exec.c@ 14969

Last change on this file since 14969 was 14969, checked in by vboxsync, 16 years ago
VMM support for completing VA in TLB (not much tested)
Property svn:eol-style set to `native`
File size: 110.7 KB

Line
1	/*
2	* virtual page mapping and translated block handling
3	*
4	* Copyright (c) 2003 Fabrice Bellard
5	*
6	* This library is free software; you can redistribute it and/or
7	* modify it under the terms of the GNU Lesser General Public
8	* License as published by the Free Software Foundation; either
9	* version 2 of the License, or (at your option) any later version.
10	*
11	* This library is distributed in the hope that it will be useful,
12	* but WITHOUT ANY WARRANTY; without even the implied warranty of
13	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14	* Lesser General Public License for more details.
15	*
16	* You should have received a copy of the GNU Lesser General Public
17	* License along with this library; if not, write to the Free Software
18	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
19	*/
20
21	/*
22	* Sun LGPL Disclaimer: For the avoidance of doubt, except that if any license choice
23	* other than GPL or LGPL is available it will apply instead, Sun elects to use only
24	* the Lesser General Public License version 2.1 (LGPLv2) at this time for any software where
25	* a choice of LGPL license versions is made available with the language indicating
26	* that LGPLv2 or any later version may be used, or where a choice of which version
27	* of the LGPL is applied is otherwise unspecified.
28	*/
29	#include "config.h"
30	#ifndef VBOX
31	#ifdef _WIN32
32	#include <windows.h>
33	#else
34	#include <sys/types.h>
35	#include <sys/mman.h>
36	#endif
37	#include <stdlib.h>
38	#include <stdio.h>
39	#include <stdarg.h>
40	#include <string.h>
41	#include <errno.h>
42	#include <unistd.h>
43	#include <inttypes.h>
44	#else /* VBOX */
45	# include <stdlib.h>
46	# include <stdio.h>
47	# include <iprt/alloc.h>
48	# include <iprt/string.h>
49	# include <iprt/param.h>
50	# include <VBox/pgm.h> /* PGM_DYNAMIC_RAM_ALLOC */
51	#endif /* VBOX */
52
53	#include "cpu.h"
54	#include "exec-all.h"
55	#if defined(CONFIG_USER_ONLY)
56	#include <qemu.h>
57	#endif
58
59	//#define DEBUG_TB_INVALIDATE
60	//#define DEBUG_FLUSH
61	//#define DEBUG_TLB
62	//#define DEBUG_UNASSIGNED
63
64	/* make various TB consistency checks */
65	//#define DEBUG_TB_CHECK
66	//#define DEBUG_TLB_CHECK
67
68	#if !defined(CONFIG_USER_ONLY)
69	/* TB consistency checks only implemented for usermode emulation. */
70	#undef DEBUG_TB_CHECK
71	#endif
72
73	#define SMC_BITMAP_USE_THRESHOLD 10
74
75	#define MMAP_AREA_START 0x00000000
76	#define MMAP_AREA_END 0xa8000000
77
78	#if defined(TARGET_SPARC64)
79	#define TARGET_PHYS_ADDR_SPACE_BITS 41
80	#elif defined(TARGET_SPARC)
81	#define TARGET_PHYS_ADDR_SPACE_BITS 36
82	#elif defined(TARGET_ALPHA)
83	#define TARGET_PHYS_ADDR_SPACE_BITS 42
84	#define TARGET_VIRT_ADDR_SPACE_BITS 42
85	#elif defined(TARGET_PPC64)
86	#define TARGET_PHYS_ADDR_SPACE_BITS 42
87	#elif defined(TARGET_X86_64) && !defined(USE_KQEMU)
88	#define TARGET_PHYS_ADDR_SPACE_BITS 42
89	#elif defined(TARGET_I386) && !defined(USE_KQEMU)
90	#define TARGET_PHYS_ADDR_SPACE_BITS 36
91	#else
92	/* Note: for compatibility with kqemu, we use 32 bits for x86_64 */
93	#define TARGET_PHYS_ADDR_SPACE_BITS 32
94	#endif
95
96	static TranslationBlock *tbs;
97	int code_gen_max_blocks;
98	TranslationBlock *tb_phys_hash[CODE_GEN_PHYS_HASH_SIZE];
99	static int nb_tbs;
100	/* any access to the tbs or the page table must use this lock */
101	spinlock_t tb_lock = SPIN_LOCK_UNLOCKED;
102
103	#ifndef VBOX
104	#if defined(__arm__) \|\| defined(__sparc_v9__)
105	/* The prologue must be reachable with a direct jump. ARM and Sparc64
106	have limited branch ranges (possibly also PPC) so place it in a
107	section close to code segment. */
108	#define code_gen_section \
109	__attribute__((__section__(".gen_code"))) \
110	__attribute__((aligned (32)))
111	#else
112	#define code_gen_section \
113	__attribute__((aligned (32)))
114	#endif
115	uint8_t code_gen_prologue[1024] code_gen_section;
116
117	#else /* VBOX */
118	extern uint8_t* code_gen_prologue;
119	#endif /* VBOX */
120
121	static uint8_t *code_gen_buffer;
122	static unsigned long code_gen_buffer_size;
123	/* threshold to flush the translated code buffer */
124	static unsigned long code_gen_buffer_max_size;
125	uint8_t *code_gen_ptr;
126
127	#ifndef VBOX
128	#if !defined(CONFIG_USER_ONLY)
129	ram_addr_t phys_ram_size;
130	int phys_ram_fd;
131	uint8_t *phys_ram_base;
132	uint8_t *phys_ram_dirty;
133	static int in_migration;
134	static ram_addr_t phys_ram_alloc_offset = 0;
135	#endif
136	#else /* VBOX */
137	RTGCPHYS phys_ram_size;
138	/* we have memory ranges (the high PC-BIOS mapping) which
139	causes some pages to fall outside the dirty map here. */
140	uint32_t phys_ram_dirty_size;
141	#endif /* VBOX */
142	#if !defined(VBOX)
143	uint8_t *phys_ram_base;
144	#endif
145	uint8_t *phys_ram_dirty;
146
147	CPUState *first_cpu;
148	/* current CPU in the current thread. It is only valid inside
149	cpu_exec() */
150	CPUState *cpu_single_env;
151	/* 0 = Do not count executed instructions.
152	1 = Precise instruction counting.
153	2 = Adaptive rate instruction counting. */
154	int use_icount = 0;
155	/* Current instruction counter. While executing translated code this may
156	include some instructions that have not yet been executed. */
157	int64_t qemu_icount;
158
159	typedef struct PageDesc {
160	/* list of TBs intersecting this ram page */
161	TranslationBlock *first_tb;
162	/* in order to optimize self modifying code, we count the number
163	of lookups we do to a given page to use a bitmap */
164	unsigned int code_write_count;
165	uint8_t *code_bitmap;
166	#if defined(CONFIG_USER_ONLY)
167	unsigned long flags;
168	#endif
169	} PageDesc;
170
171	typedef struct PhysPageDesc {
172	/* offset in host memory of the page + io_index in the low 12 bits */
173	ram_addr_t phys_offset;
174	} PhysPageDesc;
175
176	#define L2_BITS 10
177	#if defined(CONFIG_USER_ONLY) && defined(TARGET_VIRT_ADDR_SPACE_BITS)
178	/* XXX: this is a temporary hack for alpha target.
179	* In the future, this is to be replaced by a multi-level table
180	* to actually be able to handle the complete 64 bits address space.
181	*/
182	#define L1_BITS (TARGET_VIRT_ADDR_SPACE_BITS - L2_BITS - TARGET_PAGE_BITS)
183	#else
184	#define L1_BITS (32 - L2_BITS - TARGET_PAGE_BITS)
185	#endif
186
187	#define L1_SIZE (1 << L1_BITS)
188	#define L2_SIZE (1 << L2_BITS)
189
190	static void io_mem_init(void);
191
192	unsigned long qemu_real_host_page_size;
193	unsigned long qemu_host_page_bits;
194	unsigned long qemu_host_page_size;
195	unsigned long qemu_host_page_mask;
196
197	/* XXX: for system emulation, it could just be an array */
198	static PageDesc *l1_map[L1_SIZE];
199	static PhysPageDesc **l1_phys_map;
200
201	#if !defined(CONFIG_USER_ONLY)
202	static void io_mem_init(void);
203
204	/* io memory support */
205	CPUWriteMemoryFunc *io_mem_write[IO_MEM_NB_ENTRIES][4];
206	CPUReadMemoryFunc *io_mem_read[IO_MEM_NB_ENTRIES][4];
207	void *io_mem_opaque[IO_MEM_NB_ENTRIES];
208	static int io_mem_nb;
209	static int io_mem_watch;
210	#endif
211
212	#ifndef VBOX
213	/* log support */
214	static const char *logfilename = "/tmp/qemu.log";
215	#endif /* !VBOX */
216	FILE *logfile;
217	int loglevel;
218	#ifndef VBOX
219	static int log_append = 0;
220	#endif
221
222	/* statistics */
223	static int tlb_flush_count;
224	static int tb_flush_count;
225	#ifndef VBOX
226	static int tb_phys_invalidate_count;
227	#endif /* !VBOX */
228
229	#define SUBPAGE_IDX(addr) ((addr) & ~TARGET_PAGE_MASK)
230	typedef struct subpage_t {
231	target_phys_addr_t base;
232	CPUReadMemoryFunc **mem_read[TARGET_PAGE_SIZE][4];
233	CPUWriteMemoryFunc **mem_write[TARGET_PAGE_SIZE][4];
234	void *opaque[TARGET_PAGE_SIZE][2][4];
235	} subpage_t;
236
237
238	#ifndef VBOX
239	#ifdef _WIN32
240	static void map_exec(void *addr, long size)
241	{
242	DWORD old_protect;
243	VirtualProtect(addr, size,
244	PAGE_EXECUTE_READWRITE, &old_protect);
245
246	}
247	#else
248	static void map_exec(void *addr, long size)
249	{
250	unsigned long start, end, page_size;
251
252	page_size = getpagesize();
253	start = (unsigned long)addr;
254	start &= ~(page_size - 1);
255
256	end = (unsigned long)addr + size;
257	end += page_size - 1;
258	end &= ~(page_size - 1);
259
260	mprotect((void *)start, end - start,
261	PROT_READ \| PROT_WRITE \| PROT_EXEC);
262	}
263	#endif
264	#else // VBOX
265	static void map_exec(void *addr, long size)
266	{
267	RTMemProtect(addr, size,
268	RTMEM_PROT_EXEC \| RTMEM_PROT_READ \| RTMEM_PROT_WRITE);
269	}
270	#endif
271
272	static void page_init(void)
273	{
274	/* NOTE: we can always suppose that qemu_host_page_size >=
275	TARGET_PAGE_SIZE */
276	#ifdef VBOX
277	RTMemProtect(code_gen_buffer, sizeof(code_gen_buffer),
278	RTMEM_PROT_EXEC \| RTMEM_PROT_READ \| RTMEM_PROT_WRITE);
279	qemu_real_host_page_size = PAGE_SIZE;
280	#else /* !VBOX */
281	#ifdef _WIN32
282	{
283	SYSTEM_INFO system_info;
284	DWORD old_protect;
285
286	GetSystemInfo(&system_info);
287	qemu_real_host_page_size = system_info.dwPageSize;
288	}
289	#else
290	qemu_real_host_page_size = getpagesize();
291	#endif
292	#endif /* !VBOX */
293
294	if (qemu_host_page_size == 0)
295	qemu_host_page_size = qemu_real_host_page_size;
296	if (qemu_host_page_size < TARGET_PAGE_SIZE)
297	qemu_host_page_size = TARGET_PAGE_SIZE;
298	qemu_host_page_bits = 0;
299	#ifndef VBOX
300	while ((1 << qemu_host_page_bits) < qemu_host_page_size)
301	#else
302	while ((1 << qemu_host_page_bits) < (int)qemu_host_page_size)
303	#endif
304	qemu_host_page_bits++;
305	qemu_host_page_mask = ~(qemu_host_page_size - 1);
306	l1_phys_map = qemu_vmalloc(L1_SIZE * sizeof(void *));
307	memset(l1_phys_map, 0, L1_SIZE * sizeof(void *));
308	#ifdef VBOX
309	/* We use other means to set reserved bit on our pages */
310	#else
311	#if !defined(_WIN32) && defined(CONFIG_USER_ONLY)
312	{
313	long long startaddr, endaddr;
314	FILE *f;
315	int n;
316
317	mmap_lock();
318	last_brk = (unsigned long)sbrk(0);
319	f = fopen("/proc/self/maps", "r");
320	if (f) {
321	do {
322	n = fscanf (f, "%llx-%llx %*[^\n]\n", &startaddr, &endaddr);
323	if (n == 2) {
324	startaddr = MIN(startaddr,
325	(1ULL << TARGET_PHYS_ADDR_SPACE_BITS) - 1);
326	endaddr = MIN(endaddr,
327	(1ULL << TARGET_PHYS_ADDR_SPACE_BITS) - 1);
328	page_set_flags(startaddr & TARGET_PAGE_MASK,
329	TARGET_PAGE_ALIGN(endaddr),
330	PAGE_RESERVED);
331	}
332	} while (!feof(f));
333	fclose(f);
334	}
335	mmap_unlock();
336	}
337	#endif
338	#endif
339	}
340
341	#ifndef VBOX
342	static inline PageDesc **page_l1_map(target_ulong index)
343	#else
344	DECLINLINE(PageDesc **) page_l1_map(target_ulong index)
345	#endif
346	{
347	#if TARGET_LONG_BITS > 32
348	/* Host memory outside guest VM. For 32-bit targets we have already
349	excluded high addresses. */
350	if (index > ((target_ulong)L2_SIZE * L1_SIZE))
351	return NULL;
352	#endif
353	return &l1_map[index >> L2_BITS];
354	}
355
356	#ifndef VBOX
357	static inline PageDesc *page_find_alloc(target_ulong index)
358	#else
359	DECLINLINE(PageDesc *) page_find_alloc(target_ulong index)
360	#endif
361	{
362	PageDesc *lp, p;
363	lp = page_l1_map(index);
364	if (!lp)
365	return NULL;
366
367	p = *lp;
368	if (!p) {
369	/* allocate if not found */
370	#if defined(CONFIG_USER_ONLY)
371	unsigned long addr;
372	size_t len = sizeof(PageDesc) * L2_SIZE;
373	/* Don't use qemu_malloc because it may recurse. */
374	p = mmap(0, len, PROT_READ \| PROT_WRITE,
375	MAP_PRIVATE \| MAP_ANONYMOUS, -1, 0);
376	*lp = p;
377	addr = h2g(p);
378	if (addr == (target_ulong)addr) {
379	page_set_flags(addr & TARGET_PAGE_MASK,
380	TARGET_PAGE_ALIGN(addr + len),
381	PAGE_RESERVED);
382	}
383	#else
384	p = qemu_mallocz(sizeof(PageDesc) * L2_SIZE);
385	*lp = p;
386	#endif
387	}
388	return p + (index & (L2_SIZE - 1));
389	}
390
391	#ifndef VBOX
392	static inline PageDesc *page_find(target_ulong index)
393	#else
394	DECLINLINE(PageDesc *) page_find(target_ulong index)
395	#endif
396	{
397	PageDesc *lp, p;
398	lp = page_l1_map(index);
399	if (!lp)
400	return NULL;
401
402	p = *lp;
403	if (!p)
404	return 0;
405	return p + (index & (L2_SIZE - 1));
406	}
407
408	static PhysPageDesc *phys_page_find_alloc(target_phys_addr_t index, int alloc)
409	{
410	void lp, p;
411	PhysPageDesc *pd;
412
413	p = (void **)l1_phys_map;
414	#if TARGET_PHYS_ADDR_SPACE_BITS > 32
415
416	#if TARGET_PHYS_ADDR_SPACE_BITS > (32 + L1_BITS)
417	#error unsupported TARGET_PHYS_ADDR_SPACE_BITS
418	#endif
419	lp = p + ((index >> (L1_BITS + L2_BITS)) & (L1_SIZE - 1));
420	p = *lp;
421	if (!p) {
422	/* allocate if not found */
423	if (!alloc)
424	return NULL;
425	p = qemu_vmalloc(sizeof(void ) L1_SIZE);
426	memset(p, 0, sizeof(void ) L1_SIZE);
427	*lp = p;
428	}
429	#endif
430	lp = p + ((index >> L2_BITS) & (L1_SIZE - 1));
431	pd = *lp;
432	if (!pd) {
433	int i;
434	/* allocate if not found */
435	if (!alloc)
436	return NULL;
437	pd = qemu_vmalloc(sizeof(PhysPageDesc) * L2_SIZE);
438	*lp = pd;
439	for (i = 0; i < L2_SIZE; i++)
440	pd[i].phys_offset = IO_MEM_UNASSIGNED;
441	}
442	#if defined(VBOX) && !defined(VBOX_WITH_NEW_PHYS_CODE)
443	pd = ((PhysPageDesc *)pd) + (index & (L2_SIZE - 1));
444	if (RT_UNLIKELY((pd->phys_offset & ~TARGET_PAGE_MASK) == IO_MEM_RAM_MISSING))
445	remR3GrowDynRange(pd->phys_offset & TARGET_PAGE_MASK);
446	return pd;
447	#else
448	return ((PhysPageDesc *)pd) + (index & (L2_SIZE - 1));
449	#endif
450	}
451
452	#ifndef VBOX
453	static inline PhysPageDesc *phys_page_find(target_phys_addr_t index)
454	#else
455	DECLINLINE(PhysPageDesc *) phys_page_find(target_phys_addr_t index)
456	#endif
457	{
458	return phys_page_find_alloc(index, 0);
459	}
460
461	#if !defined(CONFIG_USER_ONLY)
462	static void tlb_protect_code(ram_addr_t ram_addr);
463	static void tlb_unprotect_code_phys(CPUState *env, ram_addr_t ram_addr,
464	target_ulong vaddr);
465	#define mmap_lock() do { } while(0)
466	#define mmap_unlock() do { } while(0)
467	#endif
468
469	#ifdef VBOX
470	/** @todo nike: isn't 32M too much ? */
471	#endif
472	#define DEFAULT_CODE_GEN_BUFFER_SIZE (32 * 1024 * 1024)
473
474	#if defined(CONFIG_USER_ONLY)
475	/* Currently it is not recommanded to allocate big chunks of data in
476	user mode. It will change when a dedicated libc will be used */
477	#define USE_STATIC_CODE_GEN_BUFFER
478	#endif
479
480	/* VBox allocates codegen buffer dynamically */
481	#ifndef VBOX
482	#ifdef USE_STATIC_CODE_GEN_BUFFER
483	static uint8_t static_code_gen_buffer[DEFAULT_CODE_GEN_BUFFER_SIZE];
484	#endif
485	#endif
486
487	static void code_gen_alloc(unsigned long tb_size)
488	{
489	#ifdef USE_STATIC_CODE_GEN_BUFFER
490	code_gen_buffer = static_code_gen_buffer;
491	code_gen_buffer_size = DEFAULT_CODE_GEN_BUFFER_SIZE;
492	map_exec(code_gen_buffer, code_gen_buffer_size);
493	#else
494	code_gen_buffer_size = tb_size;
495	if (code_gen_buffer_size == 0) {
496	#if defined(CONFIG_USER_ONLY)
497	/* in user mode, phys_ram_size is not meaningful */
498	code_gen_buffer_size = DEFAULT_CODE_GEN_BUFFER_SIZE;
499	#else
500	/* XXX: needs ajustments */
501	code_gen_buffer_size = (unsigned long)(phys_ram_size / 4);
502	#endif
503	}
504	if (code_gen_buffer_size < MIN_CODE_GEN_BUFFER_SIZE)
505	code_gen_buffer_size = MIN_CODE_GEN_BUFFER_SIZE;
506	/* The code gen buffer location may have constraints depending on
507	the host cpu and OS */
508	#ifdef VBOX
509	code_gen_buffer = RTMemExecAlloc(code_gen_buffer_size);
510
511	if (!code_gen_buffer) {
512	LogRel(("REM: failed allocate codegen buffer %lld\n",
513	code_gen_buffer_size));
514	return;
515	}
516	#else //!VBOX
517	#if defined(__linux__)
518	{
519	int flags;
520	void *start = NULL;
521
522	flags = MAP_PRIVATE \| MAP_ANONYMOUS;
523	#if defined(__x86_64__)
524	flags \|= MAP_32BIT;
525	/* Cannot map more than that */
526	if (code_gen_buffer_size > (800 * 1024 * 1024))
527	code_gen_buffer_size = (800 * 1024 * 1024);
528	#elif defined(__sparc_v9__)
529	// Map the buffer below 2G, so we can use direct calls and branches
530	flags \|= MAP_FIXED;
531	start = (void *) 0x60000000UL;
532	if (code_gen_buffer_size > (512 * 1024 * 1024))
533	code_gen_buffer_size = (512 * 1024 * 1024);
534	#endif
535	code_gen_buffer = mmap(start, code_gen_buffer_size,
536	PROT_WRITE \| PROT_READ \| PROT_EXEC,
537	flags, -1, 0);
538	if (code_gen_buffer == MAP_FAILED) {
539	fprintf(stderr, "Could not allocate dynamic translator buffer\n");
540	exit(1);
541	}
542	}
543	#elif defined(__FreeBSD__)
544	{
545	int flags;
546	void *addr = NULL;
547	flags = MAP_PRIVATE \| MAP_ANONYMOUS;
548	#if defined(__x86_64__)
549	/* FreeBSD doesn't have MAP_32BIT, use MAP_FIXED and assume
550	* 0x40000000 is free */
551	flags \|= MAP_FIXED;
552	addr = (void *)0x40000000;
553	/* Cannot map more than that */
554	if (code_gen_buffer_size > (800 * 1024 * 1024))
555	code_gen_buffer_size = (800 * 1024 * 1024);
556	#endif
557	code_gen_buffer = mmap(addr, code_gen_buffer_size,
558	PROT_WRITE \| PROT_READ \| PROT_EXEC,
559	flags, -1, 0);
560	if (code_gen_buffer == MAP_FAILED) {
561	fprintf(stderr, "Could not allocate dynamic translator buffer\n");
562	exit(1);
563	}
564	}
565	#else
566	code_gen_buffer = qemu_malloc(code_gen_buffer_size);
567	if (!code_gen_buffer) {
568	fprintf(stderr, "Could not allocate dynamic translator buffer\n");
569	exit(1);
570	}
571	map_exec(code_gen_buffer, code_gen_buffer_size);
572	#endif
573	map_exec(code_gen_prologue, sizeof(code_gen_prologue));
574	#endif /* !VBOX */
575	#endif /* !USE_STATIC_CODE_GEN_BUFFER */
576	#ifndef VBOX
577	map_exec(code_gen_prologue, sizeof(code_gen_prologue));
578	#else
579	map_exec(code_gen_prologue, _1K);
580	#endif
581
582	code_gen_buffer_max_size = code_gen_buffer_size -
583	code_gen_max_block_size();
584	code_gen_max_blocks = code_gen_buffer_size / CODE_GEN_AVG_BLOCK_SIZE;
585	tbs = qemu_malloc(code_gen_max_blocks * sizeof(TranslationBlock));
586	}
587
588	/* Must be called before using the QEMU cpus. 'tb_size' is the size
589	(in bytes) allocated to the translation buffer. Zero means default
590	size. */
591	void cpu_exec_init_all(unsigned long tb_size)
592	{
593	cpu_gen_init();
594	code_gen_alloc(tb_size);
595	code_gen_ptr = code_gen_buffer;
596	page_init();
597	#if !defined(CONFIG_USER_ONLY)
598	io_mem_init();
599	#endif
600	}
601
602	#ifndef VBOX
603	#if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
604
605	#define CPU_COMMON_SAVE_VERSION 1
606
607	static void cpu_common_save(QEMUFile f, void opaque)
608	{
609	CPUState *env = opaque;
610
611	qemu_put_be32s(f, &env->halted);
612	qemu_put_be32s(f, &env->interrupt_request);
613	}
614
615	static int cpu_common_load(QEMUFile f, void opaque, int version_id)
616	{
617	CPUState *env = opaque;
618
619	if (version_id != CPU_COMMON_SAVE_VERSION)
620	return -EINVAL;
621
622	qemu_get_be32s(f, &env->halted);
623	qemu_get_be32s(f, &env->interrupt_request);
624	tlb_flush(env, 1);
625
626	return 0;
627	}
628	#endif
629	#endif //!VBOX
630
631	void cpu_exec_init(CPUState *env)
632	{
633	CPUState **penv;
634	int cpu_index;
635
636	env->next_cpu = NULL;
637	penv = &first_cpu;
638	cpu_index = 0;
639	while (*penv != NULL) {
640	penv = (CPUState *)&(penv)->next_cpu;
641	cpu_index++;
642	}
643	env->cpu_index = cpu_index;
644	env->nb_watchpoints = 0;
645	*penv = env;
646	#ifndef VBOX
647	#if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
648	register_savevm("cpu_common", cpu_index, CPU_COMMON_SAVE_VERSION,
649	cpu_common_save, cpu_common_load, env);
650	register_savevm("cpu", cpu_index, CPU_SAVE_VERSION,
651	cpu_save, cpu_load, env);
652	#endif
653	#endif // !VBOX
654	}
655
656	#ifndef VBOX
657	static inline void invalidate_page_bitmap(PageDesc *p)
658	#else
659	DECLINLINE(void) invalidate_page_bitmap(PageDesc *p)
660	#endif
661	{
662	if (p->code_bitmap) {
663	qemu_free(p->code_bitmap);
664	p->code_bitmap = NULL;
665	}
666	p->code_write_count = 0;
667	}
668
669	/* set to NULL all the 'first_tb' fields in all PageDescs */
670	static void page_flush_tb(void)
671	{
672	int i, j;
673	PageDesc *p;
674
675	for(i = 0; i < L1_SIZE; i++) {
676	p = l1_map[i];
677	if (p) {
678	for(j = 0; j < L2_SIZE; j++) {
679	p->first_tb = NULL;
680	invalidate_page_bitmap(p);
681	p++;
682	}
683	}
684	}
685	}
686
687	/* flush all the translation blocks */
688	/* XXX: tb_flush is currently not thread safe */
689	void tb_flush(CPUState *env1)
690	{
691	CPUState *env;
692	#if defined(DEBUG_FLUSH)
693	printf("qemu: flush code_size=%ld nb_tbs=%d avg_tb_size=%ld\n",
694	(unsigned long)(code_gen_ptr - code_gen_buffer),
695	nb_tbs, nb_tbs > 0 ?
696	((unsigned long)(code_gen_ptr - code_gen_buffer)) / nb_tbs : 0);
697	#endif
698	if ((unsigned long)(code_gen_ptr - code_gen_buffer) > code_gen_buffer_size)
699	cpu_abort(env1, "Internal error: code buffer overflow\n");
700
701	nb_tbs = 0;
702
703	for(env = first_cpu; env != NULL; env = env->next_cpu) {
704	memset (env->tb_jmp_cache, 0, TB_JMP_CACHE_SIZE * sizeof (void *));
705	}
706
707	memset (tb_phys_hash, 0, CODE_GEN_PHYS_HASH_SIZE * sizeof (void *));
708	page_flush_tb();
709
710	code_gen_ptr = code_gen_buffer;
711	/* XXX: flush processor icache at this point if cache flush is
712	expensive */
713	tb_flush_count++;
714	}
715
716	#ifdef DEBUG_TB_CHECK
717	static void tb_invalidate_check(target_ulong address)
718	{
719	TranslationBlock *tb;
720	int i;
721	address &= TARGET_PAGE_MASK;
722	for(i = 0;i < CODE_GEN_PHYS_HASH_SIZE; i++) {
723	for(tb = tb_phys_hash[i]; tb != NULL; tb = tb->phys_hash_next) {
724	if (!(address + TARGET_PAGE_SIZE <= tb->pc \|\|
725	address >= tb->pc + tb->size)) {
726	printf("ERROR invalidate: address=%08lx PC=%08lx size=%04x\n",
727	address, (long)tb->pc, tb->size);
728	}
729	}
730	}
731	}
732
733	/* verify that all the pages have correct rights for code */
734	static void tb_page_check(void)
735	{
736	TranslationBlock *tb;
737	int i, flags1, flags2;
738
739	for(i = 0;i < CODE_GEN_PHYS_HASH_SIZE; i++) {
740	for(tb = tb_phys_hash[i]; tb != NULL; tb = tb->phys_hash_next) {
741	flags1 = page_get_flags(tb->pc);
742	flags2 = page_get_flags(tb->pc + tb->size - 1);
743	if ((flags1 & PAGE_WRITE) \|\| (flags2 & PAGE_WRITE)) {
744	printf("ERROR page flags: PC=%08lx size=%04x f1=%x f2=%x\n",
745	(long)tb->pc, tb->size, flags1, flags2);
746	}
747	}
748	}
749	}
750
751	static void tb_jmp_check(TranslationBlock *tb)
752	{
753	TranslationBlock *tb1;
754	unsigned int n1;
755
756	/* suppress any remaining jumps to this TB */
757	tb1 = tb->jmp_first;
758	for(;;) {
759	n1 = (long)tb1 & 3;
760	tb1 = (TranslationBlock *)((long)tb1 & ~3);
761	if (n1 == 2)
762	break;
763	tb1 = tb1->jmp_next[n1];
764	}
765	/* check end of list */
766	if (tb1 != tb) {
767	printf("ERROR: jmp_list from 0x%08lx\n", (long)tb);
768	}
769	}
770	#endif // DEBUG_TB_CHECK
771
772	/* invalidate one TB */
773	#ifndef VBOX
774	static inline void tb_remove(TranslationBlock *ptb, TranslationBlock tb,
775	int next_offset)
776	#else
777	DECLINLINE(void) tb_remove(TranslationBlock *ptb, TranslationBlock tb,
778	int next_offset)
779	#endif
780	{
781	TranslationBlock *tb1;
782	for(;;) {
783	tb1 = *ptb;
784	if (tb1 == tb) {
785	ptb = (TranslationBlock *)((char )tb1 + next_offset);
786	break;
787	}
788	ptb = (TranslationBlock *)((char )tb1 + next_offset);
789	}
790	}
791
792	#ifndef VBOX
793	static inline void tb_page_remove(TranslationBlock *ptb, TranslationBlock tb)
794	#else
795	DECLINLINE(void) tb_page_remove(TranslationBlock *ptb, TranslationBlock tb)
796	#endif
797	{
798	TranslationBlock *tb1;
799	unsigned int n1;
800
801	for(;;) {
802	tb1 = *ptb;
803	n1 = (long)tb1 & 3;
804	tb1 = (TranslationBlock *)((long)tb1 & ~3);
805	if (tb1 == tb) {
806	*ptb = tb1->page_next[n1];
807	break;
808	}
809	ptb = &tb1->page_next[n1];
810	}
811	}
812
813	#ifndef VBOX
814	static inline void tb_jmp_remove(TranslationBlock *tb, int n)
815	#else
816	DECLINLINE(void) tb_jmp_remove(TranslationBlock *tb, int n)
817	#endif
818	{
819	TranslationBlock tb1, *ptb;
820	unsigned int n1;
821
822	ptb = &tb->jmp_next[n];
823	tb1 = *ptb;
824	if (tb1) {
825	/* find tb(n) in circular list */
826	for(;;) {
827	tb1 = *ptb;
828	n1 = (long)tb1 & 3;
829	tb1 = (TranslationBlock *)((long)tb1 & ~3);
830	if (n1 == n && tb1 == tb)
831	break;
832	if (n1 == 2) {
833	ptb = &tb1->jmp_first;
834	} else {
835	ptb = &tb1->jmp_next[n1];
836	}
837	}
838	/* now we can suppress tb(n) from the list */
839	*ptb = tb->jmp_next[n];
840
841	tb->jmp_next[n] = NULL;
842	}
843	}
844
845	/* reset the jump entry 'n' of a TB so that it is not chained to
846	another TB */
847	#ifndef VBOX
848	static inline void tb_reset_jump(TranslationBlock *tb, int n)
849	#else
850	DECLINLINE(void) tb_reset_jump(TranslationBlock *tb, int n)
851	#endif
852	{
853	tb_set_jmp_target(tb, n, (unsigned long)(tb->tc_ptr + tb->tb_next_offset[n]));
854	}
855
856	void tb_phys_invalidate(TranslationBlock *tb, target_ulong page_addr)
857	{
858	CPUState *env;
859	PageDesc *p;
860	unsigned int h, n1;
861	target_phys_addr_t phys_pc;
862	TranslationBlock tb1, tb2;
863
864	/* remove the TB from the hash list */
865	phys_pc = tb->page_addr[0] + (tb->pc & ~TARGET_PAGE_MASK);
866	h = tb_phys_hash_func(phys_pc);
867	tb_remove(&tb_phys_hash[h], tb,
868	offsetof(TranslationBlock, phys_hash_next));
869
870	/* remove the TB from the page list */
871	if (tb->page_addr[0] != page_addr) {
872	p = page_find(tb->page_addr[0] >> TARGET_PAGE_BITS);
873	tb_page_remove(&p->first_tb, tb);
874	invalidate_page_bitmap(p);
875	}
876	if (tb->page_addr[1] != -1 && tb->page_addr[1] != page_addr) {
877	p = page_find(tb->page_addr[1] >> TARGET_PAGE_BITS);
878	tb_page_remove(&p->first_tb, tb);
879	invalidate_page_bitmap(p);
880	}
881
882	tb_invalidated_flag = 1;
883
884	/* remove the TB from the hash list */
885	h = tb_jmp_cache_hash_func(tb->pc);
886	for(env = first_cpu; env != NULL; env = env->next_cpu) {
887	if (env->tb_jmp_cache[h] == tb)
888	env->tb_jmp_cache[h] = NULL;
889	}
890
891	/* suppress this TB from the two jump lists */
892	tb_jmp_remove(tb, 0);
893	tb_jmp_remove(tb, 1);
894
895	/* suppress any remaining jumps to this TB */
896	tb1 = tb->jmp_first;
897	for(;;) {
898	n1 = (long)tb1 & 3;
899	if (n1 == 2)
900	break;
901	tb1 = (TranslationBlock *)((long)tb1 & ~3);
902	tb2 = tb1->jmp_next[n1];
903	tb_reset_jump(tb1, n1);
904	tb1->jmp_next[n1] = NULL;
905	tb1 = tb2;
906	}
907	tb->jmp_first = (TranslationBlock )((long)tb \| 2); / fail safe */
908
909	#ifndef VBOX
910	tb_phys_invalidate_count++;
911	#endif
912	}
913
914
915	#ifdef VBOX
916	void tb_invalidate_virt(CPUState *env, uint32_t eip)
917	{
918	# if 1
919	tb_flush(env);
920	# else
921	uint8_t cs_base, pc;
922	unsigned int flags, h, phys_pc;
923	TranslationBlock tb, *ptb;
924
925	flags = env->hflags;
926	flags \|= (env->eflags & (IOPL_MASK \| TF_MASK \| VM_MASK));
927	cs_base = env->segs[R_CS].base;
928	pc = cs_base + eip;
929
930	tb = tb_find(&ptb, (unsigned long)pc, (unsigned long)cs_base,
931	flags);
932
933	if(tb)
934	{
935	# ifdef DEBUG
936	printf("invalidating TB (%08X) at %08X\n", tb, eip);
937	# endif
938	tb_invalidate(tb);
939	//Note: this will leak TBs, but the whole cache will be flushed
940	// when it happens too often
941	tb->pc = 0;
942	tb->cs_base = 0;
943	tb->flags = 0;
944	}
945	# endif
946	}
947
948	# ifdef VBOX_STRICT
949	/**
950	* Gets the page offset.
951	*/
952	unsigned long get_phys_page_offset(target_ulong addr)
953	{
954	PhysPageDesc *p = phys_page_find(addr >> TARGET_PAGE_BITS);
955	return p ? p->phys_offset : 0;
956	}
957	# endif /* VBOX_STRICT */
958	#endif /* VBOX */
959
960	#ifndef VBOX
961	static inline void set_bits(uint8_t *tab, int start, int len)
962	#else
963	DECLINLINE(void) set_bits(uint8_t *tab, int start, int len)
964	#endif
965	{
966	int end, mask, end1;
967
968	end = start + len;
969	tab += start >> 3;
970	mask = 0xff << (start & 7);
971	if ((start & ~7) == (end & ~7)) {
972	if (start < end) {
973	mask &= ~(0xff << (end & 7));
974	*tab \|= mask;
975	}
976	} else {
977	*tab++ \|= mask;
978	start = (start + 8) & ~7;
979	end1 = end & ~7;
980	while (start < end1) {
981	*tab++ = 0xff;
982	start += 8;
983	}
984	if (start < end) {
985	mask = ~(0xff << (end & 7));
986	*tab \|= mask;
987	}
988	}
989	}
990
991	static void build_page_bitmap(PageDesc *p)
992	{
993	int n, tb_start, tb_end;
994	TranslationBlock *tb;
995
996	p->code_bitmap = qemu_malloc(TARGET_PAGE_SIZE / 8);
997	if (!p->code_bitmap)
998	return;
999	memset(p->code_bitmap, 0, TARGET_PAGE_SIZE / 8);
1000
1001	tb = p->first_tb;
1002	while (tb != NULL) {
1003	n = (long)tb & 3;
1004	tb = (TranslationBlock *)((long)tb & ~3);
1005	/* NOTE: this is subtle as a TB may span two physical pages */
1006	if (n == 0) {
1007	/* NOTE: tb_end may be after the end of the page, but
1008	it is not a problem */
1009	tb_start = tb->pc & ~TARGET_PAGE_MASK;
1010	tb_end = tb_start + tb->size;
1011	if (tb_end > TARGET_PAGE_SIZE)
1012	tb_end = TARGET_PAGE_SIZE;
1013	} else {
1014	tb_start = 0;
1015	tb_end = ((tb->pc + tb->size) & ~TARGET_PAGE_MASK);
1016	}
1017	set_bits(p->code_bitmap, tb_start, tb_end - tb_start);
1018	tb = tb->page_next[n];
1019	}
1020	}
1021
1022	TranslationBlock tb_gen_code(CPUState env,
1023	target_ulong pc, target_ulong cs_base,
1024	int flags, int cflags)
1025	{
1026	TranslationBlock *tb;
1027	uint8_t *tc_ptr;
1028	target_ulong phys_pc, phys_page2, virt_page2;
1029	int code_gen_size;
1030
1031	phys_pc = get_phys_addr_code(env, pc);
1032	tb = tb_alloc(pc);
1033	if (!tb) {
1034	/* flush must be done */
1035	tb_flush(env);
1036	/* cannot fail at this point */
1037	tb = tb_alloc(pc);
1038	/* Don't forget to invalidate previous TB info. */
1039	tb_invalidated_flag = 1;
1040	}
1041	tc_ptr = code_gen_ptr;
1042	tb->tc_ptr = tc_ptr;
1043	tb->cs_base = cs_base;
1044	tb->flags = flags;
1045	tb->cflags = cflags;
1046	cpu_gen_code(env, tb, &code_gen_size);
1047	code_gen_ptr = (void *)(((unsigned long)code_gen_ptr + code_gen_size + CODE_GEN_ALIGN - 1) & ~(CODE_GEN_ALIGN - 1));
1048
1049	/* check next page if needed */
1050	virt_page2 = (pc + tb->size - 1) & TARGET_PAGE_MASK;
1051	phys_page2 = -1;
1052	if ((pc & TARGET_PAGE_MASK) != virt_page2) {
1053	phys_page2 = get_phys_addr_code(env, virt_page2);
1054	}
1055	tb_link_phys(tb, phys_pc, phys_page2);
1056	return tb;
1057	}
1058
1059	/* invalidate all TBs which intersect with the target physical page
1060	starting in range [start;end[. NOTE: start and end must refer to
1061	the same physical page. 'is_cpu_write_access' should be true if called
1062	from a real cpu write access: the virtual CPU will exit the current
1063	TB if code is modified inside this TB. */
1064	void tb_invalidate_phys_page_range(target_phys_addr_t start, target_phys_addr_t end,
1065	int is_cpu_write_access)
1066	{
1067	int n, current_tb_modified, current_tb_not_found, current_flags;
1068	CPUState *env = cpu_single_env;
1069	PageDesc *p;
1070	TranslationBlock tb, tb_next, current_tb, saved_tb;
1071	target_ulong tb_start, tb_end;
1072	target_ulong current_pc, current_cs_base;
1073
1074	p = page_find(start >> TARGET_PAGE_BITS);
1075	if (!p)
1076	return;
1077	if (!p->code_bitmap &&
1078	++p->code_write_count >= SMC_BITMAP_USE_THRESHOLD &&
1079	is_cpu_write_access) {
1080	/* build code bitmap */
1081	build_page_bitmap(p);
1082	}
1083
1084	/* we remove all the TBs in the range [start, end[ */
1085	/* XXX: see if in some cases it could be faster to invalidate all the code */
1086	current_tb_not_found = is_cpu_write_access;
1087	current_tb_modified = 0;
1088	current_tb = NULL; /* avoid warning */
1089	current_pc = 0; /* avoid warning */
1090	current_cs_base = 0; /* avoid warning */
1091	current_flags = 0; /* avoid warning */
1092	tb = p->first_tb;
1093	while (tb != NULL) {
1094	n = (long)tb & 3;
1095	tb = (TranslationBlock *)((long)tb & ~3);
1096	tb_next = tb->page_next[n];
1097	/* NOTE: this is subtle as a TB may span two physical pages */
1098	if (n == 0) {
1099	/* NOTE: tb_end may be after the end of the page, but
1100	it is not a problem */
1101	tb_start = tb->page_addr[0] + (tb->pc & ~TARGET_PAGE_MASK);
1102	tb_end = tb_start + tb->size;
1103	} else {
1104	tb_start = tb->page_addr[1];
1105	tb_end = tb_start + ((tb->pc + tb->size) & ~TARGET_PAGE_MASK);
1106	}
1107	if (!(tb_end <= start \|\| tb_start >= end)) {
1108	#ifdef TARGET_HAS_PRECISE_SMC
1109	if (current_tb_not_found) {
1110	current_tb_not_found = 0;
1111	current_tb = NULL;
1112	if (env->mem_io_pc) {
1113	/* now we have a real cpu fault */
1114	current_tb = tb_find_pc(env->mem_io_pc);
1115	}
1116	}
1117	if (current_tb == tb &&
1118	(current_tb->cflags & CF_COUNT_MASK) != 1) {
1119	/* If we are modifying the current TB, we must stop
1120	its execution. We could be more precise by checking
1121	that the modification is after the current PC, but it
1122	would require a specialized function to partially
1123	restore the CPU state */
1124
1125	current_tb_modified = 1;
1126	cpu_restore_state(current_tb, env,
1127	env->mem_io_pc, NULL);
1128	#if defined(TARGET_I386)
1129	current_flags = env->hflags;
1130	current_flags \|= (env->eflags & (IOPL_MASK \| TF_MASK \| VM_MASK));
1131	current_cs_base = (target_ulong)env->segs[R_CS].base;
1132	current_pc = current_cs_base + env->eip;
1133	#else
1134	#error unsupported CPU
1135	#endif
1136	}
1137	#endif /* TARGET_HAS_PRECISE_SMC */
1138	/* we need to do that to handle the case where a signal
1139	occurs while doing tb_phys_invalidate() */
1140	saved_tb = NULL;
1141	if (env) {
1142	saved_tb = env->current_tb;
1143	env->current_tb = NULL;
1144	}
1145	tb_phys_invalidate(tb, -1);
1146	if (env) {
1147	env->current_tb = saved_tb;
1148	if (env->interrupt_request && env->current_tb)
1149	cpu_interrupt(env, env->interrupt_request);
1150	}
1151	}
1152	tb = tb_next;
1153	}
1154	#if !defined(CONFIG_USER_ONLY)
1155	/* if no code remaining, no need to continue to use slow writes */
1156	if (!p->first_tb) {
1157	invalidate_page_bitmap(p);
1158	if (is_cpu_write_access) {
1159	tlb_unprotect_code_phys(env, start, env->mem_io_vaddr);
1160	}
1161	}
1162	#endif
1163	#ifdef TARGET_HAS_PRECISE_SMC
1164	if (current_tb_modified) {
1165	/* we generate a block containing just the instruction
1166	modifying the memory. It will ensure that it cannot modify
1167	itself */
1168	env->current_tb = NULL;
1169	tb_gen_code(env, current_pc, current_cs_base, current_flags, 1);
1170	cpu_resume_from_signal(env, NULL);
1171	}
1172	#endif
1173	}
1174
1175
1176	/* len must be <= 8 and start must be a multiple of len */
1177	#ifndef VBOX
1178	static inline void tb_invalidate_phys_page_fast(target_phys_addr_t start, int len)
1179	#else
1180	DECLINLINE(void) tb_invalidate_phys_page_fast(target_phys_addr_t start, int len)
1181	#endif
1182	{
1183	PageDesc *p;
1184	int offset, b;
1185	#if 0
1186	if (1) {
1187	if (loglevel) {
1188	fprintf(logfile, "modifying code at 0x%x size=%d EIP=%x PC=%08x\n",
1189	cpu_single_env->mem_io_vaddr, len,
1190	cpu_single_env->eip,
1191	cpu_single_env->eip + (long)cpu_single_env->segs[R_CS].base);
1192	}
1193	}
1194	#endif
1195	p = page_find(start >> TARGET_PAGE_BITS);
1196	if (!p)
1197	return;
1198	if (p->code_bitmap) {
1199	offset = start & ~TARGET_PAGE_MASK;
1200	b = p->code_bitmap[offset >> 3] >> (offset & 7);
1201	if (b & ((1 << len) - 1))
1202	goto do_invalidate;
1203	} else {
1204	do_invalidate:
1205	tb_invalidate_phys_page_range(start, start + len, 1);
1206	}
1207	}
1208
1209
1210	#if !defined(CONFIG_SOFTMMU)
1211	static void tb_invalidate_phys_page(target_phys_addr_t addr,
1212	unsigned long pc, void *puc)
1213	{
1214	int n, current_flags, current_tb_modified;
1215	target_ulong current_pc, current_cs_base;
1216	PageDesc *p;
1217	TranslationBlock tb, current_tb;
1218	#ifdef TARGET_HAS_PRECISE_SMC
1219	CPUState *env = cpu_single_env;
1220	#endif
1221
1222	addr &= TARGET_PAGE_MASK;
1223	p = page_find(addr >> TARGET_PAGE_BITS);
1224	if (!p)
1225	return;
1226	tb = p->first_tb;
1227	current_tb_modified = 0;
1228	current_tb = NULL;
1229	current_pc = 0; /* avoid warning */
1230	current_cs_base = 0; /* avoid warning */
1231	current_flags = 0; /* avoid warning */
1232	#ifdef TARGET_HAS_PRECISE_SMC
1233	if (tb && pc != 0) {
1234	current_tb = tb_find_pc(pc);
1235	}
1236	#endif
1237	while (tb != NULL) {
1238	n = (long)tb & 3;
1239	tb = (TranslationBlock *)((long)tb & ~3);
1240	#ifdef TARGET_HAS_PRECISE_SMC
1241	if (current_tb == tb &&
1242	(current_tb->cflags & CF_COUNT_MASK) != 1) {
1243	/* If we are modifying the current TB, we must stop
1244	its execution. We could be more precise by checking
1245	that the modification is after the current PC, but it
1246	would require a specialized function to partially
1247	restore the CPU state */
1248
1249	current_tb_modified = 1;
1250	cpu_restore_state(current_tb, env, pc, puc);
1251	#if defined(TARGET_I386)
1252	current_flags = env->hflags;
1253	current_flags \|= (env->eflags & (IOPL_MASK \| TF_MASK \| VM_MASK));
1254	current_cs_base = (target_ulong)env->segs[R_CS].base;
1255	current_pc = current_cs_base + env->eip;
1256	#else
1257	#error unsupported CPU
1258	#endif
1259	}
1260	#endif /* TARGET_HAS_PRECISE_SMC */
1261	tb_phys_invalidate(tb, addr);
1262	tb = tb->page_next[n];
1263	}
1264	p->first_tb = NULL;
1265	#ifdef TARGET_HAS_PRECISE_SMC
1266	if (current_tb_modified) {
1267	/* we generate a block containing just the instruction
1268	modifying the memory. It will ensure that it cannot modify
1269	itself */
1270	env->current_tb = NULL;
1271	tb_gen_code(env, current_pc, current_cs_base, current_flags, 1);
1272	cpu_resume_from_signal(env, puc);
1273	}
1274	#endif
1275	}
1276	#endif
1277
1278	/* add the tb in the target page and protect it if necessary */
1279	#ifndef VBOX
1280	static inline void tb_alloc_page(TranslationBlock *tb,
1281	unsigned int n, target_ulong page_addr)
1282	#else
1283	DECLINLINE(void) tb_alloc_page(TranslationBlock *tb,
1284	unsigned int n, target_ulong page_addr)
1285	#endif
1286	{
1287	PageDesc *p;
1288	TranslationBlock *last_first_tb;
1289
1290	tb->page_addr[n] = page_addr;
1291	p = page_find_alloc(page_addr >> TARGET_PAGE_BITS);
1292	tb->page_next[n] = p->first_tb;
1293	last_first_tb = p->first_tb;
1294	p->first_tb = (TranslationBlock *)((long)tb \| n);
1295	invalidate_page_bitmap(p);
1296
1297	#if defined(TARGET_HAS_SMC) \|\| 1
1298
1299	#if defined(CONFIG_USER_ONLY)
1300	if (p->flags & PAGE_WRITE) {
1301	target_ulong addr;
1302	PageDesc *p2;
1303	int prot;
1304
1305	/* force the host page as non writable (writes will have a
1306	page fault + mprotect overhead) */
1307	page_addr &= qemu_host_page_mask;
1308	prot = 0;
1309	for(addr = page_addr; addr < page_addr + qemu_host_page_size;
1310	addr += TARGET_PAGE_SIZE) {
1311
1312	p2 = page_find (addr >> TARGET_PAGE_BITS);
1313	if (!p2)
1314	continue;
1315	prot \|= p2->flags;
1316	p2->flags &= ~PAGE_WRITE;
1317	page_get_flags(addr);
1318	}
1319	mprotect(g2h(page_addr), qemu_host_page_size,
1320	(prot & PAGE_BITS) & ~PAGE_WRITE);
1321	#ifdef DEBUG_TB_INVALIDATE
1322	printf("protecting code page: 0x" TARGET_FMT_lx "\n",
1323	page_addr);
1324	#endif
1325	}
1326	#else
1327	/* if some code is already present, then the pages are already
1328	protected. So we handle the case where only the first TB is
1329	allocated in a physical page */
1330	if (!last_first_tb) {
1331	tlb_protect_code(page_addr);
1332	}
1333	#endif
1334
1335	#endif /* TARGET_HAS_SMC */
1336	}
1337
1338	/* Allocate a new translation block. Flush the translation buffer if
1339	too many translation blocks or too much generated code. */
1340	TranslationBlock *tb_alloc(target_ulong pc)
1341	{
1342	TranslationBlock *tb;
1343
1344	if (nb_tbs >= code_gen_max_blocks \|\|
1345	#ifndef VBOX
1346	(code_gen_ptr - code_gen_buffer) >= code_gen_buffer_max_size)
1347	#else
1348	(code_gen_ptr - code_gen_buffer) >= (int)code_gen_buffer_max_size)
1349	#endif
1350	return NULL;
1351	tb = &tbs[nb_tbs++];
1352	tb->pc = pc;
1353	tb->cflags = 0;
1354	return tb;
1355	}
1356
1357	void tb_free(TranslationBlock *tb)
1358	{
1359	/* In practice this is mostly used for single use temporary TB
1360	Ignore the hard cases and just back up if this TB happens to
1361	be the last one generated. */
1362	if (nb_tbs > 0 && tb == &tbs[nb_tbs - 1]) {
1363	code_gen_ptr = tb->tc_ptr;
1364	nb_tbs--;
1365	}
1366	}
1367
1368	/* add a new TB and link it to the physical page tables. phys_page2 is
1369	(-1) to indicate that only one page contains the TB. */
1370	void tb_link_phys(TranslationBlock *tb,
1371	target_ulong phys_pc, target_ulong phys_page2)
1372	{
1373	unsigned int h;
1374	TranslationBlock **ptb;
1375
1376	/* Grab the mmap lock to stop another thread invalidating this TB
1377	before we are done. */
1378	mmap_lock();
1379	/* add in the physical hash table */
1380	h = tb_phys_hash_func(phys_pc);
1381	ptb = &tb_phys_hash[h];
1382	tb->phys_hash_next = *ptb;
1383	*ptb = tb;
1384
1385	/* add in the page list */
1386	tb_alloc_page(tb, 0, phys_pc & TARGET_PAGE_MASK);
1387	if (phys_page2 != -1)
1388	tb_alloc_page(tb, 1, phys_page2);
1389	else
1390	tb->page_addr[1] = -1;
1391
1392	tb->jmp_first = (TranslationBlock *)((long)tb \| 2);
1393	tb->jmp_next[0] = NULL;
1394	tb->jmp_next[1] = NULL;
1395
1396	/* init original jump addresses */
1397	if (tb->tb_next_offset[0] != 0xffff)
1398	tb_reset_jump(tb, 0);
1399	if (tb->tb_next_offset[1] != 0xffff)
1400	tb_reset_jump(tb, 1);
1401
1402	#ifdef DEBUG_TB_CHECK
1403	tb_page_check();
1404	#endif
1405	mmap_unlock();
1406	}
1407
1408	/* find the TB 'tb' such that tb[0].tc_ptr <= tc_ptr <
1409	tb[1].tc_ptr. Return NULL if not found */
1410	TranslationBlock *tb_find_pc(unsigned long tc_ptr)
1411	{
1412	int m_min, m_max, m;
1413	unsigned long v;
1414	TranslationBlock *tb;
1415
1416	if (nb_tbs <= 0)
1417	return NULL;
1418	if (tc_ptr < (unsigned long)code_gen_buffer \|\|
1419	tc_ptr >= (unsigned long)code_gen_ptr)
1420	return NULL;
1421	/* binary search (cf Knuth) */
1422	m_min = 0;
1423	m_max = nb_tbs - 1;
1424	while (m_min <= m_max) {
1425	m = (m_min + m_max) >> 1;
1426	tb = &tbs[m];
1427	v = (unsigned long)tb->tc_ptr;
1428	if (v == tc_ptr)
1429	return tb;
1430	else if (tc_ptr < v) {
1431	m_max = m - 1;
1432	} else {
1433	m_min = m + 1;
1434	}
1435	}
1436	return &tbs[m_max];
1437	}
1438
1439	static void tb_reset_jump_recursive(TranslationBlock *tb);
1440
1441	#ifndef VBOX
1442	static inline void tb_reset_jump_recursive2(TranslationBlock *tb, int n)
1443	#else
1444	DECLINLINE(void) tb_reset_jump_recursive2(TranslationBlock *tb, int n)
1445	#endif
1446	{
1447	TranslationBlock tb1, tb_next, **ptb;
1448	unsigned int n1;
1449
1450	tb1 = tb->jmp_next[n];
1451	if (tb1 != NULL) {
1452	/* find head of list */
1453	for(;;) {
1454	n1 = (long)tb1 & 3;
1455	tb1 = (TranslationBlock *)((long)tb1 & ~3);
1456	if (n1 == 2)
1457	break;
1458	tb1 = tb1->jmp_next[n1];
1459	}
1460	/* we are now sure now that tb jumps to tb1 */
1461	tb_next = tb1;
1462
1463	/* remove tb from the jmp_first list */
1464	ptb = &tb_next->jmp_first;
1465	for(;;) {
1466	tb1 = *ptb;
1467	n1 = (long)tb1 & 3;
1468	tb1 = (TranslationBlock *)((long)tb1 & ~3);
1469	if (n1 == n && tb1 == tb)
1470	break;
1471	ptb = &tb1->jmp_next[n1];
1472	}
1473	*ptb = tb->jmp_next[n];
1474	tb->jmp_next[n] = NULL;
1475
1476	/* suppress the jump to next tb in generated code */
1477	tb_reset_jump(tb, n);
1478
1479	/* suppress jumps in the tb on which we could have jumped */
1480	tb_reset_jump_recursive(tb_next);
1481	}
1482	}
1483
1484	static void tb_reset_jump_recursive(TranslationBlock *tb)
1485	{
1486	tb_reset_jump_recursive2(tb, 0);
1487	tb_reset_jump_recursive2(tb, 1);
1488	}
1489
1490	#if defined(TARGET_HAS_ICE)
1491	static void breakpoint_invalidate(CPUState *env, target_ulong pc)
1492	{
1493	target_ulong addr, pd;
1494	ram_addr_t ram_addr;
1495	PhysPageDesc *p;
1496
1497	addr = cpu_get_phys_page_debug(env, pc);
1498	p = phys_page_find(addr >> TARGET_PAGE_BITS);
1499	if (!p) {
1500	pd = IO_MEM_UNASSIGNED;
1501	} else {
1502	pd = p->phys_offset;
1503	}
1504	ram_addr = (pd & TARGET_PAGE_MASK) \| (pc & ~TARGET_PAGE_MASK);
1505	tb_invalidate_phys_page_range(ram_addr, ram_addr + 1, 0);
1506	}
1507	#endif
1508
1509	/* Add a watchpoint. */
1510	int cpu_watchpoint_insert(CPUState *env, target_ulong addr, int type)
1511	{
1512	int i;
1513
1514	for (i = 0; i < env->nb_watchpoints; i++) {
1515	if (addr == env->watchpoint[i].vaddr)
1516	return 0;
1517	}
1518	if (env->nb_watchpoints >= MAX_WATCHPOINTS)
1519	return -1;
1520
1521	i = env->nb_watchpoints++;
1522	env->watchpoint[i].vaddr = addr;
1523	env->watchpoint[i].type = type;
1524	tlb_flush_page(env, addr);
1525	/* FIXME: This flush is needed because of the hack to make memory ops
1526	terminate the TB. It can be removed once the proper IO trap and
1527	re-execute bits are in. */
1528	tb_flush(env);
1529	return i;
1530	}
1531
1532	/* Remove a watchpoint. */
1533	int cpu_watchpoint_remove(CPUState *env, target_ulong addr)
1534	{
1535	int i;
1536
1537	for (i = 0; i < env->nb_watchpoints; i++) {
1538	if (addr == env->watchpoint[i].vaddr) {
1539	env->nb_watchpoints--;
1540	env->watchpoint[i] = env->watchpoint[env->nb_watchpoints];
1541	tlb_flush_page(env, addr);
1542	return 0;
1543	}
1544	}
1545	return -1;
1546	}
1547
1548	/* Remove all watchpoints. */
1549	void cpu_watchpoint_remove_all(CPUState *env) {
1550	int i;
1551
1552	for (i = 0; i < env->nb_watchpoints; i++) {
1553	tlb_flush_page(env, env->watchpoint[i].vaddr);
1554	}
1555	env->nb_watchpoints = 0;
1556	}
1557
1558	/* add a breakpoint. EXCP_DEBUG is returned by the CPU loop if a
1559	breakpoint is reached */
1560	int cpu_breakpoint_insert(CPUState *env, target_ulong pc)
1561	{
1562	#if defined(TARGET_HAS_ICE)
1563	int i;
1564
1565	for(i = 0; i < env->nb_breakpoints; i++) {
1566	if (env->breakpoints[i] == pc)
1567	return 0;
1568	}
1569
1570	if (env->nb_breakpoints >= MAX_BREAKPOINTS)
1571	return -1;
1572	env->breakpoints[env->nb_breakpoints++] = pc;
1573
1574	breakpoint_invalidate(env, pc);
1575	return 0;
1576	#else
1577	return -1;
1578	#endif
1579	}
1580
1581	/* remove all breakpoints */
1582	void cpu_breakpoint_remove_all(CPUState *env) {
1583	#if defined(TARGET_HAS_ICE)
1584	int i;
1585	for(i = 0; i < env->nb_breakpoints; i++) {
1586	breakpoint_invalidate(env, env->breakpoints[i]);
1587	}
1588	env->nb_breakpoints = 0;
1589	#endif
1590	}
1591
1592	/* remove a breakpoint */
1593	int cpu_breakpoint_remove(CPUState *env, target_ulong pc)
1594	{
1595	#if defined(TARGET_HAS_ICE)
1596	int i;
1597	for(i = 0; i < env->nb_breakpoints; i++) {
1598	if (env->breakpoints[i] == pc)
1599	goto found;
1600	}
1601	return -1;
1602	found:
1603	env->nb_breakpoints--;
1604	if (i < env->nb_breakpoints)
1605	env->breakpoints[i] = env->breakpoints[env->nb_breakpoints];
1606
1607	breakpoint_invalidate(env, pc);
1608	return 0;
1609	#else
1610	return -1;
1611	#endif
1612	}
1613
1614	/* enable or disable single step mode. EXCP_DEBUG is returned by the
1615	CPU loop after each instruction */
1616	void cpu_single_step(CPUState *env, int enabled)
1617	{
1618	#if defined(TARGET_HAS_ICE)
1619	if (env->singlestep_enabled != enabled) {
1620	env->singlestep_enabled = enabled;
1621	/* must flush all the translated code to avoid inconsistancies */
1622	/* XXX: only flush what is necessary */
1623	tb_flush(env);
1624	}
1625	#endif
1626	}
1627
1628	#ifndef VBOX
1629	/* enable or disable low levels log */
1630	void cpu_set_log(int log_flags)
1631	{
1632	loglevel = log_flags;
1633	if (loglevel && !logfile) {
1634	logfile = fopen(logfilename, "w");
1635	if (!logfile) {
1636	perror(logfilename);
1637	_exit(1);
1638	}
1639	#if !defined(CONFIG_SOFTMMU)
1640	/* must avoid mmap() usage of glibc by setting a buffer "by hand" */
1641	{
1642	static uint8_t logfile_buf[4096];
1643	setvbuf(logfile, logfile_buf, _IOLBF, sizeof(logfile_buf));
1644	}
1645	#else
1646	setvbuf(logfile, NULL, _IOLBF, 0);
1647	#endif
1648	}
1649	}
1650
1651	void cpu_set_log_filename(const char *filename)
1652	{
1653	logfilename = strdup(filename);
1654	}
1655	#endif /* !VBOX */
1656
1657	/* mask must never be zero, except for A20 change call */
1658	void cpu_interrupt(CPUState *env, int mask)
1659	{
1660	#if !defined(USE_NPTL)
1661	TranslationBlock *tb;
1662	static spinlock_t interrupt_lock = SPIN_LOCK_UNLOCKED;
1663	#endif
1664	int old_mask;
1665
1666	old_mask = env->interrupt_request;
1667	#ifdef VBOX
1668	VM_ASSERT_EMT(env->pVM);
1669	ASMAtomicOrS32((int32_t volatile *)&env->interrupt_request, mask);
1670	#else /* !VBOX */
1671	/* FIXME: This is probably not threadsafe. A different thread could
1672	be in the middle of a read-modify-write operation. */
1673	env->interrupt_request \|= mask;
1674	#endif /* !VBOX */
1675	#if defined(USE_NPTL)
1676	/* FIXME: TB unchaining isn't SMP safe. For now just ignore the
1677	problem and hope the cpu will stop of its own accord. For userspace
1678	emulation this often isn't actually as bad as it sounds. Often
1679	signals are used primarily to interrupt blocking syscalls. */
1680	#else
1681	if (use_icount) {
1682	env->icount_decr.u16.high = 0xffff;
1683	#ifndef CONFIG_USER_ONLY
1684	/* CPU_INTERRUPT_EXIT isn't a real interrupt. It just means
1685	an async event happened and we need to process it. */
1686	if (!can_do_io(env)
1687	&& (mask & ~(old_mask \| CPU_INTERRUPT_EXIT)) != 0) {
1688	cpu_abort(env, "Raised interrupt while not in I/O function");
1689	}
1690	#endif
1691	} else {
1692	tb = env->current_tb;
1693	/* if the cpu is currently executing code, we must unlink it and
1694	all the potentially executing TB */
1695	if (tb && !testandset(&interrupt_lock)) {
1696	env->current_tb = NULL;
1697	tb_reset_jump_recursive(tb);
1698	resetlock(&interrupt_lock);
1699	}
1700	}
1701	#endif
1702	}
1703
1704	void cpu_reset_interrupt(CPUState *env, int mask)
1705	{
1706	#ifdef VBOX
1707	/*
1708	* Note: the current implementation can be executed by another thread without problems; make sure this remains true
1709	* for future changes!
1710	*/
1711	ASMAtomicAndS32((int32_t volatile *)&env->interrupt_request, ~mask);
1712	#else /* !VBOX */
1713	env->interrupt_request &= ~mask;
1714	#endif /* !VBOX */
1715	}
1716
1717	#ifndef VBOX
1718	CPULogItem cpu_log_items[] = {
1719	{ CPU_LOG_TB_OUT_ASM, "out_asm",
1720	"show generated host assembly code for each compiled TB" },
1721	{ CPU_LOG_TB_IN_ASM, "in_asm",
1722	"show target assembly code for each compiled TB" },
1723	{ CPU_LOG_TB_OP, "op",
1724	"show micro ops for each compiled TB (only usable if 'in_asm' used)" },
1725	#ifdef TARGET_I386
1726	{ CPU_LOG_TB_OP_OPT, "op_opt",
1727	"show micro ops after optimization for each compiled TB" },
1728	#endif
1729	{ CPU_LOG_INT, "int",
1730	"show interrupts/exceptions in short format" },
1731	{ CPU_LOG_EXEC, "exec",
1732	"show trace before each executed TB (lots of logs)" },
1733	{ CPU_LOG_TB_CPU, "cpu",
1734	"show CPU state before bloc translation" },
1735	#ifdef TARGET_I386
1736	{ CPU_LOG_PCALL, "pcall",
1737	"show protected mode far calls/returns/exceptions" },
1738	#endif
1739	#ifdef DEBUG_IOPORT
1740	{ CPU_LOG_IOPORT, "ioport",
1741	"show all i/o ports accesses" },
1742	#endif
1743	{ 0, NULL, NULL },
1744	};
1745
1746	static int cmp1(const char s1, int n, const char s2)
1747	{
1748	if (strlen(s2) != n)
1749	return 0;
1750	return memcmp(s1, s2, n) == 0;
1751	}
1752
1753	/* takes a comma separated list of log masks. Return 0 if error. */
1754	int cpu_str_to_log_mask(const char *str)
1755	{
1756	CPULogItem *item;
1757	int mask;
1758	const char p, p1;
1759
1760	p = str;
1761	mask = 0;
1762	for(;;) {
1763	p1 = strchr(p, ',');
1764	if (!p1)
1765	p1 = p + strlen(p);
1766	if(cmp1(p,p1-p,"all")) {
1767	for(item = cpu_log_items; item->mask != 0; item++) {
1768	mask \|= item->mask;
1769	}
1770	} else {
1771	for(item = cpu_log_items; item->mask != 0; item++) {
1772	if (cmp1(p, p1 - p, item->name))
1773	goto found;
1774	}
1775	return 0;
1776	}
1777	found:
1778	mask \|= item->mask;
1779	if (*p1 != ',')
1780	break;
1781	p = p1 + 1;
1782	}
1783	return mask;
1784	}
1785	#endif /* !VBOX */
1786
1787	#ifndef VBOX /* VBOX: we have our own routine. */
1788	void cpu_abort(CPUState env, const char fmt, ...)
1789	{
1790	va_list ap;
1791
1792	va_start(ap, fmt);
1793	fprintf(stderr, "qemu: fatal: ");
1794	vfprintf(stderr, fmt, ap);
1795	fprintf(stderr, "\n");
1796	#ifdef TARGET_I386
1797	cpu_dump_state(env, stderr, fprintf, X86_DUMP_FPU \| X86_DUMP_CCOP);
1798	#else
1799	cpu_dump_state(env, stderr, fprintf, 0);
1800	#endif
1801	va_end(ap);
1802	abort();
1803	}
1804	#endif /* !VBOX */
1805
1806	#ifndef VBOX
1807	CPUState cpu_copy(CPUState env)
1808	{
1809	CPUState *new_env = cpu_init(env->cpu_model_str);
1810	/* preserve chaining and index */
1811	CPUState *next_cpu = new_env->next_cpu;
1812	int cpu_index = new_env->cpu_index;
1813	memcpy(new_env, env, sizeof(CPUState));
1814	new_env->next_cpu = next_cpu;
1815	new_env->cpu_index = cpu_index;
1816	return new_env;
1817	}
1818	#endif
1819
1820	#if !defined(CONFIG_USER_ONLY)
1821
1822	#ifndef VBOX
1823	static inline void tlb_flush_jmp_cache(CPUState *env, target_ulong addr)
1824	#else
1825	DECLINLINE(void) tlb_flush_jmp_cache(CPUState *env, target_ulong addr)
1826	#endif
1827	{
1828	unsigned int i;
1829
1830	/* Discard jump cache entries for any tb which might potentially
1831	overlap the flushed page. */
1832	i = tb_jmp_cache_hash_page(addr - TARGET_PAGE_SIZE);
1833	memset (&env->tb_jmp_cache[i], 0,
1834	TB_JMP_PAGE_SIZE * sizeof(TranslationBlock *));
1835
1836	i = tb_jmp_cache_hash_page(addr);
1837	memset (&env->tb_jmp_cache[i], 0,
1838	TB_JMP_PAGE_SIZE * sizeof(TranslationBlock *));
1839
1840	#ifdef VBOX
1841	/* inform raw mode about TLB page flush */
1842	remR3FlushPage(env, addr);
1843	#endif /* VBOX */
1844	}
1845
1846	/* NOTE: if flush_global is true, also flush global entries (not
1847	implemented yet) */
1848	void tlb_flush(CPUState *env, int flush_global)
1849	{
1850	int i;
1851
1852	#if defined(DEBUG_TLB)
1853	printf("tlb_flush:\n");
1854	#endif
1855	/* must reset current TB so that interrupts cannot modify the
1856	links while we are modifying them */
1857	env->current_tb = NULL;
1858
1859	for(i = 0; i < CPU_TLB_SIZE; i++) {
1860	env->tlb_table[0][i].addr_read = -1;
1861	env->tlb_table[0][i].addr_write = -1;
1862	env->tlb_table[0][i].addr_code = -1;
1863	env->tlb_table[1][i].addr_read = -1;
1864	env->tlb_table[1][i].addr_write = -1;
1865	env->tlb_table[1][i].addr_code = -1;
1866	#if (NB_MMU_MODES >= 3)
1867	env->tlb_table[2][i].addr_read = -1;
1868	env->tlb_table[2][i].addr_write = -1;
1869	env->tlb_table[2][i].addr_code = -1;
1870	#if (NB_MMU_MODES == 4)
1871	env->tlb_table[3][i].addr_read = -1;
1872	env->tlb_table[3][i].addr_write = -1;
1873	env->tlb_table[3][i].addr_code = -1;
1874	#endif
1875	#endif
1876	}
1877
1878	memset (env->tb_jmp_cache, 0, TB_JMP_CACHE_SIZE * sizeof (void *));
1879
1880	#ifdef VBOX
1881	/* inform raw mode about TLB flush */
1882	remR3FlushTLB(env, flush_global);
1883	#endif
1884	#ifdef USE_KQEMU
1885	if (env->kqemu_enabled) {
1886	kqemu_flush(env, flush_global);
1887	}
1888	#endif
1889	tlb_flush_count++;
1890	}
1891
1892	#ifndef VBOX
1893	static inline void tlb_flush_entry(CPUTLBEntry *tlb_entry, target_ulong addr)
1894	#else
1895	DECLINLINE(void) tlb_flush_entry(CPUTLBEntry *tlb_entry, target_ulong addr)
1896	#endif
1897	{
1898	if (addr == (tlb_entry->addr_read &
1899	(TARGET_PAGE_MASK \| TLB_INVALID_MASK)) \|\|
1900	addr == (tlb_entry->addr_write &
1901	(TARGET_PAGE_MASK \| TLB_INVALID_MASK)) \|\|
1902	addr == (tlb_entry->addr_code &
1903	(TARGET_PAGE_MASK \| TLB_INVALID_MASK))) {
1904	tlb_entry->addr_read = -1;
1905	tlb_entry->addr_write = -1;
1906	tlb_entry->addr_code = -1;
1907	}
1908	}
1909
1910	void tlb_flush_page(CPUState *env, target_ulong addr)
1911	{
1912	int i;
1913
1914	#if defined(DEBUG_TLB)
1915	printf("tlb_flush_page: " TARGET_FMT_lx "\n", addr);
1916	#endif
1917	/* must reset current TB so that interrupts cannot modify the
1918	links while we are modifying them */
1919	env->current_tb = NULL;
1920
1921	addr &= TARGET_PAGE_MASK;
1922	i = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
1923	tlb_flush_entry(&env->tlb_table[0][i], addr);
1924	tlb_flush_entry(&env->tlb_table[1][i], addr);
1925	#if (NB_MMU_MODES >= 3)
1926	tlb_flush_entry(&env->tlb_table[2][i], addr);
1927	#if (NB_MMU_MODES == 4)
1928	tlb_flush_entry(&env->tlb_table[3][i], addr);
1929	#endif
1930	#endif
1931
1932	tlb_flush_jmp_cache(env, addr);
1933
1934	#ifdef USE_KQEMU
1935	if (env->kqemu_enabled) {
1936	kqemu_flush_page(env, addr);
1937	}
1938	#endif
1939	}
1940
1941	/* update the TLBs so that writes to code in the virtual page 'addr'
1942	can be detected */
1943	static void tlb_protect_code(ram_addr_t ram_addr)
1944	{
1945	cpu_physical_memory_reset_dirty(ram_addr,
1946	ram_addr + TARGET_PAGE_SIZE,
1947	CODE_DIRTY_FLAG);
1948	#if defined(VBOX) && defined(REM_MONITOR_CODE_PAGES)
1949	/** @todo Retest this? This function has changed... */
1950	remR3ProtectCode(cpu_single_env, ram_addr);
1951	#endif
1952	}
1953
1954	/* update the TLB so that writes in physical page 'phys_addr' are no longer
1955	tested for self modifying code */
1956	static void tlb_unprotect_code_phys(CPUState *env, ram_addr_t ram_addr,
1957	target_ulong vaddr)
1958	{
1959	#ifdef VBOX
1960	if (RT_LIKELY((ram_addr >> TARGET_PAGE_BITS) < phys_ram_dirty_size))
1961	#endif
1962	phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] \|= CODE_DIRTY_FLAG;
1963	}
1964
1965	#ifndef VBOX
1966	static inline void tlb_reset_dirty_range(CPUTLBEntry *tlb_entry,
1967	unsigned long start, unsigned long length)
1968	#else
1969	DECLINLINE(void) tlb_reset_dirty_range(CPUTLBEntry *tlb_entry,
1970	unsigned long start, unsigned long length)
1971	#endif
1972	{
1973	unsigned long addr;
1974	if ((tlb_entry->addr_write & ~TARGET_PAGE_MASK) == IO_MEM_RAM) {
1975	addr = (tlb_entry->addr_write & TARGET_PAGE_MASK) + tlb_entry->addend;
1976	if ((addr - start) < length) {
1977	tlb_entry->addr_write = (tlb_entry->addr_write & TARGET_PAGE_MASK) \| IO_MEM_NOTDIRTY;
1978	}
1979	}
1980	}
1981
1982	void cpu_physical_memory_reset_dirty(ram_addr_t start, ram_addr_t end,
1983	int dirty_flags)
1984	{
1985	CPUState *env;
1986	unsigned long length, start1;
1987	int i, mask, len;
1988	uint8_t *p;
1989
1990	start &= TARGET_PAGE_MASK;
1991	end = TARGET_PAGE_ALIGN(end);
1992
1993	length = end - start;
1994	if (length == 0)
1995	return;
1996	len = length >> TARGET_PAGE_BITS;
1997	#ifdef USE_KQEMU
1998	/* XXX: should not depend on cpu context */
1999	env = first_cpu;
2000	if (env->kqemu_enabled) {
2001	ram_addr_t addr;
2002	addr = start;
2003	for(i = 0; i < len; i++) {
2004	kqemu_set_notdirty(env, addr);
2005	addr += TARGET_PAGE_SIZE;
2006	}
2007	}
2008	#endif
2009	mask = ~dirty_flags;
2010	p = phys_ram_dirty + (start >> TARGET_PAGE_BITS);
2011	#ifdef VBOX
2012	if (RT_LIKELY((start >> TARGET_PAGE_BITS) < phys_ram_dirty_size))
2013	#endif
2014	for(i = 0; i < len; i++)
2015	p[i] &= mask;
2016
2017	/* we modify the TLB cache so that the dirty bit will be set again
2018	when accessing the range */
2019	#if defined(VBOX) && defined(REM_PHYS_ADDR_IN_TLB)
2020	start1 = start;
2021	#elif !defined(VBOX)
2022	start1 = start + (unsigned long)phys_ram_base;
2023	#else
2024	start1 = (unsigned long)remR3GCPhys2HCVirt(first_cpu, start, -1);
2025	#endif
2026	for(env = first_cpu; env != NULL; env = env->next_cpu) {
2027	for(i = 0; i < CPU_TLB_SIZE; i++)
2028	tlb_reset_dirty_range(&env->tlb_table[0][i], start1, length);
2029	for(i = 0; i < CPU_TLB_SIZE; i++)
2030	tlb_reset_dirty_range(&env->tlb_table[1][i], start1, length);
2031	#if (NB_MMU_MODES >= 3)
2032	for(i = 0; i < CPU_TLB_SIZE; i++)
2033	tlb_reset_dirty_range(&env->tlb_table[2][i], start1, length);
2034	#if (NB_MMU_MODES == 4)
2035	for(i = 0; i < CPU_TLB_SIZE; i++)
2036	tlb_reset_dirty_range(&env->tlb_table[3][i], start1, length);
2037	#endif
2038	#endif
2039	}
2040	}
2041
2042	#ifndef VBOX
2043	int cpu_physical_memory_set_dirty_tracking(int enable)
2044	{
2045	in_migration = enable;
2046	return 0;
2047	}
2048
2049	int cpu_physical_memory_get_dirty_tracking(void)
2050	{
2051	return in_migration;
2052	}
2053	#endif
2054
2055	#ifndef VBOX
2056	static inline void tlb_update_dirty(CPUTLBEntry *tlb_entry)
2057	#else
2058	DECLINLINE(void) tlb_update_dirty(CPUTLBEntry *tlb_entry)
2059	#endif
2060	{
2061	ram_addr_t ram_addr;
2062
2063	if ((tlb_entry->addr_write & ~TARGET_PAGE_MASK) == IO_MEM_RAM) {
2064	/* RAM case */
2065	#if defined(VBOX) && defined(REM_PHYS_ADDR_IN_TLB)
2066	ram_addr = (tlb_entry->addr_write & TARGET_PAGE_MASK) + tlb_entry->addend;
2067	#elif !defined(VBOX)
2068	ram_addr = (tlb_entry->addr_write & TARGET_PAGE_MASK) +
2069	tlb_entry->addend - (unsigned long)phys_ram_base;
2070	#else
2071	ram_addr = remR3HCVirt2GCPhys(first_cpu, (void*)((tlb_entry->addr_write & TARGET_PAGE_MASK) + tlb_entry->addend));
2072	#endif
2073	if (!cpu_physical_memory_is_dirty(ram_addr)) {
2074	tlb_entry->addr_write \|= TLB_NOTDIRTY;
2075	}
2076	}
2077	}
2078
2079	/* update the TLB according to the current state of the dirty bits */
2080	void cpu_tlb_update_dirty(CPUState *env)
2081	{
2082	int i;
2083	for(i = 0; i < CPU_TLB_SIZE; i++)
2084	tlb_update_dirty(&env->tlb_table[0][i]);
2085	for(i = 0; i < CPU_TLB_SIZE; i++)
2086	tlb_update_dirty(&env->tlb_table[1][i]);
2087	#if (NB_MMU_MODES >= 3)
2088	for(i = 0; i < CPU_TLB_SIZE; i++)
2089	tlb_update_dirty(&env->tlb_table[2][i]);
2090	#if (NB_MMU_MODES == 4)
2091	for(i = 0; i < CPU_TLB_SIZE; i++)
2092	tlb_update_dirty(&env->tlb_table[3][i]);
2093	#endif
2094	#endif
2095	}
2096
2097	#ifndef VBOX
2098	static inline void tlb_set_dirty1(CPUTLBEntry *tlb_entry, target_ulong vaddr)
2099	#else
2100	DECLINLINE(void) tlb_set_dirty1(CPUTLBEntry *tlb_entry, target_ulong vaddr)
2101	#endif
2102	{
2103	if (tlb_entry->addr_write == (vaddr \| TLB_NOTDIRTY))
2104	tlb_entry->addr_write = vaddr;
2105	}
2106
2107
2108	/* update the TLB corresponding to virtual page vaddr and phys addr
2109	addr so that it is no longer dirty */
2110	#ifndef VBOX
2111	static inline void tlb_set_dirty(CPUState *env,
2112	unsigned long addr, target_ulong vaddr)
2113	#else
2114	DECLINLINE(void) tlb_set_dirty(CPUState *env,
2115	unsigned long addr, target_ulong vaddr)
2116	#endif
2117	{
2118	int i;
2119
2120	addr &= TARGET_PAGE_MASK;
2121	i = (vaddr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
2122	tlb_set_dirty1(&env->tlb_table[0][i], addr);
2123	tlb_set_dirty1(&env->tlb_table[1][i], addr);
2124	#if (NB_MMU_MODES >= 3)
2125	tlb_set_dirty1(&env->tlb_table[2][i], vaddr);
2126	#if (NB_MMU_MODES == 4)
2127	tlb_set_dirty1(&env->tlb_table[3][i], vaddr);
2128	#endif
2129	#endif
2130	}
2131
2132	/* add a new TLB entry. At most one entry for a given virtual address
2133	is permitted. Return 0 if OK or 2 if the page could not be mapped
2134	(can only happen in non SOFTMMU mode for I/O pages or pages
2135	conflicting with the host address space). */
2136	int tlb_set_page_exec(CPUState *env, target_ulong vaddr,
2137	target_phys_addr_t paddr, int prot,
2138	int mmu_idx, int is_softmmu)
2139	{
2140	PhysPageDesc *p;
2141	unsigned long pd;
2142	unsigned int index;
2143	target_ulong address;
2144	target_ulong code_address;
2145	target_phys_addr_t addend;
2146	int ret;
2147	CPUTLBEntry *te;
2148	int i;
2149	target_phys_addr_t iotlb;
2150
2151	p = phys_page_find(paddr >> TARGET_PAGE_BITS);
2152	if (!p) {
2153	pd = IO_MEM_UNASSIGNED;
2154	} else {
2155	pd = p->phys_offset;
2156	}
2157	#if defined(DEBUG_TLB)
2158	printf("tlb_set_page: vaddr=" TARGET_FMT_lx " paddr=0x%08x prot=%x idx=%d smmu=%d pd=0x%08lx\n",
2159	vaddr, (int)paddr, prot, mmu_idx, is_softmmu, pd);
2160	#endif
2161
2162	ret = 0;
2163	address = vaddr;
2164	if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM && !(pd & IO_MEM_ROMD)) {
2165	/* IO memory case (romd handled later) */
2166	address \|= TLB_MMIO;
2167	}
2168	#if defined(VBOX) && defined(REM_PHYS_ADDR_IN_TLB)
2169	addend = pd & TARGET_PAGE_MASK;
2170	#elif !defined(VBOX)
2171	addend = (unsigned long)phys_ram_base + (pd & TARGET_PAGE_MASK);
2172	#else
2173	addend = (unsigned long)remR3GCPhys2HCVirt(env,
2174	pd & TARGET_PAGE_MASK,
2175	vaddr & TARGET_PAGE_MASK);
2176	#endif
2177	if ((pd & ~TARGET_PAGE_MASK) <= IO_MEM_ROM) {
2178	/* Normal RAM. */
2179	iotlb = pd & TARGET_PAGE_MASK;
2180	if ((pd & ~TARGET_PAGE_MASK) == IO_MEM_RAM)
2181	iotlb \|= IO_MEM_NOTDIRTY;
2182	else
2183	iotlb \|= IO_MEM_ROM;
2184	} else {
2185	/* IO handlers are currently passed a phsical address.
2186	It would be nice to pass an offset from the base address
2187	of that region. This would avoid having to special case RAM,
2188	and avoid full address decoding in every device.
2189	We can't use the high bits of pd for this because
2190	IO_MEM_ROMD uses these as a ram address. */
2191	iotlb = (pd & ~TARGET_PAGE_MASK) + paddr;
2192	}
2193
2194	code_address = address;
2195	/* Make accesses to pages with watchpoints go via the
2196	watchpoint trap routines. */
2197	for (i = 0; i < env->nb_watchpoints; i++) {
2198	if (vaddr == (env->watchpoint[i].vaddr & TARGET_PAGE_MASK)) {
2199	iotlb = io_mem_watch + paddr;
2200	/* TODO: The memory case can be optimized by not trapping
2201	reads of pages with a write breakpoint. */
2202	address \|= TLB_MMIO;
2203	}
2204	}
2205
2206	#ifdef VBOX
2207	# if !defined(REM_PHYS_ADDR_IN_TLB)
2208	if (addend == (target_phys_addr_t)-1)
2209	{
2210	address \|= TLB_MMIO;
2211	iotlb = (pd & ~TARGET_PAGE_MASK) + paddr +env->pVM->rem.s.iHandlerMemType;
2212	}
2213	# endif
2214	#endif
2215
2216	index = (vaddr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
2217	env->iotlb[mmu_idx][index] = iotlb - vaddr;
2218	te = &env->tlb_table[mmu_idx][index];
2219	te->addend = addend - vaddr;
2220	if (prot & PAGE_READ) {
2221	te->addr_read = address;
2222	} else {
2223	te->addr_read = -1;
2224	}
2225
2226	if (prot & PAGE_EXEC) {
2227	te->addr_code = code_address;
2228	} else {
2229	te->addr_code = -1;
2230	}
2231	if (prot & PAGE_WRITE) {
2232	if ((pd & ~TARGET_PAGE_MASK) == IO_MEM_ROM \|\|
2233	(pd & IO_MEM_ROMD)) {
2234	/* Write access calls the I/O callback. */
2235	te->addr_write = address \| TLB_MMIO;
2236	} else if ((pd & ~TARGET_PAGE_MASK) == IO_MEM_RAM &&
2237	!cpu_physical_memory_is_dirty(pd)) {
2238	te->addr_write = address \| TLB_NOTDIRTY;
2239	} else {
2240	te->addr_write = address;
2241	}
2242	} else {
2243	te->addr_write = -1;
2244	}
2245	#ifdef VBOX
2246	/* inform raw mode about TLB page change */
2247	remR3FlushPage(env, vaddr);
2248	#endif
2249	return ret;
2250	}
2251	#if 0
2252	/* called from signal handler: invalidate the code and unprotect the
2253	page. Return TRUE if the fault was succesfully handled. */
2254	int page_unprotect(target_ulong addr, unsigned long pc, void *puc)
2255	{
2256	#if !defined(CONFIG_SOFTMMU)
2257	VirtPageDesc *vp;
2258
2259	#if defined(DEBUG_TLB)
2260	printf("page_unprotect: addr=0x%08x\n", addr);
2261	#endif
2262	addr &= TARGET_PAGE_MASK;
2263
2264	/* if it is not mapped, no need to worry here */
2265	if (addr >= MMAP_AREA_END)
2266	return 0;
2267	vp = virt_page_find(addr >> TARGET_PAGE_BITS);
2268	if (!vp)
2269	return 0;
2270	/* NOTE: in this case, validate_tag is _not_ tested as it
2271	validates only the code TLB */
2272	if (vp->valid_tag != virt_valid_tag)
2273	return 0;
2274	if (!(vp->prot & PAGE_WRITE))
2275	return 0;
2276	#if defined(DEBUG_TLB)
2277	printf("page_unprotect: addr=0x%08x phys_addr=0x%08x prot=%x\n",
2278	addr, vp->phys_addr, vp->prot);
2279	#endif
2280	if (mprotect((void *)addr, TARGET_PAGE_SIZE, vp->prot) < 0)
2281	cpu_abort(cpu_single_env, "error mprotect addr=0x%lx prot=%d\n",
2282	(unsigned long)addr, vp->prot);
2283	/* set the dirty bit */
2284	phys_ram_dirty[vp->phys_addr >> TARGET_PAGE_BITS] = 0xff;
2285	/* flush the code inside */
2286	tb_invalidate_phys_page(vp->phys_addr, pc, puc);
2287	return 1;
2288	#elif defined(VBOX)
2289	addr &= TARGET_PAGE_MASK;
2290
2291	/* if it is not mapped, no need to worry here */
2292	if (addr >= MMAP_AREA_END)
2293	return 0;
2294	return 1;
2295	#else
2296	return 0;
2297	#endif
2298	}
2299	#endif /* 0 */
2300
2301	#else
2302
2303	void tlb_flush(CPUState *env, int flush_global)
2304	{
2305	}
2306
2307	void tlb_flush_page(CPUState *env, target_ulong addr)
2308	{
2309	}
2310
2311	int tlb_set_page_exec(CPUState *env, target_ulong vaddr,
2312	target_phys_addr_t paddr, int prot,
2313	int mmu_idx, int is_softmmu)
2314	{
2315	return 0;
2316	}
2317
2318	#ifndef VBOX
2319	/* dump memory mappings */
2320	void page_dump(FILE *f)
2321	{
2322	unsigned long start, end;
2323	int i, j, prot, prot1;
2324	PageDesc *p;
2325
2326	fprintf(f, "%-8s %-8s %-8s %s\n",
2327	"start", "end", "size", "prot");
2328	start = -1;
2329	end = -1;
2330	prot = 0;
2331	for(i = 0; i <= L1_SIZE; i++) {
2332	if (i < L1_SIZE)
2333	p = l1_map[i];
2334	else
2335	p = NULL;
2336	for(j = 0;j < L2_SIZE; j++) {
2337	if (!p)
2338	prot1 = 0;
2339	else
2340	prot1 = p[j].flags;
2341	if (prot1 != prot) {
2342	end = (i << (32 - L1_BITS)) \| (j << TARGET_PAGE_BITS);
2343	if (start != -1) {
2344	fprintf(f, "%08lx-%08lx %08lx %c%c%c\n",
2345	start, end, end - start,
2346	prot & PAGE_READ ? 'r' : '-',
2347	prot & PAGE_WRITE ? 'w' : '-',
2348	prot & PAGE_EXEC ? 'x' : '-');
2349	}
2350	if (prot1 != 0)
2351	start = end;
2352	else
2353	start = -1;
2354	prot = prot1;
2355	}
2356	if (!p)
2357	break;
2358	}
2359	}
2360	}
2361	#endif /* !VBOX */
2362
2363	int page_get_flags(target_ulong address)
2364	{
2365	PageDesc *p;
2366
2367	p = page_find(address >> TARGET_PAGE_BITS);
2368	if (!p)
2369	return 0;
2370	return p->flags;
2371	}
2372
2373	/* modify the flags of a page and invalidate the code if
2374	necessary. The flag PAGE_WRITE_ORG is positionned automatically
2375	depending on PAGE_WRITE */
2376	void page_set_flags(target_ulong start, target_ulong end, int flags)
2377	{
2378	PageDesc *p;
2379	target_ulong addr;
2380
2381	start = start & TARGET_PAGE_MASK;
2382	end = TARGET_PAGE_ALIGN(end);
2383	if (flags & PAGE_WRITE)
2384	flags \|= PAGE_WRITE_ORG;
2385	#ifdef VBOX
2386	AssertMsgFailed(("We shouldn't be here, and if we should, we must have an env to do the proper locking!\n"));
2387	#endif
2388	spin_lock(&tb_lock);
2389	for(addr = start; addr < end; addr += TARGET_PAGE_SIZE) {
2390	p = page_find_alloc(addr >> TARGET_PAGE_BITS);
2391	/* if the write protection is set, then we invalidate the code
2392	inside */
2393	if (!(p->flags & PAGE_WRITE) &&
2394	(flags & PAGE_WRITE) &&
2395	p->first_tb) {
2396	tb_invalidate_phys_page(addr, 0, NULL);
2397	}
2398	p->flags = flags;
2399	}
2400	spin_unlock(&tb_lock);
2401	}
2402
2403	int page_check_range(target_ulong start, target_ulong len, int flags)
2404	{
2405	PageDesc *p;
2406	target_ulong end;
2407	target_ulong addr;
2408
2409	end = TARGET_PAGE_ALIGN(start+len); /* must do before we loose bits in the next step */
2410	start = start & TARGET_PAGE_MASK;
2411
2412	if( end < start )
2413	/* we've wrapped around */
2414	return -1;
2415	for(addr = start; addr < end; addr += TARGET_PAGE_SIZE) {
2416	p = page_find(addr >> TARGET_PAGE_BITS);
2417	if( !p )
2418	return -1;
2419	if( !(p->flags & PAGE_VALID) )
2420	return -1;
2421
2422	if ((flags & PAGE_READ) && !(p->flags & PAGE_READ))
2423	return -1;
2424	if (flags & PAGE_WRITE) {
2425	if (!(p->flags & PAGE_WRITE_ORG))
2426	return -1;
2427	/* unprotect the page if it was put read-only because it
2428	contains translated code */
2429	if (!(p->flags & PAGE_WRITE)) {
2430	if (!page_unprotect(addr, 0, NULL))
2431	return -1;
2432	}
2433	return 0;
2434	}
2435	}
2436	return 0;
2437	}
2438
2439	/* called from signal handler: invalidate the code and unprotect the
2440	page. Return TRUE if the fault was succesfully handled. */
2441	int page_unprotect(target_ulong address, unsigned long pc, void *puc)
2442	{
2443	unsigned int page_index, prot, pindex;
2444	PageDesc p, p1;
2445	target_ulong host_start, host_end, addr;
2446
2447	/* Technically this isn't safe inside a signal handler. However we
2448	know this only ever happens in a synchronous SEGV handler, so in
2449	practice it seems to be ok. */
2450	mmap_lock();
2451
2452	host_start = address & qemu_host_page_mask;
2453	page_index = host_start >> TARGET_PAGE_BITS;
2454	p1 = page_find(page_index);
2455	if (!p1) {
2456	mmap_unlock();
2457	return 0;
2458	}
2459	host_end = host_start + qemu_host_page_size;
2460	p = p1;
2461	prot = 0;
2462	for(addr = host_start;addr < host_end; addr += TARGET_PAGE_SIZE) {
2463	prot \|= p->flags;
2464	p++;
2465	}
2466	/* if the page was really writable, then we change its
2467	protection back to writable */
2468	if (prot & PAGE_WRITE_ORG) {
2469	pindex = (address - host_start) >> TARGET_PAGE_BITS;
2470	if (!(p1[pindex].flags & PAGE_WRITE)) {
2471	mprotect((void *)g2h(host_start), qemu_host_page_size,
2472	(prot & PAGE_BITS) \| PAGE_WRITE);
2473	p1[pindex].flags \|= PAGE_WRITE;
2474	/* and since the content will be modified, we must invalidate
2475	the corresponding translated code. */
2476	tb_invalidate_phys_page(address, pc, puc);
2477	#ifdef DEBUG_TB_CHECK
2478	tb_invalidate_check(address);
2479	#endif
2480	mmap_unlock();
2481	return 1;
2482	}
2483	}
2484	mmap_unlock();
2485	return 0;
2486	}
2487
2488	static inline void tlb_set_dirty(CPUState *env,
2489	unsigned long addr, target_ulong vaddr)
2490	{
2491	}
2492	#endif /* defined(CONFIG_USER_ONLY) */
2493
2494	#if !defined(CONFIG_USER_ONLY)
2495	static int subpage_register (subpage_t *mmio, uint32_t start, uint32_t end,
2496	ram_addr_t memory);
2497	static void subpage_init (target_phys_addr_t base, ram_addr_t phys,
2498	ram_addr_t orig_memory);
2499	#define CHECK_SUBPAGE(addr, start_addr, start_addr2, end_addr, end_addr2, \
2500	need_subpage) \
2501	do { \
2502	if (addr > start_addr) \
2503	start_addr2 = 0; \
2504	else { \
2505	start_addr2 = start_addr & ~TARGET_PAGE_MASK; \
2506	if (start_addr2 > 0) \
2507	need_subpage = 1; \
2508	} \
2509	\
2510	if ((start_addr + orig_size) - addr >= TARGET_PAGE_SIZE) \
2511	end_addr2 = TARGET_PAGE_SIZE - 1; \
2512	else { \
2513	end_addr2 = (start_addr + orig_size - 1) & ~TARGET_PAGE_MASK; \
2514	if (end_addr2 < TARGET_PAGE_SIZE - 1) \
2515	need_subpage = 1; \
2516	} \
2517	} while (0)
2518
2519
2520	/* register physical memory. 'size' must be a multiple of the target
2521	page size. If (phys_offset & ~TARGET_PAGE_MASK) != 0, then it is an
2522	io memory page */
2523	void cpu_register_physical_memory(target_phys_addr_t start_addr,
2524	unsigned long size,
2525	unsigned long phys_offset)
2526	{
2527	target_phys_addr_t addr, end_addr;
2528	PhysPageDesc *p;
2529	CPUState *env;
2530	ram_addr_t orig_size = size;
2531	void *subpage;
2532
2533	#ifdef USE_KQEMU
2534	/* XXX: should not depend on cpu context */
2535	env = first_cpu;
2536	if (env->kqemu_enabled) {
2537	kqemu_set_phys_mem(start_addr, size, phys_offset);
2538	}
2539	#endif
2540	size = (size + TARGET_PAGE_SIZE - 1) & TARGET_PAGE_MASK;
2541	end_addr = start_addr + (target_phys_addr_t)size;
2542	for(addr = start_addr; addr != end_addr; addr += TARGET_PAGE_SIZE) {
2543	p = phys_page_find(addr >> TARGET_PAGE_BITS);
2544	if (p && p->phys_offset != IO_MEM_UNASSIGNED) {
2545	ram_addr_t orig_memory = p->phys_offset;
2546	target_phys_addr_t start_addr2, end_addr2;
2547	int need_subpage = 0;
2548
2549	CHECK_SUBPAGE(addr, start_addr, start_addr2, end_addr, end_addr2,
2550	need_subpage);
2551	if (need_subpage \|\| phys_offset & IO_MEM_SUBWIDTH) {
2552	if (!(orig_memory & IO_MEM_SUBPAGE)) {
2553	subpage = subpage_init((addr & TARGET_PAGE_MASK),
2554	&p->phys_offset, orig_memory);
2555	} else {
2556	subpage = io_mem_opaque[(orig_memory & ~TARGET_PAGE_MASK)
2557	>> IO_MEM_SHIFT];
2558	}
2559	subpage_register(subpage, start_addr2, end_addr2, phys_offset);
2560	} else {
2561	p->phys_offset = phys_offset;
2562	#if !defined(VBOX) \|\| defined(VBOX_WITH_NEW_PHYS_CODE)
2563	if ((phys_offset & ~TARGET_PAGE_MASK) <= IO_MEM_ROM \|\|
2564	(phys_offset & IO_MEM_ROMD))
2565	#else
2566	if ( (phys_offset & ~TARGET_PAGE_MASK) <= IO_MEM_ROM
2567	\|\| (phys_offset & IO_MEM_ROMD)
2568	\|\| (phys_offset & ~TARGET_PAGE_MASK) == IO_MEM_RAM_MISSING)
2569	#endif
2570	phys_offset += TARGET_PAGE_SIZE;
2571	}
2572	} else {
2573	p = phys_page_find_alloc(addr >> TARGET_PAGE_BITS, 1);
2574	p->phys_offset = phys_offset;
2575	#if !defined(VBOX) \|\| defined(VBOX_WITH_NEW_PHYS_CODE)
2576	if ((phys_offset & ~TARGET_PAGE_MASK) <= IO_MEM_ROM \|\|
2577	(phys_offset & IO_MEM_ROMD))
2578	#else
2579	if ( (phys_offset & ~TARGET_PAGE_MASK) <= IO_MEM_ROM
2580	\|\| (phys_offset & IO_MEM_ROMD)
2581	\|\| (phys_offset & ~TARGET_PAGE_MASK) == IO_MEM_RAM_MISSING)
2582	#endif
2583	phys_offset += TARGET_PAGE_SIZE;
2584	else {
2585	target_phys_addr_t start_addr2, end_addr2;
2586	int need_subpage = 0;
2587
2588	CHECK_SUBPAGE(addr, start_addr, start_addr2, end_addr,
2589	end_addr2, need_subpage);
2590
2591	if (need_subpage \|\| phys_offset & IO_MEM_SUBWIDTH) {
2592	subpage = subpage_init((addr & TARGET_PAGE_MASK),
2593	&p->phys_offset, IO_MEM_UNASSIGNED);
2594	subpage_register(subpage, start_addr2, end_addr2,
2595	phys_offset);
2596	}
2597	}
2598	}
2599	}
2600	/* since each CPU stores ram addresses in its TLB cache, we must
2601	reset the modified entries */
2602	/* XXX: slow ! */
2603	for(env = first_cpu; env != NULL; env = env->next_cpu) {
2604	tlb_flush(env, 1);
2605	}
2606	}
2607
2608	/* XXX: temporary until new memory mapping API */
2609	uint32_t cpu_get_physical_page_desc(target_phys_addr_t addr)
2610	{
2611	PhysPageDesc *p;
2612
2613	p = phys_page_find(addr >> TARGET_PAGE_BITS);
2614	if (!p)
2615	return IO_MEM_UNASSIGNED;
2616	return p->phys_offset;
2617	}
2618
2619	#ifndef VBOX
2620	/* XXX: better than nothing */
2621	ram_addr_t qemu_ram_alloc(ram_addr_t size)
2622	{
2623	ram_addr_t addr;
2624	if ((phys_ram_alloc_offset + size) > phys_ram_size) {
2625	fprintf(stderr, "Not enough memory (requested_size = %" PRIu64 ", max memory = %" PRIu64 ")\n",
2626	(uint64_t)size, (uint64_t)phys_ram_size);
2627	abort();
2628	}
2629	addr = phys_ram_alloc_offset;
2630	phys_ram_alloc_offset = TARGET_PAGE_ALIGN(phys_ram_alloc_offset + size);
2631	return addr;
2632	}
2633
2634	void qemu_ram_free(ram_addr_t addr)
2635	{
2636	}
2637	#endif
2638
2639
2640	static uint32_t unassigned_mem_readb(void *opaque, target_phys_addr_t addr)
2641	{
2642	#ifdef DEBUG_UNASSIGNED
2643	printf("Unassigned mem read 0x%08x\n", (int)addr);
2644	#endif
2645	#if defined(TARGET_SPARC) \|\| defined(TARGET_CRIS)
2646	do_unassigned_access(addr, 0, 0, 0, 1);
2647	#endif
2648	return 0;
2649	}
2650
2651	static uint32_t unassigned_mem_readw(void *opaque, target_phys_addr_t addr)
2652	{
2653	#ifdef DEBUG_UNASSIGNED
2654	printf("Unassigned mem read " TARGET_FMT_plx "\n", addr);
2655	#endif
2656	#if defined(TARGET_SPARC) \|\| defined(TARGET_CRIS)
2657	do_unassigned_access(addr, 0, 0, 0, 2);
2658	#endif
2659	return 0;
2660	}
2661
2662	static uint32_t unassigned_mem_readl(void *opaque, target_phys_addr_t addr)
2663	{
2664	#ifdef DEBUG_UNASSIGNED
2665	printf("Unassigned mem read " TARGET_FMT_plx "\n", addr);
2666	#endif
2667	#if defined(TARGET_SPARC) \|\| defined(TARGET_CRIS)
2668	do_unassigned_access(addr, 0, 0, 0, 4);
2669	#endif
2670	return 0;
2671	}
2672
2673	static void unassigned_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
2674	{
2675	#ifdef DEBUG_UNASSIGNED
2676	printf("Unassigned mem write 0x%08x = 0x%x\n", (int)addr, val);
2677	#endif
2678	}
2679
2680	static void unassigned_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
2681	{
2682	#ifdef DEBUG_UNASSIGNED
2683	printf("Unassigned mem write " TARGET_FMT_plx " = 0x%x\n", addr, val);
2684	#endif
2685	#if defined(TARGET_SPARC) \|\| defined(TARGET_CRIS)
2686	do_unassigned_access(addr, 1, 0, 0, 2);
2687	#endif
2688	}
2689
2690	static void unassigned_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
2691	{
2692	#ifdef DEBUG_UNASSIGNED
2693	printf("Unassigned mem write " TARGET_FMT_plx " = 0x%x\n", addr, val);
2694	#endif
2695	#if defined(TARGET_SPARC) \|\| defined(TARGET_CRIS)
2696	do_unassigned_access(addr, 1, 0, 0, 4);
2697	#endif
2698	}
2699	static CPUReadMemoryFunc *unassigned_mem_read[3] = {
2700	unassigned_mem_readb,
2701	unassigned_mem_readw,
2702	unassigned_mem_readl,
2703	};
2704
2705	static CPUWriteMemoryFunc *unassigned_mem_write[3] = {
2706	unassigned_mem_writeb,
2707	unassigned_mem_writew,
2708	unassigned_mem_writel,
2709	};
2710
2711	static void notdirty_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
2712	{
2713	unsigned long ram_addr;
2714	int dirty_flags;
2715	#if defined(VBOX)
2716	ram_addr = addr;
2717	#elif
2718	ram_addr = addr - (unsigned long)phys_ram_base;
2719	#endif
2720	#ifdef VBOX
2721	if (RT_UNLIKELY((ram_addr >> TARGET_PAGE_BITS) >= phys_ram_dirty_size))
2722	dirty_flags = 0xff;
2723	else
2724	#endif /* VBOX */
2725	dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2726	if (!(dirty_flags & CODE_DIRTY_FLAG)) {
2727	#if !defined(CONFIG_USER_ONLY)
2728	tb_invalidate_phys_page_fast(ram_addr, 1);
2729	# ifdef VBOX
2730	if (RT_UNLIKELY((ram_addr >> TARGET_PAGE_BITS) >= phys_ram_dirty_size))
2731	dirty_flags = 0xff;
2732	else
2733	# endif /* VBOX */
2734	dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2735	#endif
2736	}
2737	#if defined(VBOX) && !defined(REM_PHYS_ADDR_IN_TLB)
2738	remR3PhysWriteU8(addr, val);
2739	#else
2740	stb_p((uint8_t *)(long)addr, val);
2741	#endif
2742	#ifdef USE_KQEMU
2743	if (cpu_single_env->kqemu_enabled &&
2744	(dirty_flags & KQEMU_MODIFY_PAGE_MASK) != KQEMU_MODIFY_PAGE_MASK)
2745	kqemu_modify_page(cpu_single_env, ram_addr);
2746	#endif
2747	dirty_flags \|= (0xff & ~CODE_DIRTY_FLAG);
2748	#ifdef VBOX
2749	if (RT_LIKELY((ram_addr >> TARGET_PAGE_BITS) < phys_ram_dirty_size))
2750	#endif /* !VBOX */
2751	phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] = dirty_flags;
2752	/* we remove the notdirty callback only if the code has been
2753	flushed */
2754	if (dirty_flags == 0xff)
2755	tlb_set_dirty(cpu_single_env, addr, cpu_single_env->mem_io_vaddr);
2756	}
2757
2758	static void notdirty_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
2759	{
2760	unsigned long ram_addr;
2761	int dirty_flags;
2762	#if defined(VBOX)
2763	ram_addr = addr;
2764	#else
2765	ram_addr = addr - (unsigned long)phys_ram_base;
2766	#endif
2767	#ifdef VBOX
2768	if (RT_UNLIKELY((ram_addr >> TARGET_PAGE_BITS) >= phys_ram_dirty_size))
2769	dirty_flags = 0xff;
2770	else
2771	#endif /* VBOX */
2772	dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2773	if (!(dirty_flags & CODE_DIRTY_FLAG)) {
2774	#if !defined(CONFIG_USER_ONLY)
2775	tb_invalidate_phys_page_fast(ram_addr, 2);
2776	# ifdef VBOX
2777	if (RT_UNLIKELY((ram_addr >> TARGET_PAGE_BITS) >= phys_ram_dirty_size))
2778	dirty_flags = 0xff;
2779	else
2780	# endif /* VBOX */
2781	dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2782	#endif
2783	}
2784	#if defined(VBOX) && !defined(REM_PHYS_ADDR_IN_TLB)
2785	remR3PhysWriteU16(addr, val);
2786	#else
2787	stw_p((uint8_t *)(long)addr, val);
2788	#endif
2789
2790	#ifdef USE_KQEMU
2791	if (cpu_single_env->kqemu_enabled &&
2792	(dirty_flags & KQEMU_MODIFY_PAGE_MASK) != KQEMU_MODIFY_PAGE_MASK)
2793	kqemu_modify_page(cpu_single_env, ram_addr);
2794	#endif
2795	dirty_flags \|= (0xff & ~CODE_DIRTY_FLAG);
2796	#ifdef VBOX
2797	if (RT_LIKELY((ram_addr >> TARGET_PAGE_BITS) < phys_ram_dirty_size))
2798	#endif
2799	phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] = dirty_flags;
2800	/* we remove the notdirty callback only if the code has been
2801	flushed */
2802	if (dirty_flags == 0xff)
2803	tlb_set_dirty(cpu_single_env, addr, cpu_single_env->mem_io_vaddr);
2804	}
2805
2806	static void notdirty_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
2807	{
2808	unsigned long ram_addr;
2809	int dirty_flags;
2810	#if defined(VBOX)
2811	ram_addr = addr;
2812	#else
2813	ram_addr = addr - (unsigned long)phys_ram_base;
2814	#endif
2815	#ifdef VBOX
2816	if (RT_UNLIKELY((ram_addr >> TARGET_PAGE_BITS) >= phys_ram_dirty_size))
2817	dirty_flags = 0xff;
2818	else
2819	#endif /* VBOX */
2820	dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2821	if (!(dirty_flags & CODE_DIRTY_FLAG)) {
2822	#if !defined(CONFIG_USER_ONLY)
2823	tb_invalidate_phys_page_fast(ram_addr, 4);
2824	# ifdef VBOX
2825	if (RT_UNLIKELY((ram_addr >> TARGET_PAGE_BITS) >= phys_ram_dirty_size))
2826	dirty_flags = 0xff;
2827	else
2828	# endif /* VBOX */
2829	dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2830	#endif
2831	}
2832	#if defined(VBOX) && !defined(REM_PHYS_ADDR_IN_TLB)
2833	remR3PhysWriteU32(addr, val);
2834	#else
2835	stl_p((uint8_t *)(long)addr, val);
2836	#endif
2837	#ifdef USE_KQEMU
2838	if (cpu_single_env->kqemu_enabled &&
2839	(dirty_flags & KQEMU_MODIFY_PAGE_MASK) != KQEMU_MODIFY_PAGE_MASK)
2840	kqemu_modify_page(cpu_single_env, ram_addr);
2841	#endif
2842	dirty_flags \|= (0xff & ~CODE_DIRTY_FLAG);
2843	#ifdef VBOX
2844	if (RT_LIKELY((ram_addr >> TARGET_PAGE_BITS) < phys_ram_dirty_size))
2845	#endif
2846	phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] = dirty_flags;
2847	/* we remove the notdirty callback only if the code has been
2848	flushed */
2849	if (dirty_flags == 0xff)
2850	tlb_set_dirty(cpu_single_env, addr, cpu_single_env->mem_io_vaddr);
2851	}
2852
2853	static CPUReadMemoryFunc *error_mem_read[3] = {
2854	NULL, /* never used */
2855	NULL, /* never used */
2856	NULL, /* never used */
2857	};
2858
2859	static CPUWriteMemoryFunc *notdirty_mem_write[3] = {
2860	notdirty_mem_writeb,
2861	notdirty_mem_writew,
2862	notdirty_mem_writel,
2863	};
2864
2865
2866	/* Generate a debug exception if a watchpoint has been hit. */
2867	static void check_watchpoint(int offset, int flags)
2868	{
2869	CPUState *env = cpu_single_env;
2870	target_ulong vaddr;
2871	int i;
2872
2873	vaddr = (env->mem_io_vaddr & TARGET_PAGE_MASK) + offset;
2874	for (i = 0; i < env->nb_watchpoints; i++) {
2875	if (vaddr == env->watchpoint[i].vaddr
2876	&& (env->watchpoint[i].type & flags)) {
2877	env->watchpoint_hit = i + 1;
2878	cpu_interrupt(env, CPU_INTERRUPT_DEBUG);
2879	break;
2880	}
2881	}
2882	}
2883
2884	/* Watchpoint access routines. Watchpoints are inserted using TLB tricks,
2885	so these check for a hit then pass through to the normal out-of-line
2886	phys routines. */
2887	static uint32_t watch_mem_readb(void *opaque, target_phys_addr_t addr)
2888	{
2889	check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_READ);
2890	return ldub_phys(addr);
2891	}
2892
2893	static uint32_t watch_mem_readw(void *opaque, target_phys_addr_t addr)
2894	{
2895	check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_READ);
2896	return lduw_phys(addr);
2897	}
2898
2899	static uint32_t watch_mem_readl(void *opaque, target_phys_addr_t addr)
2900	{
2901	check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_READ);
2902	return ldl_phys(addr);
2903	}
2904
2905	static void watch_mem_writeb(void *opaque, target_phys_addr_t addr,
2906	uint32_t val)
2907	{
2908	check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_WRITE);
2909	stb_phys(addr, val);
2910	}
2911
2912	static void watch_mem_writew(void *opaque, target_phys_addr_t addr,
2913	uint32_t val)
2914	{
2915	check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_WRITE);
2916	stw_phys(addr, val);
2917	}
2918
2919	static void watch_mem_writel(void *opaque, target_phys_addr_t addr,
2920	uint32_t val)
2921	{
2922	check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_WRITE);
2923	stl_phys(addr, val);
2924	}
2925
2926	static CPUReadMemoryFunc *watch_mem_read[3] = {
2927	watch_mem_readb,
2928	watch_mem_readw,
2929	watch_mem_readl,
2930	};
2931
2932	static CPUWriteMemoryFunc *watch_mem_write[3] = {
2933	watch_mem_writeb,
2934	watch_mem_writew,
2935	watch_mem_writel,
2936	};
2937
2938	static inline uint32_t subpage_readlen (subpage_t *mmio, target_phys_addr_t addr,
2939	unsigned int len)
2940	{
2941	uint32_t ret;
2942	unsigned int idx;
2943
2944	idx = SUBPAGE_IDX(addr - mmio->base);
2945	#if defined(DEBUG_SUBPAGE)
2946	printf("%s: subpage %p len %d addr " TARGET_FMT_plx " idx %d\n", __func__,
2947	mmio, len, addr, idx);
2948	#endif
2949	ret = (**mmio->mem_read[idx][len])(mmio->opaque[idx][0][len], addr);
2950
2951	return ret;
2952	}
2953
2954	static inline void subpage_writelen (subpage_t *mmio, target_phys_addr_t addr,
2955	uint32_t value, unsigned int len)
2956	{
2957	unsigned int idx;
2958
2959	idx = SUBPAGE_IDX(addr - mmio->base);
2960	#if defined(DEBUG_SUBPAGE)
2961	printf("%s: subpage %p len %d addr " TARGET_FMT_plx " idx %d value %08x\n", __func__,
2962	mmio, len, addr, idx, value);
2963	#endif
2964	(**mmio->mem_write[idx][len])(mmio->opaque[idx][1][len], addr, value);
2965	}
2966
2967	static uint32_t subpage_readb (void *opaque, target_phys_addr_t addr)
2968	{
2969	#if defined(DEBUG_SUBPAGE)
2970	printf("%s: addr " TARGET_FMT_plx "\n", __func__, addr);
2971	#endif
2972
2973	return subpage_readlen(opaque, addr, 0);
2974	}
2975
2976	static void subpage_writeb (void *opaque, target_phys_addr_t addr,
2977	uint32_t value)
2978	{
2979	#if defined(DEBUG_SUBPAGE)
2980	printf("%s: addr " TARGET_FMT_plx " val %08x\n", __func__, addr, value);
2981	#endif
2982	subpage_writelen(opaque, addr, value, 0);
2983	}
2984
2985	static uint32_t subpage_readw (void *opaque, target_phys_addr_t addr)
2986	{
2987	#if defined(DEBUG_SUBPAGE)
2988	printf("%s: addr " TARGET_FMT_plx "\n", __func__, addr);
2989	#endif
2990
2991	return subpage_readlen(opaque, addr, 1);
2992	}
2993
2994	static void subpage_writew (void *opaque, target_phys_addr_t addr,
2995	uint32_t value)
2996	{
2997	#if defined(DEBUG_SUBPAGE)
2998	printf("%s: addr " TARGET_FMT_plx " val %08x\n", __func__, addr, value);
2999	#endif
3000	subpage_writelen(opaque, addr, value, 1);
3001	}
3002
3003	static uint32_t subpage_readl (void *opaque, target_phys_addr_t addr)
3004	{
3005	#if defined(DEBUG_SUBPAGE)
3006	printf("%s: addr " TARGET_FMT_plx "\n", __func__, addr);
3007	#endif
3008
3009	return subpage_readlen(opaque, addr, 2);
3010	}
3011
3012	static void subpage_writel (void *opaque,
3013	target_phys_addr_t addr, uint32_t value)
3014	{
3015	#if defined(DEBUG_SUBPAGE)
3016	printf("%s: addr " TARGET_FMT_plx " val %08x\n", __func__, addr, value);
3017	#endif
3018	subpage_writelen(opaque, addr, value, 2);
3019	}
3020
3021	static CPUReadMemoryFunc *subpage_read[] = {
3022	&subpage_readb,
3023	&subpage_readw,
3024	&subpage_readl,
3025	};
3026
3027	static CPUWriteMemoryFunc *subpage_write[] = {
3028	&subpage_writeb,
3029	&subpage_writew,
3030	&subpage_writel,
3031	};
3032
3033	static int subpage_register (subpage_t *mmio, uint32_t start, uint32_t end,
3034	ram_addr_t memory)
3035	{
3036	int idx, eidx;
3037	unsigned int i;
3038
3039	if (start >= TARGET_PAGE_SIZE \|\| end >= TARGET_PAGE_SIZE)
3040	return -1;
3041	idx = SUBPAGE_IDX(start);
3042	eidx = SUBPAGE_IDX(end);
3043	#if defined(DEBUG_SUBPAGE)
3044	printf("%s: %p start %08x end %08x idx %08x eidx %08x mem %d\n", __func__,
3045	mmio, start, end, idx, eidx, memory);
3046	#endif
3047	memory >>= IO_MEM_SHIFT;
3048	for (; idx <= eidx; idx++) {
3049	for (i = 0; i < 4; i++) {
3050	if (io_mem_read[memory][i]) {
3051	mmio->mem_read[idx][i] = &io_mem_read[memory][i];
3052	mmio->opaque[idx][0][i] = io_mem_opaque[memory];
3053	}
3054	if (io_mem_write[memory][i]) {
3055	mmio->mem_write[idx][i] = &io_mem_write[memory][i];
3056	mmio->opaque[idx][1][i] = io_mem_opaque[memory];
3057	}
3058	}
3059	}
3060
3061	return 0;
3062	}
3063
3064	static void subpage_init (target_phys_addr_t base, ram_addr_t phys,
3065	ram_addr_t orig_memory)
3066	{
3067	subpage_t *mmio;
3068	int subpage_memory;
3069
3070	mmio = qemu_mallocz(sizeof(subpage_t));
3071	if (mmio != NULL) {
3072	mmio->base = base;
3073	subpage_memory = cpu_register_io_memory(0, subpage_read, subpage_write, mmio);
3074	#if defined(DEBUG_SUBPAGE)
3075	printf("%s: %p base " TARGET_FMT_plx " len %08x %d\n", __func__,
3076	mmio, base, TARGET_PAGE_SIZE, subpage_memory);
3077	#endif
3078	*phys = subpage_memory \| IO_MEM_SUBPAGE;
3079	subpage_register(mmio, 0, TARGET_PAGE_SIZE - 1, orig_memory);
3080	}
3081
3082	return mmio;
3083	}
3084
3085	static void io_mem_init(void)
3086	{
3087	cpu_register_io_memory(IO_MEM_ROM >> IO_MEM_SHIFT, error_mem_read, unassigned_mem_write, NULL);
3088	cpu_register_io_memory(IO_MEM_UNASSIGNED >> IO_MEM_SHIFT, unassigned_mem_read, unassigned_mem_write, NULL);
3089	cpu_register_io_memory(IO_MEM_NOTDIRTY >> IO_MEM_SHIFT, error_mem_read, notdirty_mem_write, NULL);
3090	#if defined(VBOX) && !defined(VBOX_WITH_NEW_PHYS_CODE)
3091	cpu_register_io_memory(IO_MEM_RAM_MISSING >> IO_MEM_SHIFT, unassigned_mem_read, unassigned_mem_write, NULL);
3092	io_mem_nb = 6;
3093	#else
3094	io_mem_nb = 5;
3095	#endif
3096
3097	io_mem_watch = cpu_register_io_memory(0, watch_mem_read,
3098	watch_mem_write, NULL);
3099
3100	#ifndef VBOX /* VBOX: we do this later when the RAM is allocated. */
3101	/* alloc dirty bits array */
3102	phys_ram_dirty = qemu_vmalloc(phys_ram_size >> TARGET_PAGE_BITS);
3103	memset(phys_ram_dirty, 0xff, phys_ram_size >> TARGET_PAGE_BITS);
3104	#endif /* !VBOX */
3105	}
3106
3107	/* mem_read and mem_write are arrays of functions containing the
3108	function to access byte (index 0), word (index 1) and dword (index
3109	2). Functions can be omitted with a NULL function pointer. The
3110	registered functions may be modified dynamically later.
3111	If io_index is non zero, the corresponding io zone is
3112	modified. If it is zero, a new io zone is allocated. The return
3113	value can be used with cpu_register_physical_memory(). (-1) is
3114	returned if error. */
3115	int cpu_register_io_memory(int io_index,
3116	CPUReadMemoryFunc **mem_read,
3117	CPUWriteMemoryFunc **mem_write,
3118	void *opaque)
3119	{
3120	int i, subwidth = 0;
3121
3122	if (io_index <= 0) {
3123	if (io_mem_nb >= IO_MEM_NB_ENTRIES)
3124	return -1;
3125	io_index = io_mem_nb++;
3126	} else {
3127	if (io_index >= IO_MEM_NB_ENTRIES)
3128	return -1;
3129	}
3130
3131	for(i = 0;i < 3; i++) {
3132	if (!mem_read[i] \|\| !mem_write[i])
3133	subwidth = IO_MEM_SUBWIDTH;
3134	io_mem_read[io_index][i] = mem_read[i];
3135	io_mem_write[io_index][i] = mem_write[i];
3136	}
3137	io_mem_opaque[io_index] = opaque;
3138	return (io_index << IO_MEM_SHIFT) \| subwidth;
3139	}
3140
3141	CPUWriteMemoryFunc **cpu_get_io_memory_write(int io_index)
3142	{
3143	return io_mem_write[io_index >> IO_MEM_SHIFT];
3144	}
3145
3146	CPUReadMemoryFunc **cpu_get_io_memory_read(int io_index)
3147	{
3148	return io_mem_read[io_index >> IO_MEM_SHIFT];
3149	}
3150	#endif /* !defined(CONFIG_USER_ONLY) */
3151
3152	/* physical memory access (slow version, mainly for debug) */
3153	#if defined(CONFIG_USER_ONLY)
3154	void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
3155	int len, int is_write)
3156	{
3157	int l, flags;
3158	target_ulong page;
3159	void * p;
3160
3161	while (len > 0) {
3162	page = addr & TARGET_PAGE_MASK;
3163	l = (page + TARGET_PAGE_SIZE) - addr;
3164	if (l > len)
3165	l = len;
3166	flags = page_get_flags(page);
3167	if (!(flags & PAGE_VALID))
3168	return;
3169	if (is_write) {
3170	if (!(flags & PAGE_WRITE))
3171	return;
3172	/* XXX: this code should not depend on lock_user */
3173	if (!(p = lock_user(VERIFY_WRITE, addr, l, 0)))
3174	/* FIXME - should this return an error rather than just fail? */
3175	return;
3176	memcpy(p, buf, len);
3177	unlock_user(p, addr, len);
3178	} else {
3179	if (!(flags & PAGE_READ))
3180	return;
3181	if (!(p = lock_user(VERIFY_READ, addr, l, 1)))
3182	/* FIXME - should this return an error rather than just fail? */
3183	return;
3184	memcpy(buf, p, len);
3185	unlock_user(p, addr, 0);
3186	}
3187	len -= l;
3188	buf += l;
3189	addr += l;
3190	}
3191	}
3192
3193	#else
3194	void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
3195	int len, int is_write)
3196	{
3197	int l, io_index;
3198	uint8_t *ptr;
3199	uint32_t val;
3200	target_phys_addr_t page;
3201	unsigned long pd;
3202	PhysPageDesc *p;
3203
3204	while (len > 0) {
3205	page = addr & TARGET_PAGE_MASK;
3206	l = (page + TARGET_PAGE_SIZE) - addr;
3207	if (l > len)
3208	l = len;
3209	p = phys_page_find(page >> TARGET_PAGE_BITS);
3210	if (!p) {
3211	pd = IO_MEM_UNASSIGNED;
3212	} else {
3213	pd = p->phys_offset;
3214	}
3215
3216	if (is_write) {
3217	if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
3218	io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3219	/* XXX: could force cpu_single_env to NULL to avoid
3220	potential bugs */
3221	if (l >= 4 && ((addr & 3) == 0)) {
3222	/* 32 bit write access */
3223	#if !defined(VBOX) \|\| !defined(REM_PHYS_ADDR_IN_TLB)
3224	val = ldl_p(buf);
3225	#else
3226	val = (const uint32_t )buf;
3227	#endif
3228	io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val);
3229	l = 4;
3230	} else if (l >= 2 && ((addr & 1) == 0)) {
3231	/* 16 bit write access */
3232	#if !defined(VBOX) \|\| !defined(REM_PHYS_ADDR_IN_TLB)
3233	val = lduw_p(buf);
3234	#else
3235	val = (const uint16_t )buf;
3236	#endif
3237	io_mem_write[io_index][1](io_mem_opaque[io_index], addr, val);
3238	l = 2;
3239	} else {
3240	/* 8 bit write access */
3241	#if !defined(VBOX) \|\| !defined(REM_PHYS_ADDR_IN_TLB)
3242	val = ldub_p(buf);
3243	#else
3244	val = (const uint8_t )buf;
3245	#endif
3246	io_mem_write[io_index][0](io_mem_opaque[io_index], addr, val);
3247	l = 1;
3248	}
3249	} else {
3250	unsigned long addr1;
3251	addr1 = (pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK);
3252	/* RAM case */
3253	#ifdef VBOX
3254	remR3PhysWrite(addr1, buf, l); NOREF(ptr);
3255	#else
3256	ptr = phys_ram_base + addr1;
3257	memcpy(ptr, buf, l);
3258	#endif
3259	if (!cpu_physical_memory_is_dirty(addr1)) {
3260	/* invalidate code */
3261	tb_invalidate_phys_page_range(addr1, addr1 + l, 0);
3262	/* set dirty bit */
3263	#ifdef VBOX
3264	if (RT_LIKELY((addr1 >> TARGET_PAGE_BITS) < phys_ram_dirty_size))
3265	#endif
3266	phys_ram_dirty[addr1 >> TARGET_PAGE_BITS] \|=
3267	(0xff & ~CODE_DIRTY_FLAG);
3268	}
3269	}
3270	} else {
3271	if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM &&
3272	!(pd & IO_MEM_ROMD)) {
3273	/* I/O case */
3274	io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3275	if (l >= 4 && ((addr & 3) == 0)) {
3276	/* 32 bit read access */
3277	val = io_mem_read[io_index][2](io_mem_opaque[io_index], addr);
3278	#if !defined(VBOX) \|\| !defined(REM_PHYS_ADDR_IN_TLB)
3279	stl_p(buf, val);
3280	#else
3281	(uint32_t )buf = val;
3282	#endif
3283	l = 4;
3284	} else if (l >= 2 && ((addr & 1) == 0)) {
3285	/* 16 bit read access */
3286	val = io_mem_read[io_index][1](io_mem_opaque[io_index], addr);
3287	#if !defined(VBOX) \|\| !defined(REM_PHYS_ADDR_IN_TLB)
3288	stw_p(buf, val);
3289	#else
3290	(uint16_t )buf = val;
3291	#endif
3292	l = 2;
3293	} else {
3294	/* 8 bit read access */
3295	val = io_mem_read[io_index][0](io_mem_opaque[io_index], addr);
3296	#if !defined(VBOX) \|\| !defined(REM_PHYS_ADDR_IN_TLB)
3297	stb_p(buf, val);
3298	#else
3299	(uint8_t )buf = val;
3300	#endif
3301	l = 1;
3302	}
3303	} else {
3304	/* RAM case */
3305	#ifdef VBOX
3306	remR3PhysRead((pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK), buf, l); NOREF(ptr);
3307	#else
3308	ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) +
3309	(addr & ~TARGET_PAGE_MASK);
3310	memcpy(buf, ptr, l);
3311	#endif
3312	}
3313	}
3314	len -= l;
3315	buf += l;
3316	addr += l;
3317	}
3318	}
3319
3320	#ifndef VBOX
3321	/* used for ROM loading : can write in RAM and ROM */
3322	void cpu_physical_memory_write_rom(target_phys_addr_t addr,
3323	const uint8_t *buf, int len)
3324	{
3325	int l;
3326	uint8_t *ptr;
3327	target_phys_addr_t page;
3328	unsigned long pd;
3329	PhysPageDesc *p;
3330
3331	while (len > 0) {
3332	page = addr & TARGET_PAGE_MASK;
3333	l = (page + TARGET_PAGE_SIZE) - addr;
3334	if (l > len)
3335	l = len;
3336	p = phys_page_find(page >> TARGET_PAGE_BITS);
3337	if (!p) {
3338	pd = IO_MEM_UNASSIGNED;
3339	} else {
3340	pd = p->phys_offset;
3341	}
3342
3343	if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM &&
3344	(pd & ~TARGET_PAGE_MASK) != IO_MEM_ROM &&
3345	!(pd & IO_MEM_ROMD)) {
3346	/* do nothing */
3347	} else {
3348	unsigned long addr1;
3349	addr1 = (pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK);
3350	/* ROM/RAM case */
3351	ptr = phys_ram_base + addr1;
3352	memcpy(ptr, buf, l);
3353	}
3354	len -= l;
3355	buf += l;
3356	addr += l;
3357	}
3358	}
3359	#endif /* !VBOX */
3360
3361
3362	/* warning: addr must be aligned */
3363	uint32_t ldl_phys(target_phys_addr_t addr)
3364	{
3365	int io_index;
3366	uint8_t *ptr;
3367	uint32_t val;
3368	unsigned long pd;
3369	PhysPageDesc *p;
3370
3371	p = phys_page_find(addr >> TARGET_PAGE_BITS);
3372	if (!p) {
3373	pd = IO_MEM_UNASSIGNED;
3374	} else {
3375	pd = p->phys_offset;
3376	}
3377
3378	if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM &&
3379	!(pd & IO_MEM_ROMD)) {
3380	/* I/O case */
3381	io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3382	val = io_mem_read[io_index][2](io_mem_opaque[io_index], addr);
3383	} else {
3384	/* RAM case */
3385	#ifndef VBOX
3386	ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) +
3387	(addr & ~TARGET_PAGE_MASK);
3388	val = ldl_p(ptr);
3389	#else
3390	val = remR3PhysReadU32((pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK)); NOREF(ptr);
3391	#endif
3392	}
3393	return val;
3394	}
3395
3396	/* warning: addr must be aligned */
3397	uint64_t ldq_phys(target_phys_addr_t addr)
3398	{
3399	int io_index;
3400	uint8_t *ptr;
3401	uint64_t val;
3402	unsigned long pd;
3403	PhysPageDesc *p;
3404
3405	p = phys_page_find(addr >> TARGET_PAGE_BITS);
3406	if (!p) {
3407	pd = IO_MEM_UNASSIGNED;
3408	} else {
3409	pd = p->phys_offset;
3410	}
3411
3412	if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM &&
3413	!(pd & IO_MEM_ROMD)) {
3414	/* I/O case */
3415	io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3416	#ifdef TARGET_WORDS_BIGENDIAN
3417	val = (uint64_t)io_mem_read[io_index][2](io_mem_opaque[io_index], addr) << 32;
3418	val \|= io_mem_read[io_index][2](io_mem_opaque[io_index], addr + 4);
3419	#else
3420	val = io_mem_read[io_index][2](io_mem_opaque[io_index], addr);
3421	val \|= (uint64_t)io_mem_read[io_index][2](io_mem_opaque[io_index], addr + 4) << 32;
3422	#endif
3423	} else {
3424	/* RAM case */
3425	#ifndef VBOX
3426	ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) +
3427	(addr & ~TARGET_PAGE_MASK);
3428	val = ldq_p(ptr);
3429	#else
3430	val = remR3PhysReadU64((pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK)); NOREF(ptr);
3431	#endif
3432	}
3433	return val;
3434	}
3435
3436	/* XXX: optimize */
3437	uint32_t ldub_phys(target_phys_addr_t addr)
3438	{
3439	uint8_t val;
3440	cpu_physical_memory_read(addr, &val, 1);
3441	return val;
3442	}
3443
3444	/* XXX: optimize */
3445	uint32_t lduw_phys(target_phys_addr_t addr)
3446	{
3447	uint16_t val;
3448	cpu_physical_memory_read(addr, (uint8_t *)&val, 2);
3449	return tswap16(val);
3450	}
3451
3452	/* warning: addr must be aligned. The ram page is not masked as dirty
3453	and the code inside is not invalidated. It is useful if the dirty
3454	bits are used to track modified PTEs */
3455	void stl_phys_notdirty(target_phys_addr_t addr, uint32_t val)
3456	{
3457	int io_index;
3458	uint8_t *ptr;
3459	unsigned long pd;
3460	PhysPageDesc *p;
3461
3462	p = phys_page_find(addr >> TARGET_PAGE_BITS);
3463	if (!p) {
3464	pd = IO_MEM_UNASSIGNED;
3465	} else {
3466	pd = p->phys_offset;
3467	}
3468
3469	if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
3470	io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3471	io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val);
3472	} else {
3473	#ifndef VBOX
3474	ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) +
3475	(addr & ~TARGET_PAGE_MASK);
3476	stl_p(ptr, val);
3477	#else
3478	remR3PhysWriteU32((pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK), val); NOREF(ptr);
3479	#endif
3480	#ifndef VBOX
3481	if (unlikely(in_migration)) {
3482	if (!cpu_physical_memory_is_dirty(addr1)) {
3483	/* invalidate code */
3484	tb_invalidate_phys_page_range(addr1, addr1 + 4, 0);
3485	/* set dirty bit */
3486	phys_ram_dirty[addr1 >> TARGET_PAGE_BITS] \|=
3487	(0xff & ~CODE_DIRTY_FLAG);
3488	}
3489	}
3490	#endif
3491	}
3492	}
3493
3494	void stq_phys_notdirty(target_phys_addr_t addr, uint64_t val)
3495	{
3496	int io_index;
3497	uint8_t *ptr;
3498	unsigned long pd;
3499	PhysPageDesc *p;
3500
3501	p = phys_page_find(addr >> TARGET_PAGE_BITS);
3502	if (!p) {
3503	pd = IO_MEM_UNASSIGNED;
3504	} else {
3505	pd = p->phys_offset;
3506	}
3507
3508	if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
3509	io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3510	#ifdef TARGET_WORDS_BIGENDIAN
3511	io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val >> 32);
3512	io_mem_write[io_index][2](io_mem_opaque[io_index], addr + 4, val);
3513	#else
3514	io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val);
3515	io_mem_write[io_index][2](io_mem_opaque[io_index], addr + 4, val >> 32);
3516	#endif
3517	} else {
3518	#ifndef VBOX
3519	ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) +
3520	(addr & ~TARGET_PAGE_MASK);
3521	stq_p(ptr, val);
3522	#else
3523	remR3PhysWriteU64((pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK), val); NOREF(ptr);
3524	#endif
3525	}
3526	}
3527
3528
3529	/* warning: addr must be aligned */
3530	void stl_phys(target_phys_addr_t addr, uint32_t val)
3531	{
3532	int io_index;
3533	uint8_t *ptr;
3534	unsigned long pd;
3535	PhysPageDesc *p;
3536
3537	p = phys_page_find(addr >> TARGET_PAGE_BITS);
3538	if (!p) {
3539	pd = IO_MEM_UNASSIGNED;
3540	} else {
3541	pd = p->phys_offset;
3542	}
3543
3544	if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
3545	io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3546	io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val);
3547	} else {
3548	unsigned long addr1;
3549	addr1 = (pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK);
3550	/* RAM case */
3551	#ifndef VBOX
3552	ptr = phys_ram_base + addr1;
3553	stl_p(ptr, val);
3554	#else
3555	remR3PhysWriteU32((pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK), val); NOREF(ptr);
3556	#endif
3557	if (!cpu_physical_memory_is_dirty(addr1)) {
3558	/* invalidate code */
3559	tb_invalidate_phys_page_range(addr1, addr1 + 4, 0);
3560	/* set dirty bit */
3561	#ifdef VBOX
3562	if (RT_LIKELY((addr1 >> TARGET_PAGE_BITS) < phys_ram_dirty_size))
3563	#endif
3564	phys_ram_dirty[addr1 >> TARGET_PAGE_BITS] \|=
3565	(0xff & ~CODE_DIRTY_FLAG);
3566	}
3567	}
3568	}
3569
3570	/* XXX: optimize */
3571	void stb_phys(target_phys_addr_t addr, uint32_t val)
3572	{
3573	uint8_t v = val;
3574	cpu_physical_memory_write(addr, &v, 1);
3575	}
3576
3577	/* XXX: optimize */
3578	void stw_phys(target_phys_addr_t addr, uint32_t val)
3579	{
3580	uint16_t v = tswap16(val);
3581	cpu_physical_memory_write(addr, (const uint8_t *)&v, 2);
3582	}
3583
3584	/* XXX: optimize */
3585	void stq_phys(target_phys_addr_t addr, uint64_t val)
3586	{
3587	val = tswap64(val);
3588	cpu_physical_memory_write(addr, (const uint8_t *)&val, 8);
3589	}
3590
3591	#endif
3592
3593	/* virtual memory access for debug */
3594	int cpu_memory_rw_debug(CPUState *env, target_ulong addr,
3595	uint8_t *buf, int len, int is_write)
3596	{
3597	int l;
3598	target_ulong page, phys_addr;
3599
3600	while (len > 0) {
3601	page = addr & TARGET_PAGE_MASK;
3602	phys_addr = cpu_get_phys_page_debug(env, page);
3603	/* if no physical page mapped, return an error */
3604	if (phys_addr == -1)
3605	return -1;
3606	l = (page + TARGET_PAGE_SIZE) - addr;
3607	if (l > len)
3608	l = len;
3609	cpu_physical_memory_rw(phys_addr + (addr & ~TARGET_PAGE_MASK),
3610	buf, l, is_write);
3611	len -= l;
3612	buf += l;
3613	addr += l;
3614	}
3615	return 0;
3616	}
3617
3618	/* in deterministic execution mode, instructions doing device I/Os
3619	must be at the end of the TB */
3620	void cpu_io_recompile(CPUState env, void retaddr)
3621	{
3622	TranslationBlock *tb;
3623	uint32_t n, cflags;
3624	target_ulong pc, cs_base;
3625	uint64_t flags;
3626
3627	tb = tb_find_pc((unsigned long)retaddr);
3628	if (!tb) {
3629	cpu_abort(env, "cpu_io_recompile: could not find TB for pc=%p",
3630	retaddr);
3631	}
3632	n = env->icount_decr.u16.low + tb->icount;
3633	cpu_restore_state(tb, env, (unsigned long)retaddr, NULL);
3634	/* Calculate how many instructions had been executed before the fault
3635	occurred. */
3636	n = n - env->icount_decr.u16.low;
3637	/* Generate a new TB ending on the I/O insn. */
3638	n++;
3639	/* On MIPS and SH, delay slot instructions can only be restarted if
3640	they were already the first instruction in the TB. If this is not
3641	the first instruction in a TB then re-execute the preceding
3642	branch. */
3643	#if defined(TARGET_MIPS)
3644	if ((env->hflags & MIPS_HFLAG_BMASK) != 0 && n > 1) {
3645	env->active_tc.PC -= 4;
3646	env->icount_decr.u16.low++;
3647	env->hflags &= ~MIPS_HFLAG_BMASK;
3648	}
3649	#elif defined(TARGET_SH4)
3650	if ((env->flags & ((DELAY_SLOT \| DELAY_SLOT_CONDITIONAL))) != 0
3651	&& n > 1) {
3652	env->pc -= 2;
3653	env->icount_decr.u16.low++;
3654	env->flags &= ~(DELAY_SLOT \| DELAY_SLOT_CONDITIONAL);
3655	}
3656	#endif
3657	/* This should never happen. */
3658	if (n > CF_COUNT_MASK)
3659	cpu_abort(env, "TB too big during recompile");
3660
3661	cflags = n \| CF_LAST_IO;
3662	pc = tb->pc;
3663	cs_base = tb->cs_base;
3664	flags = tb->flags;
3665	tb_phys_invalidate(tb, -1);
3666	/* FIXME: In theory this could raise an exception. In practice
3667	we have already translated the block once so it's probably ok. */
3668	tb_gen_code(env, pc, cs_base, flags, cflags);
3669	/* TODO: If env->pc != tb->pc (i.e. the faulting instruction was not
3670	the first in the TB) then we end up generating a whole new TB and
3671	repeating the fault, which is horribly inefficient.
3672	Better would be to execute just this insn uncached, or generate a
3673	second new TB. */
3674	cpu_resume_from_signal(env, NULL);
3675	}
3676
3677	#ifndef VBOX
3678	void dump_exec_info(FILE *f,
3679	int (cpu_fprintf)(FILE f, const char *fmt, ...))
3680	{
3681	int i, target_code_size, max_target_code_size;
3682	int direct_jmp_count, direct_jmp2_count, cross_page;
3683	TranslationBlock *tb;
3684
3685	target_code_size = 0;
3686	max_target_code_size = 0;
3687	cross_page = 0;
3688	direct_jmp_count = 0;
3689	direct_jmp2_count = 0;
3690	for(i = 0; i < nb_tbs; i++) {
3691	tb = &tbs[i];
3692	target_code_size += tb->size;
3693	if (tb->size > max_target_code_size)
3694	max_target_code_size = tb->size;
3695	if (tb->page_addr[1] != -1)
3696	cross_page++;
3697	if (tb->tb_next_offset[0] != 0xffff) {
3698	direct_jmp_count++;
3699	if (tb->tb_next_offset[1] != 0xffff) {
3700	direct_jmp2_count++;
3701	}
3702	}
3703	}
3704	/* XXX: avoid using doubles ? */
3705	cpu_fprintf(f, "Translation buffer state:\n");
3706	cpu_fprintf(f, "gen code size %ld/%ld\n",
3707	code_gen_ptr - code_gen_buffer, code_gen_buffer_max_size);
3708	cpu_fprintf(f, "TB count %d/%d\n",
3709	nb_tbs, code_gen_max_blocks);
3710	cpu_fprintf(f, "TB avg target size %d max=%d bytes\n",
3711	nb_tbs ? target_code_size / nb_tbs : 0,
3712	max_target_code_size);
3713	cpu_fprintf(f, "TB avg host size %d bytes (expansion ratio: %0.1f)\n",
3714	nb_tbs ? (code_gen_ptr - code_gen_buffer) / nb_tbs : 0,
3715	target_code_size ? (double) (code_gen_ptr - code_gen_buffer) / target_code_size : 0);
3716	cpu_fprintf(f, "cross page TB count %d (%d%%)\n",
3717	cross_page,
3718	nb_tbs ? (cross_page * 100) / nb_tbs : 0);
3719	cpu_fprintf(f, "direct jump count %d (%d%%) (2 jumps=%d %d%%)\n",
3720	direct_jmp_count,
3721	nb_tbs ? (direct_jmp_count * 100) / nb_tbs : 0,
3722	direct_jmp2_count,
3723	nb_tbs ? (direct_jmp2_count * 100) / nb_tbs : 0);
3724	cpu_fprintf(f, "\nStatistics:\n");
3725	cpu_fprintf(f, "TB flush count %d\n", tb_flush_count);
3726	cpu_fprintf(f, "TB invalidate count %d\n", tb_phys_invalidate_count);
3727	cpu_fprintf(f, "TLB flush count %d\n", tlb_flush_count);
3728	tcg_dump_info(f, cpu_fprintf);
3729	}
3730	#endif /* !VBOX */
3731
3732	#if !defined(CONFIG_USER_ONLY)
3733
3734	#define MMUSUFFIX _cmmu
3735	#define GETPC() NULL
3736	#define env cpu_single_env
3737	#define SOFTMMU_CODE_ACCESS
3738
3739	#define SHIFT 0
3740	#include "softmmu_template.h"
3741
3742	#define SHIFT 1
3743	#include "softmmu_template.h"
3744
3745	#define SHIFT 2
3746	#include "softmmu_template.h"
3747
3748	#define SHIFT 3
3749	#include "softmmu_template.h"
3750
3751	#undef env
3752
3753	#endif

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/recompiler_new/exec.c@ 14969

Download in other formats: