	size_t len = sizeof(PageDesc) * L2_SIZE;
373	/* Don't use qemu_malloc because it may recurse. */
374	p = mmap(0, len, PROT_READ \| PROT_WRITE,
375	MAP_PRIVATE \| MAP_ANONYMOUS, -1, 0);
376	*lp = p;
377	addr = h2g(p);
378	if (addr == (target_ulong)addr) {
379	page_set_flags(addr & TARGET_PAGE_MASK,
380	TARGET_PAGE_ALIGN(addr + len),
381	PAGE_RESERVED);
382	}
383	#else
384	p = qemu_mallocz(sizeof(PageDesc) * L2_SIZE);
385	*lp = p;
386	#endif
387	}
388	return p + (index & (L2_SIZE - 1));
389	}
390
391	#ifndef VBOX
392	static inline PageDesc *page_find(target_ulong index)
393	#else
394	DECLINLINE(PageDesc *) page_find(target_ulong index)
395	#endif
396	{
397	PageDesc *lp, p;
398	lp = page_l1_map(index);
399	if (!lp)
400	return NULL;
401
402	p = *lp;
403	if (!p)
404	return 0;
405	return p + (index & (L2_SIZE - 1));
406	}
407
408	static PhysPageDesc *phys_page_find_alloc(target_phys_addr_t index, int alloc)
409	{
410	void lp, p;
411	PhysPageDesc *pd;
412
413	p = (void **)l1_phys_map;
414	#if TARGET_PHYS_ADDR_SPACE_BITS > 32
415
416	#if TARGET_PHYS_ADDR_SPACE_BITS > (32 + L1_BITS)
417	#error unsupported TARGET_PHYS_ADDR_SPACE_BITS
418	#endif
419	lp = p + ((index >> (L1_BITS + L2_BITS)) & (L1_SIZE - 1));
420	p = *lp;
421	if (!p) {
422	/* allocate if not found */
423	if (!alloc)
424	return NULL;
425	p = qemu_vmalloc(sizeof(void ) L1_SIZE);
426	memset(p, 0, sizeof(void ) L1_SIZE);
427	*lp = p;
428	}
429	#endif
430	lp = p + ((index >> L2_BITS) & (L1_SIZE - 1));
431	pd = *lp;
432	if (!pd) {
433	int i;
434	/* allocate if not found */
435	if (!alloc)
436	return NULL;
437	pd = qemu_vmalloc(sizeof(PhysPageDesc) * L2_SIZE);
438	*lp = pd;
439	for (i = 0; i < L2_SIZE; i++)
440	pd[i].phys_offset = IO_MEM_UNASSIGNED;
441	}
442	#if defined(VBOX) && !defined(VBOX_WITH_NEW_PHYS_CODE)
443	pd = ((PhysPageDesc *)pd) + (index & (L2_SIZE - 1));
444	if (RT_UNLIKELY((pd->phys_offset & ~TARGET_PAGE_MASK) == IO_MEM_RAM_MISSING))
445	remR3GrowDynRange(pd->phys_offset & TARGET_PAGE_MASK);
446	return pd;
447	#else
448	return ((PhysPageDesc *)pd) + (index & (L2_SIZE - 1));
449	#endif
450	}
451
452	#ifndef VBOX
453	static inline PhysPageDesc *phys_page_find(target_phys_addr_t index)
454	#else
455	DECLINLINE(PhysPageDesc *) phys_page_find(target_phys_addr_t index)
456	#endif
457	{
458	return phys_page_find_alloc(index, 0);
459	}
460
461	#if !defined(CONFIG_USER_ONLY)
462	static void tlb_protect_code(ram_addr_t ram_addr);
463	static void tlb_unprotect_code_phys(CPUState *env, ram_addr_t ram_addr,
464	target_ulong vaddr);
465	#define mmap_lock() do { } while(0)
466	#define mmap_unlock() do { } while(0)
467	#endif
468
469	#ifdef VBOX
470	/** @todo nike: isn't 32M too much ? */
471	#endif
472	#define DEFAULT_CODE_GEN_BUFFER_SIZE (32 * 1024 * 1024)
473
474	#if defined(CONFIG_USER_ONLY)
475	/* Currently it is not recommanded to allocate big chunks of data in
476	user mode. It will change when a dedicated libc will be used */
477	#define USE_STATIC_CODE_GEN_BUFFER
478	#endif
479
480	/* VBox allocates codegen buffer dynamically */
481	#ifndef VBOX
482	#ifdef USE_STATIC_CODE_GEN_BUFFER
483	static uint8_t static_code_gen_buffer[DEFAULT_CODE_GEN_BUFFER_SIZE];
484	#endif
485	#endif
486
487	static void code_gen_alloc(unsigned long tb_size)
488	{
489	#ifdef USE_STATIC_CODE_GEN_BUFFER
490	code_gen_buffer = static_code_gen_buffer;
491	code_gen_buffer_size = DEFAULT_CODE_GEN_BUFFER_SIZE;
492	map_exec(code_gen_buffer, code_gen_buffer_size);
493	#else
494	code_gen_buffer_size = tb_size;
495	if (code_gen_buffer_size == 0) {
496	#if defined(CONFIG_USER_ONLY)
497	/* in user mode, phys_ram_size is not meaningful */
498	code_gen_buffer_size = DEFAULT_CODE_GEN_BUFFER_SIZE;
499	#else
500	/* XXX: needs ajustments */
501	code_gen_buffer_size = (unsigned long)(phys_ram_size / 4);
502	#endif
503	}
504	if (code_gen_buffer_size < MIN_CODE_GEN_BUFFER_SIZE)
505	code_gen_buffer_size = MIN_CODE_GEN_BUFFER_SIZE;
506	/* The code gen buffer location may have constraints depending on
507	the host cpu and OS */
508	#ifdef VBOX
509	code_gen_buffer = RTMemExecAlloc(code_gen_buffer_size);
510
511	if (!code_gen_buffer) {
512	LogRel(("REM: failed allocate codegen buffer %lld\n",
513	code_gen_buffer_size));
514	return;
515	}
516	#else //!VBOX
517	#if defined(__linux__)
518	{
519	int flags;
520	void *start = NULL;
521
522	flags = MAP_PRIVATE \| MAP_ANONYMOUS;
523	#if defined(__x86_64__)
524	flags \|= MAP_32BIT;
525	/* Cannot map more than that */
526	if (code_gen_buffer_size > (800 * 1024 * 1024))
527	code_gen_buffer_size = (800 * 1024 * 1024);
528	#elif defined(__sparc_v9__)
529	// Map the buffer below 2G, so we can use direct calls and branches
530	flags \|= MAP_FIXED;
531	start = (void *) 0x60000000UL;
532	if (code_gen_buffer_size > (512 * 1024 * 1024))
533	code_gen_buffer_size = (512 * 1024 * 1024);
534	#endif
535	code_gen_buffer = mmap(start, code_gen_buffer_size,
536	PROT_WRITE \| PROT_READ \| PROT_EXEC,
537	flags, -1, 0);
538	if (code_gen_buffer == MAP_FAILED) {
539	fprintf(stderr, "Could not allocate dynamic translator buffer\n");
540	exit(1);
541	}
542	}
543	#elif defined(__FreeBSD__)
544	{
545	int flags;
546	void *addr = NULL;
547	flags = MAP_PRIVATE \| MAP_ANONYMOUS;
548	#if defined(__x86_64__)
549	/* FreeBSD doesn't have MAP_32BIT, use MAP_FIXED and assume
550	* 0x40000000 is free */
551	flags \|= MAP_FIXED;
552	addr = (void *)0x40000000;
553	/* Cannot map more than that */
554	if (code_gen_buffer_size > (800 * 1024 * 1024))
555	code_gen_buffer_size = (800 * 1024 * 1024);
556	#endif
557	code_gen_buffer = mmap(addr, code_gen_buffer_size,
558	PROT_WRITE \| PROT_READ \| PROT_EXEC,
559	flags, -1, 0);
560	if (code_gen_buffer == MAP_FAILED) {
561	fprintf(stderr, "Could not allocate dynamic translator buffer\n");
562	exit(1);
563	}
564	}
565	#else
566	code_gen_buffer = qemu_malloc(code_gen_buffer_size);
567	if (!code_gen_buffer) {
568	fprintf(stderr, "Could not allocate dynamic translator buffer\n");
569	exit(1);
570	}
571	map_exec(code_gen_buffer, code_gen_buffer_size);
572	#endif
573	map_exec(code_gen_prologue, sizeof(code_gen_prologue));
574	#endif /* !VBOX */
575	#endif /* !USE_STATIC_CODE_GEN_BUFFER */
576	#ifndef VBOX
577	map_exec(code_gen_prologue, sizeof(code_gen_prologue));
578	#else
579	map_exec(code_gen_prologue, _1K);
580	#endif
581
582	code_gen_buffer_max_size = code_gen_buffer_size -
583	code_gen_max_block_size();
584	code_gen_max_blocks = code_gen_buffer_size / CODE_GEN_AVG_BLOCK_SIZE;
585	tbs = qemu_malloc(code_gen_max_blocks * sizeof(TranslationBlock));
586	}
587
588	/* Must be called before using the QEMU cpus. 'tb_size' is the size
589	(in bytes) allocated to the translation buffer. Zero means default
590	size. */
591	void cpu_exec_init_all(unsigned long tb_size)
592	{
593	cpu_gen_init();
594	code_gen_alloc(tb_size);
595	code_gen_ptr = code_gen_buffer;
596	page_init();
597	#if !defined(CONFIG_USER_ONLY)
598	io_mem_init();
599	#endif
600	}
601
602	#ifndef VBOX
603	#if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
604
605	#define CPU_COMMON_SAVE_VERSION 1
606
607	static void cpu_common_save(QEMUFile f, void opaque)
608	{
609	CPUState *env = opaque;
610
611	qemu_put_be32s(f, &env->halted);
612	qemu_put_be32s(f, &env->interrupt_request);
613	}
614
615	static int cpu_common_load(QEMUFile f, void opaque, int version_id)
616	{
617	CPUState *env = opaque;
618
619	if (version_id != CPU_COMMON_SAVE_VERSION)
620	return -EINVAL;
621
622	qemu_get_be32s(f, &env->halted);
623	qemu_get_be32s(f, &env->interrupt_request);
624	tlb_flush(env, 1);
625
626	return 0;
627	}
628	#endif
629	#endif //!VBOX
630
631	void cpu_exec_init(CPUState *env)
632	{
633	CPUState **penv;
634	int cpu_index;
635
636	env->next_cpu = NULL;
637	penv = &first_cpu;
638	cpu_index = 0;
639	while (*penv != NULL) {
640	penv = (CPUState *)&(penv)->next_cpu;
641	cpu_index++;
642	}
643	env->cpu_index = cpu_index;
644	env->nb_watchpoints = 0;
645	*penv = env;
646	#ifndef VBOX
647	#if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
648	register_savevm("cpu_common", cpu_index, CPU_COMMON_SAVE_VERSION,
649	cpu_common_save, cpu_common_load, env);
650	register_savevm("cpu", cpu_index, CPU_SAVE_VERSION,
651	cpu_save, cpu_load, env);
652	#endif
653	#endif // !VBOX
654	}
655
656	#ifndef VBOX
657	static inline void invalidate_page_bitmap(PageDesc *p)
658	#else
659	DECLINLINE(void) invalidate_page_bitmap(PageDesc *p)
660	#endif
661	{
662	if (p->code_bitmap) {
663	qemu_free(p->code_bitmap);
664	p->code_bitmap = NULL;
665	}
666	p->code_write_count = 0;
667	}
668
669	/* set to NULL all the 'first_tb' fields in all PageDescs */
670	static void page_flush_tb(void)
671	{
672	int i, j;
673	PageDesc *p;
674
675	for(i = 0; i < L1_SIZE; i++) {
676	p = l1_map[i];
677	if (p) {
678	for(j = 0; j < L2_SIZE; j++) {
679	p->first_tb = NULL;
680	invalidate_page_bitmap(p);
681	p++;
682	}
683	}
684	}
685	}
686
687	/* flush all the translation blocks */
688	/* XXX: tb_flush is currently not thread safe */
689	void tb_flush(CPUState *env1)
690	{
691	CPUState *env;
692	#if defined(DEBUG_FLUSH)
693	printf("qemu: flush code_size=%ld nb_tbs=%d avg_tb_size=%ld\n",
694	(unsigned long)(code_gen_ptr - code_gen_buffer),
695	nb_tbs, nb_tbs > 0 ?
696	((unsigned long)(code_gen_ptr - code_gen_buffer)) / nb_tbs : 0);
697	#endif
698	if ((unsigned long)(code_gen_ptr - code_gen_buffer) > code_gen_buffer_size)
699	cpu_abort(env1, "Internal error: code buffer overflow\n");
700
701	nb_tbs = 0;
702
703	for(env = first_cpu; env != NULL; env = env->next_cpu) {
704	memset (env->tb_jmp_cache, 0, TB_JMP_CACHE_SIZE * sizeof (void *));
705	}
706
707	memset (tb_phys_hash, 0, CODE_GEN_PHYS_HASH_SIZE * sizeof (void *));
708	page_flush_tb();
709
710	code_gen_ptr = code_gen_buffer;
711	/* XXX: flush processor icache at this point if cache flush is
712	expensive */
713	tb_flush_count++;
714	}
715
716	#ifdef DEBUG_TB_CHECK
717	static void tb_invalidate_check(target_ulong address)
718	{
719	TranslationBlock *tb;
720	int i;
721	address &= TARGET_PAGE_MASK;
722	for(i = 0;i < CODE_GEN_PHYS_HASH_SIZE; i++) {
723	for(tb = tb_phys_hash[i]; tb != NULL; tb = tb->phys_hash_next) {
724	if (!(address + TARGET_PAGE_SIZE <= tb->pc \|\|
725	address >= tb->pc + tb->size)) {
726	printf("ERROR invalidate: address=%08lx PC=%08lx size=%04x\n",
727	address, (long)tb->pc, tb->size);
728	}
729	}
730	}
731	}
732
733	/* verify that all the pages have correct rights for code */
734	static void tb_page_check(void)
735	{
736	TranslationBlock *tb;
737	int i, flags1, flags2;
738
739	for(i = 0;i < CODE_GEN_PHYS_HASH_SIZE; i++) {
740	for(tb = tb_phys_hash[i]; tb != NULL; tb = tb->phys_hash_next) {
741	flags1 = page_get_flags(tb->pc);
742	flags2 = page_get_flags(tb->pc + tb->size - 1);
743	if ((flags1 & PAGE_WRITE) \|\| (flags2 & PAGE_WRITE)) {
744	printf("ERROR page flags: PC=%08lx size=%04x f1=%x f2=%x\n",
745	(long)tb->pc, tb->size, flags1, flags2);
746	}
747	}
748	}
749	}
750
751	static void tb_jmp_check(TranslationBlock *tb)
752	{
753	TranslationBlock *tb1;
754	unsigned int n1;
755
756	/* suppress any remaining jumps to this TB */
757	tb1 = tb->jmp_first;
758	for(;;) {
759	n1 = (long)tb1 & 3;
760	tb1 = (TranslationBlock *)((long)tb1 & ~3);
761	if (n1 == 2)
762	break;
763	tb1 = tb1->jmp_next[n1];
764	}
765	/* check end of list */
766	if (tb1 != tb) {
767	printf("ERROR: jmp_list from 0x%08lx\n", (long)tb);
768	}
769	}
770	#endif // DEBUG_TB_CHECK
771
772	/* invalidate one TB */
773	#ifndef VBOX
774	static inline void tb_remove(TranslationBlock *ptb, TranslationBlock tb,
775	int next_offset)
776	#else
777	DECLINLINE(void) tb_remove(TranslationBlock *ptb, TranslationBlock tb,
778	int next_offset)
779	#endif
780	{
781	TranslationBlock *tb1;
782	for(;;) {
783	tb1 = *ptb;
784	if (tb1 == tb) {
785	ptb = (TranslationBlock *)((char )tb1 + next_offset);
786	break;
787	}
788	ptb = (TranslationBlock *)((char )tb1 + next_offset);
789	}
790	}
791
792	#ifndef VBOX
793	static inline void tb_page_remove(TranslationBlock *ptb, TranslationBlock tb)
794	#else
795	DECLINLINE(void) tb_page_remove(TranslationBlock *ptb, TranslationBlock tb)
796	#endif
797	{
798	TranslationBlock *tb1;
799	unsigned int n1;
800
801	for(;;) {
802	tb1 = *ptb;
803	n1 = (long)tb1 & 3;
804	tb1 = (TranslationBlock *)((long)tb1 & ~3);
805	if (tb1 == tb) {
806	*ptb = tb1->page_next[n1];
807	break;
808	}
809	ptb = &tb1->page_next[n1];
810	}
811	}
812
813	#ifndef VBOX
814	static inline void tb_jmp_remove(TranslationBlock *tb, int n)
815	#else
816	DECLINLINE(void) tb_jmp_remove(TranslationBlock *tb, int n)
817	#endif
818	{
819	TranslationBlock tb1, *ptb;
820	unsigned int n1;
821
822	ptb = &tb->jmp_next[n];
823	tb1 = *ptb;
824	if (tb1) {
825	/* find tb(n) in circular list */
826	for(;;) {
827	tb1 = *ptb;
828	n1 = (long)tb1 & 3;
829	tb1 = (TranslationBlock *)((long)tb1 & ~3);
830	if (n1 == n && tb1 == tb)
831	break;
832	if (n1 == 2) {
833	ptb = &tb1->jmp_first;
834	} else {
835	ptb = &tb1->jmp_next[n1];
836	}
837	}
838	/* now we can suppress tb(n) from the list */
839	*ptb = tb->jmp_next[n];
840
841	tb->jmp_next[n] = NULL;
842	}
843	}
844
845	/* reset the jump entry 'n' of a TB so that it is not chained to
846	another TB */
847	#ifndef VBOX
848	static inline void tb_reset_jump(TranslationBlock *tb, int n)
849	#else
850	DECLINLINE(void) tb_reset_jump(TranslationBlock *tb, int n)
851	#endif
852	{
853	tb_set_jmp_target(tb, n, (unsigned long)(tb->tc_ptr + tb->tb_next_offset[n]));
854	}
855
856	void tb_phys_invalidate(TranslationBlock *tb, target_ulong page_addr)
857	{
858	CPUState *env;
859	PageDesc *p;
860	unsigned int h, n1;
861	target_phys_addr_t phys_pc;
862	TranslationBlock tb1, tb2;
863
864	/* remove the TB from the hash list */
865	phys_pc = tb->page_addr[0] + (tb->pc & ~TARGET_PAGE_MASK);
866	h = tb_phys_hash_func(phys_pc);
867	tb_remove(&tb_phys_hash[h], tb,
868	offsetof(TranslationBlock, phys_hash_next));
869
870	/* remove the TB from the page list */
871	if (tb->page_addr[0] != page_addr) {
872	p = page_find(tb->page_addr[0] >> TARGET_PAGE_BITS);
873	tb_page_remove(&p->first_tb, tb);
874	invalidate_page_bitmap(p);
875	}
876	if (tb->page_addr[1] != -1 && tb->page_addr[1] != page_addr) {
877	p = page_find(tb->page_addr[1] >> TARGET_PAGE_BITS);
878	tb_page_remove(&p->first_tb, tb);
879	invalidate_page_bitmap(p);
880	}
881
882	tb_invalidated_flag = 1;
883
884	/* remove the TB from the hash list */
885	h = tb_jmp_cache_hash_func(tb->pc);
886	for(env = first_cpu; env != NULL; env = env->next_cpu) {
887	if (env->tb_jmp_cache[h] == tb)
888	env->tb_jmp_cache[h] = NULL;
889	}
890
891	/* suppress this TB from the two jump lists */
892	tb_jmp_remove(tb, 0);
893	tb_jmp_remove(tb, 1);
894
895	/* suppress any remaining jumps to this TB */
896	tb1 = tb->jmp_first;
897	for(;;) {
898	n1 = (long)tb1 & 3;
899	if (n1 == 2)
900	break;
901	tb1 = (TranslationBlock *)((long)tb1 & ~3);
902	tb2 = tb1->jmp_next[n1];
903	tb_reset_jump(tb1, n1);
904	tb1->jmp_next[n1] = NULL;
905	tb1 = tb2;
906	}
907	tb->jmp_first = (TranslationBlock )((long)tb \| 2); / fail safe */
908
909	#ifndef VBOX
910	tb_phys_invalidate_count++;
911	#endif
912	}
913
914
915	#ifdef VBOX
916	void tb_invalidate_virt(CPUState *env, uint32_t eip)
917	{
918	# if 1
919	tb_flush(env);
920	# else
921	uint8_t cs_base, pc;
922	unsigned int flags, h, phys_pc;
923	TranslationBlock tb, *ptb;
924
925	flags = env->hflags;
926	flags \|= (env->eflags & (IOPL_MASK \| TF_MASK \| VM_MASK));
927	cs_base = env->segs[R_CS].base;
928	pc = cs_base + eip;
929
930	tb = tb_find(&ptb, (unsigned long)pc, (unsigned long)cs_base,
931	flags);
932
933	if(tb)
934	{
935	# ifdef DEBUG
936	printf("invalidating TB (%08X) at %08X\n", tb, eip);
937	# endif
938	tb_invalidate(tb);
939	//Note: this will leak TBs, but the whole cache will be flushed
940	// when it happens too often
941	tb->pc = 0;
942	tb->cs_base = 0;
943	tb->flags = 0;
944	}
945	# endif
946	}
947
948	# ifdef VBOX_STRICT
949	/**
950	* Gets the page offset.
951	*/
952	unsigned long get_phys_page_offset(target_ulong addr)
953	{
954	PhysPageDesc *p = phys_page_find(addr >> TARGET_PAGE_BITS);
955	return p ? p->phys_offset : 0;
956	}
957	# endif /* VBOX_STRICT */
958	#endif /* VBOX */
959
960	#ifndef VBOX
961	static inline void set_bits(uint8_t *tab, int start, int len)
962	#else
963	DECLINLINE(void) set_bits(uint8_t *tab, int start, int len)
964	#endif
965	{
966	int end, mask, end1;
967
968	end = start + len;
969	tab += start >> 3;
970	mask = 0xff << (start & 7);
971	if ((start & ~7) == (end & ~7)) {
972	if (start < end) {
973	mask &= ~(0xff << (end & 7));
974	*tab \|= mask;
975	}
976	} else {
977	*tab++ \|= mask;
978	start = (start + 8) & ~7;
979	end1 = end & ~7;
980	while (start < end1) {
981	*tab++ = 0xff;
982	start += 8;
983	}
984	if (start < end) {
985	mask = ~(0xff << (end & 7));
986	*tab \|= mask;
987	}
988	}
989	}
990
991	static void build_page_bitmap(PageDesc *p)
992	{
993	int n, tb_start, tb_end;
994	TranslationBlock *tb;
995
996	p->code_bitmap = qemu_malloc(TARGET_PAGE_SIZE / 8);
997	if (!p->code_bitmap)
998	return;
999	memset(p->code_bitmap, 0, TARGET_PAGE_SIZE / 8);
1000
1001	tb = p->first_tb;
1002	while (tb != NULL) {
1003	n = (long)tb & 3;
1004	tb = (TranslationBlock *)((long)tb & ~3);
1005	/* NOTE: this is subtle as a TB may span two physical pages */
1006	if (n == 0) {
1007	/* NOTE: tb_end may be after the end of the page, but
1008	it is not a problem */
1009	tb_start = tb->pc & ~TARGET_PAGE_MASK;
1010	tb_end = tb_start + tb->size;
1011	if (tb_end > TARGET_PAGE_SIZE)
1012	tb_end = TARGET_PAGE_SIZE;
1013	} else {
1014	tb_start = 0;
1015	tb_end = ((tb->pc + tb->size) & ~TARGET_PAGE_MASK);
1016	}
1017	set_bits(p->code_bitmap, tb_start, tb_end - tb_start);
1018	tb = tb->page_next[n];
1019	}
1020	}
1021
1022	TranslationBlock tb_gen_code(CPUState env,
1023	target_ulong pc, target_ulong cs_base,
1024	int flags, int cflags)
1025	{
1026	TranslationBlock *tb;
1027	uint8_t *tc_ptr;
1028	target_ulong phys_pc, phys_page2, virt_page2;
1029	int code_gen_size;
1030
1031	phys_pc = get_phys_addr_code(env, pc);
1032	tb = tb_alloc(pc);
1033	if (!tb) {
1034	/* flush must be done */
1035	tb_flush(env);
1036	/* cannot fail at this point */
1037	tb = tb_alloc(pc);
1038	/* Don't forget to invalidate previous TB info. */
1039	tb_invalidated_flag = 1;
1040	}
1041	tc_ptr = code_gen_ptr;
1042	tb->tc_ptr = tc_ptr;
1043	tb->cs_base = cs_base;
1044	tb->flags = flags;
1045	tb->cflags = cflags;
1046	cpu_gen_code(env, tb, &code_gen_size);
1047	code_gen_ptr = (void *)(((unsigned long)code_gen_ptr + code_gen_size + CODE_GEN_ALIGN - 1) & ~(CODE_GEN_ALIGN - 1));
1048
1049	/* check next page if needed */
1050	virt_page2 = (pc + tb->size - 1) & TARGET_PAGE_MASK;
1051	phys_page2 = -1;
1052	if ((pc & TARGET_PAGE_MASK) != virt_page2) {
1053	phys_page2 = get_phys_addr_code(env, virt_page2);
1054	}
1055	tb_link_phys(tb, phys_pc, phys_page2);
1056	return tb;
1057	}
1058
1059	/* invalidate all TBs which intersect with the target physical page
1060	starting in range [start;end[. NOTE: start and end must refer to
1061	the same physical page. 'is_cpu_write_access' should be true if called
1062	from a real cpu write access: the virtual CPU will exit the current
1063	TB if code is modified inside this TB. */
1064	void tb_invalidate_phys_page_range(target_phys_addr_t start, target_phys_addr_t end,
1065	int is_cpu_write_access)
1066	{
1067	int n, current_tb_modified, current_tb_not_found, current_flags;
1068	CPUState *env = cpu_single_env;
1069	PageDesc *p;
1070	TranslationBlock tb, tb_next, current_tb, saved_tb;
1071	target_ulong tb_start, tb_end;
1072	target_ulong current_pc, current_cs_base;
1073
1074	p = page_find(start >> TARGET_PAGE_BITS);
1075	if (!p)
1076	return;
1077	if (!p->code_bitmap &&
1078	++p->code_write_count >= SMC_BITMAP_USE_THRESHOLD &&
1079	is_cpu_write_access) {
1080	/* build code bitmap */
1081	build_page_bitmap(p);
1082	}
1083
1084	/* we remove all the TBs in the range [start, end[ */
1085	/* XXX: see if in some cases it could be faster to invalidate all the code */
1086	current_tb_not_found = is_cpu_write_access;
1087	current_tb_modified = 0;
1088	current_tb = NULL; /* avoid warning */
1089	current_pc = 0; /* avoid warning */
1090	current_cs_base = 0; /* avoid warning */
1091	current_flags = 0; /* avoid warning */
1092	tb = p->first_tb;
1093	while (tb != NULL) {
1094	n = (long)tb & 3;
1095	tb = (TranslationBlock *)((long)tb & ~3);
1096	tb_next = tb->page_next[n];
1097	/* NOTE: this is subtle as a TB may span two physical pages */
1098	if (n == 0) {
1099	/* NOTE: tb_end may be after the end of the page, but
1100	it is not a problem */
1101	tb_start = tb->page_addr[0] + (tb->pc & ~TARGET_PAGE_MASK);
1102	tb_end = tb_start + tb->size;
1103	} else {
1104	tb_start = tb->page_addr[1];
1105	tb_end = tb_start + ((tb->pc + tb->size) & ~TARGET_PAGE_MASK);
1106	}
1107	if (!(tb_end <= start \|\| tb_start >= end)) {
1108	#ifdef TARGET_HAS_PRECISE_SMC
1109	if (current_tb_not_found) {
1110	current_tb_not_found = 0;
1111	current_tb = NULL;
1112	if (env->mem_io_pc) {
1113	/* now we have a real cpu fault */
1114	current_tb = tb_find_pc(env->mem_io_pc);
1115	}
1116	}
1117	if (current_tb == tb &&
1118	(current_tb->cflags & CF_COUNT_MASK) != 1) {
1119	/* If we are modifying the current TB, we must stop
1120	its execution. We could be more precise by checking
1121	that the modification is after the current PC, but it
1122	would require a specialized function to partially
1123	restore the CPU state */
1124
1125	current_tb_modified = 1;
1126	cpu_restore_state(current_tb, env,
1127	env->mem_io_pc, NULL);
1128	#if defined(TARGET_I386)
1129	current_flags = env->hflags;
1130	current_flags \|= (env->eflags & (IOPL_MASK \| TF_MASK \| VM_MASK));
1131	current_cs_base = (target_ulong)env->segs[R_CS].base;
1132	current_pc = current_cs_base + env->eip;
1133	#else
1134	#error unsupported CPU
1135	#endif
1136	}
1137	#endif /* TARGET_HAS_PRECISE_SMC */
1138	/* we need to do that to handle the case where a signal
1139	occurs while doing tb_phys_invalidate() */
1140	saved_tb = NULL;
1141	if (env) {
1142	saved_tb = env->current_tb;
1143	env->current_tb = NULL;
1144	}
1145	tb_phys_invalidate(tb, -1);
1146	if (env) {
1147	env->current_tb = saved_tb;
1148	if (env->interrupt_request && env->current_tb)
1149	cpu_interrupt(env, env->interrupt_request);
1150	}
1151	}
1152	tb = tb_next;
1153	}
1154	#if !defined(CONFIG_USER_ONLY)
1155	/* if no code remaining, no need to continue to use slow writes */
1156	if (!p->first_tb) {
1157	invalidate_page_bitmap(p);
1158	if (is_cpu_write_access) {
1159	tlb_unprotect_code_phys(env, start, env->mem_io_vaddr);
1160	}
1161	}
1162	#endif
1163	#ifdef TARGET_HAS_PRECISE_SMC
1164	if (current_tb_modified) {
1165	/* we generate a block containing just the instruction
1166	modifying the memory. It will ensure that it cannot modify
1167	itself */
1168	env->current_tb = NULL;
1169	tb_gen_code(env, current_pc, current_cs_base, current_flags, 1);
1170	cpu_resume_from_signal(env, NULL);
1171	}
1172	#endif
1173	}
1174
1175
1176	/* len must be <= 8 and start must be a multiple of len */
1177	#ifndef VBOX
1178	static inline void tb_invalidate_phys_page_fast(target_phys_addr_t start, int len)
1179	#else
1180	DECLINLINE(void) tb_invalidate_phys_page_fast(target_phys_addr_t start, int len)
1181	#endif
1182	{
1183	PageDesc *p;
1184	int offset, b;
1185	#if 0
1186	if (1) {
1187	if (loglevel) {
1188	fprintf(logfile, "modifying code at 0x%x size=%d EIP=%x PC=%08x\n",
1189	cpu_single_env->mem_io_vaddr, len,
1190	cpu_single_env->eip,
1191	cpu_single_env->eip + (long)cpu_single_env->segs[R_CS].base);
1192	}
1193	}
1194	#endif
1195	p = page_find(start >> TARGET_PAGE_BITS);
1196	if (!p)
1197	return;
1198	if (p->code_bitmap) {
1199	offset = start & ~TARGET_PAGE_MASK;
1200	b = p->code_bitmap[offset >> 3] >> (offset & 7);
1201	if (b & ((1 << len) - 1))
1202	goto do_invalidate;
1203	} else {
1204	do_invalidate:
1205	tb_invalidate_phys_page_range(start, start + len, 1);
1206	}
1207	}
1208
1209
1210	#if !defined(CONFIG_SOFTMMU)
1211	static void tb_invalidate_phys_page(target_phys_addr_t addr,
1212	unsigned long pc, void *puc)
1213	{
1214	int n, current_flags, current_tb_modified;
1215	target_ulong current_pc, current_cs_base;
1216	PageDesc *p;
1217	TranslationBlock tb, current_tb;
1218	#ifdef TARGET_HAS_PRECISE_SMC
1219	CPUState *env = cpu_single_env;
1220	#endif
1221
1222	addr &= TARGET_PAGE_MASK;
1223	p = page_find(addr >> TARGET_PAGE_BITS);
1224	if (!p)
1225	return;
1226	tb = p->first_tb;
1227	current_tb_modified = 0;
1228	current_tb = NULL;
1229	current_pc = 0; /* avoid warning */
1230	current_cs_base = 0; /* avoid warning */
1231	current_flags = 0; /* avoid warning */
1232	#ifdef TARGET_HAS_PRECISE_SMC
1233	if (tb && pc != 0) {
1234	current_tb = tb_find_pc(pc);
1235	}
1236	#endif
1237	while (tb != NULL) {
1238	n = (long)tb & 3;
1239	tb = (TranslationBlock *)((long)tb & ~3);
1240	#ifdef TARGET_HAS_PRECISE_SMC
1241	if (current_tb == tb &&
1242	(current_tb->cflags & CF_COUNT_MASK) != 1) {
1243	/* If we are modifying the current TB, we must stop
1244	its execution. We could be more precise by checking
1245	that the modification is after the current PC, but it
1246	would require a specialized function to partially
1247	restore the CPU state */
1248
1249	current_tb_modified = 1;
1250	cpu_restore_state(current_tb, env, pc, puc);
1251	#if defined(TARGET_I386)
1252	current_flags = env->hflags;
1253	current_flags \|= (env->eflags & (IOPL_MASK \| TF_MASK \| VM_MASK));
1254	current_cs_base = (target_ulong)env->segs[R_CS].base;
1255	current_pc = current_cs_base + env->eip;
1256	#else
1257	#error unsupported CPU
1258	#endif
1259	}
1260	#endif /* TARGET_HAS_PRECISE_SMC */
1261	tb_phys_invalidate(tb, addr);
1262	tb = tb->page_next[n];
1263	}
1264	p->first_tb = NULL;
1265	#ifdef TARGET_HAS_PRECISE_SMC
1266	if (current_tb_modified) {
1267	/* we generate a block containing just the instruction
1268	modifying the memory. It will ensure that it cannot modify
1269	itself */
1270	env->current_tb = NULL;
1271	tb_gen_code(env, current_pc, current_cs_base, current_flags, 1);
1272	cpu_resume_from_signal(env, puc);
1273	}
1274	#endif
1275	}
1276	#endif
1277
1278	/* add the tb in the target page and protect it if necessary */
1279	#ifndef VBOX
1280	static inline void tb_alloc_page(TranslationBlock *tb,
1281	unsigned int n, target_ulong page_addr)
1282	#else
1283	DECLINLINE(void) tb_alloc_page(TranslationBlock *tb,
1284	unsigned int n, target_ulong page_addr)
1285	#endif
1286	{
1287	PageDesc *p;
1288	TranslationBlock *last_first_tb;
1289
1290	tb->page_addr[n] = page_addr;
1291	p = page_find_alloc(page_addr >> TARGET_PAGE_BITS);
1292	tb->page_next[n] = p->first_tb;
1293	last_first_tb = p->first_tb;
1294	p->first_tb = (TranslationBlock *)((long)tb \| n);
1295	invalidate_page_bitmap(p);
1296
1297	#if defined(TARGET_HAS_SMC) \|\| 1
1298
1299	#if defined(CONFIG_USER_ONLY)
1300	if (p->flags & PAGE_WRITE) {
1301	target_ulong addr;
1302	PageDesc *p2;
1303	int prot;
1304
1305	/* force the host page as non writable (writes will have a
1306	page fault + mprotect overhead) */
1307	page_addr &= qemu_host_page_mask;
1308	prot = 0;
1309	for(addr = page_addr; addr < page_addr + qemu_host_page_size;
1310	addr += TARGET_PAGE_SIZE) {
1311
1312	p2 = page_find (addr >> TARGET_PAGE_BITS);
1313	if (!p2)
1314	continue;
1315	prot \|= p2->flags;
1316	p2->flags &= ~PAGE_WRITE;
1317	page_get_flags(addr);
1318	}
1319	mprotect(g2h(page_addr), qemu_host_page_size,
1320	(prot & PAGE_BITS) & ~PAGE_WRITE);
1321	#ifdef DEBUG_TB_INVALIDATE
1322	printf("protecting code page: 0x" TARGET_FMT_lx "\n",
1323	page_addr);
1324	#endif
1325	}
1326	#else
1327	/* if some code is already present, then the pages are already
1328	protected. So we handle the case where only the first TB is
1329	allocated in a physical page */
1330	if (!last_first_tb) {
1331	tlb_protect_code(page_addr);
1332	}
1333	#endif
1334
1335	#endif /* TARGET_HAS_SMC */
1336	}
1337
1338	/* Allocate a new translation block. Flush the translation buffer if
1339	too many translation blocks or too much generated code. */
1340	TranslationBlock *tb_alloc(target_ulong pc)
1341	{
1342	TranslationBlock *tb;
1343
1344	if (nb_tbs >= code_gen_max_blocks \|\|
1345	#ifndef VBOX
1346	(code_gen_ptr - code_gen_buffer) >= code_gen_buffer_max_size)
1347	#else
1348	(code_gen_ptr - code_gen_buffer) >= (int)code_gen_buffer_max_size)
1349	#endif
1350	return NULL;
1351	tb = &tbs[nb_tbs++];
1352	tb->pc = pc;
1353	tb->cflags = 0;
1354	return tb;
1355	}
1356
1357	void tb_free(TranslationBlock *tb)
1358	{
1359	/* In practice this is mostly used for single use temporary TB
1360	Ignore the hard cases and just back up if this TB happens to
1361	be the last one generated. */
1362	if (nb_tbs > 0 && tb == &tbs[nb_tbs - 1]) {
1363	code_gen_ptr = tb->tc_ptr;
1364	nb_tbs--;
1365	}
1366	}
1367
1368	/* add a new TB and link it to the physical page tables. phys_page2 is
1369	(-1) to indicate that only one page contains the TB. */
1370	void tb_link_phys(TranslationBlock *tb,
1371	target_ulong phys_pc, target_ulong phys_page2)
1372	{
1373	unsigned int h;
1374	TranslationBlock **ptb;
1375
1376	/* Grab the mmap lock to stop another thread invalidating this TB
1377	before we are done. */
1378	mmap_lock();
1379	/* add in the physical hash table */
1380	h = tb_phys_hash_func(phys_pc);
1381	ptb = &tb_phys_hash[h];
1382	tb->phys_hash_next = *ptb;
1383	*ptb = tb;
1384
1385	/* add in the page list */
1386	tb_alloc_page(tb, 0, phys_pc & TARGET_PAGE_MASK);
1387	if (phys_page2 != -1)
1388	tb_alloc_page(tb, 1, phys_page2);
1389	else
1390	tb->page_addr[1] = -1;
1391
1392	tb->jmp_first = (TranslationBlock *)((long)tb \| 2);
1393	tb->jmp_next[0] = NULL;
1394	tb->jmp_next[1] = NULL;
1395
1396	/* init original jump addresses */
1397	if (tb->tb_next_offset[0] != 0xffff)
1398	tb_reset_jump(tb, 0);
1399	if (tb->tb_next_offset[1] != 0xffff)
1400	tb_reset_jump(tb, 1);
1401
1402	#ifdef DEBUG_TB_CHECK
1403	tb_page_check();
1404	#endif
1405	mmap_unlock();
1406	}
1407
1408	/* find the TB 'tb' such that tb[0].tc_ptr <= tc_ptr <
1409	tb[1].tc_ptr. Return NULL if not found */
1410	TranslationBlock *tb_find_pc(unsigned long tc_ptr)
1411	{
1412	int m_min, m_max, m;
1413	unsigned long v;
1414	TranslationBlock *tb;
1415
1416	if (nb_tbs <= 0)
1417	return NULL;
1418	if (tc_ptr < (unsigned long)code_gen_buffer \|\|
1419	tc_ptr >= (unsigned long)code_gen_ptr)
1420	return NULL;
1421	/* binary search (cf Knuth) */
1422	m_min = 0;
1423	m_max = nb_tbs - 1;
1424	while (m_min <= m_max) {
1425	m = (m_min + m_max) >> 1;
1426	tb = &tbs[m];
1427	v = (unsigned long)tb->tc_ptr;
1428	if (v == tc_ptr)
1429	return tb;
1430	else if (tc_ptr < v) {
1431	m_max = m - 1;
1432	} else {
1433	m_min = m + 1;
1434	}
1435	}
1436	return &tbs[m_max];
1437	}
1438
1439	static void tb_reset_jump_recursive(TranslationBlock *tb);
1440
1441	#ifndef VBOX
1442	static inline void tb_reset_jump_recursive2(TranslationBlock *tb, int n)
1443	#else
1444	DECLINLINE(void) tb_reset_jump_recursive2(TranslationBlock *tb, int n)
1445	#endif
1446	{
1447	TranslationBlock tb1, tb_next, **ptb;
1448	unsigned int n1;
1449
1450	tb1 = tb->jmp_next[n];
1451	if (tb1 != NULL) {
1452	/* find head of list */
1453	for(;;) {
1454	n1 = (long)tb1 & 3;
1455	tb1 = (TranslationBlock *)((long)tb1 & ~3);
1456	if (n1 == 2)
1457	break;
1458	tb1 = tb1->jmp_next[n1];
1459	}
1460	/* we are now sure now that tb jumps to tb1 */
1461	tb_next = tb1;
1462
1463	/* remove tb from the jmp_first list */
1464	ptb = &tb_next->jmp_first;
1465	for(;;) {
1466	tb1 = *ptb;
1467	n1 = (long)tb1 & 3;
1468	tb1 = (TranslationBlock *)((long)tb1 & ~3);
1469	if (n1 == n && tb1 == tb)
1470	break;
1471	ptb = &tb1->jmp_next[n1];
1472	}
1473	*ptb = tb->jmp_next[n];
1474	tb->jmp_next[n] = NULL;
1475
1476	/* suppress the jump to next tb in generated code */
1477	tb_reset_jump(tb, n);
1478
1479	/* suppress jumps in the tb on which we could have jumped */
1480	tb_reset_jump_recursive(tb_next);
1481	}
1482	}
1483
1484	static void tb_reset_jump_recursive(TranslationBlock *tb)
1485	{
1486	tb_reset_jump_recursive2(tb, 0);
1487	tb_reset_jump_recursive2(tb, 1);
1488	}
1489
1490	#if defined(TARGET_HAS_ICE)
1491	static void breakpoint_invalidate(CPUState *env, target_ulong pc)
1492	{
1493	target_ulong addr, pd;
1494	ram_addr_t ram_addr;
1495	PhysPageDesc *p;
1496
1497	addr = cpu_get_phys_page_debug(env, pc);
1498	p = phys_page_find(addr >> TARGET_PAGE_BITS);
1499	if (!p) {
1500	pd = IO_MEM_UNASSIGNED;
1501	} else {
1502	pd = p->phys_offset;
1503	}
1504	ram_addr = (pd & TARGET_PAGE_MASK) \| (pc & ~TARGET_PAGE_MASK);
1505	tb_invalidate_phys_page_range(ram_addr, ram_addr + 1, 0);
1506	}
1507	#endif
1508
1509	/* Add a watchpoint. */
1510	int cpu_watchpoint_insert(CPUState *env, target_ulong addr, int type)
1511	{
1512	int i;
1513
1514	for (i = 0; i < env->nb_watchpoints; i++) {
1515	if (addr == env->watchpoint[i].vaddr)
1516	return 0;
1517	}
1518	if (env->nb_watchpoints >= MAX_WATCHPOINTS)
1519	return -1;
1520
1521	i = env->nb_watchpoints++;
1522	env->watchpoint[i].vaddr = addr;
1523	env->watchpoint[i].type = type;
1524	tlb_flush_page(env, addr);
1525	/* FIXME: This flush is needed because of the hack to make memory ops
1526	terminate the TB. It can be removed once the proper IO trap and
1527	re-execute bits are in. */
1528	tb_flush(env);
1529	return i;
1530	}
1531
1532	/* Remove a watchpoint. */
1533	int cpu_watchpoint_remove(CPUState *env, target_ulong addr)
1534	{
1535	int i;
1536
1537	for (i = 0; i < env->nb_watchpoints; i++) {
1538	if (addr == env->watchpoint[i].vaddr) {
1539	env->nb_watchpoints--;
1540	env->watchpoint[i] = env->watchpoint[env->nb_watchpoints];
1541	tlb_flush_page(env, addr);
1542	return 0;
1543	}
1544	}
1545	return -1;
1546	}
1547
1548	/* Remove all watchpoints. */
1549	void cpu_watchpoint_remove_all(CPUState *env) {
1550	int i;
1551
1552	for (i = 0; i < env->nb_watchpoints; i++) {
1553	tlb_flush_page(env, env->watchpoint[i].vaddr);
1554	}
1555	env->nb_watchpoints = 0;
1556	}
1557
1558	/* add a breakpoint. EXCP_DEBUG is returned by the CPU loop if a
1559	breakpoint is reached */
1560	int cpu_breakpoint_insert(CPUState *env, target_ulong pc)
1561	{
1562	#if defined(TARGET_HAS_ICE)
1563	int i;
1564
1565	for(i = 0; i < env->nb_breakpoints; i++) {
1566	if (env->breakpoints[i] == pc)
1567	return 0;
1568	}
1569
1570	if (env->nb_breakpoints >= MAX_BREAKPOINTS)
1571	return -1;
1572	env->breakpoints[env->nb_breakpoints++] = pc;
1573
1574	breakpoint_invalidate(env, pc);
1575	return 0;
1576	#else
1577	return -1;
1578	#endif
1579	}
1580
1581	/* remove all breakpoints */
1582	void cpu_breakpoint_remove_all(CPUState *env) {
1583	#if defined(TARGET_HAS_ICE)
1584	int i;
1585	for(i = 0; i < env->nb_breakpoints; i++) {
1586	breakpoint_invalidate(env, env->breakpoints[i]);
1587	}
1588	env->nb_breakpoints = 0;
1589	#endif
1590	}
1591
1592	/* remove a breakpoint */
1593	int cpu_breakpoint_remove(CPUState *env, target_ulong pc)
1594	{
1595	#if defined(TARGET_HAS_ICE)
1596	int i;
1597	for(i = 0; i < env->nb_breakpoints; i++) {
1598	if (env->breakpoints[i] == pc)
1599	goto found;
1600	}
1601	return -1;
1602	found:
1603	env->nb_breakpoints--;
1604	if (i < env->nb_breakpoints)
1605	env->breakpoints[i] = env->breakpoints[env->nb_breakpoints];
1606
1607	breakpoint_invalidate(env, pc);
1608	return 0;
1609	#else
1610	return -1;
1611	#endif
1612	}
1613
1614	/* enable or disable single step mode. EXCP_DEBUG is returned by the
1615	CPU loop after each instruction */
1616	void cpu_single_step(CPUState *env, int enabled)
1617	{
1618	#if defined(TARGET_HAS_ICE)
1619	if (env->singlestep_enabled != enabled) {
1620	env->singlestep_enabled = enabled;
1621	/* must flush all the translated code to avoid inconsistancies */
1622	/* XXX: only flush what is necessary */
1623	tb_flush(env);
1624	}
1625	#endif
1626	}
1627
1628	#ifndef VBOX
1629	/* enable or disable low levels log */
1630	void cpu_set_log(int log_flags)
1631	{
1632	loglevel = log_flags;
1633	if (loglevel && !logfile) {
1634	logfile = fopen(logfilename, "w");
1635	if (!logfile) {
1636	perror(logfilename);
1637	_exit(1);
1638	}
1639	#if !defined(CONFIG_SOFTMMU)
1640	/* must avoid mmap() usage of glibc by setting a buffer "by hand" */
1641	{
1642	static uint8_t logfile_buf[4096];
1643	setvbuf(logfile, logfile_buf, _IOLBF, sizeof(logfile_buf));
1644	}
1645	#else
1646	setvbuf(logfile, NULL, _IOLBF, 0);
1647	#endif
1648	}
1649	}
1650
1651	void cpu_set_log_filename(const char *filename)
1652	{
1653	logfilename = strdup(filename);
1654	}
1655	#endif /* !VBOX */
1656
1657	/* mask must never be zero, except for A20 change call */
1658	void cpu_interrupt(CPUState *env, int mask)
1659	{
1660	#if !defined(USE_NPTL)
1661	TranslationBlock *tb;
1662	static spinlock_t interrupt_lock = SPIN_LOCK_UNLOCKED;
1663	#endif
1664	int old_mask;
1665
1666	old_mask = env->interrupt_request;
1667	#ifdef VBOX
1668	VM_ASSERT_EMT(env->pVM);
1669	ASMAtomicOrS32((int32_t volatile *)&env->interrupt_request, mask);
1670	#else /* !VBOX */
1671	/* FIXME: This is probably not threadsafe. A different thread could
1672	be in the middle of a read-modify-write operation. */
1673	env->interrupt_request \|= mask;
1674	#endif /* !VBOX */
1675	#if defined(USE_NPTL)
1676	/* FIXME: TB unchaining isn't SMP safe. For now just ignore the
1677	problem and hope the cpu will stop of its own accord. For userspace
1678	emulation this often isn't actually as bad as it sounds. Often
1679	signals are used primarily to interrupt blocking syscalls. */
1680	#else
1681	if (use_icount) {
1682	env->icount_decr.u16.high = 0xffff;
1683	#ifndef CONFIG_USER_ONLY
1684	/* CPU_INTERRUPT_EXIT isn't a real interrupt. It just means
1685	an async event happened and we need to process it. */
1686	if (!can_do_io(env)
1687	&& (mask & ~(old_mask \| CPU_INTERRUPT_EXIT)) != 0) {
1688	cpu_abort(env, "Raised interrupt while not in I/O function");
1689	}
1690	#endif
1691	} else {
1692	tb = env->current_tb;
1693	/* if the cpu is currently executing code, we must unlink it and
1694	all the potentially executing TB */
1695	if (tb && !testandset(&interrupt_lock)) {
1696	env->current_tb = NULL;
1697	tb_reset_jump_recursive(tb);
1698	resetlock(&interrupt_lock);
1699	}
1700	}
1701	#endif
1702	}
1703
1704	void cpu_reset_interrupt(CPUState *env, int mask)
1705	{
1706	#ifdef VBOX
1707	/*
1708	* Note: the current implementation can be executed by another thread without problems; make sure this remains true
1709	* for future changes!
1710	*/
1711	ASMAtomicAndS32((int32_t volatile *)&env->interrupt_request, ~mask);
1712	#else /* !VBOX */
1713	env->interrupt_request &= ~mask;
1714	#endif /* !VBOX */
1715	}
1716
1717	#ifndef VBOX
1718	CPULogItem cpu_log_items[] = {
1719	{ CPU_LOG_TB_OUT_ASM, "out_asm",
1720	"show generated host assembly code for each compiled TB" },
1721	{ CPU_LOG_TB_IN_ASM, "in_asm",
1722	"show target assembly code for each compiled TB" },
1723	{ CPU_LOG_TB_OP, "op",
1724	"show micro ops for each compiled TB (only usable if 'in_asm' used)" },
1725	#ifdef TARGET_I386
1726	{ CPU_LOG_TB_OP_OPT, "op_opt",
1727	"show micro ops after optimization for each compiled TB" },
1728	#endif
1729	{ CPU_LOG_INT, "int",
1730	"show interrupts/exceptions in short format" },
1731	{ CPU_LOG_EXEC, "exec",
1732	"show trace before each executed TB (lots of logs)" },
1733	{ CPU_LOG_TB_CPU, "cpu",
1734	"show CPU state before bloc translation" },
1735	#ifdef TARGET_I386
1736	{ CPU_LOG_PCALL, "pcall",
1737	"show protected mode far calls/returns/exceptions" },
1738	#endif
1739	#ifdef DEBUG_IOPORT
1740	{ CPU_LOG_IOPORT, "ioport",
1741	"show all i/o ports accesses" },
1742	#endif
1743	{ 0, NULL, NULL },
1744	};
1745
1746	static int cmp1(const char s1, int n, const char s2)
1747	{
1748	if (strlen(s2) != n)
1749	return 0;
1750	return memcmp(s1, s2, n) == 0;
1751	}
1752
1753	/* takes a comma separated list of log masks. Return 0 if error. */
1754	int cpu_str_to_log_mask(const char *str)
1755	{
1756	CPULogItem *item;
1757	int mask;
1758	const char p, p1;
1759
1760	p = str;
1761	mask = 0;
1762	for(;;) {
1763	p1 = strchr(p, ',');
1764	if (!p1)
1765	p1 = p + strlen(p);
1766	if(cmp1(p,p1-p,"all")) {
1767	for(item = cpu_log_items; item->mask != 0; item++) {
1768	mask \|= item->mask;
1769	}
1770	} else {
1771	for(item = cpu_log_items; item->mask != 0; item++) {
1772	if (cmp1(p, p1 - p, item->name))
1773	goto found;
1774	}
1775	return 0;
1776	}
1777	found:
1778	mask \|= item->mask;
1779	if (*p1 != ',')
1780	break;
1781	p = p1 + 1;
1782	}
1783	return mask;
1784	}
1785	#endif /* !VBOX */
1786
1787	#ifndef VBOX /* VBOX: we have our own routine. */
1788	void cpu_abort(CPUState env, const char fmt, ...)
1789	{
1790	va_list ap;
1791
1792	va_start(ap, fmt);
1793	fprintf(stderr, "qemu: fatal: ");
1794	vfprintf(stderr, fmt, ap);
1795	fprintf(stderr, "\n");
1796	#ifdef TARGET_I386
1797	cpu_dump_state(env, stderr, fprintf, X86_DUMP_FPU \| X86_DUMP_CCOP);
1798	#else
1799	cpu_dump_state(env, stderr, fprintf, 0);
1800	#endif
1801	va_end(ap);
1802	abort();
1803	}
1804	#endif /* !VBOX */
1805
1806	#ifndef VBOX
1807	CPUState cpu_copy(CPUState env)
1808	{
1809	CPUState *new_env = cpu_init(env->cpu_model_str);
1810	/* preserve chaining and index */
1811	CPUState *next_cpu = new_env->next_cpu;
1812	int cpu_index = new_env->cpu_index;
1813	memcpy(new_env, env, sizeof(CPUState));
1814	new_env->next_cpu = next_cpu;
1815	new_env->cpu_index = cpu_index;
1816	return new_env;
1817	}
1818	#endif
1819
1820	#if !defined(CONFIG_USER_ONLY)
1821
1822	#ifndef VBOX
1823	static inline void tlb_flush_jmp_cache(CPUState *env, target_ulong addr)
1824	#else
1825	DECLINLINE(void) tlb_flush_jmp_cache(CPUState *env, target_ulong addr)
1826	#endif
1827	{
1828	unsigned int i;
1829
1830	/* Discard jump cache entries for any tb which might potentially
1831	overlap the flushed page. */
1832	i = tb_jmp_cache_hash_page(addr - TARGET_PAGE_SIZE);
1833	memset (&env->tb_jmp_cache[i], 0,
1834	TB_JMP_PAGE_SIZE * sizeof(TranslationBlock *));
1835
1836	i = tb_jmp_cache_hash_page(addr);
1837	memset (&env->tb_jmp_cache[i], 0,
1838	TB_JMP_PAGE_SIZE * sizeof(TranslationBlock *));
1839
1840	#ifdef VBOX
1841	/* inform raw mode about TLB page flush */
1842	remR3FlushPage(env, addr);
1843	#endif /* VBOX */
1844	}
1845
1846	/* NOTE: if flush_global is true, also flush global entries (not
1847	implemented yet) */
1848	void tlb_flush(CPUState *env, int flush_global)
1849	{
1850	int i;
1851
1852	#if defined(DEBUG_TLB)
1853	printf("tlb_flush:\n");
1854	#endif
1855	/* must reset current TB so that interrupts cannot modify the
1856	links while we are modifying them */
1857	env->current_tb = NULL;
1858
1859	for(i = 0; i < CPU_TLB_SIZE; i++) {
1860	env->tlb_table[0][i].addr_read = -1;
1861	env->tlb_table[0][i].addr_write = -1;
1862	env->tlb_table[0][i].addr_code = -1;
1863	env->tlb_table[1][i].addr_read = -1;
1864	env->tlb_table[1][i].addr_write = -1;
1865	env->tlb_table[1][i].addr_code = -1;
1866	#if (NB_MMU_MODES >= 3)
1867	env->tlb_table[2][i].addr_read = -1;
1868	env->tlb_table[2][i].addr_write = -1;
1869	env->tlb_table[2][i].addr_code = -1;
1870	#if (NB_MMU_MODES == 4)
1871	env->tlb_table[3][i].addr_read = -1;
1872	env->tlb_table[3][i].addr_write = -1;
1873	env->tlb_table[3][i].addr_code = -1;
1874	#endif
1875	#endif
1876	}
1877
1878	memset (env->tb_jmp_cache, 0, TB_JMP_CACHE_SIZE * sizeof (void *));
1879
1880	#ifdef VBOX
1881	/* inform raw mode about TLB flush */
1882	remR3FlushTLB(env, flush_global);
1883	#endif
1884	#ifdef USE_KQEMU
1885	if (env->kqemu_enabled) {
1886	kqemu_flush(env, flush_global);
1887	}
1888	#endif
1889	tlb_flush_count++;
1890	}
1891
1892	#ifndef VBOX
1893	static inline void tlb_flush_entry(CPUTLBEntry *tlb_entry, target_ulong addr)
1894	#else
1895	DECLINLINE(void) tlb_flush_entry(CPUTLBEntry *tlb_entry, target_ulong addr)
1896	#endif
1897	{
1898	if (addr == (tlb_entry->addr_read &
1899	(TARGET_PAGE_MASK \| TLB_INVALID_MASK)) \|\|
1900	addr == (tlb_entry->addr_write &
1901	(TARGET_PAGE_MASK \| TLB_INVALID_MASK)) \|\|
1902	addr == (tlb_entry->addr_code &
1903	(TARGET_PAGE_MASK \| TLB_INVALID_MASK))) {
1904	tlb_entry->addr_read = -1;
1905	tlb_entry->addr_write = -1;
1906	tlb_entry->addr_code = -1;
1907	}
1908	}
1909
1910	void tlb_flush_page(CPUState *env, target_ulong addr)
1911	{
1912	int i;
1913
1914	#if defined(DEBUG_TLB)
1915	printf("tlb_flush_page: " TARGET_FMT_lx "\n", addr);
1916	#endif
1917	/* must reset current TB so that interrupts cannot modify the
1918	links while we are modifying them */
1919	env->current_tb = NULL;
1920
1921	addr &= TARGET_PAGE_MASK;
1922	i = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
1923	tlb_flush_entry(&env->tlb_table[0][i], addr);
1924	tlb_flush_entry(&env->tlb_table[1][i], addr);
1925	#if (NB_MMU_MODES >= 3)
1926	tlb_flush_entry(&env->tlb_table[2][i], addr);
1927	#if (NB_MMU_MODES == 4)
1928	tlb_flush_entry(&env->tlb_table[3][i], addr);
1929	#endif
1930	#endif
1931
1932	tlb_flush_jmp_cache(env, addr);
1933
1934	#ifdef USE_KQEMU
1935	if (env->kqemu_enabled) {
1936	kqemu_flush_page(env, addr);
1937	}
1938	#endif
1939	}
1940
1941	/* update the TLBs so that writes to code in the virtual page 'addr'
1942	can be detected */
1943	static void tlb_protect_code(ram_addr_t ram_addr)
1944	{
1945	cpu_physical_memory_reset_dirty(ram_addr,
1946	ram_addr + TARGET_PAGE_SIZE,
1947	CODE_DIRTY_FLAG);
1948	#if defined(VBOX) && defined(REM_MONITOR_CODE_PAGES)
1949	/** @todo Retest this? This function has changed... */
1950	remR3ProtectCode(cpu_single_env, ram_addr);
1951	#endif
1952	}
1953
1954	/* update the TLB so that writes in physical page 'phys_addr' are no longer
1955	tested for self modifying code */
1956	static void tlb_unprotect_code_phys(CPUState *env, ram_addr_t ram_addr,
1957	target_ulong vaddr)
1958	{
1959	#ifdef VBOX
1960	if (RT_LIKELY((ram_addr >> TARGET_PAGE_BITS) < phys_ram_dirty_size))
1961	#endif
1962	phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] \|= CODE_DIRTY_FLAG;
1963	}
1964
1965	#ifndef VBOX
1966	static inline void tlb_reset_dirty_range(CPUTLBEntry *tlb_entry,
1967	unsigned long start, unsigned long length)
1968	#else
1969	DECLINLINE(void) tlb_reset_dirty_range(CPUTLBEntry *tlb_entry,
1970	unsigned long start, unsigned long length)
1971	#endif
1972	{
1973	unsigned long addr;
1974	if ((tlb_entry->addr_write & ~TARGET_PAGE_MASK) == IO_MEM_RAM) {
1975	addr = (tlb_entry->addr_write & TARGET_PAGE_MASK) + tlb_entry->addend;
1976	if ((addr - start) < length) {
1977	tlb_entry->addr_write = (tlb_entry->addr_write & TARGET_PAGE_MASK) \| IO_MEM_NOTDIRTY;
1978	}
1979	}
1980	}
1981
1982	void cpu_physical_memory_reset_dirty(ram_addr_t start, ram_addr_t end,
1983	int dirty_flags)
1984	{
1985	CPUState *env;
1986	unsigned long length, start1;
1987	int i, mask, len;
1988	uint8_t *p;
1989
1990	start &= TARGET_PAGE_MASK;
1991	end = TARGET_PAGE_ALIGN(end);
1992
1993	length = end - start;
1994	if (length == 0)
1995	return;
1996	len = length >> TARGET_PAGE_BITS;
1997	#ifdef USE_KQEMU
1998	/* XXX: should not depend on cpu context */
1999	env = first_cpu;
2000	if (env->kqemu_enabled) {
2001	ram_addr_t addr;
2002	addr = start;
2003	for(i = 0; i < len; i++) {
2004	kqemu_set_notdirty(env, addr);
2005	addr += TARGET_PAGE_SIZE;
2006	}
2007	}
2008	#endif
2009	mask = ~dirty_flags;
2010	p = phys_ram_dirty + (start >> TARGET_PAGE_BITS);
2011	#ifdef VBOX
2012	if (RT_LIKELY((start >> TARGET_PAGE_BITS) < phys_ram_dirty_size))
2013	#endif
2014	for(i = 0; i < len; i++)
2015	p[i] &= mask;
2016
2017	/* we modify the TLB cache so that the dirty bit will be set again
2018	when accessing the range */
2019	#if defined(VBOX) && defined(REM_PHYS_ADDR_IN_TLB)
2020	start1 = start;
2021	#elif !defined(VBOX)
2022	start1 = start + (unsigned long)phys_ram_base;
2023	#else
2024	start1 = (unsigned long)remR3GCPhys2HCVirt(first_cpu, start);
2025	#endif
2026	for(env = first_cpu; env != NULL; env = env->next_cpu) {
2027	for(i = 0; i < CPU_TLB_SIZE; i++)
2028	tlb_reset_dirty_range(&env->tlb_table[0][i], start1, length);
2029	for(i = 0; i < CPU_TLB_SIZE; i++)
2030	tlb_reset_dirty_range(&env->tlb_table[1][i], start1, length);
2031	#if (NB_MMU_MODES >= 3)
2032	for(i = 0; i < CPU_TLB_SIZE; i++)
2033	tlb_reset_dirty_range(&env->tlb_table[2][i], start1, length);
2034	#if (NB_MMU_MODES == 4)
2035	for(i = 0; i < CPU_TLB_SIZE; i++)
2036	tlb_reset_dirty_range(&env->tlb_table[3][i], start1, length);
2037	#endif
2038	#endif
2039	}
2040	}
2041
2042	#ifndef VBOX
2043	int cpu_physical_memory_set_dirty_tracking(int enable)
2044	{
2045	in_migration = enable;
2046	return 0;
2047	}
2048
2049	int cpu_physical_memory_get_dirty_tracking(void)
2050	{
2051	return in_migration;
2052	}
2053	#endif
2054
2055	#ifndef VBOX
2056	static inline void tlb_update_dirty(CPUTLBEntry *tlb_entry)
2057	#else
2058	DECLINLINE(void) tlb_update_dirty(CPUTLBEntry *tlb_entry)
2059	#endif
2060	{
2061	ram_addr_t ram_addr;
2062
2063	if ((tlb_entry->addr_write & ~TARGET_PAGE_MASK) == IO_MEM_RAM) {
2064	/* RAM case */
2065	#if defined(VBOX) && defined(REM_PHYS_ADDR_IN_TLB)
2066	ram_addr = (tlb_entry->addr_write & TARGET_PAGE_MASK) + tlb_entry->addend;
2067	#elif !defined(VBOX)
2068	ram_addr = (tlb_entry->addr_write & TARGET_PAGE_MASK) +
2069	tlb_entry->addend - (unsigned long)phys_ram_base;
2070	#else
2071	ram_addr = remR3HCVirt2GCPhys(first_cpu, (tlb_entry->addr_write & TARGET_PAGE_MASK) + tlb_entry->addend);
2072	#endif
2073	if (!cpu_physical_memory_is_dirty(ram_addr)) {
2074	tlb_entry->addr_write \|= TLB_NOTDIRTY;
2075	}
2076	}
2077	}
2078
2079	/* update the TLB according to the current state of the dirty bits */
2080	void cpu_tlb_update_dirty(CPUState *env)
2081	{
2082	int i;
2083	for(i = 0; i < CPU_TLB_SIZE; i++)
2084	tlb_update_dirty(&env->tlb_table[0][i]);
2085	for(i = 0; i < CPU_TLB_SIZE; i++)
2086	tlb_update_dirty(&env->tlb_table[1][i]);
2087	#if (NB_MMU_MODES >= 3)
2088	for(i = 0; i < CPU_TLB_SIZE; i++)
2089	tlb_update_dirty(&env->tlb_table[2][i]);
2090	#if (NB_MMU_MODES == 4)
2091	for(i = 0; i < CPU_TLB_SIZE; i++)
2092	tlb_update_dirty(&env->tlb_table[3][i]);
2093	#endif
2094	#endif
2095	}
2096
2097	#ifndef VBOX
2098	static inline void tlb_set_dirty1(CPUTLBEntry *tlb_entry, target_ulong vaddr)
2099	#else
2100	DECLINLINE(void) tlb_set_dirty1(CPUTLBEntry *tlb_entry, target_ulong vaddr)
2101	#endif
2102	{
2103	if (tlb_entry->addr_write == (vaddr \| TLB_NOTDIRTY))
2104	tlb_entry->addr_write = vaddr;
2105	}
2106
2107
2108	/* update the TLB corresponding to virtual page vaddr and phys addr
2109	addr so that it is no longer dirty */
2110	#ifndef VBOX
2111	static inline void tlb_set_dirty(CPUState *env,
2112	unsigned long addr, target_ulong vaddr)
2113	#else
2114	DECLINLINE(void) tlb_set_dirty(CPUState *env,
2115	unsigned long addr, target_ulong vaddr)
2116	#endif
2117	{
2118	int i;
2119
2120	addr &= TARGET_PAGE_MASK;
2121	i = (vaddr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
2122	tlb_set_dirty1(&env->tlb_table[0][i], addr);
2123	tlb_set_dirty1(&env->tlb_table[1][i], addr);
2124	#if (NB_MMU_MODES >= 3)
2125	tlb_set_dirty1(&env->tlb_table[2][i], vaddr);
2126	#if (NB_MMU_MODES == 4)
2127	tlb_set_dirty1(&env->tlb_table[3][i], vaddr);
2128	#endif
2129	#endif
2130	}
2131
2132	/* add a new TLB entry. At most one entry for a given virtual address
2133	is permitted. Return 0 if OK or 2 if the page could not be mapped
2134	(can only happen in non SOFTMMU mode for I/O pages or pages
2135	conflicting with the host address space). */
2136	int tlb_set_page_exec(CPUState *env, target_ulong vaddr,
2137	target_phys_addr_t paddr, int prot,
2138	int mmu_idx, int is_softmmu)
2139	{
2140	PhysPageDesc *p;
2141	unsigned long pd;
2142	unsigned int index;
2143	target_ulong address;
2144	target_ulong code_address;
2145	target_phys_addr_t addend;
2146	int ret;
2147	CPUTLBEntry *te;
2148	int i;
2149	target_phys_addr_t iotlb;
2150
2151	p = phys_page_find(paddr >> TARGET_PAGE_BITS);
2152	if (!p) {
2153	pd = IO_MEM_UNASSIGNED;
2154	} else {
2155	pd = p->phys_offset;
2156	}
2157	#if defined(DEBUG_TLB)
2158	printf("tlb_set_page: vaddr=" TARGET_FMT_lx " paddr=0x%08x prot=%x idx=%d smmu=%d pd=0x%08lx\n",
2159	vaddr, (int)paddr, prot, mmu_idx, is_softmmu, pd);
2160	#endif
2161
2162	ret = 0;
2163	address = vaddr;
2164	if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM && !(pd & IO_MEM_ROMD)) {
2165	/* IO memory case (romd handled later) */
2166	address \|= TLB_MMIO;
2167	}
2168	#if defined(VBOX) && defined(REM_PHYS_ADDR_IN_TLB)
2169	addend = pd & TARGET_PAGE_MASK;
2170	#elif !defined(VBOX)
2171	addend = (unsigned long)phys_ram_base + (pd & TARGET_PAGE_MASK);
2172	#else
2173	addend = (unsigned long)remR3GCPhys2HCVirt(env, pd & TARGET_PAGE_MASK);
2174	#endif
2175	if ((pd & ~TARGET_PAGE_MASK) <= IO_MEM_ROM) {
2176	/* Normal RAM. */
2177	iotlb = pd & TARGET_PAGE_MASK;
2178	if ((pd & ~TARGET_PAGE_MASK) == IO_MEM_RAM)
2179	iotlb \|= IO_MEM_NOTDIRTY;
2180	else
2181	iotlb \|= IO_MEM_ROM;
2182	} else {
2183	/* IO handlers are currently passed a phsical address.
2184	It would be nice to pass an offset from the base address
2185	of that region. This would avoid having to special case RAM,
2186	and avoid full address decoding in every device.
2187	We can't use the high bits of pd for this because
2188	IO_MEM_ROMD uses these as a ram address. */
2189	iotlb = (pd & ~TARGET_PAGE_MASK) + paddr;
2190	}
2191
2192	code_address = address;
2193	/* Make accesses to pages with watchpoints go via the
2194	watchpoint trap routines. */
2195	for (i = 0; i < env->nb_watchpoints; i++) {
2196	if (vaddr == (env->watchpoint[i].vaddr & TARGET_PAGE_MASK)) {
2197	iotlb = io_mem_watch + paddr;
2198	/* TODO: The memory case can be optimized by not trapping
2199	reads of pages with a write breakpoint. */
2200	address \|= TLB_MMIO;
2201	}
2202	}
2203
2204	index = (vaddr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
2205	env->iotlb[mmu_idx][index] = iotlb - vaddr;
2206	te = &env->tlb_table[mmu_idx][index];
2207	te->addend = addend - vaddr;
2208	if (prot & PAGE_READ) {
2209	te->addr_read = address;
2210	} else {
2211	te->addr_read = -1;
2212	}
2213
2214	if (prot & PAGE_EXEC) {
2215	te->addr_code = code_address;
2216	} else {
2217	te->addr_code = -1;
2218	}
2219	if (prot & PAGE_WRITE) {
2220	if ((pd & ~TARGET_PAGE_MASK) == IO_MEM_ROM \|\|
2221	(pd & IO_MEM_ROMD)) {
2222	/* Write access calls the I/O callback. */
2223	te->addr_write = address \| TLB_MMIO;
2224	} else if ((pd & ~TARGET_PAGE_MASK) == IO_MEM_RAM &&
2225	!cpu_physical_memory_is_dirty(pd)) {
2226	te->addr_write = address \| TLB_NOTDIRTY;
2227	} else {
2228	te->addr_write = address;
2229	}
2230	} else {
2231	te->addr_write = -1;
2232	}
2233	#ifdef VBOX
2234	/* inform raw mode about TLB page change */
2235	remR3FlushPage(env, vaddr);
2236	#endif
2237	return ret;
2238	}
2239	#if 0
2240	/* called from signal handler: invalidate the code and unprotect the
2241	page. Return TRUE if the fault was succesfully handled. */
2242	int page_unprotect(target_ulong addr, unsigned long pc, void *puc)
2243	{
2244	#if !defined(CONFIG_SOFTMMU)
2245	VirtPageDesc *vp;
2246
2247	#if defined(DEBUG_TLB)
2248	printf("page_unprotect: addr=0x%08x\n", addr);
2249	#endif
2250	addr &= TARGET_PAGE_MASK;
2251
2252	/* if it is not mapped, no need to worry here */
2253	if (addr >= MMAP_AREA_END)
2254	return 0;
2255	vp = virt_page_find(addr >> TARGET_PAGE_BITS);
2256	if (!vp)
2257	return 0;
2258	/* NOTE: in this case, validate_tag is _not_ tested as it
2259	validates only the code TLB */
2260	if (vp->valid_tag != virt_valid_tag)
2261	return 0;
2262	if (!(vp->prot & PAGE_WRITE))
2263	return 0;
2264	#if defined(DEBUG_TLB)
2265	printf("page_unprotect: addr=0x%08x phys_addr=0x%08x prot=%x\n",
2266	addr, vp->phys_addr, vp->prot);
2267	#endif
2268	if (mprotect((void *)addr, TARGET_PAGE_SIZE, vp->prot) < 0)
2269	cpu_abort(cpu_single_env, "error mprotect addr=0x%lx prot=%d\n",
2270	(unsigned long)addr, vp->prot);
2271	/* set the dirty bit */
2272	phys_ram_dirty[vp->phys_addr >> TARGET_PAGE_BITS] = 0xff;
2273	/* flush the code inside */
2274	tb_invalidate_phys_page(vp->phys_addr, pc, puc);
2275	return 1;
2276	#elif defined(VBOX)
2277	addr &= TARGET_PAGE_MASK;
2278
2279	/* if it is not mapped, no need to worry here */
2280	if (addr >= MMAP_AREA_END)
2281	return 0;
2282	return 1;
2283	#else
2284	return 0;
2285	#endif
2286	}
2287	#endif /* 0 */
2288
2289	#else
2290
2291	void tlb_flush(CPUState *env, int flush_global)
2292	{
2293	}
2294
2295	void tlb_flush_page(CPUState *env, target_ulong addr)
2296	{
2297	}
2298
2299	int tlb_set_page_exec(CPUState *env, target_ulong vaddr,
2300	target_phys_addr_t paddr, int prot,
2301	int mmu_idx, int is_softmmu)
2302	{
2303	return 0;
2304	}
2305
2306	#ifndef VBOX
2307	/* dump memory mappings */
2308	void page_dump(FILE *f)
2309	{
2310	unsigned long start, end;
2311	int i, j, prot, prot1;
2312	PageDesc *p;
2313
2314	fprintf(f, "%-8s %-8s %-8s %s\n",
2315	"start", "end", "size", "prot");
2316	start = -1;
2317	end = -1;
2318	prot = 0;
2319	for(i = 0; i <= L1_SIZE; i++) {
2320	if (i < L1_SIZE)
2321	p = l1_map[i];
2322	else
2323	p = NULL;
2324	for(j = 0;j < L2_SIZE; j++) {
2325	if (!p)
2326	prot1 = 0;
2327	else
2328	prot1 = p[j].flags;
2329	if (prot1 != prot) {
2330	end = (i << (32 - L1_BITS)) \| (j << TARGET_PAGE_BITS);
2331	if (start != -1) {
2332	fprintf(f, "%08lx-%08lx %08lx %c%c%c\n",
2333	start, end, end - start,
2334	prot & PAGE_READ ? 'r' : '-',
2335	prot & PAGE_WRITE ? 'w' : '-',
2336	prot & PAGE_EXEC ? 'x' : '-');
2337	}
2338	if (prot1 != 0)
2339	start = end;
2340	else
2341	start = -1;
2342	prot = prot1;
2343	}
2344	if (!p)
2345	break;
2346	}
2347	}
2348	}
2349	#endif /* !VBOX */
2350
2351	int page_get_flags(target_ulong address)
2352	{
2353	PageDesc *p;
2354
2355	p = page_find(address >> TARGET_PAGE_BITS);
2356	if (!p)
2357	return 0;
2358	return p->flags;
2359	}
2360
2361	/* modify the flags of a page and invalidate the code if
2362	necessary. The flag PAGE_WRITE_ORG is positionned automatically
2363	depending on PAGE_WRITE */
2364	void page_set_flags(target_ulong start, target_ulong end, int flags)
2365	{
2366	PageDesc *p;
2367	target_ulong addr;
2368
2369	start = start & TARGET_PAGE_MASK;
2370	end = TARGET_PAGE_ALIGN(end);
2371	if (flags & PAGE_WRITE)
2372	flags \|= PAGE_WRITE_ORG;
2373	#ifdef VBOX
2374	AssertMsgFailed(("We shouldn't be here, and if we should, we must have an env to do the proper locking!\n"));
2375	#endif
2376	spin_lock(&tb_lock);
2377	for(addr = start; addr < end; addr += TARGET_PAGE_SIZE) {
2378	p = page_find_alloc(addr >> TARGET_PAGE_BITS);
2379	/* if the write protection is set, then we invalidate the code
2380	inside */
2381	if (!(p->flags & PAGE_WRITE) &&
2382	(flags & PAGE_WRITE) &&
2383	p->first_tb) {
2384	tb_invalidate_phys_page(addr, 0, NULL);
2385	}
2386	p->flags = flags;
2387	}
2388	spin_unlock(&tb_lock);
2389	}
2390
2391	int page_check_range(target_ulong start, target_ulong len, int flags)
2392	{
2393	PageDesc *p;
2394	target_ulong end;
2395	target_ulong addr;
2396
2397	end = TARGET_PAGE_ALIGN(start+len); /* must do before we loose bits in the next step */
2398	start = start & TARGET_PAGE_MASK;
2399
2400	if( end < start )
2401	/* we've wrapped around */
2402	return -1;
2403	for(addr = start; addr < end; addr += TARGET_PAGE_SIZE) {
2404	p = page_find(addr >> TARGET_PAGE_BITS);
2405	if( !p )
2406	return -1;
2407	if( !(p->flags & PAGE_VALID) )
2408	return -1;
2409
2410	if ((flags & PAGE_READ) && !(p->flags & PAGE_READ))
2411	return -1;
2412	if (flags & PAGE_WRITE) {
2413	if (!(p->flags & PAGE_WRITE_ORG))
2414	return -1;
2415	/* unprotect the page if it was put read-only because it
2416	contains translated code */
2417	if (!(p->flags & PAGE_WRITE)) {
2418	if (!page_unprotect(addr, 0, NULL))
2419	return -1;
2420	}
2421	return 0;
2422	}
2423	}
2424	return 0;
2425	}
2426
2427	/* called from signal handler: invalidate the code and unprotect the
2428	page. Return TRUE if the fault was succesfully handled. */
2429	int page_unprotect(target_ulong address, unsigned long pc, void *puc)
2430	{
2431	unsigned int page_index, prot, pindex;
2432	PageDesc p, p1;
2433	target_ulong host_start, host_end, addr;
2434
2435	/* Technically this isn't safe inside a signal handler. However we
2436	know this only ever happens in a synchronous SEGV handler, so in
2437	practice it seems to be ok. */
2438	mmap_lock();
2439
2440	host_start = address & qemu_host_page_mask;
2441	page_index = host_start >> TARGET_PAGE_BITS;
2442	p1 = page_find(page_index);
2443	if (!p1) {
2444	mmap_unlock();
2445	return 0;
2446	}
2447	host_end = host_start + qemu_host_page_size;
2448	p = p1;
2449	prot = 0;
2450	for(addr = host_start;addr < host_end; addr += TARGET_PAGE_SIZE) {
2451	prot \|= p->flags;
2452	p++;
2453	}
2454	/* if the page was really writable, then we change its
2455	protection back to writable */
2456	if (prot & PAGE_WRITE_ORG) {
2457	pindex = (address - host_start) >> TARGET_PAGE_BITS;
2458	if (!(p1[pindex].flags & PAGE_WRITE)) {
2459	mprotect((void *)g2h(host_start), qemu_host_page_size,
2460	(prot & PAGE_BITS) \| PAGE_WRITE);
2461	p1[pindex].flags \|= PAGE_WRITE;
2462	/* and since the content will be modified, we must invalidate
2463	the corresponding translated code. */
2464	tb_invalidate_phys_page(address, pc, puc);
2465	#ifdef DEBUG_TB_CHECK
2466	tb_invalidate_check(address);
2467	#endif
2468	mmap_unlock();
2469	return 1;
2470	}
2471	}
2472	mmap_unlock();
2473	return 0;
2474	}
2475
2476	static inline void tlb_set_dirty(CPUState *env,
2477	unsigned long addr, target_ulong vaddr)
2478	{
2479	}
2480	#endif /* defined(CONFIG_USER_ONLY) */
2481
2482	#if !defined(CONFIG_USER_ONLY)
2483	static int subpage_register (subpage_t *mmio, uint32_t start, uint32_t end,
2484	ram_addr_t memory);
2485	static void subpage_init (target_phys_addr_t base, ram_addr_t phys,
2486	ram_addr_t orig_memory);
2487	#define CHECK_SUBPAGE(addr, start_addr, start_addr2, end_addr, end_addr2, \
2488	need_subpage) \
2489	do { \
2490	if (addr > start_addr) \
2491	start_addr2 = 0; \
2492	else { \
2493	start_addr2 = start_addr & ~TARGET_PAGE_MASK; \
2494	if (start_addr2 > 0) \
2495	need_subpage = 1; \
2496	} \
2497	\
2498	if ((start_addr + orig_size) - addr >= TARGET_PAGE_SIZE) \
2499	end_addr2 = TARGET_PAGE_SIZE - 1; \
2500	else { \
2501	end_addr2 = (start_addr + orig_size - 1) & ~TARGET_PAGE_MASK; \
2502	if (end_addr2 < TARGET_PAGE_SIZE - 1) \
2503	need_subpage = 1; \
2504	} \
2505	} while (0)
2506
2507
2508	/* register physical memory. 'size' must be a multiple of the target
2509	page size. If (phys_offset & ~TARGET_PAGE_MASK) != 0, then it is an
2510	io memory page */
2511	void cpu_register_physical_memory(target_phys_addr_t start_addr,
2512	unsigned long size,
2513	unsigned long phys_offset)
2514	{
2515	target_phys_addr_t addr, end_addr;
2516	PhysPageDesc *p;
2517	CPUState *env;
2518	ram_addr_t orig_size = size;
2519	void *subpage;
2520
2521	#ifdef USE_KQEMU
2522	/* XXX: should not depend on cpu context */
2523	env = first_cpu;
2524	if (env->kqemu_enabled) {
2525	kqemu_set_phys_mem(start_addr, size, phys_offset);
2526	}
2527	#endif
2528	size = (size + TARGET_PAGE_SIZE - 1) & TARGET_PAGE_MASK;
2529	end_addr = start_addr + (target_phys_addr_t)size;
2530	for(addr = start_addr; addr != end_addr; addr += TARGET_PAGE_SIZE) {
2531	p = phys_page_find(addr >> TARGET_PAGE_BITS);
2532	if (p && p->phys_offset != IO_MEM_UNASSIGNED) {
2533	ram_addr_t orig_memory = p->phys_offset;
2534	target_phys_addr_t start_addr2, end_addr2;
2535	int need_subpage = 0;
2536
2537	CHECK_SUBPAGE(addr, start_addr, start_addr2, end_addr, end_addr2,
2538	need_subpage);
2539	if (need_subpage \|\| phys_offset & IO_MEM_SUBWIDTH) {
2540	if (!(orig_memory & IO_MEM_SUBPAGE)) {
2541	subpage = subpage_init((addr & TARGET_PAGE_MASK),
2542	&p->phys_offset, orig_memory);
2543	} else {
2544	subpage = io_mem_opaque[(orig_memory & ~TARGET_PAGE_MASK)
2545	>> IO_MEM_SHIFT];
2546	}
2547	subpage_register(subpage, start_addr2, end_addr2, phys_offset);
2548	} else {
2549	p->phys_offset = phys_offset;
2550	#if !defined(VBOX) \|\| defined(VBOX_WITH_NEW_PHYS_CODE)
2551	if ((phys_offset & ~TARGET_PAGE_MASK) <= IO_MEM_ROM \|\|
2552	(phys_offset & IO_MEM_ROMD))
2553	#else
2554	if ( (phys_offset & ~TARGET_PAGE_MASK) <= IO_MEM_ROM
2555	\|\| (phys_offset & IO_MEM_ROMD)
2556	\|\| (phys_offset & ~TARGET_PAGE_MASK) == IO_MEM_RAM_MISSING)
2557	#endif
2558	phys_offset += TARGET_PAGE_SIZE;
2559	}
2560	} else {
2561	p = phys_page_find_alloc(addr >> TARGET_PAGE_BITS, 1);
2562	p->phys_offset = phys_offset;
2563	#if !defined(VBOX) \|\| defined(VBOX_WITH_NEW_PHYS_CODE)
2564	if ((phys_offset & ~TARGET_PAGE_MASK) <= IO_MEM_ROM \|\|
2565	(phys_offset & IO_MEM_ROMD))
2566	#else
2567	if ( (phys_offset & ~TARGET_PAGE_MASK) <= IO_MEM_ROM
2568	\|\| (phys_offset & IO_MEM_ROMD)
2569	\|\| (phys_offset & ~TARGET_PAGE_MASK) == IO_MEM_RAM_MISSING)
2570	#endif
2571	phys_offset += TARGET_PAGE_SIZE;
2572	else {
2573	target_phys_addr_t start_addr2, end_addr2;
2574	int need_subpage = 0;
2575
2576	CHECK_SUBPAGE(addr, start_addr, start_addr2, end_addr,
2577	end_addr2, need_subpage);
2578
2579	if (need_subpage \|\| phys_offset & IO_MEM_SUBWIDTH) {
2580	subpage = subpage_init((addr & TARGET_PAGE_MASK),
2581	&p->phys_offset, IO_MEM_UNASSIGNED);
2582	subpage_register(subpage, start_addr2, end_addr2,
2583	phys_offset);
2584	}
2585	}
2586	}
2587	}
2588	/* since each CPU stores ram addresses in its TLB cache, we must
2589	reset the modified entries */
2590	/* XXX: slow ! */
2591	for(env = first_cpu; env != NULL; env = env->next_cpu) {
2592	tlb_flush(env, 1);
2593	}
2594	}
2595
2596	/* XXX: temporary until new memory mapping API */
2597	uint32_t cpu_get_physical_page_desc(target_phys_addr_t addr)
2598	{
2599	PhysPageDesc *p;
2600
2601	p = phys_page_find(addr >> TARGET_PAGE_BITS);
2602	if (!p)
2603	return IO_MEM_UNASSIGNED;
2604	return p->phys_offset;
2605	}
2606
2607	#ifndef VBOX
2608	/* XXX: better than nothing */
2609	ram_addr_t qemu_ram_alloc(ram_addr_t size)
2610	{
2611	ram_addr_t addr;
2612	if ((phys_ram_alloc_offset + size) > phys_ram_size) {
2613	fprintf(stderr, "Not enough memory (requested_size = %" PRIu64 ", max memory = %" PRIu64 ")\n",
2614	(uint64_t)size, (uint64_t)phys_ram_size);
2615	abort();
2616	}
2617	addr = phys_ram_alloc_offset;
2618	phys_ram_alloc_offset = TARGET_PAGE_ALIGN(phys_ram_alloc_offset + size);
2619	return addr;
2620	}
2621
2622	void qemu_ram_free(ram_addr_t addr)
2623	{
2624	}
2625	#endif
2626
2627
2628	static uint32_t unassigned_mem_readb(void *opaque, target_phys_addr_t addr)
2629	{
2630	#ifdef DEBUG_UNASSIGNED
2631	printf("Unassigned mem read 0x%08x\n", (int)addr);
2632	#endif
2633	#if defined(TARGET_SPARC) \|\| defined(TARGET_CRIS)
2634	do_unassigned_access(addr, 0, 0, 0, 1);
2635	#endif
2636	return 0;
2637	}
2638
2639	static uint32_t unassigned_mem_readw(void *opaque, target_phys_addr_t addr)
2640	{
2641	#ifdef DEBUG_UNASSIGNED
2642	printf("Unassigned mem read " TARGET_FMT_plx "\n", addr);
2643	#endif
2644	#if defined(TARGET_SPARC) \|\| defined(TARGET_CRIS)
2645	do_unassigned_access(addr, 0, 0, 0, 2);
2646	#endif
2647	return 0;
2648	}
2649
2650	static uint32_t unassigned_mem_readl(void *opaque, target_phys_addr_t addr)
2651	{
2652	#ifdef DEBUG_UNASSIGNED
2653	printf("Unassigned mem read " TARGET_FMT_plx "\n", addr);
2654	#endif
2655	#if defined(TARGET_SPARC) \|\| defined(TARGET_CRIS)
2656	do_unassigned_access(addr, 0, 0, 0, 4);
2657	#endif
2658	return 0;
2659	}
2660
2661	static void unassigned_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
2662	{
2663	#ifdef DEBUG_UNASSIGNED
2664	printf("Unassigned mem write 0x%08x = 0x%x\n", (int)addr, val);
2665	#endif
2666	}
2667
2668	static void unassigned_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
2669	{
2670	#ifdef DEBUG_UNASSIGNED
2671	printf("Unassigned mem write " TARGET_FMT_plx " = 0x%x\n", addr, val);
2672	#endif
2673	#if defined(TARGET_SPARC) \|\| defined(TARGET_CRIS)
2674	do_unassigned_access(addr, 1, 0, 0, 2);
2675	#endif
2676	}
2677
2678	static void unassigned_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
2679	{
2680	#ifdef DEBUG_UNASSIGNED
2681	printf("Unassigned mem write " TARGET_FMT_plx " = 0x%x\n", addr, val);
2682	#endif
2683	#if defined(TARGET_SPARC) \|\| defined(TARGET_CRIS)
2684	do_unassigned_access(addr, 1, 0, 0, 4);
2685	#endif
2686	}
2687	static CPUReadMemoryFunc *unassigned_mem_read[3] = {
2688	unassigned_mem_readb,
2689	unassigned_mem_readw,
2690	unassigned_mem_readl,
2691	};
2692
2693	static CPUWriteMemoryFunc *unassigned_mem_write[3] = {
2694	unassigned_mem_writeb,
2695	unassigned_mem_writew,
2696	unassigned_mem_writel,
2697	};
2698
2699	static void notdirty_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
2700	{
2701	unsigned long ram_addr;
2702	int dirty_flags;
2703	#if defined(VBOX) && defined(REM_PHYS_ADDR_IN_TLB)
2704	ram_addr = addr;
2705	#elif !defined(VBOX)
2706	ram_addr = addr - (unsigned long)phys_ram_base;
2707	#else
2708	ram_addr = remR3HCVirt2GCPhys(first_cpu, (void *)addr);
2709	#endif
2710	#ifdef VBOX
2711	if (RT_UNLIKELY((ram_addr >> TARGET_PAGE_BITS) >= phys_ram_dirty_size))
2712	dirty_flags = 0xff;
2713	else
2714	#endif /* VBOX */
2715	dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2716	if (!(dirty_flags & CODE_DIRTY_FLAG)) {
2717	#if !defined(CONFIG_USER_ONLY)
2718	tb_invalidate_phys_page_fast(ram_addr, 1);
2719	# ifdef VBOX
2720	if (RT_UNLIKELY((ram_addr >> TARGET_PAGE_BITS) >= phys_ram_dirty_size))
2721	dirty_flags = 0xff;
2722	else
2723	# endif /* VBOX */
2724	dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2725	#endif
2726	}
2727	stb_p((uint8_t *)(long)addr, val);
2728	#ifdef USE_KQEMU
2729	if (cpu_single_env->kqemu_enabled &&
2730	(dirty_flags & KQEMU_MODIFY_PAGE_MASK) != KQEMU_MODIFY_PAGE_MASK)
2731	kqemu_modify_page(cpu_single_env, ram_addr);
2732	#endif
2733	dirty_flags \|= (0xff & ~CODE_DIRTY_FLAG);
2734	#ifdef VBOX
2735	if (RT_LIKELY((ram_addr >> TARGET_PAGE_BITS) < phys_ram_dirty_size))
2736	#endif /* !VBOX */
2737	phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] = dirty_flags;
2738	/* we remove the notdirty callback only if the code has been
2739	flushed */
2740	if (dirty_flags == 0xff)
2741	tlb_set_dirty(cpu_single_env, addr, cpu_single_env->mem_io_vaddr);
2742	}
2743
2744	static void notdirty_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
2745	{
2746	unsigned long ram_addr;
2747	int dirty_flags;
2748	#if defined(VBOX) && defined(REM_PHYS_ADDR_IN_TLB)
2749	ram_addr = addr;
2750	#elif !defined(VBOX)
2751	ram_addr = addr - (unsigned long)phys_ram_base;
2752	#else
2753	ram_addr = remR3HCVirt2GCPhys(first_cpu, (void *)addr);
2754	#endif
2755	#ifdef VBOX
2756	if (RT_UNLIKELY((ram_addr >> TARGET_PAGE_BITS) >= phys_ram_dirty_size))
2757	dirty_flags = 0xff;
2758	else
2759	#endif /* VBOX */
2760	dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2761	if (!(dirty_flags & CODE_DIRTY_FLAG)) {
2762	#if !defined(CONFIG_USER_ONLY)
2763	tb_invalidate_phys_page_fast(ram_addr, 2);
2764	# ifdef VBOX
2765	if (RT_UNLIKELY((ram_addr >> TARGET_PAGE_BITS) >= phys_ram_dirty_size))
2766	dirty_flags = 0xff;
2767	else
2768	# endif /* VBOX */
2769	dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2770	#endif
2771	}
2772	stw_p((uint8_t *)(long)addr, val);
2773	#ifdef USE_KQEMU
2774	if (cpu_single_env->kqemu_enabled &&
2775	(dirty_flags & KQEMU_MODIFY_PAGE_MASK) != KQEMU_MODIFY_PAGE_MASK)
2776	kqemu_modify_page(cpu_single_env, ram_addr);
2777	#endif
2778	dirty_flags \|= (0xff & ~CODE_DIRTY_FLAG);
2779	#ifdef VBOX
2780	if (RT_LIKELY((ram_addr >> TARGET_PAGE_BITS) < phys_ram_dirty_size))
2781	#endif
2782	phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] = dirty_flags;
2783	/* we remove the notdirty callback only if the code has been
2784	flushed */
2785	if (dirty_flags == 0xff)
2786	tlb_set_dirty(cpu_single_env, addr, cpu_single_env->mem_io_vaddr);
2787	}
2788
2789	static void notdirty_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
2790	{
2791	unsigned long ram_addr;
2792	int dirty_flags;
2793	#if defined(VBOX) && defined(REM_PHYS_ADDR_IN_TLB)
2794	ram_addr = addr;
2795	#elif !defined(VBOX)
2796	ram_addr = addr - (unsigned long)phys_ram_base;
2797	#else
2798	ram_addr = remR3HCVirt2GCPhys(first_cpu, (void *)addr);
2799	#endif
2800	#ifdef VBOX
2801	if (RT_UNLIKELY((ram_addr >> TARGET_PAGE_BITS) >= phys_ram_dirty_size))
2802	dirty_flags = 0xff;
2803	else
2804	#endif /* VBOX */
2805	dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2806	if (!(dirty_flags & CODE_DIRTY_FLAG)) {
2807	#if !defined(CONFIG_USER_ONLY)
2808	tb_invalidate_phys_page_fast(ram_addr, 4);
2809	# ifdef VBOX
2810	if (RT_UNLIKELY((ram_addr >> TARGET_PAGE_BITS) >= phys_ram_dirty_size))
2811	dirty_flags = 0xff;
2812	else
2813	# endif /* VBOX */
2814	dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2815	#endif
2816	}
2817	stl_p((uint8_t *)(long)addr, val);
2818	#ifdef USE_KQEMU
2819	if (cpu_single_env->kqemu_enabled &&
2820	(dirty_flags & KQEMU_MODIFY_PAGE_MASK) != KQEMU_MODIFY_PAGE_MASK)
2821	kqemu_modify_page(cpu_single_env, ram_addr);
2822	#endif
2823	dirty_flags \|= (0xff & ~CODE_DIRTY_FLAG);
2824	#ifdef VBOX
2825	if (RT_LIKELY((ram_addr >> TARGET_PAGE_BITS) < phys_ram_dirty_size))
2826	#endif
2827	phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] = dirty_flags;
2828	/* we remove the notdirty callback only if the code has been
2829	flushed */
2830	if (dirty_flags == 0xff)
2831	tlb_set_dirty(cpu_single_env, addr, cpu_single_env->mem_io_vaddr);
2832	}
2833
2834	static CPUReadMemoryFunc *error_mem_read[3] = {
2835	NULL, /* never used */
2836	NULL, /* never used */
2837	NULL, /* never used */
2838	};
2839
2840	static CPUWriteMemoryFunc *notdirty_mem_write[3] = {
2841	notdirty_mem_writeb,
2842	notdirty_mem_writew,
2843	notdirty_mem_writel,
2844	};
2845
2846
2847	/* Generate a debug exception if a watchpoint has been hit. */
2848	static void check_watchpoint(int offset, int flags)
2849	{
2850	CPUState *env = cpu_single_env;
2851	target_ulong vaddr;
2852	int i;
2853
2854	vaddr = (env->mem_io_vaddr & TARGET_PAGE_MASK) + offset;
2855	for (i = 0; i < env->nb_watchpoints; i++) {
2856	if (vaddr == env->watchpoint[i].vaddr
2857	&& (env->watchpoint[i].type & flags)) {
2858	env->watchpoint_hit = i + 1;
2859	cpu_interrupt(env, CPU_INTERRUPT_DEBUG);
2860	break;
2861	}
2862	}
2863	}
2864
2865	/* Watchpoint access routines. Watchpoints are inserted using TLB tricks,
2866	so these check for a hit then pass through to the normal out-of-line
2867	phys routines. */
2868	static uint32_t watch_mem_readb(void *opaque, target_phys_addr_t addr)
2869	{
2870	check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_READ);
2871	return ldub_phys(addr);
2872	}
2873
2874	static uint32_t watch_mem_readw(void *opaque, target_phys_addr_t addr)
2875	{
2876	check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_READ);
2877	return lduw_phys(addr);
2878	}
2879
2880	static uint32_t watch_mem_readl(void *opaque, target_phys_addr_t addr)
2881	{
2882	check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_READ);
2883	return ldl_phys(addr);
2884	}
2885
2886	static void watch_mem_writeb(void *opaque, target_phys_addr_t addr,
2887	uint32_t val)
2888	{
2889	check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_WRITE);
2890	stb_phys(addr, val);
2891	}
2892
2893	static void watch_mem_writew(void *opaque, target_phys_addr_t addr,
2894	uint32_t val)
2895	{
2896	check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_WRITE);
2897	stw_phys(addr, val);
2898	}
2899
2900	static void watch_mem_writel(void *opaque, target_phys_addr_t addr,
2901	uint32_t val)
2902	{
2903	check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_WRITE);
2904	stl_phys(addr, val);
2905	}
2906
2907	static CPUReadMemoryFunc *watch_mem_read[3] = {
2908	watch_mem_readb,
2909	watch_mem_readw,
2910	watch_mem_readl,
2911	};
2912
2913	static CPUWriteMemoryFunc *watch_mem_write[3] = {
2914	watch_mem_writeb,
2915	watch_mem_writew,
2916	watch_mem_writel,
2917	};
2918
2919	static inline uint32_t subpage_readlen (subpage_t *mmio, target_phys_addr_t addr,
2920	unsigned int len)
2921	{
2922	uint32_t ret;
2923	unsigned int idx;
2924
2925	idx = SUBPAGE_IDX(addr - mmio->base);
2926	#if defined(DEBUG_SUBPAGE)
2927	printf("%s: subpage %p len %d addr " TARGET_FMT_plx " idx %d\n", __func__,
2928	mmio, len, addr, idx);
2929	#endif
2930	ret = (**mmio->mem_read[idx][len])(mmio->opaque[idx][0][len], addr);
2931
2932	return ret;
2933	}
2934
2935	static inline void subpage_writelen (subpage_t *mmio, target_phys_addr_t addr,
2936	uint32_t value, unsigned int len)
2937	{
2938	unsigned int idx;
2939
2940	idx = SUBPAGE_IDX(addr - mmio->base);
2941	#if defined(DEBUG_SUBPAGE)
2942	printf("%s: subpage %p len %d addr " TARGET_FMT_plx " idx %d value %08x\n", __func__,
2943	mmio, len, addr, idx, value);
2944	#endif
2945	(**mmio->mem_write[idx][len])(mmio->opaque[idx][1][len], addr, value);
2946	}
2947
2948	static uint32_t subpage_readb (void *opaque, target_phys_addr_t addr)
2949	{
2950	#if defined(DEBUG_SUBPAGE)
2951	printf("%s: addr " TARGET_FMT_plx "\n", __func__, addr);
2952	#endif
2953
2954	return subpage_readlen(opaque, addr, 0);
2955	}
2956
2957	static void subpage_writeb (void *opaque, target_phys_addr_t addr,
2958	uint32_t value)
2959	{
2960	#if defined(DEBUG_SUBPAGE)
2961	printf("%s: addr " TARGET_FMT_plx " val %08x\n", __func__, addr, value);
2962	#endif
2963	subpage_writelen(opaque, addr, value, 0);
2964	}
2965
2966	static uint32_t subpage_readw (void *opaque, target_phys_addr_t addr)
2967	{
2968	#if defined(DEBUG_SUBPAGE)
2969	printf("%s: addr " TARGET_FMT_plx "\n", __func__, addr);
2970	#endif
2971
2972	return subpage_readlen(opaque, addr, 1);
2973	}
2974
2975	static void subpage_writew (void *opaque, target_phys_addr_t addr,
2976	uint32_t value)
2977	{
2978	#if defined(DEBUG_SUBPAGE)
2979	printf("%s: addr " TARGET_FMT_plx " val %08x\n", __func__, addr, value);
2980	#endif
2981	subpage_writelen(opaque, addr, value, 1);
2982	}
2983
2984	static uint32_t subpage_readl (void *opaque, target_phys_addr_t addr)
2985	{
2986	#if defined(DEBUG_SUBPAGE)
2987	printf("%s: addr " TARGET_FMT_plx "\n", __func__, addr);
2988	#endif
2989
2990	return subpage_readlen(opaque, addr, 2);
2991	}
2992
2993	static void subpage_writel (void *opaque,
2994	target_phys_addr_t addr, uint32_t value)
2995	{
2996	#if defined(DEBUG_SUBPAGE)
2997	printf("%s: addr " TARGET_FMT_plx " val %08x\n", __func__, addr, value);
2998	#endif
2999	subpage_writelen(opaque, addr, value, 2);
3000	}
3001
3002	static CPUReadMemoryFunc *subpage_read[] = {
3003	&subpage_readb,
3004	&subpage_readw,
3005	&subpage_readl,
3006	};
3007
3008	static CPUWriteMemoryFunc *subpage_write[] = {
3009	&subpage_writeb,
3010	&subpage_writew,
3011	&subpage_writel,
3012	};
3013
3014	static int subpage_register (subpage_t *mmio, uint32_t start, uint32_t end,
3015	ram_addr_t memory)
3016	{
3017	int idx, eidx;
3018	unsigned int i;
3019
3020	if (start >= TARGET_PAGE_SIZE \|\| end >= TARGET_PAGE_SIZE)
3021	return -1;
3022	idx = SUBPAGE_IDX(start);
3023	eidx = SUBPAGE_IDX(end);
3024	#if defined(DEBUG_SUBPAGE)
3025	printf("%s: %p start %08x end %08x idx %08x eidx %08x mem %d\n", __func__,
3026	mmio, start, end, idx, eidx, memory);
3027	#endif
3028	memory >>= IO_MEM_SHIFT;
3029	for (; idx <= eidx; idx++) {
3030	for (i = 0; i < 4; i++) {
3031	if (io_mem_read[memory][i]) {
3032	mmio->mem_read[idx][i] = &io_mem_read[memory][i];
3033	mmio->opaque[idx][0][i] = io_mem_opaque[memory];
3034	}
3035	if (io_mem_write[memory][i]) {
3036	mmio->mem_write[idx][i] = &io_mem_write[memory][i];
3037	mmio->opaque[idx][1][i] = io_mem_opaque[memory];
3038	}
3039	}
3040	}
3041
3042	return 0;
3043	}
3044
3045	static void subpage_init (target_phys_addr_t base, ram_addr_t phys,
3046	ram_addr_t orig_memory)
3047	{
3048	subpage_t *mmio;
3049	int subpage_memory;
3050
3051	mmio = qemu_mallocz(sizeof(subpage_t));
3052	if (mmio != NULL) {
3053	mmio->base = base;
3054	subpage_memory = cpu_register_io_memory(0, subpage_read, subpage_write, mmio);
3055	#if defined(DEBUG_SUBPAGE)
3056	printf("%s: %p base " TARGET_FMT_plx " len %08x %d\n", __func__,
3057	mmio, base, TARGET_PAGE_SIZE, subpage_memory);
3058	#endif
3059	*phys = subpage_memory \| IO_MEM_SUBPAGE;
3060	subpage_register(mmio, 0, TARGET_PAGE_SIZE - 1, orig_memory);
3061	}
3062
3063	return mmio;
3064	}
3065
3066	static void io_mem_init(void)
3067	{
3068	cpu_register_io_memory(IO_MEM_ROM >> IO_MEM_SHIFT, error_mem_read, unassigned_mem_write, NULL);
3069	cpu_register_io_memory(IO_MEM_UNASSIGNED >> IO_MEM_SHIFT, unassigned_mem_read, unassigned_mem_write, NULL);
3070	cpu_register_io_memory(IO_MEM_NOTDIRTY >> IO_MEM_SHIFT, error_mem_read, notdirty_mem_write, NULL);
3071	#if defined(VBOX) && !defined(VBOX_WITH_NEW_PHYS_CODE)
3072	cpu_register_io_memory(IO_MEM_RAM_MISSING >> IO_MEM_SHIFT, unassigned_mem_read, unassigned_mem_write, NULL);
3073	io_mem_nb = 6;
3074	#else
3075	io_mem_nb = 5;
3076	#endif
3077
3078	io_mem_watch = cpu_register_io_memory(0, watch_mem_read,
3079	watch_mem_write, NULL);
3080
3081	#ifndef VBOX /* VBOX: we do this later when the RAM is allocated. */
3082	/* alloc dirty bits array */
3083	phys_ram_dirty = qemu_vmalloc(phys_ram_size >> TARGET_PAGE_BITS);
3084	memset(phys_ram_dirty, 0xff, phys_ram_size >> TARGET_PAGE_BITS);
3085	#endif /* !VBOX */
3086	}
3087
3088	/* mem_read and mem_write are arrays of functions containing the
3089	function to access byte (index 0), word (index 1) and dword (index
3090	2). Functions can be omitted with a NULL function pointer. The
3091	registered functions may be modified dynamically later.
3092	If io_index is non zero, the corresponding io zone is
3093	modified. If it is zero, a new io zone is allocated. The return
3094	value can be used with cpu_register_physical_memory(). (-1) is
3095	returned if error. */
3096	int cpu_register_io_memory(int io_index,
3097	CPUReadMemoryFunc **mem_read,
3098	CPUWriteMemoryFunc **mem_write,
3099	void *opaque)
3100	{
3101	int i, subwidth = 0;
3102
3103	if (io_index <= 0) {
3104	if (io_mem_nb >= IO_MEM_NB_ENTRIES)
3105	return -1;
3106	io_index = io_mem_nb++;
3107	} else {
3108	if (io_index >= IO_MEM_NB_ENTRIES)
3109	return -1;
3110	}
3111
3112	for(i = 0;i < 3; i++) {
3113	if (!mem_read[i] \|\| !mem_write[i])
3114	subwidth = IO_MEM_SUBWIDTH;
3115	io_mem_read[io_index][i] = mem_read[i];
3116	io_mem_write[io_index][i] = mem_write[i];
3117	}
3118	io_mem_opaque[io_index] = opaque;
3119	return (io_index << IO_MEM_SHIFT) \| subwidth;
3120	}
3121
3122	CPUWriteMemoryFunc **cpu_get_io_memory_write(int io_index)
3123	{
3124	return io_mem_write[io_index >> IO_MEM_SHIFT];
3125	}
3126
3127	CPUReadMemoryFunc **cpu_get_io_memory_read(int io_index)
3128	{
3129	return io_mem_read[io_index >> IO_MEM_SHIFT];
3130	}
3131	#endif /* !defined(CONFIG_USER_ONLY) */
3132
3133	/* physical memory access (slow version, mainly for debug) */
3134	#if defined(CONFIG_USER_ONLY)
3135	void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
3136	int len, int is_write)
3137	{
3138	int l, flags;
3139	target_ulong page;
3140	void * p;
3141
3142	while (len > 0) {
3143	page = addr & TARGET_PAGE_MASK;
3144	l = (page + TARGET_PAGE_SIZE) - addr;
3145	if (l > len)
3146	l = len;
3147	flags = page_get_flags(page);
3148	if (!(flags & PAGE_VALID))
3149	return;
3150	if (is_write) {
3151	if (!(flags & PAGE_WRITE))
3152	return;
3153	/* XXX: this code should not depend on lock_user */
3154	if (!(p = lock_user(VERIFY_WRITE, addr, l, 0)))
3155	/* FIXME - should this return an error rather than just fail? */
3156	return;
3157	memcpy(p, buf, len);
3158	unlock_user(p, addr, len);
3159	} else {
3160	if (!(flags & PAGE_READ))
3161	return;
3162	if (!(p = lock_user(VERIFY_READ, addr, l, 1)))
3163	/* FIXME - should this return an error rather than just fail? */
3164	return;
3165	memcpy(buf, p, len);
3166	unlock_user(p, addr, 0);
3167	}
3168	len -= l;
3169	buf += l;
3170	addr += l;
3171	}
3172	}
3173
3174	#else
3175	void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
3176	int len, int is_write)
3177	{
3178	int l, io_index;
3179	uint8_t *ptr;
3180	uint32_t val;
3181	target_phys_addr_t page;
3182	unsigned long pd;
3183	PhysPageDesc *p;
3184
3185	while (len > 0) {
3186	page = addr & TARGET_PAGE_MASK;
3187	l = (page + TARGET_PAGE_SIZE) - addr;
3188	if (l > len)
3189	l = len;
3190	p = phys_page_find(page >> TARGET_PAGE_BITS);
3191	if (!p) {
3192	pd = IO_MEM_UNASSIGNED;
3193	} else {
3194	pd = p->phys_offset;
3195	}
3196
3197	if (is_write) {
3198	if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
3199	io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3200	/* XXX: could force cpu_single_env to NULL to avoid
3201	potential bugs */
3202	if (l >= 4 && ((addr & 3) == 0)) {
3203	/* 32 bit write access */
3204	#if !defined(VBOX) \|\| !defined(REM_PHYS_ADDR_IN_TLB)
3205	val = ldl_p(buf);
3206	#else
3207	val = (const uint32_t )buf;
3208	#endif
3209	io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val);
3210	l = 4;
3211	} else if (l >= 2 && ((addr & 1) == 0)) {
3212	/* 16 bit write access */
3213	#if !defined(VBOX) \|\| !defined(REM_PHYS_ADDR_IN_TLB)
3214	val = lduw_p(buf);
3215	#else
3216	val = (const uint16_t )buf;
3217	#endif
3218	io_mem_write[io_index][1](io_mem_opaque[io_index], addr, val);
3219	l = 2;
3220	} else {
3221	/* 8 bit write access */
3222	#if !defined(VBOX) \|\| !defined(REM_PHYS_ADDR_IN_TLB)
3223	val = ldub_p(buf);
3224	#else
3225	val = (const uint8_t )buf;
3226	#endif
3227	io_mem_write[io_index][0](io_mem_opaque[io_index], addr, val);
3228	l = 1;
3229	}
3230	} else {
3231	unsigned long addr1;
3232	addr1 = (pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK);
3233	/* RAM case */
3234	#ifdef VBOX
3235	remR3PhysWrite(addr1, buf, l); NOREF(ptr);
3236	#else
3237	ptr = phys_ram_base + addr1;
3238	memcpy(ptr, buf, l);
3239	#endif
3240	if (!cpu_physical_memory_is_dirty(addr1)) {
3241	/* invalidate code */
3242	tb_invalidate_phys_page_range(addr1, addr1 + l, 0);
3243	/* set dirty bit */
3244	#ifdef VBOX
3245	if (RT_LIKELY((addr1 >> TARGET_PAGE_BITS) < phys_ram_dirty_size))
3246	#endif
3247	phys_ram_dirty[addr1 >> TARGET_PAGE_BITS] \|=
3248	(0xff & ~CODE_DIRTY_FLAG);
3249	}
3250	}
3251	} else {
3252	if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM &&
3253	!(pd & IO_MEM_ROMD)) {
3254	/* I/O case */
3255	io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3256	if (l >= 4 && ((addr & 3) == 0)) {
3257	/* 32 bit read access */
3258	val = io_mem_read[io_index][2](io_mem_opaque[io_index], addr);
3259	#if !defined(VBOX) \|\| !defined(REM_PHYS_ADDR_IN_TLB)
3260	stl_p(buf, val);
3261	#else
3262	(uint32_t )buf = val;
3263	#endif
3264	l = 4;
3265	} else if (l >= 2 && ((addr & 1) == 0)) {
3266	/* 16 bit read access */
3267	val = io_mem_read[io_index][1](io_mem_opaque[io_index], addr);
3268	#if !defined(VBOX) \|\| !defined(REM_PHYS_ADDR_IN_TLB)
3269	stw_p(buf, val);
3270	#else
3271	(uint16_t )buf = val;
3272	#endif
3273	l = 2;
3274	} else {
3275	/* 8 bit read access */
3276	val = io_mem_read[io_index][0](io_mem_opaque[io_index], addr);
3277	#if !defined(VBOX) \|\| !defined(REM_PHYS_ADDR_IN_TLB)
3278	stb_p(buf, val);
3279	#else
3280	(uint8_t )buf = val;
3281	#endif
3282	l = 1;
3283	}
3284	} else {
3285	/* RAM case */
3286	#ifdef VBOX
3287	remR3PhysRead((pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK), buf, l); NOREF(ptr);
3288	#else
3289	ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) +
3290	(addr & ~TARGET_PAGE_MASK);
3291	memcpy(buf, ptr, l);
3292	#endif
3293	}
3294	}
3295	len -= l;
3296	buf += l;
3297	addr += l;
3298	}
3299	}
3300
3301	#ifndef VBOX
3302	/* used for ROM loading : can write in RAM and ROM */
3303	void cpu_physical_memory_write_rom(target_phys_addr_t addr,
3304	const uint8_t *buf, int len)
3305	{
3306	int l;
3307	uint8_t *ptr;
3308	target_phys_addr_t page;
3309	unsigned long pd;
3310	PhysPageDesc *p;
3311
3312	while (len > 0) {
3313	page = addr & TARGET_PAGE_MASK;
3314	l = (page + TARGET_PAGE_SIZE) - addr;
3315	if (l > len)
3316	l = len;
3317	p = phys_page_find(page >> TARGET_PAGE_BITS);
3318	if (!p) {
3319	pd = IO_MEM_UNASSIGNED;
3320	} else {
3321	pd = p->phys_offset;
3322	}
3323
3324	if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM &&
3325	(pd & ~TARGET_PAGE_MASK) != IO_MEM_ROM &&
3326	!(pd & IO_MEM_ROMD)) {
3327	/* do nothing */
3328	} else {
3329	unsigned long addr1;
3330	addr1 = (pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK);
3331	/* ROM/RAM case */
3332	ptr = phys_ram_base + addr1;
3333	memcpy(ptr, buf, l);
3334	}
3335	len -= l;
3336	buf += l;
3337	addr += l;
3338	}
3339	}
3340	#endif /* !VBOX */
3341
3342
3343	/* warning: addr must be aligned */
3344	uint32_t ldl_phys(target_phys_addr_t addr)
3345	{
3346	int io_index;
3347	uint8_t *ptr;
3348	uint32_t val;
3349	unsigned long pd;
3350	PhysPageDesc *p;
3351
3352	p = phys_page_find(addr >> TARGET_PAGE_BITS);
3353	if (!p) {
3354	pd = IO_MEM_UNASSIGNED;
3355	} else {
3356	pd = p->phys_offset;
3357	}
3358
3359	if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM &&
3360	!(pd & IO_MEM_ROMD)) {
3361	/* I/O case */
3362	io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3363	val = io_mem_read[io_index][2](io_mem_opaque[io_index], addr);
3364	} else {
3365	/* RAM case */
3366	#ifndef VBOX
3367	ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) +
3368	(addr & ~TARGET_PAGE_MASK);
3369	val = ldl_p(ptr);
3370	#else
3371	val = remR3PhysReadU32((pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK)); NOREF(ptr);
3372	#endif
3373	}
3374	return val;
3375	}
3376
3377	/* warning: addr must be aligned */
3378	uint64_t ldq_phys(target_phys_addr_t addr)
3379	{
3380	int io_index;
3381	uint8_t *ptr;
3382	uint64_t val;
3383	unsigned long pd;
3384	PhysPageDesc *p;
3385
3386	p = phys_page_find(addr >> TARGET_PAGE_BITS);
3387	if (!p) {
3388	pd = IO_MEM_UNASSIGNED;
3389	} else {
3390	pd = p->phys_offset;
3391	}
3392
3393	if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM &&
3394	!(pd & IO_MEM_ROMD)) {
3395	/* I/O case */
3396	io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3397	#ifdef TARGET_WORDS_BIGENDIAN
3398	val = (uint64_t)io_mem_read[io_index][2](io_mem_opaque[io_index], addr) << 32;
3399	val \|= io_mem_read[io_index][2](io_mem_opaque[io_index], addr + 4);
3400	#else
3401	val = io_mem_read[io_index][2](io_mem_opaque[io_index], addr);
3402	val \|= (uint64_t)io_mem_read[io_index][2](io_mem_opaque[io_index], addr + 4) << 32;
3403	#endif
3404	} else {
3405	/* RAM case */
3406	#ifndef VBOX
3407	ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) +
3408	(addr & ~TARGET_PAGE_MASK);
3409	val = ldq_p(ptr);
3410	#else
3411	val = remR3PhysReadU64((pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK)); NOREF(ptr);
3412	#endif
3413	}
3414	return val;
3415	}
3416
3417	/* XXX: optimize */
3418	uint32_t ldub_phys(target_phys_addr_t addr)
3419	{
3420	uint8_t val;
3421	cpu_physical_memory_read(addr, &val, 1);
3422	return val;
3423	}
3424
3425	/* XXX: optimize */
3426	uint32_t lduw_phys(target_phys_addr_t addr)
3427	{
3428	uint16_t val;
3429	cpu_physical_memory_read(addr, (uint8_t *)&val, 2);
3430	return tswap16(val);
3431	}
3432
3433	/* warning: addr must be aligned. The ram page is not masked as dirty
3434	and the code inside is not invalidated. It is useful if the dirty
3435	bits are used to track modified PTEs */
3436	void stl_phys_notdirty(target_phys_addr_t addr, uint32_t val)
3437	{
3438	int io_index;
3439	uint8_t *ptr;
3440	unsigned long pd;
3441	PhysPageDesc *p;
3442
3443	p = phys_page_find(addr >> TARGET_PAGE_BITS);
3444	if (!p) {
3445	pd = IO_MEM_UNASSIGNED;
3446	} else {
3447	pd = p->phys_offset;
3448	}
3449
3450	if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
3451	io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3452	io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val);
3453	} else {
3454	#ifndef VBOX
3455	ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) +
3456	(addr & ~TARGET_PAGE_MASK);
3457	stl_p(ptr, val);
3458	#else
3459	remR3PhysWriteU32((pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK), val); NOREF(ptr);
3460	#endif
3461	#ifndef VBOX
3462	if (unlikely(in_migration)) {
3463	if (!cpu_physical_memory_is_dirty(addr1)) {
3464	/* invalidate code */
3465	tb_invalidate_phys_page_range(addr1, addr1 + 4, 0);
3466	/* set dirty bit */
3467	phys_ram_dirty[addr1 >> TARGET_PAGE_BITS] \|=
3468	(0xff & ~CODE_DIRTY_FLAG);
3469	}
3470	}
3471	#endif
3472	}
3473	}
3474
3475	void stq_phys_notdirty(target_phys_addr_t addr, uint64_t val)
3476	{
3477	int io_index;
3478	uint8_t *ptr;
3479	unsigned long pd;
3480	PhysPageDesc *p;
3481
3482	p = phys_page_find(addr >> TARGET_PAGE_BITS);
3483	if (!p) {
3484	pd = IO_MEM_UNASSIGNED;
3485	} else {
3486	pd = p->phys_offset;
3487	}
3488
3489	if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
3490	io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3491	#ifdef TARGET_WORDS_BIGENDIAN
3492	io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val >> 32);
3493	io_mem_write[io_index][2](io_mem_opaque[io_index], addr + 4, val);
3494	#else
3495	io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val);
3496	io_mem_write[io_index][2](io_mem_opaque[io_index], addr + 4, val >> 32);
3497	#endif
3498	} else {
3499	#ifndef VBOX
3500	ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) +
3501	(addr & ~TARGET_PAGE_MASK);
3502	stq_p(ptr, val);
3503	#else
3504	remR3PhysWriteU64((pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK), val); NOREF(ptr);
3505	#endif
3506	}
3507	}
3508
3509
3510	/* warning: addr must be aligned */
3511	void stl_phys(target_phys_addr_t addr, uint32_t val)
3512	{
3513	int io_index;
3514	uint8_t *ptr;
3515	unsigned long pd;
3516	PhysPageDesc *p;
3517
3518	p = phys_page_find(addr >> TARGET_PAGE_BITS);
3519	if (!p) {
3520	pd = IO_MEM_UNASSIGNED;
3521	} else {
3522	pd = p->phys_offset;
3523	}
3524
3525	if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
3526	io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3527	io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val);
3528	} else {
3529	unsigned long addr1;
3530	addr1 = (pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK);
3531	/* RAM case */
3532	#ifndef VBOX
3533	ptr = phys_ram_base + addr1;
3534	stl_p(ptr, val);
3535	#else
3536	remR3PhysWriteU32((pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK), val); NOREF(ptr);
3537	#endif
3538	if (!cpu_physical_memory_is_dirty(addr1)) {
3539	/* invalidate code */
3540	tb_invalidate_phys_page_range(addr1, addr1 + 4, 0);
3541	/* set dirty bit */
3542	#ifdef VBOX
3543	if (RT_LIKELY((addr1 >> TARGET_PAGE_BITS) < phys_ram_dirty_size))
3544	#endif
3545	phys_ram_dirty[addr1 >> TARGET_PAGE_BITS] \|=
3546	(0xff & ~CODE_DIRTY_FLAG);
3547	}
3548	}
3549	}
3550
3551	/* XXX: optimize */
3552	void stb_phys(target_phys_addr_t addr, uint32_t val)
3553	{
3554	uint8_t v = val;
3555	cpu_physical_memory_write(addr, &v, 1);
3556	}
3557
3558	/* XXX: optimize */
3559	void stw_phys(target_phys_addr_t addr, uint32_t val)
3560	{
3561	uint16_t v = tswap16(val);
3562	cpu_physical_memory_write(addr, (const uint8_t *)&v, 2);
3563	}
3564
3565	/* XXX: optimize */
3566	void stq_phys(target_phys_addr_t addr, uint64_t val)
3567	{
3568	val = tswap64(val);
3569	cpu_physical_memory_write(addr, (const uint8_t *)&val, 8);
3570	}
3571
3572	#endif
3573
3574	/* virtual memory access for debug */
3575	int cpu_memory_rw_debug(CPUState *env, target_ulong addr,
3576	uint8_t *buf, int len, int is_write)
3577	{
3578	int l;
3579	target_ulong page, phys_addr;
3580
3581	while (len > 0) {
3582	page = addr & TARGET_PAGE_MASK;
3583	phys_addr = cpu_get_phys_page_debug(env, page);
3584	/* if no physical page mapped, return an error */
3585	if (phys_addr == -1)
3586	return -1;
3587	l = (page + TARGET_PAGE_SIZE) - addr;
3588	if (l > len)
3589	l = len;
3590	cpu_physical_memory_rw(phys_addr + (addr & ~TARGET_PAGE_MASK),
3591	buf, l, is_write);
3592	len -= l;
3593	buf += l;
3594	addr += l;
3595	}
3596	return 0;
3597	}
3598
3599	/* in deterministic execution mode, instructions doing device I/Os
3600	must be at the end of the TB */
3601	void cpu_io_recompile(CPUState env, void retaddr)
3602	{
3603	TranslationBlock *tb;
3604	uint32_t n, cflags;
3605	target_ulong pc, cs_base;
3606	uint64_t flags;
3607
3608	tb = tb_find_pc((unsigned long)retaddr);
3609	if (!tb) {
3610	cpu_abort(env, "cpu_io_recompile: could not find TB for pc=%p",
3611	retaddr);
3612	}
3613	n = env->icount_decr.u16.low + tb->icount;
3614	cpu_restore_state(tb, env, (unsigned long)retaddr, NULL);
3615	/* Calculate how many instructions had been executed before the fault
3616	occurred. */
3617	n = n - env->icount_decr.u16.low;
3618	/* Generate a new TB ending on the I/O insn. */
3619	n++;
3620	/* On MIPS and SH, delay slot instructions can only be restarted if
3621	they were already the first instruction in the TB. If this is not
3622	the first instruction in a TB then re-execute the preceding
3623	branch. */
3624	#if defined(TARGET_MIPS)
3625	if ((env->hflags & MIPS_HFLAG_BMASK) != 0 && n > 1) {
3626	env->active_tc.PC -= 4;
3627	env->icount_decr.u16.low++;
3628	env->hflags &= ~MIPS_HFLAG_BMASK;
3629	}
3630	#elif defined(TARGET_SH4)
3631	if ((env->flags & ((DELAY_SLOT \| DELAY_SLOT_CONDITIONAL))) != 0
3632	&& n > 1) {
3633	env->pc -= 2;
3634	env->icount_decr.u16.low++;
3635	env->flags &= ~(DELAY_SLOT \| DELAY_SLOT_CONDITIONAL);
3636	}
3637	#endif
3638	/* This should never happen. */
3639	if (n > CF_COUNT_MASK)
3640	cpu_abort(env, "TB too big during recompile");
3641
3642	cflags = n \| CF_LAST_IO;
3643	pc = tb->pc;
3644	cs_base = tb->cs_base;
3645	flags = tb->flags;
3646	tb_phys_invalidate(tb, -1);
3647	/* FIXME: In theory this could raise an exception. In practice
3648	we have already translated the block once so it's probably ok. */
3649	tb_gen_code(env, pc, cs_base, flags, cflags);
3650	/* TODO: If env->pc != tb->pc (i.e. the faulting instruction was not
3651	the first in the TB) then we end up generating a whole new TB and
3652	repeating the fault, which is horribly inefficient.
3653	Better would be to execute just this insn uncached, or generate a
3654	second new TB. */
3655	cpu_resume_from_signal(env, NULL);
3656	}
3657
3658	#ifndef VBOX
3659	void dump_exec_info(FILE *f,
3660	int (cpu_fprintf)(FILE f, const char *fmt, ...))
3661	{
3662	int i, target_code_size, max_target_code_size;
3663	int direct_jmp_count, direct_jmp2_count, cross_page;
3664	TranslationBlock *tb;
3665
3666	target_code_size = 0;
3667	max_target_code_size = 0;
3668	cross_page = 0;
3669	direct_jmp_count = 0;
3670	direct_jmp2_count = 0;
3671	for(i = 0; i < nb_tbs; i++) {
3672	tb = &tbs[i];
3673	target_code_size += tb->size;
3674	if (tb->size > max_target_code_size)
3675	max_target_code_size = tb->size;
3676	if (tb->page_addr[1] != -1)
3677	cross_page++;
3678	if (tb->tb_next_offset[0] != 0xffff) {
3679	direct_jmp_count++;
3680	if (tb->tb_next_offset[1] != 0xffff) {
3681	direct_jmp2_count++;
3682	}
3683	}
3684	}
3685	/* XXX: avoid using doubles ? */
3686	cpu_fprintf(f, "Translation buffer state:\n");
3687	cpu_fprintf(f, "gen code size %ld/%ld\n",
3688	code_gen_ptr - code_gen_buffer, code_gen_buffer_max_size);
3689	cpu_fprintf(f, "TB count %d/%d\n",
3690	nb_tbs, code_gen_max_blocks);
3691	cpu_fprintf(f, "TB avg target size %d max=%d bytes\n",
3692	nb_tbs ? target_code_size / nb_tbs : 0,
3693	max_target_code_size);
3694	cpu_fprintf(f, "TB avg host size %d bytes (expansion ratio: %0.1f)\n",
3695	nb_tbs ? (code_gen_ptr - code_gen_buffer) / nb_tbs : 0,
3696	target_code_size ? (double) (code_gen_ptr - code_gen_buffer) / target_code_size : 0);
3697	cpu_fprintf(f, "cross page TB count %d (%d%%)\n",
3698	cross_page,
3699	nb_tbs ? (cross_page * 100) / nb_tbs : 0);
3700	cpu_fprintf(f, "direct jump count %d (%d%%) (2 jumps=%d %d%%)\n",
3701	direct_jmp_count,
3702	nb_tbs ? (direct_jmp_count * 100) / nb_tbs : 0,
3703	direct_jmp2_count,
3704	nb_tbs ? (direct_jmp2_count * 100) / nb_tbs : 0);
3705	cpu_fprintf(f, "\nStatistics:\n");
3706	cpu_fprintf(f, "TB flush count %d\n", tb_flush_count);
3707	cpu_fprintf(f, "TB invalidate count %d\n", tb_phys_invalidate_count);
3708	cpu_fprintf(f, "TLB flush count %d\n", tlb_flush_count);
3709	tcg_dump_info(f, cpu_fprintf);
3710	}
3711	#endif /* !VBOX */
3712
3713	#if !defined(CONFIG_USER_ONLY)
3714
3715	#define MMUSUFFIX _cmmu
3716	#define GETPC() NULL
3717	#define env cpu_single_env
3718	#define SOFTMMU_CODE_ACCESS
3719
3720	#define SHIFT 0
3721	#include "softmmu_template.h"
3722
3723	#define SHIFT 1
3724	#include "softmmu_template.h"
3725
3726	#define SHIFT 2
3727	#include "softmmu_template.h"
3728
3729	#define SHIFT 3
3730	#include "softmmu_template.h"
3731
3732	#undef env
3733
3734	#endif

注意: 瀏覽 TracBrowser 來幫助您使用儲存庫瀏覽器

source: vbox/trunk/src/recompiler_new/exec.c@ 13872

以其他格式下載: