exec.c@ 14974

最後變更在這個檔案從14974是 14974,由 vboxsync 提交於 16 年前
reenabled VA in TLB code
屬性 svn:eol-style 設為 `native`
檔案大小: 110.8 KB

行
1	/*
2	* virtual page mapping and translated block handling
3	*
4	* Copyright (c) 2003 Fabrice Bellard
5	*
6	* This library is free software; you can redistribute it and/or
7	* modify it under the terms of the GNU Lesser General Public
8	* License as published by the Free Software Foundation; either
9	* version 2 of the License, or (at your option) any later version.
10	*
11	* This library is distributed in the hope that it will be useful,
12	* but WITHOUT ANY WARRANTY; without even the implied warranty of
13	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14	* Lesser General Public License for more details.
15	*
16	* You should have received a copy of the GNU Lesser General Public
17	* License along with this library; if not, write to the Free Software
18	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
19	*/
20
21	/*
22	* Sun LGPL Disclaimer: For the avoidance of doubt, except that if any license choice
23	* other than GPL or LGPL is available it will apply instead, Sun elects to use only
24	* the Lesser General Public License version 2.1 (LGPLv2) at this time for any software where
25	* a choice of LGPL license versions is made available with the language indicating
26	* that LGPLv2 or any later version may be used, or where a choice of which version
27	* of the LGPL is applied is otherwise unspecified.
28	*/
29	#include "config.h"
30	#ifndef VBOX
31	#ifdef _WIN32
32	#include <windows.h>
33	#else
34	#include <sys/types.h>
35	#include <sys/mman.h>
36	#endif
37	#include <stdlib.h>
38	#include <stdio.h>
39	#include <stdarg.h>
40	#include <string.h>
41	#include <errno.h>
42	#include <unistd.h>
43	#include <inttypes.h>
44	#else /* VBOX */
45	# include <stdlib.h>
46	# include <stdio.h>
47	# include <iprt/alloc.h>
48	# include <iprt/string.h>
49	# include <iprt/param.h>
50	# include <VBox/pgm.h> /* PGM_DYNAMIC_RAM_ALLOC */
51	#endif /* VBOX */
52
53	#include "cpu.h"
54	#include "exec-all.h"
55	#if defined(CONFIG_USER_ONLY)
56	#include <qemu.h>
57	#endif
58
59	//#define DEBUG_TB_INVALIDATE
60	//#define DEBUG_FLUSH
61	//#define DEBUG_TLB
62	//#define DEBUG_UNASSIGNED
63
64	/* make various TB consistency checks */
65	//#define DEBUG_TB_CHECK
66	//#define DEBUG_TLB_CHECK
67
68	#if !defined(CONFIG_USER_ONLY)
69	/* TB consistency checks only implemented for usermode emulation. */
70	#undef DEBUG_TB_CHECK
71	#endif
72
73	#define SMC_BITMAP_USE_THRESHOLD 10
74
75	#define MMAP_AREA_START 0x00000000
76	#define MMAP_AREA_END 0xa8000000
77
78	#if defined(TARGET_SPARC64)
79	#define TARGET_PHYS_ADDR_SPACE_BITS 41
80	#elif defined(TARGET_SPARC)
81	#define TARGET_PHYS_ADDR_SPACE_BITS 36
82	#elif defined(TARGET_ALPHA)
83	#define TARGET_PHYS_ADDR_SPACE_BITS 42
84	#define TARGET_VIRT_ADDR_SPACE_BITS 42
85	#elif defined(TARGET_PPC64)
86	#define TARGET_PHYS_ADDR_SPACE_BITS 42
87	#elif defined(TARGET_X86_64) && !defined(USE_KQEMU)
88	#define TARGET_PHYS_ADDR_SPACE_BITS 42
89	#elif defined(TARGET_I386) && !defined(USE_KQEMU)
90	#define TARGET_PHYS_ADDR_SPACE_BITS 36
91	#else
92	/* Note: for compatibility with kqemu, we use 32 bits for x86_64 */
93	#define TARGET_PHYS_ADDR_SPACE_BITS 32
94	#endif
95
96	static TranslationBlock *tbs;
97	int code_gen_max_blocks;
98	TranslationBlock *tb_phys_hash[CODE_GEN_PHYS_HASH_SIZE];
99	static int nb_tbs;
100	/* any access to the tbs or the page table must use this lock */
101	spinlock_t tb_lock = SPIN_LOCK_UNLOCKED;
102
103	#ifndef VBOX
104	#if defined(__arm__) \|\| defined(__sparc_v9__)
105	/* The prologue must be reachable with a direct jump. ARM and Sparc64
106	have limited branch ranges (possibly also PPC) so place it in a
107	section close to code segment. */
108	#define code_gen_section \
109	__attribute__((__section__(".gen_code"))) \
110	__attribute__((aligned (32)))
111	#else
112	#define code_gen_section \
113	__attribute__((aligned (32)))
114	#endif
115	uint8_t code_gen_prologue[1024] code_gen_section;
116
117	#else /* VBOX */
118	extern uint8_t* code_gen_prologue;
119	#endif /* VBOX */
120
121	static uint8_t *code_gen_buffer;
122	static unsigned long code_gen_buffer_size;
123	/* threshold to flush the translated code buffer */
124	static unsigned long code_gen_buffer_max_size;
125	uint8_t *code_gen_ptr;
126
127	#ifndef VBOX
128	#if !defined(CONFIG_USER_ONLY)
129	ram_addr_t phys_ram_size;
130	int phys_ram_fd;
131	uint8_t *phys_ram_base;
132	uint8_t *phys_ram_dirty;
133	static int in_migration;
134	static ram_addr_t phys_ram_alloc_offset = 0;
135	#endif
136	#else /* VBOX */
137	RTGCPHYS phys_ram_size;
138	/* we have memory ranges (the high PC-BIOS mapping) which
139	causes some pages to fall outside the dirty map here. */
140	uint32_t phys_ram_dirty_size;
141	#endif /* VBOX */
142	#if !defined(VBOX)
143	uint8_t *phys_ram_base;
144	#endif
145	uint8_t *phys_ram_dirty;
146
147	CPUState *first_cpu;
148	/* current CPU in the current thread. It is only valid inside
149	cpu_exec() */
150	CPUState *cpu_single_env;
151	/* 0 = Do not count executed instructions.
152	1 = Precise instruction counting.
153	2 = Adaptive rate instruction counting. */
154	int use_icount = 0;
155	/* Current instruction counter. While executing translated code this may
156	include some instructions that have not yet been executed. */
157	int64_t qemu_icount;
158
159	typedef struct PageDesc {
160	/* list of TBs intersecting this ram page */
161	TranslationBlock *first_tb;
162	/* in order to optimize self modifying code, we count the number
163	of lookups we do to a given page to use a bitmap */
164	unsigned int code_write_count;
165	uint8_t *code_bitmap;
166	#if defined(CONFIG_USER_ONLY)
167	unsigned long flags;
168	#endif
169	} PageDesc;
170
171	typedef struct PhysPageDesc {
172	/* offset in host memory of the page + io_index in the low 12 bits */
173	ram_addr_t phys_offset;
174	} PhysPageDesc;
175
176	#define L2_BITS 10
177	#if defined(CONFIG_USER_ONLY) && defined(TARGET_VIRT_ADDR_SPACE_BITS)
178	/* XXX: this is a temporary hack for alpha target.
179	* In the future, this is to be replaced by a multi-level table
180	* to actually be able to handle the complete 64 bits address space.
181	*/
182	#define L1_BITS (TARGET_VIRT_ADDR_SPACE_BITS - L2_BITS - TARGET_PAGE_BITS)
183	#else
184	#define L1_BITS (32 - L2_BITS - TARGET_PAGE_BITS)
185	#endif
186
187	#define L1_SIZE (1 << L1_BITS)
188	#define L2_SIZE (1 << L2_BITS)
189
190	static void io_mem_init(void);
191
192	unsigned long qemu_real_host_page_size;
193	unsigned long qemu_host_page_bits;
194	unsigned long qemu_host_page_size;
195	unsigned long qemu_host_page_mask;
196
197	/* XXX: for system emulation, it could just be an array */
198	static PageDesc *l1_map[L1_SIZE];
199	static PhysPageDesc **l1_phys_map;
200
201	#if !defined(CONFIG_USER_ONLY)
202	static void io_mem_init(void);
203
204	/* io memory support */
205	CPUWriteMemoryFunc *io_mem_write[IO_MEM_NB_ENTRIES][4];
206	CPUReadMemoryFunc *io_mem_read[IO_MEM_NB_ENTRIES][4];
207	void *io_mem_opaque[IO_MEM_NB_ENTRIES];
208	static int io_mem_nb;
209	static int io_mem_watch;
210	#endif
211
212	#ifndef VBOX
213	/* log support */
214	static const char *logfilename = "/tmp/qemu.log";
215	#endif /* !VBOX */
216	FILE *logfile;
217	int loglevel;
218	#ifndef VBOX
219	static int log_append = 0;
220	#endif
221
222	/* statistics */
223	static int tlb_flush_count;
224	static int tb_flush_count;
225	#ifndef VBOX
226	static int tb_phys_invalidate_count;
227	#endif /* !VBOX */
228
229	#define SUBPAGE_IDX(addr) ((addr) & ~TARGET_PAGE_MASK)
230	typedef struct subpage_t {
231	target_phys_addr_t base;
232	CPUReadMemoryFunc **mem_read[TARGET_PAGE_SIZE][4];
233	CPUWriteMemoryFunc **mem_write[TARGET_PAGE_SIZE][4];
234	void *opaque[TARGET_PAGE_SIZE][2][4];
235	} subpage_t;
236
237
238	#ifndef VBOX
239	#ifdef _WIN32
240	static void map_exec(void *addr, long size)
241	{
242	DWORD old_protect;
243	VirtualProtect(addr, size,
244	PAGE_EXECUTE_READWRITE, &old_protect);
245
246	}
247	#else
248	static void map_exec(void *addr, long size)
249	{
250	unsigned long start, end, page_size;
251
252	page_size = getpagesize();
253	start = (unsigned long)addr;
254	start &= ~(page_size - 1);
255
256	end = (unsigned long)addr + size;
257	end += page_size - 1;
258	end &= ~(page_size - 1);
259
260	mprotect((void *)start, end - start,
261	PROT_READ \| PROT_WRITE \| PROT_EXEC);
262	}
263	#endif
264	#else // VBOX
265	static void map_exec(void *addr, long size)
266	{
267	RTMemProtect(addr, size,
268	RTMEM_PROT_EXEC \| RTMEM_PROT_READ \| RTMEM_PROT_WRITE);
269	}
270	#endif
271
272	static void page_init(void)
273	{
274	/* NOTE: we can always suppose that qemu_host_page_size >=
275	TARGET_PAGE_SIZE */
276	#ifdef VBOX
277	RTMemProtect(code_gen_buffer, sizeof(code_gen_buffer),
278	RTMEM_PROT_EXEC \| RTMEM_PROT_READ \| RTMEM_PROT_WRITE);
279	qemu_real_host_page_size = PAGE_SIZE;
280	#else /* !VBOX */
281	#ifdef _WIN32
282	{
283	SYSTEM_INFO system_info;
284	DWORD old_protect;
285
286	GetSystemInfo(&system_info);
287	qemu_real_host_page_size = system_info.dwPageSize;
288	}
289	#else
290	qemu_real_host_page_size = getpagesize();
291	#endif
292	#endif /* !VBOX */
293
294	if (qemu_host_page_size == 0)
295	qemu_host_page_size = qemu_real_host_page_size;
296	if (qemu_host_page_size < TARGET_PAGE_SIZE)
297	qemu_host_page_size = TARGET_PAGE_SIZE;
298	qemu_host_page_bits = 0;
299	#ifndef VBOX
300	while ((1 << qemu_host_page_bits) < qemu_host_page_size)
301	#else
302	while ((1 << qemu_host_page_bits) < (int)qemu_host_page_size)
303	#endif
304	qemu_host_page_bits++;
305	qemu_host_page_mask = ~(qemu_host_page_size - 1);
306	l1_phys_map = qemu_vmalloc(L1_SIZE * sizeof(void *));
307	memset(l1_phys_map, 0, L1_SIZE * sizeof(void *));
308	#ifdef VBOX
309	/* We use other means to set reserved bit on our pages */
310	#else
311	#if !defined(_WIN32) && defined(CONFIG_USER_ONLY)
312	{
313	long long startaddr, endaddr;
314	FILE *f;
315	int n;
316
317	mmap_lock();
318	last_brk = (unsigned long)sbrk(0);
319	f = fopen("/proc/self/maps", "r");
320	if (f) {
321	do {
322	n = fscanf (f, "%llx-%llx %*[^\n]\n", &startaddr, &endaddr);
323	if (n == 2) {
324	startaddr = MIN(startaddr,
325	(1ULL << TARGET_PHYS_ADDR_SPACE_BITS) - 1);
326	endaddr = MIN(endaddr,
327	(1ULL << TARGET_PHYS_ADDR_SPACE_BITS) - 1);
328	page_set_flags(startaddr & TARGET_PAGE_MASK,
329	TARGET_PAGE_ALIGN(endaddr),
330	PAGE_RESERVED);
331	}
332	} while (!feof(f));
333	fclose(f);
334	}
335	mmap_unlock();
336	}
337	#endif
338	#endif
339	}
340
341	#ifndef VBOX
342	static inline PageDesc **page_l1_map(target_ulong index)
343	#else
344	DECLINLINE(PageDesc **) page_l1_map(target_ulong index)
345	#endif
346	{
347	#if TARGET_LONG_BITS > 32
348	/* Host memory outside guest VM. For 32-bit targets we have already
349	excluded high addresses. */
350	if (index > ((target_ulong)L2_SIZE * L1_SIZE))
351	return NULL;
352	#endif
353	return &l1_map[index >> L2_BITS];
354	}
355
356	#ifndef VBOX
357	static inline PageDesc *page_find_alloc(target_ulong index)
358	#else
359	DECLINLINE(PageDesc *) page_find_alloc(target_ulong index)
360	#endif
361	{
362	PageDesc *lp, p;
363	lp = page_l1_map(index);
364	if (!lp)
365	return NULL;
366
367	p = *lp;
368	if (!p) {
369	/* allocate if not found */
370	#if defined(CONFIG_USER_ONLY)
371	unsigned long addr;
372	size_t len = sizeof(PageDesc) * L2_SIZE;
373	/* Don't use qemu_malloc because it may recurse. */
374	p = mmap(0, len, PROT_READ \| PROT_WRITE,
375	MAP_PRIVATE \| MAP_ANONYMOUS, -1, 0);
376	*lp = p;
377	addr = h2g(p);
378	if (addr == (target_ulong)addr) {
379	page_set_flags(addr & TARGET_PAGE_MASK,
380	TARGET_PAGE_ALIGN(addr + len),
381	PAGE_RESERVED);
382	}
383	#else
384	p = qemu_mallocz(sizeof(PageDesc) * L2_SIZE);
385	*lp = p;
386	#endif
387	}
388	return p + (index & (L2_SIZE - 1));
389	}
390
391	#ifndef VBOX
392	static inline PageDesc *page_find(target_ulong index)
393	#else
394	DECLINLINE(PageDesc *) page_find(target_ulong index)
395	#endif
396	{
397	PageDesc *lp, p;
398	lp = page_l1_map(index);
399	if (!lp)
400	return NULL;
401
402	p = *lp;
403	if (!p)
404	return 0;
405	return p + (index & (L2_SIZE - 1));
406	}
407
408	static PhysPageDesc *phys_page_find_alloc(target_phys_addr_t index, int alloc)
409	{
410	void lp, p;
411	PhysPageDesc *pd;
412
413	p = (void **)l1_phys_map;
414	#if TARGET_PHYS_ADDR_SPACE_BITS > 32
415
416	#if TARGET_PHYS_ADDR_SPACE_BITS > (32 + L1_BITS)
417	#error unsupported TARGET_PHYS_ADDR_SPACE_BITS
418	#endif
419	lp = p + ((index >> (L1_BITS + L2_BITS)) & (L1_SIZE - 1));
420	p = *lp;
421	if (!p) {
422	/* allocate if not found */
423	if (!alloc)
424	return NULL;
425	p = qemu_vmalloc(sizeof(void ) L1_SIZE);
426	memset(p, 0, sizeof(void ) L1_SIZE);
427	*lp = p;
428	}
429	#endif
430	lp = p + ((index >> L2_BITS) & (L1_SIZE - 1));
431	pd = *lp;
432	if (!pd) {
433	int i;
434	/* allocate if not found */
435	if (!alloc)
436	return NULL;
437	pd = qemu_vmalloc(sizeof(PhysPageDesc) * L2_SIZE);
438	*lp = pd;
439	for (i = 0; i < L2_SIZE; i++)
440	pd[i].phys_offset = IO_MEM_UNASSIGNED;
441	}
442	#if defined(VBOX) && !defined(VBOX_WITH_NEW_PHYS_CODE)
443	pd = ((PhysPageDesc *)pd) + (index & (L2_SIZE - 1));
444	if (RT_UNLIKELY((pd->phys_offset & ~TARGET_PAGE_MASK) == IO_MEM_RAM_MISSING))
445	remR3GrowDynRange(pd->phys_offset & TARGET_PAGE_MASK);
446	return pd;
447	#else
448	return ((PhysPageDesc *)pd) + (index & (L2_SIZE - 1));
449	#endif
450	}
451
452	#ifndef VBOX
453	static inline PhysPageDesc *phys_page_find(target_phys_addr_t index)
454	#else
455	DECLINLINE(PhysPageDesc *) phys_page_find(target_phys_addr_t index)
456	#endif
457	{
458	return phys_page_find_alloc(index, 0);
459	}
460
461	#if !defined(CONFIG_USER_ONLY)
462	static void tlb_protect_code(ram_addr_t ram_addr);
463	static void tlb_unprotect_code_phys(CPUState *env, ram_addr_t ram_addr,
464	target_ulong vaddr);
465	#define mmap_lock() do { } while(0)
466	#define mmap_unlock() do { } while(0)
467	#endif
468
469	#ifdef VBOX
470	/** @todo nike: isn't 32M too much ? */
471	#endif
472	#define DEFAULT_CODE_GEN_BUFFER_SIZE (32 * 1024 * 1024)
473
474	#if defined(CONFIG_USER_ONLY)
475	/* Currently it is not recommanded to allocate big chunks of data in
476	user mode. It will change when a dedicated libc will be used */
477	#define USE_STATIC_CODE_GEN_BUFFER
478	#endif
479
480	/* VBox allocates codegen buffer dynamically */
481	#ifndef VBOX
482	#ifdef USE_STATIC_CODE_GEN_BUFFER
483	static uint8_t static_code_gen_buffer[DEFAULT_CODE_GEN_BUFFER_SIZE];
484	#endif
485	#endif
486
487	static void code_gen_alloc(unsigned long tb_size)
488	{
489	#ifdef USE_STATIC_CODE_GEN_BUFFER
490	code_gen_buffer = static_code_gen_buffer;
491	code_gen_buffer_size = DEFAULT_CODE_GEN_BUFFER_SIZE;
492	map_exec(code_gen_buffer, code_gen_buffer_size);
493	#else
494	code_gen_buffer_size = tb_size;
495	if (code_gen_buffer_size == 0) {
496	#if defined(CONFIG_USER_ONLY)
497	/* in user mode, phys_ram_size is not meaningful */
498	code_gen_buffer_size = DEFAULT_CODE_GEN_BUFFER_SIZE;
499	#else
500	/* XXX: needs ajustments */
501	code_gen_buffer_size = (unsigned long)(phys_ram_size / 4);
502	#endif
503	}
504	if (code_gen_buffer_size < MIN_CODE_GEN_BUFFER_SIZE)
505	code_gen_buffer_size = MIN_CODE_GEN_BUFFER_SIZE;
506	/* The code gen buffer location may have constraints depending on
507	the host cpu and OS */
508	#ifdef VBOX
509	code_gen_buffer = RTMemExecAlloc(code_gen_buffer_size);
510
511	if (!code_gen_buffer) {
512	LogRel(("REM: failed allocate codegen buffer %lld\n",
513	code_gen_buffer_size));
514	return;
515	}
516	#else //!VBOX
517	#if defined(__linux__)
518	{
519	int flags;
520	void *start = NULL;
521
522	flags = MAP_PRIVATE \| MAP_ANONYMOUS;
523	#if defined(__x86_64__)
524	flags \|= MAP_32BIT;
525	/* Cannot map more than that */
526	if (code_gen_buffer_size > (800 * 1024 * 1024))
527	code_gen_buffer_size = (800 * 1024 * 1024);
528	#elif defined(__sparc_v9__)
529	// Map the buffer below 2G, so we can use direct calls and branches
530	flags \|= MAP_FIXED;
531	start = (void *) 0x60000000UL;
532	if (code_gen_buffer_size > (512 * 1024 * 1024))
533	code_gen_buffer_size = (512 * 1024 * 1024);
534	#endif
535	code_gen_buffer = mmap(start, code_gen_buffer_size,
536	PROT_WRITE \| PROT_READ \| PROT_EXEC,
537	flags, -1, 0);
538	if (code_gen_buffer == MAP_FAILED) {
539	fprintf(stderr, "Could not allocate dynamic translator buffer\n");
540	exit(1);
541	}
542	}
543	#elif defined(__FreeBSD__)
544	{
545	int flags;
546	void *addr = NULL;
547	flags = MAP_PRIVATE \| MAP_ANONYMOUS;
548	#if defined(__x86_64__)
549	/* FreeBSD doesn't have MAP_32BIT, use MAP_FIXED and assume
550	* 0x40000000 is free */
551	flags \|= MAP_FIXED;
552	addr = (void *)0x40000000;
553	/* Cannot map more than that */
554	if (code_gen_buffer_size > (800 * 1024 * 1024))
555	code_gen_buffer_size = (800 * 1024 * 1024);
556	#endif
557	code_gen_buffer = mmap(addr, code_gen_buffer_size,
558	PROT_WRITE \| PROT_READ \| PROT_EXEC,
559	flags, -1, 0);
560	if (code_gen_buffer == MAP_FAILED) {
561	fprintf(stderr, "Could not allocate dynamic translator buffer\n");
562	exit(1);
563	}
564	}
565	#else
566	code_gen_buffer = qemu_malloc(code_gen_buffer_size);
567	if (!code_gen_buffer) {
568	fprintf(stderr, "Could not allocate dynamic translator buffer\n");
569	exit(1);
570	}
571	map_exec(code_gen_buffer, code_gen_buffer_size);
572	#endif
573	map_exec(code_gen_prologue, sizeof(code_gen_prologue));
574	#endif /* !VBOX */
575	#endif /* !USE_STATIC_CODE_GEN_BUFFER */
576	#ifndef VBOX
577	map_exec(code_gen_prologue, sizeof(code_gen_prologue));
578	#else
579	map_exec(code_gen_prologue, _1K);
580	#endif
581
582	code_gen_buffer_max_size = code_gen_buffer_size -
583	code_gen_max_block_size();
584	code_gen_max_blocks = code_gen_buffer_size / CODE_GEN_AVG_BLOCK_SIZE;
585	tbs = qemu_malloc(code_gen_max_blocks * sizeof(TranslationBlock));
586	}
587
588	/* Must be called before using the QEMU cpus. 'tb_size' is the size
589	(in bytes) allocated to the translation buffer. Zero means default
590	size. */
591	void cpu_exec_init_all(unsigned long tb_size)
592	{
593	cpu_gen_init();
594	code_gen_alloc(tb_size);
595	code_gen_ptr = code_gen_buffer;
596	page_init();
597	#if !defined(CONFIG_USER_ONLY)
598	io_mem_init();
599	#endif
600	}
601
602	#ifndef VBOX
603	#if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
604
605	#define CPU_COMMON_SAVE_VERSION 1
606
607	static void cpu_common_save(QEMUFile f, void opaque)
608	{
609	CPUState *env = opaque;
610
611	qemu_put_be32s(f, &env->halted);
612	qemu_put_be32s(f, &env->interrupt_request);
613	}
614
615	static int cpu_common_load(QEMUFile f, void opaque, int version_id)
616	{
617	CPUState *env = opaque;
618
619	if (version_id != CPU_COMMON_SAVE_VERSION)
620	return -EINVAL;
621
622	qemu_get_be32s(f, &env->halted);
623	qemu_get_be32s(f, &env->interrupt_request);
624	tlb_flush(env, 1);
625
626	return 0;
627	}
628	#endif
629	#endif //!VBOX
630
631	void cpu_exec_init(CPUState *env)
632	{
633	CPUState **penv;
634	int cpu_index;
635
636	env->next_cpu = NULL;
637	penv = &first_cpu;
638	cpu_index = 0;
639	while (*penv != NULL) {
640	penv = (CPUState *)&(penv)->next_cpu;
641	cpu_index++;
642	}
643	env->cpu_index = cpu_index;
644	env->nb_watchpoints = 0;
645	*penv = env;
646	#ifndef VBOX
647	#if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
648	register_savevm("cpu_common", cpu_index, CPU_COMMON_SAVE_VERSION,
649	cpu_common_save, cpu_common_load, env);
650	register_savevm("cpu", cpu_index, CPU_SAVE_VERSION,
651	cpu_save, cpu_load, env);
652	#endif
653	#endif // !VBOX
654	}
655
656	#ifndef VBOX
657	static inline void invalidate_page_bitmap(PageDesc *p)
658	#else
659	DECLINLINE(void) invalidate_page_bitmap(PageDesc *p)
660	#endif
661	{
662	if (p->code_bitmap) {
663	qemu_free(p->code_bitmap);
664	p->code_bitmap = NULL;
665	}
666	p->code_write_count = 0;
667	}
668
669	/* set to NULL all the 'first_tb' fields in all PageDescs */
670	static void page_flush_tb(void)
671	{
672	int i, j;
673	PageDesc *p;
674
675	for(i = 0; i < L1_SIZE; i++) {
676	p = l1_map[i];
677	if (p) {
678	for(j = 0; j < L2_SIZE; j++) {
679	p->first_tb = NULL;
680	invalidate_page_bitmap(p);
681	p++;
682	}
683	}
684	}
685	}
686
687	/* flush all the translation blocks */
688	/* XXX: tb_flush is currently not thread safe */
689	void tb_flush(CPUState *env1)
690	{
691	CPUState *env;
692	#if defined(DEBUG_FLUSH)
693	printf("qemu: flush code_size=%ld nb_tbs=%d avg_tb_size=%ld\n",
694	(unsigned long)(code_gen_ptr - code_gen_buffer),
695	nb_tbs, nb_tbs > 0 ?
696	((unsigned long)(code_gen_ptr - code_gen_buffer)) / nb_tbs : 0);
697	#endif
698	if ((unsigned long)(code_gen_ptr - code_gen_buffer) > code_gen_buffer_size)
699	cpu_abort(env1, "Internal error: code buffer overflow\n");
700
701	nb_tbs = 0;
702
703	for(env = first_cpu; env != NULL; env = env->next_cpu) {
704	memset (env->tb_jmp_cache, 0, TB_JMP_CACHE_SIZE * sizeof (void *));
705	}
706
707	memset (tb_phys_hash, 0, CODE_GEN_PHYS_HASH_SIZE * sizeof (void *));
708	page_flush_tb();
709
710	code_gen_ptr = code_gen_buffer;
711	/* XXX: flush processor icache at this point if cache flush is
712	expensive */
713	tb_flush_count++;
714	}
715
716	#ifdef DEBUG_TB_CHECK
717	static void tb_invalidate_check(target_ulong address)
718	{
719	TranslationBlock *tb;
720	int i;
721	address &= TARGET_PAGE_MASK;
722	for(i = 0;i < CODE_GEN_PHYS_HASH_SIZE; i++) {
723	for(tb = tb_phys_hash[i]; tb != NULL; tb = tb->phys_hash_next) {
724	if (!(address + TARGET_PAGE_SIZE <= tb->pc \|\|
725	address >= tb->pc + tb->size)) {
726	printf("ERROR invalidate: address=%08lx PC=%08lx size=%04x\n",
727	address, (long)tb->pc, tb->size);
728	}
729	}
730	}
731	}
732
733	/* verify that all the pages have correct rights for code */
734	static void tb_page_check(void)
735	{
736	TranslationBlock *tb;
737	int i, flags1, flags2;
738
739	for(i = 0;i < CODE_GEN_PHYS_HASH_SIZE; i++) {
740	for(tb = tb_phys_hash[i]; tb != NULL; tb = tb->phys_hash_next) {
741	flags1 = page_get_flags(tb->pc);
742	flags2 = page_get_flags(tb->pc + tb->size - 1);
743	if ((flags1 & PAGE_WRITE) \|\| (flags2 & PAGE_WRITE)) {
744	printf("ERROR page flags: PC=%08lx size=%04x f1=%x f2=%x\n",
745	(long)tb->pc, tb->size, flags1, flags2);
746	}
747	}
748	}
749	}
750
751	static void tb_jmp_check(TranslationBlock *tb)
752	{
753	TranslationBlock *tb1;
754	unsigned int n1;
755
756	/* suppress any remaining jumps to this TB */
757	tb1 = tb->jmp_first;
758	for(;;) {
759	n1 = (long)tb1 & 3;
760	tb1 = (TranslationBlock *)((long)tb1 & ~3);
761	if (n1 == 2)
762	break;
763	tb1 = tb1->jmp_next[n1];
764	}
765	/* check end of list */
766	if (tb1 != tb) {
767	printf("ERROR: jmp_list from 0x%08lx\n", (long)tb);
768	}
769	}
770	#endif // DEBUG_TB_CHECK
771
772	/* invalidate one TB */
773	#ifndef VBOX
774	static inline void tb_remove(TranslationBlock *ptb, TranslationBlock tb,
775	int next_offset)
776	#else
777	DECLINLINE(void) tb_remove(TranslationBlock *ptb, TranslationBlock tb,
778	int next_offset)
779	#endif
780	{
781	TranslationBlock *tb1;
782	for(;;) {
783	tb1 = *ptb;
784	if (tb1 == tb) {
785	ptb = (TranslationBlock *)((char )tb1 + next_offset);
786	break;
787	}
788	ptb = (TranslationBlock *)((char )tb1 + next_offset);
789	}
790	}
791
792	#ifndef VBOX
793	static inline void tb_page_remove(TranslationBlock *ptb, TranslationBlock tb)
794	#else
795	DECLINLINE(void) tb_page_remove(TranslationBlock *ptb, TranslationBlock tb)
796	#endif
797	{
798	TranslationBlock *tb1;
799	unsigned int n1;
800
801	for(;;) {
802	tb1 = *ptb;
803	n1 = (long)tb1 & 3;
804	tb1 = (TranslationBlock *)((long)tb1 & ~3);
805	if (tb1 == tb) {
806	*ptb = tb1->page_next[n1];
807	break;
808	}
809	ptb = &tb1->page_next[n1];
810	}
811	}
812
813	#ifndef VBOX
814	static inline void tb_jmp_remove(TranslationBlock *tb, int n)
815	#else
816	DECLINLINE(void) tb_jmp_remove(TranslationBlock *tb, int n)
817	#endif
818	{
819	TranslationBlock tb1, *ptb;
820	unsigned int n1;
821
822	ptb = &tb->jmp_next[n];
823	tb1 = *ptb;
824	if (tb1) {
825	/* find tb(n) in circular list */
826	for(;;) {
827	tb1 = *ptb;
828	n1 = (long)tb1 & 3;
829	tb1 = (TranslationBlock *)((long)tb1 & ~3);
830	if (n1 == n && tb1 == tb)
831	break;
832	if (n1 == 2) {
833	ptb = &tb1->jmp_first;
834	} else {
835	ptb = &tb1->jmp_next[n1];
836	}
837	}
838	/* now we can suppress tb(n) from the list */
839	*ptb = tb->jmp_next[n];
840
841	tb->jmp_next[n] = NULL;
842	}
843	}
844
845	/* reset the jump entry 'n' of a TB so that it is not chained to
846	another TB */
847	#ifndef VBOX
848	static inline void tb_reset_jump(TranslationBlock *tb, int n)
849	#else
850	DECLINLINE(void) tb_reset_jump(TranslationBlock *tb, int n)
851	#endif
852	{
853	tb_set_jmp_target(tb, n, (unsigned long)(tb->tc_ptr + tb->tb_next_offset[n]));
854	}
855
856	void tb_phys_invalidate(TranslationBlock *tb, target_ulong page_addr)
857	{
858	CPUState *env;
859	PageDesc *p;
860	unsigned int h, n1;
861	target_phys_addr_t phys_pc;
862	TranslationBlock tb1, tb2;
863
864	/* remove the TB from the hash list */
865	phys_pc = tb->page_addr[0] + (tb->pc & ~TARGET_PAGE_MASK);
866	h = tb_phys_hash_func(phys_pc);
867	tb_remove(&tb_phys_hash[h], tb,
868	offsetof(TranslationBlock, phys_hash_next));
869
870	/* remove the TB from the page list */
871	if (tb->page_addr[0] != page_addr) {
872	p = page_find(tb->page_addr[0] >> TARGET_PAGE_BITS);
873	tb_page_remove(&p->first_tb, tb);
874	invalidate_page_bitmap(p);
875	}
876	if (tb->page_addr[1] != -1 && tb->page_addr[1] != page_addr) {
877	p = page_find(tb->page_addr[1] >> TARGET_PAGE_BITS);
878	tb_page_remove(&p->first_tb, tb);
879	invalidate_page_bitmap(p);
880	}
881
882	tb_invalidated_flag = 1;
883
884	/* remove the TB from the hash list */
885	h = tb_jmp_cache_hash_func(tb->pc);
886	for(env = first_cpu; env != NULL; env = env->next_cpu) {
887	if (env->tb_jmp_cache[h] == tb)
888	env->tb_jmp_cache[h] = NULL;
889	}
890
891	/* suppress this TB from the two jump lists */
892	tb_jmp_remove(tb, 0);
893	tb_jmp_remove(tb, 1);
894
895	/* suppress any remaining jumps to this TB */
896	tb1 = tb->jmp_first;
897	for(;;) {
898	n1 = (long)tb1 & 3;
899	if (n1 == 2)
900	break;
901	tb1 = (TranslationBlock *)((long)tb1 & ~3);
902	tb2 = tb1->jmp_next[n1];
903	tb_reset_jump(tb1, n1);
904	tb1->jmp_next[n1] = NULL;
905	tb1 = tb2;
906	}
907	tb->jmp_first = (TranslationBlock )((long)tb \| 2); / fail safe */
908
909	#ifndef VBOX
910	tb_phys_invalidate_count++;
911	#endif
912	}
913
914
915	#ifdef VBOX
916	void tb_invalidate_virt(CPUState *env, uint32_t eip)
917	{
918	# if 1
919	tb_flush(env);
920	# else
921	uint8_t cs_base, pc;
922	unsigned int flags, h, phys_pc;
923	TranslationBlock tb, *ptb;
924
925	flags = env->hflags;
926	flags \|= (env->eflags & (IOPL_MASK \| TF_MASK \| VM_MASK));
927	cs_base = env->segs[R_CS].base;
928	pc = cs_base + eip;
929
930	tb = tb_find(&ptb, (unsigned long)pc, (unsigned long)cs_base,
931	flags);
932
933	if(tb)
934	{
935	# ifdef DEBUG
936	printf("invalidating TB (%08X) at %08X\n", tb, eip);
937	# endif
938	tb_invalidate(tb);
939	//Note: this will leak TBs, but the whole cache will be flushed
940	// when it happens too often
941	tb->pc = 0;
942	tb->cs_base = 0;
943	tb->flags = 0;
944	}
945	# endif
946	}
947
948	# ifdef VBOX_STRICT
949	/**
950	* Gets the page offset.
951	*/
952	unsigned long get_phys_page_offset(target_ulong addr)
953	{
954	PhysPageDesc *p = phys_page_find(addr >> TARGET_PAGE_BITS);
955	return p ? p->phys_offset : 0;
956	}
957	# endif /* VBOX_STRICT */
958	#endif /* VBOX */
959
960	#ifndef VBOX
961	static inline void set_bits(uint8_t *tab, int start, int len)
962	#else
963	DECLINLINE(void) set_bits(uint8_t *tab, int start, int len)
964	#endif
965	{
966	int end, mask, end1;
967
968	end = start + len;
969	tab += start >> 3;
970	mask = 0xff << (start & 7);
971	if ((start & ~7) == (end & ~7)) {
972	if (start < end) {
973	mask &= ~(0xff << (end & 7));
974	*tab \|= mask;
975	}
976	} else {
977	*tab++ \|= mask;
978	start = (start + 8) & ~7;
979	end1 = end & ~7;
980	while (start < end1) {
981	*tab++ = 0xff;
982	start += 8;
983	}
984	if (start < end) {
985	mask = ~(0xff << (end & 7));
986	*tab \|= mask;
987	}
988	}
989	}
990
991	static void build_page_bitmap(PageDesc *p)
992	{
993	int n, tb_start, tb_end;
994	TranslationBlock *tb;
995
996	p->code_bitmap = qemu_malloc(TARGET_PAGE_SIZE / 8);
997	if (!p->code_bitmap)
998	return;
999	memset(p->code_bitmap, 0, TARGET_PAGE_SIZE / 8);
1000
1001	tb = p->first_tb;
1002	while (tb != NULL) {
1003	n = (long)tb & 3;
1004	tb = (TranslationBlock *)((long)tb & ~3);
1005	/* NOTE: this is subtle as a TB may span two physical pages */
1006	if (n == 0) {
1007	/* NOTE: tb_end may be after the end of the page, but
1008	it is not a problem */
1009	tb_start = tb->pc & ~TARGET_PAGE_MASK;
1010	tb_end = tb_start + tb->size;
1011	if (tb_end > TARGET_PAGE_SIZE)
1012	tb_end = TARGET_PAGE_SIZE;
1013	} else {
1014	tb_start = 0;
1015	tb_end = ((tb->pc + tb->size) & ~TARGET_PAGE_MASK);
1016	}
1017	set_bits(p->code_bitmap, tb_start, tb_end - tb_start);
1018	tb = tb->page_next[n];
1019	}
1020	}
1021
1022	TranslationBlock tb_gen_code(CPUState env,
1023	target_ulong pc, target_ulong cs_base,
1024	int flags, int cflags)
1025	{
1026	TranslationBlock *tb;
1027	uint8_t *tc_ptr;
1028	target_ulong phys_pc, phys_page2, virt_page2;
1029	int code_gen_size;
1030
1031	phys_pc = get_phys_addr_code(env, pc);
1032	tb = tb_alloc(pc);
1033	if (!tb) {
1034	/* flush must be done */
1035	tb_flush(env);
1036	/* cannot fail at this point */
1037	tb = tb_alloc(pc);
1038	/* Don't forget to invalidate previous TB info. */
1039	tb_invalidated_flag = 1;
1040	}
1041	tc_ptr = code_gen_ptr;
1042	tb->tc_ptr = tc_ptr;
1043	tb->cs_base = cs_base;
1044	tb->flags = flags;
1045	tb->cflags = cflags;
1046	cpu_gen_code(env, tb, &code_gen_size);
1047	code_gen_ptr = (void *)(((unsigned long)code_gen_ptr + code_gen_size + CODE_GEN_ALIGN - 1) & ~(CODE_GEN_ALIGN - 1));
1048
1049	/* check next page if needed */
1050	virt_page2 = (pc + tb->size - 1) & TARGET_PAGE_MASK;
1051	phys_page2 = -1;
1052	if ((pc & TARGET_PAGE_MASK) != virt_page2) {
1053	phys_page2 = get_phys_addr_code(env, virt_page2);
1054	}
1055	tb_link_phys(tb, phys_pc, phys_page2);
1056	return tb;
1057	}
1058
1059	/* invalidate all TBs which intersect with the target physical page
1060	starting in range [start;end[. NOTE: start and end must refer to
1061	the same physical page. 'is_cpu_write_access' should be true if called
1062	from a real cpu write access: the virtual CPU will exit the current
1063	TB if code is modified inside this TB. */
1064	void tb_invalidate_phys_page_range(target_phys_addr_t start, target_phys_addr_t end,
1065	int is_cpu_write_access)
1066	{
1067	int n, current_tb_modified, current_tb_not_found, current_flags;
1068	CPUState *env = cpu_single_env;
1069	PageDesc *p;
1070	TranslationBlock tb, tb_next, current_tb, saved_tb;
1071	target_ulong tb_start, tb_end;
1072	target_ulong current_pc, current_cs_base;
1073
1074	p = page_find(start >> TARGET_PAGE_BITS);
1075	if (!p)
1076	return;
1077	if (!p->code_bitmap &&
1078	++p->code_write_count >= SMC_BITMAP_USE_THRESHOLD &&
1079	is_cpu_write_access) {
1080	/* build code bitmap */
1081	build_page_bitmap(p);
1082	}
1083
1084	/* we remove all the TBs in the range [start, end[ */
1085	/* XXX: see if in some cases it could be faster to invalidate all the code */
1086	current_tb_not_found = is_cpu_write_access;
1087	current_tb_modified = 0;
1088	current_tb = NULL; /* avoid warning */
1089	current_pc = 0; /* avoid warning */
1090	current_cs_base = 0; /* avoid warning */
1091	current_flags = 0; /* avoid warning */
1092	tb = p->first_tb;
1093	while (tb != NULL) {
1094	n = (long)tb & 3;
1095	tb = (TranslationBlock *)((long)tb & ~3);
1096	tb_next = tb->page_next[n];
1097	/* NOTE: this is subtle as a TB may span two physical pages */
1098	if (n == 0) {
1099	/* NOTE: tb_end may be after the end of the page, but
1100	it is not a problem */
1101	tb_start = tb->page_addr[0] + (tb->pc & ~TARGET_PAGE_MASK);
1102	tb_end = tb_start + tb->size;
1103	} else {
1104	tb_start = tb->page_addr[1];
1105	tb_end = tb_start + ((tb->pc + tb->size) & ~TARGET_PAGE_MASK);
1106	}
1107	if (!(tb_end <= start \|\| tb_start >= end)) {
1108	#ifdef TARGET_HAS_PRECISE_SMC
1109	if (current_tb_not_found) {
1110	current_tb_not_found = 0;
1111	current_tb = NULL;
1112	if (env->mem_io_pc) {
1113	/* now we have a real cpu fault */
1114	current_tb = tb_find_pc(env->mem_io_pc);
1115	}
1116	}
1117	if (current_tb == tb &&
1118	(current_tb->cflags & CF_COUNT_MASK) != 1) {
1119	/* If we are modifying the current TB, we must stop
1120	its execution. We could be more precise by checking
1121	that the modification is after the current PC, but it
1122	would require a specialized function to partially
1123	restore the CPU state */
1124
1125	current_tb_modified = 1;
1126	cpu_restore_state(current_tb, env,
1127	env->mem_io_pc, NULL);
1128	#if defined(TARGET_I386)
1129	current_flags = env->hflags;
1130	current_flags \|= (env->eflags & (IOPL_MASK \| TF_MASK \| VM_MASK));
1131	current_cs_base = (target_ulong)env->segs[R_CS].base;
1132	current_pc = current_cs_base + env->eip;
1133	#else
1134	#error unsupported CPU
1135	#endif
1136	}
1137	#endif /* TARGET_HAS_PRECISE_SMC */
1138	/* we need to do that to handle the case where a signal
1139	occurs while doing tb_phys_invalidate() */
1140	saved_tb = NULL;
1141	if (env) {
1142	saved_tb = env->current_tb;
1143	env->current_tb = NULL;
1144	}
1145	tb_phys_invalidate(tb, -1);
1146	if (env) {
1147	env->current_tb = saved_tb;
1148	if (env->interrupt_request && env->current_tb)
1149	cpu_interrupt(env, env->interrupt_request);
1150	}
1151	}
1152	tb = tb_next;
1153	}
1154	#if !defined(CONFIG_USER_ONLY)
1155	/* if no code remaining, no need to continue to use slow writes */
1156	if (!p->first_tb) {
1157	invalidate_page_bitmap(p);
1158	if (is_cpu_write_access) {
1159	tlb_unprotect_code_phys(env, start, env->mem_io_vaddr);
1160	}
1161	}
1162	#endif
1163	#ifdef TARGET_HAS_PRECISE_SMC
1164	if (current_tb_modified) {
1165	/* we generate a block containing just the instruction
1166	modifying the memory. It will ensure that it cannot modify
1167	itself */
1168	env->current_tb = NULL;
1169	tb_gen_code(env, current_pc, current_cs_base, current_flags, 1);
1170	cpu_resume_from_signal(env, NULL);
1171	}
1172	#endif
1173	}
1174
1175
1176	/* len must be <= 8 and start must be a multiple of len */
1177	#ifndef VBOX
1178	static inline void tb_invalidate_phys_page_fast(target_phys_addr_t start, int len)
1179	#else
1180	DECLINLINE(void) tb_invalidate_phys_page_fast(target_phys_addr_t start, int len)
1181	#endif
1182	{
1183	PageDesc *p;
1184	int offset, b;
1185	#if 0
1186	if (1) {
1187	if (loglevel) {
1188	fprintf(logfile, "modifying code at 0x%x size=%d EIP=%x PC=%08x\n",
1189	cpu_single_env->mem_io_vaddr, len,
1190	cpu_single_env->eip,
1191	cpu_single_env->eip + (long)cpu_single_env->segs[R_CS].base);
1192	}
1193	}
1194	#endif
1195	p = page_find(start >> TARGET_PAGE_BITS);
1196	if (!p)
1197	return;
1198	if (p->code_bitmap) {
1199	offset = start & ~TARGET_PAGE_MASK;
1200	b = p->code_bitmap[offset >> 3] >> (offset & 7);
1201	if (b & ((1 << len) - 1))
1202	goto do_invalidate;
1203	} else {
1204	do_invalidate:
1205	tb_invalidate_phys_page_range(start, start + len, 1);
1206	}
1207	}
1208
1209
1210	#if !defined(CONFIG_SOFTMMU)
1211	static void tb_invalidate_phys_page(target_phys_addr_t addr,
1212	unsigned long pc, void *puc)
1213	{
1214	int n, current_flags, current_tb_modified;
1215	target_ulong current_pc, current_cs_base;
1216	PageDesc *p;
1217	TranslationBlock tb, current_tb;
1218	#ifdef TARGET_HAS_PRECISE_SMC
1219	CPUState *env = cpu_single_env;
1220	#endif
1221
1222	addr &= TARGET_PAGE_MASK;
1223	p = page_find(addr >> TARGET_PAGE_BITS);
1224	if (!p)
1225	return;
1226	tb = p->first_tb;
1227	current_tb_modified = 0;
1228	current_tb = NULL;
1229	current_pc = 0; /* avoid warning */
1230	current_cs_base = 0; /* avoid warning */
1231	current_flags = 0; /* avoid warning */
1232	#ifdef TARGET_HAS_PRECISE_SMC
1233	if (tb && pc != 0) {
1234	current_tb = tb_find_pc(pc);
1235	}
1236	#endif
1237	while (tb != NULL) {
1238	n = (long)tb & 3;
1239	tb = (TranslationBlock *)((long)tb & ~3);
1240	#ifdef TARGET_HAS_PRECISE_SMC
1241	if (current_tb == tb &&
1242	(current_tb->cflags & CF_COUNT_MASK) != 1) {
1243	/* If we are modifying the current TB, we must stop
1244	its execution. We could be more precise by checking
1245	that the modification is after the current PC, but it
1246	would require a specialized function to partially
1247	restore the CPU state */
1248
1249	current_tb_modified = 1;
1250	cpu_restore_state(current_tb, env, pc, puc);
1251	#if defined(TARGET_I386)
1252	current_flags = env->hflags;
1253	current_flags \|= (env->eflags & (IOPL_MASK \| TF_MASK \| VM_MASK));
1254	current_cs_base = (target_ulong)env->segs[R_CS].base;
1255	current_pc = current_cs_base + env->eip;
1256	#else
1257	#error unsupported CPU
1258	#endif
1259	}
1260	#endif /* TARGET_HAS_PRECISE_SMC */
1261	tb_phys_invalidate(tb, addr);
1262	tb = tb->page_next[n];
1263	}
1264	p->first_tb = NULL;
1265	#ifdef TARGET_HAS_PRECISE_SMC
1266	if (current_tb_modified) {
1267	/* we generate a block containing just the instruction
1268	modifying the memory. It will ensure that it cannot modify
1269	itself */
1270	env->current_tb = NULL;
1271	tb_gen_code(env, current_pc, current_cs_base, current_flags, 1);
1272	cpu_resume_from_signal(env, puc);
1273	}
1274	#endif
1275	}
1276	#endif
1277
1278	/* add the tb in the target page and protect it if necessary */
1279	#ifndef VBOX
1280	static inline void tb_alloc_page(TranslationBlock *tb,
1281	unsigned int n, target_ulong page_addr)
1282	#else
1283	DECLINLINE(void) tb_alloc_page(TranslationBlock *tb,
1284	unsigned int n, target_ulong page_addr)
1285	#endif
1286	{
1287	PageDesc *p;
1288	TranslationBlock *last_first_tb;
1289
1290	tb->page_addr[n] = page_addr;
1291	p = page_find_alloc(page_addr >> TARGET_PAGE_BITS);
1292	tb->page_next[n] = p->first_tb;
1293	last_first_tb = p->first_tb;
1294	p->first_tb = (TranslationBlock *)((long)tb \| n);
1295	invalidate_page_bitmap(p);
1296
1297	#if defined(TARGET_HAS_SMC) \|\| 1
1298
1299	#if defined(CONFIG_USER_ONLY)
1300	if (p->flags & PAGE_WRITE) {
1301	target_ulong addr;
1302	PageDesc *p2;
1303	int prot;
1304
1305	/* force the host page as non writable (writes will have a
1306	page fault + mprotect overhead) */
1307	page_addr &= qemu_host_page_mask;
1308	prot = 0;
1309	for(addr = page_addr; addr < page_addr + qemu_host_page_size;
1310	addr += TARGET_PAGE_SIZE) {
1311
1312	p2 = page_find (addr >> TARGET_PAGE_BITS);
1313	if (!p2)
1314	continue;
1315	prot \|= p2->flags;
1316	p2->flags &= ~PAGE_WRITE;
1317	page_get_flags(addr);
1318	}
1319	mprotect(g2h(page_addr), qemu_host_page_size,
1320	(prot & PAGE_BITS) & ~PAGE_WRITE);
1321	#ifdef DEBUG_TB_INVALIDATE
1322	printf("protecting code page: 0x" TARGET_FMT_lx "\n",
1323	page_addr);
1324	#endif
1325	}
1326	#else
1327	/* if some code is already present, then the pages are already
1328	protected. So we handle the case where only the first TB is
1329	allocated in a physical page */
1330	if (!last_first_tb) {
1331	tlb_protect_code(page_addr);
1332	}
1333	#endif
1334
1335	#endif /* TARGET_HAS_SMC */
1336	}
1337
1338	/* Allocate a new translation block. Flush the translation buffer if
1339	too many translation blocks or too much generated code. */
1340	TranslationBlock *tb_alloc(target_ulong pc)
1341	{
1342	TranslationBlock *tb;
1343
1344	if (nb_tbs >= code_gen_max_blocks \|\|
1345	#ifndef VBOX
1346	(code_gen_ptr - code_gen_buffer) >= code_gen_buffer_max_size)
1347	#else
1348	(code_gen_ptr - code_gen_buffer) >= (int)code_gen_buffer_max_size)
1349	#endif
1350	return NULL;
1351	tb = &tbs[nb_tbs++];
1352	tb->pc = pc;
1353	tb->cflags = 0;
1354	return tb;
1355	}
1356
1357	void tb_free(TranslationBlock *tb)
1358	{
1359	/* In practice this is mostly used for single use temporary TB
1360	Ignore the hard cases and just back up if this TB happens to
1361	be the last one generated. */
1362	if (nb_tbs > 0 && tb == &tbs[nb_tbs - 1]) {
1363	code_gen_ptr = tb->tc_ptr;
1364	nb_tbs--;
1365	}
1366	}
1367
1368	/* add a new TB and link it to the physical page tables. phys_page2 is
1369	(-1) to indicate that only one page contains the TB. */
1370	void tb_link_phys(TranslationBlock *tb,
1371	target_ulong phys_pc, target_ulong phys_page2)
1372	{
1373	unsigned int h;
1374	TranslationBlock **ptb;
1375
1376	/* Grab the mmap lock to stop another thread invalidating this TB
1377	before we are done. */
1378	mmap_lock();
1379	/* add in the physical hash table */
1380	h = tb_phys_hash_func(phys_pc);
1381	ptb = &tb_phys_hash[h];
1382	tb->phys_hash_next = *ptb;
1383	*ptb = tb;
1384
1385	/* add in the page list */
1386	tb_alloc_page(tb, 0, phys_pc & TARGET_PAGE_MASK);
1387	if (phys_page2 != -1)
1388	tb_alloc_page(tb, 1, phys_page2);
1389	else
1390	tb->page_addr[1] = -1;
1391
1392	tb->jmp_first = (TranslationBlock *)((long)tb \| 2);
1393	tb->jmp_next[0] = NULL;
1394	tb->jmp_next[1] = NULL;
1395
1396	/* init original jump addresses */
1397	if (tb->tb_next_offset[0] != 0xffff)
1398	tb_reset_jump(tb, 0);
1399	if (tb->tb_next_offset[1] != 0xffff)
1400	tb_reset_jump(tb, 1);
1401
1402	#ifdef DEBUG_TB_CHECK
1403	tb_page_check();
1404	#endif
1405	mmap_unlock();
1406	}
1407
1408	/* find the TB 'tb' such that tb[0].tc_ptr <= tc_ptr <
1409	tb[1].tc_ptr. Return NULL if not found */
1410	TranslationBlock *tb_find_pc(unsigned long tc_ptr)
1411	{
1412	int m_min, m_max, m;
1413	unsigned long v;
1414	TranslationBlock *tb;
1415
1416	if (nb_tbs <= 0)
1417	return NULL;
1418	if (tc_ptr < (unsigned long)code_gen_buffer \|\|
1419	tc_ptr >= (unsigned long)code_gen_ptr)
1420	return NULL;
1421	/* binary search (cf Knuth) */
1422	m_min = 0;
1423	m_max = nb_tbs - 1;
1424	while (m_min <= m_max) {
1425	m = (m_min + m_max) >> 1;
1426	tb = &tbs[m];
1427	v = (unsigned long)tb->tc_ptr;
1428	if (v == tc_ptr)
1429	return tb;
1430	else if (tc_ptr < v) {
1431	m_max = m - 1;
1432	} else {
1433	m_min = m + 1;
1434	}
1435	}
1436	return &tbs[m_max];
1437	}
1438
1439	static void tb_reset_jump_recursive(TranslationBlock *tb);
1440
1441	#ifndef VBOX
1442	static inline void tb_reset_jump_recursive2(TranslationBlock *tb, int n)
1443	#else
1444	DECLINLINE(void) tb_reset_jump_recursive2(TranslationBlock *tb, int n)
1445	#endif
1446	{
1447	TranslationBlock tb1, tb_next, **ptb;
1448	unsigned int n1;
1449
1450	tb1 = tb->jmp_next[n];
1451	if (tb1 != NULL) {
1452	/* find head of list */
1453	for(;;) {
1454	n1 = (long)tb1 & 3;
1455	tb1 = (TranslationBlock *)((long)tb1 & ~3);
1456	if (n1 == 2)
1457	break;
1458	tb1 = tb1->jmp_next[n1];
1459	}
1460	/* we are now sure now that tb jumps to tb1 */
1461	tb_next = tb1;
1462
1463	/* remove tb from the jmp_first list */
1464	ptb = &tb_next->jmp_first;
1465	for(;;) {
1466	tb1 = *ptb;
1467	n1 = (long)tb1 & 3;
1468	tb1 = (TranslationBlock *)((long)tb1 & ~3);
1469	if (n1 == n && tb1 == tb)
1470	break;
1471	ptb = &tb1->jmp_next[n1];
1472	}
1473	*ptb = tb->jmp_next[n];
1474	tb->jmp_next[n] = NULL;
1475
1476	/* suppress the jump to next tb in generated code */
1477	tb_reset_jump(tb, n);
1478
1479	/* suppress jumps in the tb on which we could have jumped */
1480	tb_reset_jump_recursive(tb_next);
1481	}
1482	}
1483
1484	static void tb_reset_jump_recursive(TranslationBlock *tb)
1485	{
1486	tb_reset_jump_recursive2(tb, 0);
1487	tb_reset_jump_recursive2(tb, 1);
1488	}
1489
1490	#if defined(TARGET_HAS_ICE)
1491	static void breakpoint_invalidate(CPUState *env, target_ulong pc)
1492	{
1493	target_ulong addr, pd;
1494	ram_addr_t ram_addr;
1495	PhysPageDesc *p;
1496
1497	addr = cpu_get_phys_page_debug(env, pc);
1498	p = phys_page_find(addr >> TARGET_PAGE_BITS);
1499	if (!p) {
1500	pd = IO_MEM_UNASSIGNED;
1501	} else {
1502	pd = p->phys_offset;
1503	}
1504	ram_addr = (pd & TARGET_PAGE_MASK) \| (pc & ~TARGET_PAGE_MASK);
1505	tb_invalidate_phys_page_range(ram_addr, ram_addr + 1, 0);
1506	}
1507	#endif
1508
1509	/* Add a watchpoint. */
1510	int cpu_watchpoint_insert(CPUState *env, target_ulong addr, int type)
1511	{
1512	int i;
1513
1514	for (i = 0; i < env->nb_watchpoints; i++) {
1515	if (addr == env->watchpoint[i].vaddr)
1516	return 0;
1517	}
1518	if (env->nb_watchpoints >= MAX_WATCHPOINTS)
1519	return -1;
1520
1521	i = env->nb_watchpoints++;
1522	env->watchpoint[i].vaddr = addr;
1523	env->watchpoint[i].type = type;
1524	tlb_flush_page(env, addr);
1525	/* FIXME: This flush is needed because of the hack to make memory ops
1526	terminate the TB. It can be removed once the proper IO trap and
1527	re-execute bits are in. */
1528	tb_flush(env);
1529	return i;
1530	}
1531
1532	/* Remove a watchpoint. */
1533	int cpu_watchpoint_remove(CPUState *env, target_ulong addr)
1534	{
1535	int i;
1536
1537	for (i = 0; i < env->nb_watchpoints; i++) {
1538	if (addr == env->watchpoint[i].vaddr) {
1539	env->nb_watchpoints--;
1540	env->watchpoint[i] = env->watchpoint[env->nb_watchpoints];
1541	tlb_flush_page(env, addr);
1542	return 0;
1543	}
1544	}
1545	return -1;
1546	}
1547
1548	/* Remove all watchpoints. */
1549	void cpu_watchpoint_remove_all(CPUState *env) {
1550	int i;
1551
1552	for (i = 0; i < env->nb_watchpoints; i++) {
1553	tlb_flush_page(env, env->watchpoint[i].vaddr);
1554	}
1555	env->nb_watchpoints = 0;
1556	}
1557
1558	/* add a breakpoint. EXCP_DEBUG is returned by the CPU loop if a
1559	breakpoint is reached */
1560	int cpu_breakpoint_insert(CPUState *env, target_ulong pc)
1561	{
1562	#if defined(TARGET_HAS_ICE)
1563	int i;
1564
1565	for(i = 0; i < env->nb_breakpoints; i++) {
1566	if (env->breakpoints[i] == pc)
1567	return 0;
1568	}
1569
1570	if (env->nb_breakpoints >= MAX_BREAKPOINTS)
1571	return -1;
1572	env->breakpoints[env->nb_breakpoints++] = pc;
1573
1574	breakpoint_invalidate(env, pc);
1575	return 0;
1576	#else
1577	return -1;
1578	#endif
1579	}
1580
1581	/* remove all breakpoints */
1582	void cpu_breakpoint_remove_all(CPUState *env) {
1583	#if defined(TARGET_HAS_ICE)
1584	int i;
1585	for(i = 0; i < env->nb_breakpoints; i++) {
1586	breakpoint_invalidate(env, env->breakpoints[i]);
1587	}
1588	env->nb_breakpoints = 0;
1589	#endif
1590	}
1591
1592	/* remove a breakpoint */
1593	int cpu_breakpoint_remove(CPUState *env, target_ulong pc)
1594	{
1595	#if defined(TARGET_HAS_ICE)
1596	int i;
1597	for(i = 0; i < env->nb_breakpoints; i++) {
1598	if (env->breakpoints[i] == pc)
1599	goto found;
1600	}
1601	return -1;
1602	found:
1603	env->nb_breakpoints--;
1604	if (i < env->nb_breakpoints)
1605	env->breakpoints[i] = env->breakpoints[env->nb_breakpoints];
1606
1607	breakpoint_invalidate(env, pc);
1608	return 0;
1609	#else
1610	return -1;
1611	#endif
1612	}
1613
1614	/* enable or disable single step mode. EXCP_DEBUG is returned by the
1615	CPU loop after each instruction */
1616	void cpu_single_step(CPUState *env, int enabled)
1617	{
1618	#if defined(TARGET_HAS_ICE)
1619	if (env->singlestep_enabled != enabled) {
1620	env->singlestep_enabled = enabled;
1621	/* must flush all the translated code to avoid inconsistancies */
1622	/* XXX: only flush what is necessary */
1623	tb_flush(env);
1624	}
1625	#endif
1626	}
1627
1628	#ifndef VBOX
1629	/* enable or disable low levels log */
1630	void cpu_set_log(int log_flags)
1631	{
1632	loglevel = log_flags;
1633	if (loglevel && !logfile) {
1634	logfile = fopen(logfilename, "w");
1635	if (!logfile) {
1636	perror(logfilename);
1637	_exit(1);
1638	}
1639	#if !defined(CONFIG_SOFTMMU)
1640	/* must avoid mmap() usage of glibc by setting a buffer "by hand" */
1641	{
1642	static uint8_t logfile_buf[4096];
1643	setvbuf(logfile, logfile_buf, _IOLBF, sizeof(logfile_buf));
1644	}
1645	#else
1646	setvbuf(logfile, NULL, _IOLBF, 0);
1647	#endif
1648	}
1649	}
1650
1651	void cpu_set_log_filename(const char *filename)
1652	{
1653	logfilename = strdup(filename);
1654	}
1655	#endif /* !VBOX */
1656
1657	/* mask must never be zero, except for A20 change call */
1658	void cpu_interrupt(CPUState *env, int mask)
1659	{
1660	#if !defined(USE_NPTL)
1661	TranslationBlock *tb;
1662	static spinlock_t interrupt_lock = SPIN_LOCK_UNLOCKED;
1663	#endif
1664	int old_mask;
1665
1666	old_mask = env->interrupt_request;
1667	#ifdef VBOX
1668	VM_ASSERT_EMT(env->pVM);
1669	ASMAtomicOrS32((int32_t volatile *)&env->interrupt_request, mask);
1670	#else /* !VBOX */
1671	/* FIXME: This is probably not threadsafe. A different thread could
1672	be in the middle of a read-modify-write operation. */
1673	env->interrupt_request \|= mask;
1674	#endif /* !VBOX */
1675	#if defined(USE_NPTL)
1676	/* FIXME: TB unchaining isn't SMP safe. For now just ignore the
1677	problem and hope the cpu will stop of its own accord. For userspace
1678	emulation this often isn't actually as bad as it sounds. Often
1679	signals are used primarily to interrupt blocking syscalls. */
1680	#else
1681	if (use_icount) {
1682	env->icount_decr.u16.high = 0xffff;
1683	#ifndef CONFIG_USER_ONLY
1684	/* CPU_INTERRUPT_EXIT isn't a real interrupt. It just means
1685	an async event happened and we need to process it. */
1686	if (!can_do_io(env)
1687	&& (mask & ~(old_mask \| CPU_INTERRUPT_EXIT)) != 0) {
1688	cpu_abort(env, "Raised interrupt while not in I/O function");
1689	}
1690	#endif
1691	} else {
1692	tb = env->current_tb;
1693	/* if the cpu is currently executing code, we must unlink it and
1694	all the potentially executing TB */
1695	if (tb && !testandset(&interrupt_lock)) {
1696	env->current_tb = NULL;
1697	tb_reset_jump_recursive(tb);
1698	resetlock(&interrupt_lock);
1699	}
1700	}
1701	#endif
1702	}
1703
1704	void cpu_reset_interrupt(CPUState *env, int mask)
1705	{
1706	#ifdef VBOX
1707	/*
1708	* Note: the current implementation can be executed by another thread without problems; make sure this remains true
1709	* for future changes!
1710	*/
1711	ASMAtomicAndS32((int32_t volatile *)&env->interrupt_request, ~mask);
1712	#else /* !VBOX */
1713	env->interrupt_request &= ~mask;
1714	#endif /* !VBOX */
1715	}
1716
1717	#ifndef VBOX
1718	CPULogItem cpu_log_items[] = {
1719	{ CPU_LOG_TB_OUT_ASM, "out_asm",
1720	"show generated host assembly code for each compiled TB" },
1721	{ CPU_LOG_TB_IN_ASM, "in_asm",
1722	"show target assembly code for each compiled TB" },
1723	{ CPU_LOG_TB_OP, "op",
1724	"show micro ops for each compiled TB (only usable if 'in_asm' used)" },
1725	#ifdef TARGET_I386
1726	{ CPU_LOG_TB_OP_OPT, "op_opt",
1727	"show micro ops after optimization for each compiled TB" },
1728	#endif
1729	{ CPU_LOG_INT, "int",
1730	"show interrupts/exceptions in short format" },
1731	{ CPU_LOG_EXEC, "exec",
1732	"show trace before each executed TB (lots of logs)" },
1733	{ CPU_LOG_TB_CPU, "cpu",
1734	"show CPU state before bloc translation" },
1735	#ifdef TARGET_I386
1736	{ CPU_LOG_PCALL, "pcall",
1737	"show protected mode far calls/returns/exceptions" },
1738	#endif
1739	#ifdef DEBUG_IOPORT
1740	{ CPU_LOG_IOPORT, "ioport",
1741	"show all i/o ports accesses" },
1742	#endif
1743	{ 0, NULL, NULL },
1744	};
1745
1746	static int cmp1(const char s1, int n, const char s2)
1747	{
1748	if (strlen(s2) != n)
1749	return 0;
1750	return memcmp(s1, s2, n) == 0;
1751	}
1752
1753	/* takes a comma separated list of log masks. Return 0 if error. */
1754	int cpu_str_to_log_mask(const char *str)
1755	{
1756	CPULogItem *item;
1757	int mask;
1758	const char p, p1;
1759
1760	p = str;
1761	mask = 0;
1762	for(;;) {
1763	p1 = strchr(p, ',');
1764	if (!p1)
1765	p1 = p + strlen(p);
1766	if(cmp1(p,p1-p,"all")) {
1767	for(item = cpu_log_items; item->mask != 0; item++) {
1768	mask \|= item->mask;
1769	}
1770	} else {
1771	for(item = cpu_log_items; item->mask != 0; item++) {
1772	if (cmp1(p, p1 - p, item->name))
1773	goto found;
1774	}
1775	return 0;
1776	}
1777	found:
1778	mask \|= item->mask;
1779	if (*p1 != ',')
1780	break;
1781	p = p1 + 1;
1782	}
1783	return mask;
1784	}
1785	#endif /* !VBOX */
1786
1787	#ifndef VBOX /* VBOX: we have our own routine. */
1788	void cpu_abort(CPUState env, const char fmt, ...)
1789	{
1790	va_list ap;
1791
1792	va_start(ap, fmt);
1793	fprintf(stderr, "qemu: fatal: ");
1794	vfprintf(stderr, fmt, ap);
1795	fprintf(stderr, "\n");
1796	#ifdef TARGET_I386
1797	cpu_dump_state(env, stderr, fprintf, X86_DUMP_FPU \| X86_DUMP_CCOP);
1798	#else
1799	cpu_dump_state(env, stderr, fprintf, 0);
1800	#endif
1801	va_end(ap);
1802	abort();
1803	}
1804	#endif /* !VBOX */
1805
1806	#ifndef VBOX
1807	CPUState cpu_copy(CPUState env)
1808	{
1809	CPUState *new_env = cpu_init(env->cpu_model_str);
1810	/* preserve chaining and index */
1811	CPUState *next_cpu = new_env->next_cpu;
1812	int cpu_index = new_env->cpu_index;
1813	memcpy(new_env, env, sizeof(CPUState));
1814	new_env->next_cpu = next_cpu;
1815	new_env->cpu_index = cpu_index;
1816	return new_env;
1817	}
1818	#endif
1819
1820	#if !defined(CONFIG_USER_ONLY)
1821
1822	#ifndef VBOX
1823	static inline void tlb_flush_jmp_cache(CPUState *env, target_ulong addr)
1824	#else
1825	DECLINLINE(void) tlb_flush_jmp_cache(CPUState *env, target_ulong addr)
1826	#endif
1827	{
1828	unsigned int i;
1829
1830	/* Discard jump cache entries for any tb which might potentially
1831	overlap the flushed page. */
1832	i = tb_jmp_cache_hash_page(addr - TARGET_PAGE_SIZE);
1833	memset (&env->tb_jmp_cache[i], 0,
1834	TB_JMP_PAGE_SIZE * sizeof(TranslationBlock *));
1835
1836	i = tb_jmp_cache_hash_page(addr);
1837	memset (&env->tb_jmp_cache[i], 0,
1838	TB_JMP_PAGE_SIZE * sizeof(TranslationBlock *));
1839
1840	#ifdef VBOX
1841	/* inform raw mode about TLB page flush */
1842	remR3FlushPage(env, addr);
1843	#endif /* VBOX */
1844	}
1845
1846	/* NOTE: if flush_global is true, also flush global entries (not
1847	implemented yet) */
1848	void tlb_flush(CPUState *env, int flush_global)
1849	{
1850	int i;
1851
1852	#if defined(DEBUG_TLB)
1853	printf("tlb_flush:\n");
1854	#endif
1855	/* must reset current TB so that interrupts cannot modify the
1856	links while we are modifying them */
1857	env->current_tb = NULL;
1858
1859	for(i = 0; i < CPU_TLB_SIZE; i++) {
1860	env->tlb_table[0][i].addr_read = -1;
1861	env->tlb_table[0][i].addr_write = -1;
1862	env->tlb_table[0][i].addr_code = -1;
1863	env->tlb_table[1][i].addr_read = -1;
1864	env->tlb_table[1][i].addr_write = -1;
1865	env->tlb_table[1][i].addr_code = -1;
1866	#if (NB_MMU_MODES >= 3)
1867	env->tlb_table[2][i].addr_read = -1;
1868	env->tlb_table[2][i].addr_write = -1;
1869	env->tlb_table[2][i].addr_code = -1;
1870	#if (NB_MMU_MODES == 4)
1871	env->tlb_table[3][i].addr_read = -1;
1872	env->tlb_table[3][i].addr_write = -1;
1873	env->tlb_table[3][i].addr_code = -1;
1874	#endif
1875	#endif
1876	}
1877
1878	memset (env->tb_jmp_cache, 0, TB_JMP_CACHE_SIZE * sizeof (void *));
1879
1880	#ifdef VBOX
1881	/* inform raw mode about TLB flush */
1882	remR3FlushTLB(env, flush_global);
1883	#endif
1884	#ifdef USE_KQEMU
1885	if (env->kqemu_enabled) {
1886	kqemu_flush(env, flush_global);
1887	}
1888	#endif
1889	tlb_flush_count++;
1890	}
1891
1892	#ifndef VBOX
1893	static inline void tlb_flush_entry(CPUTLBEntry *tlb_entry, target_ulong addr)
1894	#else
1895	DECLINLINE(void) tlb_flush_entry(CPUTLBEntry *tlb_entry, target_ulong addr)
1896	#endif
1897	{
1898	if (addr == (tlb_entry->addr_read &
1899	(TARGET_PAGE_MASK \| TLB_INVALID_MASK)) \|\|
1900	addr == (tlb_entry->addr_write &
1901	(TARGET_PAGE_MASK \| TLB_INVALID_MASK)) \|\|
1902	addr == (tlb_entry->addr_code &
1903	(TARGET_PAGE_MASK \| TLB_INVALID_MASK))) {
1904	tlb_entry->addr_read = -1;
1905	tlb_entry->addr_write = -1;
1906	tlb_entry->addr_code = -1;
1907	}
1908	}
1909
1910	void tlb_flush_page(CPUState *env, target_ulong addr)
1911	{
1912	int i;
1913
1914	#if defined(DEBUG_TLB)
1915	printf("tlb_flush_page: " TARGET_FMT_lx "\n", addr);
1916	#endif
1917	/* must reset current TB so that interrupts cannot modify the
1918	links while we are modifying them */
1919	env->current_tb = NULL;
1920
1921	addr &= TARGET_PAGE_MASK;
1922	i = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
1923	tlb_flush_entry(&env->tlb_table[0][i], addr);
1924	tlb_flush_entry(&env->tlb_table[1][i], addr);
1925	#if (NB_MMU_MODES >= 3)
1926	tlb_flush_entry(&env->tlb_table[2][i], addr);
1927	#if (NB_MMU_MODES == 4)
1928	tlb_flush_entry(&env->tlb_table[3][i], addr);
1929	#endif
1930	#endif
1931
1932	tlb_flush_jmp_cache(env, addr);
1933
1934	#ifdef USE_KQEMU
1935	if (env->kqemu_enabled) {
1936	kqemu_flush_page(env, addr);
1937	}
1938	#endif
1939	}
1940
1941	/* update the TLBs so that writes to code in the virtual page 'addr'
1942	can be detected */
1943	static void tlb_protect_code(ram_addr_t ram_addr)
1944	{
1945	cpu_physical_memory_reset_dirty(ram_addr,
1946	ram_addr + TARGET_PAGE_SIZE,
1947	CODE_DIRTY_FLAG);
1948	#if defined(VBOX) && defined(REM_MONITOR_CODE_PAGES)
1949	/** @todo Retest this? This function has changed... */
1950	remR3ProtectCode(cpu_single_env, ram_addr);
1951	#endif
1952	}
1953
1954	/* update the TLB so that writes in physical page 'phys_addr' are no longer
1955	tested for self modifying code */
1956	static void tlb_unprotect_code_phys(CPUState *env, ram_addr_t ram_addr,
1957	target_ulong vaddr)
1958	{
1959	#ifdef VBOX
1960	if (RT_LIKELY((ram_addr >> TARGET_PAGE_BITS) < phys_ram_dirty_size))
1961	#endif
1962	phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] \|= CODE_DIRTY_FLAG;
1963	}
1964
1965	#ifndef VBOX
1966	static inline void tlb_reset_dirty_range(CPUTLBEntry *tlb_entry,
1967	unsigned long start, unsigned long length)
1968	#else
1969	DECLINLINE(void) tlb_reset_dirty_range(CPUTLBEntry *tlb_entry,
1970	unsigned long start, unsigned long length)
1971	#endif
1972	{
1973	unsigned long addr;
1974
1975	#ifdef VBOX
1976	if (start & 1)
1977	return;
1978	#endif
1979	if ((tlb_entry->addr_write & ~TARGET_PAGE_MASK) == IO_MEM_RAM) {
1980	addr = (tlb_entry->addr_write & TARGET_PAGE_MASK) + tlb_entry->addend;
1981	if ((addr - start) < length) {
1982	tlb_entry->addr_write = (tlb_entry->addr_write & TARGET_PAGE_MASK) \| IO_MEM_NOTDIRTY;
1983	}
1984	}
1985	}
1986
1987	void cpu_physical_memory_reset_dirty(ram_addr_t start, ram_addr_t end,
1988	int dirty_flags)
1989	{
1990	CPUState *env;
1991	unsigned long length, start1;
1992	int i, mask, len;
1993	uint8_t *p;
1994
1995	start &= TARGET_PAGE_MASK;
1996	end = TARGET_PAGE_ALIGN(end);
1997
1998	length = end - start;
1999	if (length == 0)
2000	return;
2001	len = length >> TARGET_PAGE_BITS;
2002	#ifdef USE_KQEMU
2003	/* XXX: should not depend on cpu context */
2004	env = first_cpu;
2005	if (env->kqemu_enabled) {
2006	ram_addr_t addr;
2007	addr = start;
2008	for(i = 0; i < len; i++) {
2009	kqemu_set_notdirty(env, addr);
2010	addr += TARGET_PAGE_SIZE;
2011	}
2012	}
2013	#endif
2014	mask = ~dirty_flags;
2015	p = phys_ram_dirty + (start >> TARGET_PAGE_BITS);
2016	#ifdef VBOX
2017	if (RT_LIKELY((start >> TARGET_PAGE_BITS) < phys_ram_dirty_size))
2018	#endif
2019	for(i = 0; i < len; i++)
2020	p[i] &= mask;
2021
2022	/* we modify the TLB cache so that the dirty bit will be set again
2023	when accessing the range */
2024	#if defined(VBOX) && defined(REM_PHYS_ADDR_IN_TLB)
2025	start1 = start;
2026	#elif !defined(VBOX)
2027	start1 = start + (unsigned long)phys_ram_base;
2028	#else
2029	start1 = (unsigned long)remR3GCPhys2HCVirt(first_cpu, start, -1);
2030	#endif
2031	for(env = first_cpu; env != NULL; env = env->next_cpu) {
2032	for(i = 0; i < CPU_TLB_SIZE; i++)
2033	tlb_reset_dirty_range(&env->tlb_table[0][i], start1, length);
2034	for(i = 0; i < CPU_TLB_SIZE; i++)
2035	tlb_reset_dirty_range(&env->tlb_table[1][i], start1, length);
2036	#if (NB_MMU_MODES >= 3)
2037	for(i = 0; i < CPU_TLB_SIZE; i++)
2038	tlb_reset_dirty_range(&env->tlb_table[2][i], start1, length);
2039	#if (NB_MMU_MODES == 4)
2040	for(i = 0; i < CPU_TLB_SIZE; i++)
2041	tlb_reset_dirty_range(&env->tlb_table[3][i], start1, length);
2042	#endif
2043	#endif
2044	}
2045	}
2046
2047	#ifndef VBOX
2048	int cpu_physical_memory_set_dirty_tracking(int enable)
2049	{
2050	in_migration = enable;
2051	return 0;
2052	}
2053
2054	int cpu_physical_memory_get_dirty_tracking(void)
2055	{
2056	return in_migration;
2057	}
2058	#endif
2059
2060	#ifndef VBOX
2061	static inline void tlb_update_dirty(CPUTLBEntry *tlb_entry)
2062	#else
2063	DECLINLINE(void) tlb_update_dirty(CPUTLBEntry *tlb_entry)
2064	#endif
2065	{
2066	ram_addr_t ram_addr;
2067
2068	if ((tlb_entry->addr_write & ~TARGET_PAGE_MASK) == IO_MEM_RAM) {
2069	/* RAM case */
2070	#if defined(VBOX) && defined(REM_PHYS_ADDR_IN_TLB)
2071	ram_addr = (tlb_entry->addr_write & TARGET_PAGE_MASK) + tlb_entry->addend;
2072	#elif !defined(VBOX)
2073	ram_addr = (tlb_entry->addr_write & TARGET_PAGE_MASK) +
2074	tlb_entry->addend - (unsigned long)phys_ram_base;
2075	#else
2076	ram_addr = remR3HCVirt2GCPhys(first_cpu, (void*)((tlb_entry->addr_write & TARGET_PAGE_MASK) + tlb_entry->addend));
2077	#endif
2078	if (!cpu_physical_memory_is_dirty(ram_addr)) {
2079	tlb_entry->addr_write \|= TLB_NOTDIRTY;
2080	}
2081	}
2082	}
2083
2084	/* update the TLB according to the current state of the dirty bits */
2085	void cpu_tlb_update_dirty(CPUState *env)
2086	{
2087	int i;
2088	for(i = 0; i < CPU_TLB_SIZE; i++)
2089	tlb_update_dirty(&env->tlb_table[0][i]);
2090	for(i = 0; i < CPU_TLB_SIZE; i++)
2091	tlb_update_dirty(&env->tlb_table[1][i]);
2092	#if (NB_MMU_MODES >= 3)
2093	for(i = 0; i < CPU_TLB_SIZE; i++)
2094	tlb_update_dirty(&env->tlb_table[2][i]);
2095	#if (NB_MMU_MODES == 4)
2096	for(i = 0; i < CPU_TLB_SIZE; i++)
2097	tlb_update_dirty(&env->tlb_table[3][i]);
2098	#endif
2099	#endif
2100	}
2101
2102	#ifndef VBOX
2103	static inline void tlb_set_dirty1(CPUTLBEntry *tlb_entry, target_ulong vaddr)
2104	#else
2105	DECLINLINE(void) tlb_set_dirty1(CPUTLBEntry *tlb_entry, target_ulong vaddr)
2106	#endif
2107	{
2108	if (tlb_entry->addr_write == (vaddr \| TLB_NOTDIRTY))
2109	tlb_entry->addr_write = vaddr;
2110	}
2111
2112
2113	/* update the TLB corresponding to virtual page vaddr and phys addr
2114	addr so that it is no longer dirty */
2115	#ifndef VBOX
2116	static inline void tlb_set_dirty(CPUState *env,
2117	unsigned long addr, target_ulong vaddr)
2118	#else
2119	DECLINLINE(void) tlb_set_dirty(CPUState *env,
2120	unsigned long addr, target_ulong vaddr)
2121	#endif
2122	{
2123	int i;
2124
2125	addr &= TARGET_PAGE_MASK;
2126	i = (vaddr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
2127	tlb_set_dirty1(&env->tlb_table[0][i], addr);
2128	tlb_set_dirty1(&env->tlb_table[1][i], addr);
2129	#if (NB_MMU_MODES >= 3)
2130	tlb_set_dirty1(&env->tlb_table[2][i], vaddr);
2131	#if (NB_MMU_MODES == 4)
2132	tlb_set_dirty1(&env->tlb_table[3][i], vaddr);
2133	#endif
2134	#endif
2135	}
2136
2137	/* add a new TLB entry. At most one entry for a given virtual address
2138	is permitted. Return 0 if OK or 2 if the page could not be mapped
2139	(can only happen in non SOFTMMU mode for I/O pages or pages
2140	conflicting with the host address space). */
2141	int tlb_set_page_exec(CPUState *env, target_ulong vaddr,
2142	target_phys_addr_t paddr, int prot,
2143	int mmu_idx, int is_softmmu)
2144	{
2145	PhysPageDesc *p;
2146	unsigned long pd;
2147	unsigned int index;
2148	target_ulong address;
2149	target_ulong code_address;
2150	target_phys_addr_t addend;
2151	int ret;
2152	CPUTLBEntry *te;
2153	int i;
2154	target_phys_addr_t iotlb;
2155
2156	p = phys_page_find(paddr >> TARGET_PAGE_BITS);
2157	if (!p) {
2158	pd = IO_MEM_UNASSIGNED;
2159	} else {
2160	pd = p->phys_offset;
2161	}
2162	#if defined(DEBUG_TLB)
2163	printf("tlb_set_page: vaddr=" TARGET_FMT_lx " paddr=0x%08x prot=%x idx=%d smmu=%d pd=0x%08lx\n",
2164	vaddr, (int)paddr, prot, mmu_idx, is_softmmu, pd);
2165	#endif
2166
2167	ret = 0;
2168	address = vaddr;
2169	if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM && !(pd & IO_MEM_ROMD)) {
2170	/* IO memory case (romd handled later) */
2171	address \|= TLB_MMIO;
2172	}
2173	#if defined(VBOX) && defined(REM_PHYS_ADDR_IN_TLB)
2174	addend = pd & TARGET_PAGE_MASK;
2175	#elif !defined(VBOX)
2176	addend = (unsigned long)phys_ram_base + (pd & TARGET_PAGE_MASK);
2177	#else
2178	addend = (unsigned long)remR3GCPhys2HCVirt(env,
2179	pd & TARGET_PAGE_MASK,
2180	vaddr & TARGET_PAGE_MASK);
2181	#endif
2182	if ((pd & ~TARGET_PAGE_MASK) <= IO_MEM_ROM) {
2183	/* Normal RAM. */
2184	iotlb = pd & TARGET_PAGE_MASK;
2185	if ((pd & ~TARGET_PAGE_MASK) == IO_MEM_RAM)
2186	iotlb \|= IO_MEM_NOTDIRTY;
2187	else
2188	iotlb \|= IO_MEM_ROM;
2189	} else {
2190	/* IO handlers are currently passed a phsical address.
2191	It would be nice to pass an offset from the base address
2192	of that region. This would avoid having to special case RAM,
2193	and avoid full address decoding in every device.
2194	We can't use the high bits of pd for this because
2195	IO_MEM_ROMD uses these as a ram address. */
2196	iotlb = (pd & ~TARGET_PAGE_MASK) + paddr;
2197	}
2198
2199	code_address = address;
2200
2201	#ifdef VBOX
2202	# if !defined(REM_PHYS_ADDR_IN_TLB)
2203	if (addend & 0x1)
2204	{
2205	addend &= ~(target_ulong)0x1;
2206	if ((pd & ~TARGET_PAGE_MASK) == IO_MEM_RAM)
2207	{
2208	address \|= TLB_MMIO;
2209	iotlb = (pd & ~TARGET_PAGE_MASK) + paddr +env->pVM->rem.s.iHandlerMemType;
2210	}
2211	}
2212	# endif
2213	#endif
2214
2215	/* Make accesses to pages with watchpoints go via the
2216	watchpoint trap routines. */
2217	for (i = 0; i < env->nb_watchpoints; i++) {
2218	if (vaddr == (env->watchpoint[i].vaddr & TARGET_PAGE_MASK)) {
2219	iotlb = io_mem_watch + paddr;
2220	/* TODO: The memory case can be optimized by not trapping
2221	reads of pages with a write breakpoint. */
2222	address \|= TLB_MMIO;
2223	}
2224	}
2225
2226	index = (vaddr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
2227	env->iotlb[mmu_idx][index] = iotlb - vaddr;
2228	te = &env->tlb_table[mmu_idx][index];
2229	te->addend = addend - vaddr;
2230	if (prot & PAGE_READ) {
2231	te->addr_read = address;
2232	} else {
2233	te->addr_read = -1;
2234	}
2235
2236	if (prot & PAGE_EXEC) {
2237	te->addr_code = code_address;
2238	} else {
2239	te->addr_code = -1;
2240	}
2241	if (prot & PAGE_WRITE) {
2242	if ((pd & ~TARGET_PAGE_MASK) == IO_MEM_ROM \|\|
2243	(pd & IO_MEM_ROMD)) {
2244	/* Write access calls the I/O callback. */
2245	te->addr_write = address \| TLB_MMIO;
2246	} else if ((pd & ~TARGET_PAGE_MASK) == IO_MEM_RAM &&
2247	!cpu_physical_memory_is_dirty(pd)) {
2248	te->addr_write = address \| TLB_NOTDIRTY;
2249	} else {
2250	te->addr_write = address;
2251	}
2252	} else {
2253	te->addr_write = -1;
2254	}
2255	#ifdef VBOX
2256	/* inform raw mode about TLB page change */
2257	remR3FlushPage(env, vaddr);
2258	#endif
2259	return ret;
2260	}
2261	#if 0
2262	/* called from signal handler: invalidate the code and unprotect the
2263	page. Return TRUE if the fault was succesfully handled. */
2264	int page_unprotect(target_ulong addr, unsigned long pc, void *puc)
2265	{
2266	#if !defined(CONFIG_SOFTMMU)
2267	VirtPageDesc *vp;
2268
2269	#if defined(DEBUG_TLB)
2270	printf("page_unprotect: addr=0x%08x\n", addr);
2271	#endif
2272	addr &= TARGET_PAGE_MASK;
2273
2274	/* if it is not mapped, no need to worry here */
2275	if (addr >= MMAP_AREA_END)
2276	return 0;
2277	vp = virt_page_find(addr >> TARGET_PAGE_BITS);
2278	if (!vp)
2279	return 0;
2280	/* NOTE: in this case, validate_tag is _not_ tested as it
2281	validates only the code TLB */
2282	if (vp->valid_tag != virt_valid_tag)
2283	return 0;
2284	if (!(vp->prot & PAGE_WRITE))
2285	return 0;
2286	#if defined(DEBUG_TLB)
2287	printf("page_unprotect: addr=0x%08x phys_addr=0x%08x prot=%x\n",
2288	addr, vp->phys_addr, vp->prot);
2289	#endif
2290	if (mprotect((void *)addr, TARGET_PAGE_SIZE, vp->prot) < 0)
2291	cpu_abort(cpu_single_env, "error mprotect addr=0x%lx prot=%d\n",
2292	(unsigned long)addr, vp->prot);
2293	/* set the dirty bit */
2294	phys_ram_dirty[vp->phys_addr >> TARGET_PAGE_BITS] = 0xff;
2295	/* flush the code inside */
2296	tb_invalidate_phys_page(vp->phys_addr, pc, puc);
2297	return 1;
2298	#elif defined(VBOX)
2299	addr &= TARGET_PAGE_MASK;
2300
2301	/* if it is not mapped, no need to worry here */
2302	if (addr >= MMAP_AREA_END)
2303	return 0;
2304	return 1;
2305	#else
2306	return 0;
2307	#endif
2308	}
2309	#endif /* 0 */
2310
2311	#else
2312
2313	void tlb_flush(CPUState *env, int flush_global)
2314	{
2315	}
2316
2317	void tlb_flush_page(CPUState *env, target_ulong addr)
2318	{
2319	}
2320
2321	int tlb_set_page_exec(CPUState *env, target_ulong vaddr,
2322	target_phys_addr_t paddr, int prot,
2323	int mmu_idx, int is_softmmu)
2324	{
2325	return 0;
2326	}
2327
2328	#ifndef VBOX
2329	/* dump memory mappings */
2330	void page_dump(FILE *f)
2331	{
2332	unsigned long start, end;
2333	int i, j, prot, prot1;
2334	PageDesc *p;
2335
2336	fprintf(f, "%-8s %-8s %-8s %s\n",
2337	"start", "end", "size", "prot");
2338	start = -1;
2339	end = -1;
2340	prot = 0;
2341	for(i = 0; i <= L1_SIZE; i++) {
2342	if (i < L1_SIZE)
2343	p = l1_map[i];
2344	else
2345	p = NULL;
2346	for(j = 0;j < L2_SIZE; j++) {
2347	if (!p)
2348	prot1 = 0;
2349	else
2350	prot1 = p[j].flags;
2351	if (prot1 != prot) {
2352	end = (i << (32 - L1_BITS)) \| (j << TARGET_PAGE_BITS);
2353	if (start != -1) {
2354	fprintf(f, "%08lx-%08lx %08lx %c%c%c\n",
2355	start, end, end - start,
2356	prot & PAGE_READ ? 'r' : '-',
2357	prot & PAGE_WRITE ? 'w' : '-',
2358	prot & PAGE_EXEC ? 'x' : '-');
2359	}
2360	if (prot1 != 0)
2361	start = end;
2362	else
2363	start = -1;
2364	prot = prot1;
2365	}
2366	if (!p)
2367	break;
2368	}
2369	}
2370	}
2371	#endif /* !VBOX */
2372
2373	int page_get_flags(target_ulong address)
2374	{
2375	PageDesc *p;
2376
2377	p = page_find(address >> TARGET_PAGE_BITS);
2378	if (!p)
2379	return 0;
2380	return p->flags;
2381	}
2382
2383	/* modify the flags of a page and invalidate the code if
2384	necessary. The flag PAGE_WRITE_ORG is positionned automatically
2385	depending on PAGE_WRITE */
2386	void page_set_flags(target_ulong start, target_ulong end, int flags)
2387	{
2388	PageDesc *p;
2389	target_ulong addr;
2390
2391	start = start & TARGET_PAGE_MASK;
2392	end = TARGET_PAGE_ALIGN(end);
2393	if (flags & PAGE_WRITE)
2394	flags \|= PAGE_WRITE_ORG;
2395	#ifdef VBOX
2396	AssertMsgFailed(("We shouldn't be here, and if we should, we must have an env to do the proper locking!\n"));
2397	#endif
2398	spin_lock(&tb_lock);
2399	for(addr = start; addr < end; addr += TARGET_PAGE_SIZE) {
2400	p = page_find_alloc(addr >> TARGET_PAGE_BITS);
2401	/* if the write protection is set, then we invalidate the code
2402	inside */
2403	if (!(p->flags & PAGE_WRITE) &&
2404	(flags & PAGE_WRITE) &&
2405	p->first_tb) {
2406	tb_invalidate_phys_page(addr, 0, NULL);
2407	}
2408	p->flags = flags;
2409	}
2410	spin_unlock(&tb_lock);
2411	}
2412
2413	int page_check_range(target_ulong start, target_ulong len, int flags)
2414	{
2415	PageDesc *p;
2416	target_ulong end;
2417	target_ulong addr;
2418
2419	end = TARGET_PAGE_ALIGN(start+len); /* must do before we loose bits in the next step */
2420	start = start & TARGET_PAGE_MASK;
2421
2422	if( end < start )
2423	/* we've wrapped around */
2424	return -1;
2425	for(addr = start; addr < end; addr += TARGET_PAGE_SIZE) {
2426	p = page_find(addr >> TARGET_PAGE_BITS);
2427	if( !p )
2428	return -1;
2429	if( !(p->flags & PAGE_VALID) )
2430	return -1;
2431
2432	if ((flags & PAGE_READ) && !(p->flags & PAGE_READ))
2433	return -1;
2434	if (flags & PAGE_WRITE) {
2435	if (!(p->flags & PAGE_WRITE_ORG))
2436	return -1;
2437	/* unprotect the page if it was put read-only because it
2438	contains translated code */
2439	if (!(p->flags & PAGE_WRITE)) {
2440	if (!page_unprotect(addr, 0, NULL))
2441	return -1;
2442	}
2443	return 0;
2444	}
2445	}
2446	return 0;
2447	}
2448
2449	/* called from signal handler: invalidate the code and unprotect the
2450	page. Return TRUE if the fault was succesfully handled. */
2451	int page_unprotect(target_ulong address, unsigned long pc, void *puc)
2452	{
2453	unsigned int page_index, prot, pindex;
2454	PageDesc p, p1;
2455	target_ulong host_start, host_end, addr;
2456
2457	/* Technically this isn't safe inside a signal handler. However we
2458	know this only ever happens in a synchronous SEGV handler, so in
2459	practice it seems to be ok. */
2460	mmap_lock();
2461
2462	host_start = address & qemu_host_page_mask;
2463	page_index = host_start >> TARGET_PAGE_BITS;
2464	p1 = page_find(page_index);
2465	if (!p1) {
2466	mmap_unlock();
2467	return 0;
2468	}
2469	host_end = host_start + qemu_host_page_size;
2470	p = p1;
2471	prot = 0;
2472	for(addr = host_start;addr < host_end; addr += TARGET_PAGE_SIZE) {
2473	prot \|= p->flags;
2474	p++;
2475	}
2476	/* if the page was really writable, then we change its
2477	protection back to writable */
2478	if (prot & PAGE_WRITE_ORG) {
2479	pindex = (address - host_start) >> TARGET_PAGE_BITS;
2480	if (!(p1[pindex].flags & PAGE_WRITE)) {
2481	mprotect((void *)g2h(host_start), qemu_host_page_size,
2482	(prot & PAGE_BITS) \| PAGE_WRITE);
2483	p1[pindex].flags \|= PAGE_WRITE;
2484	/* and since the content will be modified, we must invalidate
2485	the corresponding translated code. */
2486	tb_invalidate_phys_page(address, pc, puc);
2487	#ifdef DEBUG_TB_CHECK
2488	tb_invalidate_check(address);
2489	#endif
2490	mmap_unlock();
2491	return 1;
2492	}
2493	}
2494	mmap_unlock();
2495	return 0;
2496	}
2497
2498	static inline void tlb_set_dirty(CPUState *env,
2499	unsigned long addr, target_ulong vaddr)
2500	{
2501	}
2502	#endif /* defined(CONFIG_USER_ONLY) */
2503
2504	#if !defined(CONFIG_USER_ONLY)
2505	static int subpage_register (subpage_t *mmio, uint32_t start, uint32_t end,
2506	ram_addr_t memory);
2507	static void subpage_init (target_phys_addr_t base, ram_addr_t phys,
2508	ram_addr_t orig_memory);
2509	#define CHECK_SUBPAGE(addr, start_addr, start_addr2, end_addr, end_addr2, \
2510	need_subpage) \
2511	do { \
2512	if (addr > start_addr) \
2513	start_addr2 = 0; \
2514	else { \
2515	start_addr2 = start_addr & ~TARGET_PAGE_MASK; \
2516	if (start_addr2 > 0) \
2517	need_subpage = 1; \
2518	} \
2519	\
2520	if ((start_addr + orig_size) - addr >= TARGET_PAGE_SIZE) \
2521	end_addr2 = TARGET_PAGE_SIZE - 1; \
2522	else { \
2523	end_addr2 = (start_addr + orig_size - 1) & ~TARGET_PAGE_MASK; \
2524	if (end_addr2 < TARGET_PAGE_SIZE - 1) \
2525	need_subpage = 1; \
2526	} \
2527	} while (0)
2528
2529
2530	/* register physical memory. 'size' must be a multiple of the target
2531	page size. If (phys_offset & ~TARGET_PAGE_MASK) != 0, then it is an
2532	io memory page */
2533	void cpu_register_physical_memory(target_phys_addr_t start_addr,
2534	unsigned long size,
2535	unsigned long phys_offset)
2536	{
2537	target_phys_addr_t addr, end_addr;
2538	PhysPageDesc *p;
2539	CPUState *env;
2540	ram_addr_t orig_size = size;
2541	void *subpage;
2542
2543	#ifdef USE_KQEMU
2544	/* XXX: should not depend on cpu context */
2545	env = first_cpu;
2546	if (env->kqemu_enabled) {
2547	kqemu_set_phys_mem(start_addr, size, phys_offset);
2548	}
2549	#endif
2550	size = (size + TARGET_PAGE_SIZE - 1) & TARGET_PAGE_MASK;
2551	end_addr = start_addr + (target_phys_addr_t)size;
2552	for(addr = start_addr; addr != end_addr; addr += TARGET_PAGE_SIZE) {
2553	p = phys_page_find(addr >> TARGET_PAGE_BITS);
2554	if (p && p->phys_offset != IO_MEM_UNASSIGNED) {
2555	ram_addr_t orig_memory = p->phys_offset;
2556	target_phys_addr_t start_addr2, end_addr2;
2557	int need_subpage = 0;
2558
2559	CHECK_SUBPAGE(addr, start_addr, start_addr2, end_addr, end_addr2,
2560	need_subpage);
2561	if (need_subpage \|\| phys_offset & IO_MEM_SUBWIDTH) {
2562	if (!(orig_memory & IO_MEM_SUBPAGE)) {
2563	subpage = subpage_init((addr & TARGET_PAGE_MASK),
2564	&p->phys_offset, orig_memory);
2565	} else {
2566	subpage = io_mem_opaque[(orig_memory & ~TARGET_PAGE_MASK)
2567	>> IO_MEM_SHIFT];
2568	}
2569	subpage_register(subpage, start_addr2, end_addr2, phys_offset);
2570	} else {
2571	p->phys_offset = phys_offset;
2572	#if !defined(VBOX) \|\| defined(VBOX_WITH_NEW_PHYS_CODE)
2573	if ((phys_offset & ~TARGET_PAGE_MASK) <= IO_MEM_ROM \|\|
2574	(phys_offset & IO_MEM_ROMD))
2575	#else
2576	if ( (phys_offset & ~TARGET_PAGE_MASK) <= IO_MEM_ROM
2577	\|\| (phys_offset & IO_MEM_ROMD)
2578	\|\| (phys_offset & ~TARGET_PAGE_MASK) == IO_MEM_RAM_MISSING)
2579	#endif
2580	phys_offset += TARGET_PAGE_SIZE;
2581	}
2582	} else {
2583	p = phys_page_find_alloc(addr >> TARGET_PAGE_BITS, 1);
2584	p->phys_offset = phys_offset;
2585	#if !defined(VBOX) \|\| defined(VBOX_WITH_NEW_PHYS_CODE)
2586	if ((phys_offset & ~TARGET_PAGE_MASK) <= IO_MEM_ROM \|\|
2587	(phys_offset & IO_MEM_ROMD))
2588	#else
2589	if ( (phys_offset & ~TARGET_PAGE_MASK) <= IO_MEM_ROM
2590	\|\| (phys_offset & IO_MEM_ROMD)
2591	\|\| (phys_offset & ~TARGET_PAGE_MASK) == IO_MEM_RAM_MISSING)
2592	#endif
2593	phys_offset += TARGET_PAGE_SIZE;
2594	else {
2595	target_phys_addr_t start_addr2, end_addr2;
2596	int need_subpage = 0;
2597
2598	CHECK_SUBPAGE(addr, start_addr, start_addr2, end_addr,
2599	end_addr2, need_subpage);
2600
2601	if (need_subpage \|\| phys_offset & IO_MEM_SUBWIDTH) {
2602	subpage = subpage_init((addr & TARGET_PAGE_MASK),
2603	&p->phys_offset, IO_MEM_UNASSIGNED);
2604	subpage_register(subpage, start_addr2, end_addr2,
2605	phys_offset);
2606	}
2607	}
2608	}
2609	}
2610	/* since each CPU stores ram addresses in its TLB cache, we must
2611	reset the modified entries */
2612	/* XXX: slow ! */
2613	for(env = first_cpu; env != NULL; env = env->next_cpu) {
2614	tlb_flush(env, 1);
2615	}
2616	}
2617
2618	/* XXX: temporary until new memory mapping API */
2619	uint32_t cpu_get_physical_page_desc(target_phys_addr_t addr)
2620	{
2621	PhysPageDesc *p;
2622
2623	p = phys_page_find(addr >> TARGET_PAGE_BITS);
2624	if (!p)
2625	return IO_MEM_UNASSIGNED;
2626	return p->phys_offset;
2627	}
2628
2629	#ifndef VBOX
2630	/* XXX: better than nothing */
2631	ram_addr_t qemu_ram_alloc(ram_addr_t size)
2632	{
2633	ram_addr_t addr;
2634	if ((phys_ram_alloc_offset + size) > phys_ram_size) {
2635	fprintf(stderr, "Not enough memory (requested_size = %" PRIu64 ", max memory = %" PRIu64 ")\n",
2636	(uint64_t)size, (uint64_t)phys_ram_size);
2637	abort();
2638	}
2639	addr = phys_ram_alloc_offset;
2640	phys_ram_alloc_offset = TARGET_PAGE_ALIGN(phys_ram_alloc_offset + size);
2641	return addr;
2642	}
2643
2644	void qemu_ram_free(ram_addr_t addr)
2645	{
2646	}
2647	#endif
2648
2649
2650	static uint32_t unassigned_mem_readb(void *opaque, target_phys_addr_t addr)
2651	{
2652	#ifdef DEBUG_UNASSIGNED
2653	printf("Unassigned mem read 0x%08x\n", (int)addr);
2654	#endif
2655	#if defined(TARGET_SPARC) \|\| defined(TARGET_CRIS)
2656	do_unassigned_access(addr, 0, 0, 0, 1);
2657	#endif
2658	return 0;
2659	}
2660
2661	static uint32_t unassigned_mem_readw(void *opaque, target_phys_addr_t addr)
2662	{
2663	#ifdef DEBUG_UNASSIGNED
2664	printf("Unassigned mem read " TARGET_FMT_plx "\n", addr);
2665	#endif
2666	#if defined(TARGET_SPARC) \|\| defined(TARGET_CRIS)
2667	do_unassigned_access(addr, 0, 0, 0, 2);
2668	#endif
2669	return 0;
2670	}
2671
2672	static uint32_t unassigned_mem_readl(void *opaque, target_phys_addr_t addr)
2673	{
2674	#ifdef DEBUG_UNASSIGNED
2675	printf("Unassigned mem read " TARGET_FMT_plx "\n", addr);
2676	#endif
2677	#if defined(TARGET_SPARC) \|\| defined(TARGET_CRIS)
2678	do_unassigned_access(addr, 0, 0, 0, 4);
2679	#endif
2680	return 0;
2681	}
2682
2683	static void unassigned_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
2684	{
2685	#ifdef DEBUG_UNASSIGNED
2686	printf("Unassigned mem write 0x%08x = 0x%x\n", (int)addr, val);
2687	#endif
2688	}
2689
2690	static void unassigned_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
2691	{
2692	#ifdef DEBUG_UNASSIGNED
2693	printf("Unassigned mem write " TARGET_FMT_plx " = 0x%x\n", addr, val);
2694	#endif
2695	#if defined(TARGET_SPARC) \|\| defined(TARGET_CRIS)
2696	do_unassigned_access(addr, 1, 0, 0, 2);
2697	#endif
2698	}
2699
2700	static void unassigned_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
2701	{
2702	#ifdef DEBUG_UNASSIGNED
2703	printf("Unassigned mem write " TARGET_FMT_plx " = 0x%x\n", addr, val);
2704	#endif
2705	#if defined(TARGET_SPARC) \|\| defined(TARGET_CRIS)
2706	do_unassigned_access(addr, 1, 0, 0, 4);
2707	#endif
2708	}
2709	static CPUReadMemoryFunc *unassigned_mem_read[3] = {
2710	unassigned_mem_readb,
2711	unassigned_mem_readw,
2712	unassigned_mem_readl,
2713	};
2714
2715	static CPUWriteMemoryFunc *unassigned_mem_write[3] = {
2716	unassigned_mem_writeb,
2717	unassigned_mem_writew,
2718	unassigned_mem_writel,
2719	};
2720
2721	static void notdirty_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
2722	{
2723	unsigned long ram_addr;
2724	int dirty_flags;
2725	#if defined(VBOX)
2726	ram_addr = addr;
2727	#elif
2728	ram_addr = addr - (unsigned long)phys_ram_base;
2729	#endif
2730	#ifdef VBOX
2731	if (RT_UNLIKELY((ram_addr >> TARGET_PAGE_BITS) >= phys_ram_dirty_size))
2732	dirty_flags = 0xff;
2733	else
2734	#endif /* VBOX */
2735	dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2736	if (!(dirty_flags & CODE_DIRTY_FLAG)) {
2737	#if !defined(CONFIG_USER_ONLY)
2738	tb_invalidate_phys_page_fast(ram_addr, 1);
2739	# ifdef VBOX
2740	if (RT_UNLIKELY((ram_addr >> TARGET_PAGE_BITS) >= phys_ram_dirty_size))
2741	dirty_flags = 0xff;
2742	else
2743	# endif /* VBOX */
2744	dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2745	#endif
2746	}
2747	#if defined(VBOX) && !defined(REM_PHYS_ADDR_IN_TLB)
2748	remR3PhysWriteU8(addr, val);
2749	#else
2750	stb_p((uint8_t *)(long)addr, val);
2751	#endif
2752	#ifdef USE_KQEMU
2753	if (cpu_single_env->kqemu_enabled &&
2754	(dirty_flags & KQEMU_MODIFY_PAGE_MASK) != KQEMU_MODIFY_PAGE_MASK)
2755	kqemu_modify_page(cpu_single_env, ram_addr);
2756	#endif
2757	dirty_flags \|= (0xff & ~CODE_DIRTY_FLAG);
2758	#ifdef VBOX
2759	if (RT_LIKELY((ram_addr >> TARGET_PAGE_BITS) < phys_ram_dirty_size))
2760	#endif /* !VBOX */
2761	phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] = dirty_flags;
2762	/* we remove the notdirty callback only if the code has been
2763	flushed */
2764	if (dirty_flags == 0xff)
2765	tlb_set_dirty(cpu_single_env, addr, cpu_single_env->mem_io_vaddr);
2766	}
2767
2768	static void notdirty_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
2769	{
2770	unsigned long ram_addr;
2771	int dirty_flags;
2772	#if defined(VBOX)
2773	ram_addr = addr;
2774	#else
2775	ram_addr = addr - (unsigned long)phys_ram_base;
2776	#endif
2777	#ifdef VBOX
2778	if (RT_UNLIKELY((ram_addr >> TARGET_PAGE_BITS) >= phys_ram_dirty_size))
2779	dirty_flags = 0xff;
2780	else
2781	#endif /* VBOX */
2782	dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2783	if (!(dirty_flags & CODE_DIRTY_FLAG)) {
2784	#if !defined(CONFIG_USER_ONLY)
2785	tb_invalidate_phys_page_fast(ram_addr, 2);
2786	# ifdef VBOX
2787	if (RT_UNLIKELY((ram_addr >> TARGET_PAGE_BITS) >= phys_ram_dirty_size))
2788	dirty_flags = 0xff;
2789	else
2790	# endif /* VBOX */
2791	dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2792	#endif
2793	}
2794	#if defined(VBOX) && !defined(REM_PHYS_ADDR_IN_TLB)
2795	remR3PhysWriteU16(addr, val);
2796	#else
2797	stw_p((uint8_t *)(long)addr, val);
2798	#endif
2799
2800	#ifdef USE_KQEMU
2801	if (cpu_single_env->kqemu_enabled &&
2802	(dirty_flags & KQEMU_MODIFY_PAGE_MASK) != KQEMU_MODIFY_PAGE_MASK)
2803	kqemu_modify_page(cpu_single_env, ram_addr);
2804	#endif
2805	dirty_flags \|= (0xff & ~CODE_DIRTY_FLAG);
2806	#ifdef VBOX
2807	if (RT_LIKELY((ram_addr >> TARGET_PAGE_BITS) < phys_ram_dirty_size))
2808	#endif
2809	phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] = dirty_flags;
2810	/* we remove the notdirty callback only if the code has been
2811	flushed */
2812	if (dirty_flags == 0xff)
2813	tlb_set_dirty(cpu_single_env, addr, cpu_single_env->mem_io_vaddr);
2814	}
2815
2816	static void notdirty_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
2817	{
2818	unsigned long ram_addr;
2819	int dirty_flags;
2820	#if defined(VBOX)
2821	ram_addr = addr;
2822	#else
2823	ram_addr = addr - (unsigned long)phys_ram_base;
2824	#endif
2825	#ifdef VBOX
2826	if (RT_UNLIKELY((ram_addr >> TARGET_PAGE_BITS) >= phys_ram_dirty_size))
2827	dirty_flags = 0xff;
2828	else
2829	#endif /* VBOX */
2830	dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2831	if (!(dirty_flags & CODE_DIRTY_FLAG)) {
2832	#if !defined(CONFIG_USER_ONLY)
2833	tb_invalidate_phys_page_fast(ram_addr, 4);
2834	# ifdef VBOX
2835	if (RT_UNLIKELY((ram_addr >> TARGET_PAGE_BITS) >= phys_ram_dirty_size))
2836	dirty_flags = 0xff;
2837	else
2838	# endif /* VBOX */
2839	dirty_flags = phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS];
2840	#endif
2841	}
2842	#if defined(VBOX) && !defined(REM_PHYS_ADDR_IN_TLB)
2843	remR3PhysWriteU32(addr, val);
2844	#else
2845	stl_p((uint8_t *)(long)addr, val);
2846	#endif
2847	#ifdef USE_KQEMU
2848	if (cpu_single_env->kqemu_enabled &&
2849	(dirty_flags & KQEMU_MODIFY_PAGE_MASK) != KQEMU_MODIFY_PAGE_MASK)
2850	kqemu_modify_page(cpu_single_env, ram_addr);
2851	#endif
2852	dirty_flags \|= (0xff & ~CODE_DIRTY_FLAG);
2853	#ifdef VBOX
2854	if (RT_LIKELY((ram_addr >> TARGET_PAGE_BITS) < phys_ram_dirty_size))
2855	#endif
2856	phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] = dirty_flags;
2857	/* we remove the notdirty callback only if the code has been
2858	flushed */
2859	if (dirty_flags == 0xff)
2860	tlb_set_dirty(cpu_single_env, addr, cpu_single_env->mem_io_vaddr);
2861	}
2862
2863	static CPUReadMemoryFunc *error_mem_read[3] = {
2864	NULL, /* never used */
2865	NULL, /* never used */
2866	NULL, /* never used */
2867	};
2868
2869	static CPUWriteMemoryFunc *notdirty_mem_write[3] = {
2870	notdirty_mem_writeb,
2871	notdirty_mem_writew,
2872	notdirty_mem_writel,
2873	};
2874
2875
2876	/* Generate a debug exception if a watchpoint has been hit. */
2877	static void check_watchpoint(int offset, int flags)
2878	{
2879	CPUState *env = cpu_single_env;
2880	target_ulong vaddr;
2881	int i;
2882
2883	vaddr = (env->mem_io_vaddr & TARGET_PAGE_MASK) + offset;
2884	for (i = 0; i < env->nb_watchpoints; i++) {
2885	if (vaddr == env->watchpoint[i].vaddr
2886	&& (env->watchpoint[i].type & flags)) {
2887	env->watchpoint_hit = i + 1;
2888	cpu_interrupt(env, CPU_INTERRUPT_DEBUG);
2889	break;
2890	}
2891	}
2892	}
2893
2894	/* Watchpoint access routines. Watchpoints are inserted using TLB tricks,
2895	so these check for a hit then pass through to the normal out-of-line
2896	phys routines. */
2897	static uint32_t watch_mem_readb(void *opaque, target_phys_addr_t addr)
2898	{
2899	check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_READ);
2900	return ldub_phys(addr);
2901	}
2902
2903	static uint32_t watch_mem_readw(void *opaque, target_phys_addr_t addr)
2904	{
2905	check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_READ);
2906	return lduw_phys(addr);
2907	}
2908
2909	static uint32_t watch_mem_readl(void *opaque, target_phys_addr_t addr)
2910	{
2911	check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_READ);
2912	return ldl_phys(addr);
2913	}
2914
2915	static void watch_mem_writeb(void *opaque, target_phys_addr_t addr,
2916	uint32_t val)
2917	{
2918	check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_WRITE);
2919	stb_phys(addr, val);
2920	}
2921
2922	static void watch_mem_writew(void *opaque, target_phys_addr_t addr,
2923	uint32_t val)
2924	{
2925	check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_WRITE);
2926	stw_phys(addr, val);
2927	}
2928
2929	static void watch_mem_writel(void *opaque, target_phys_addr_t addr,
2930	uint32_t val)
2931	{
2932	check_watchpoint(addr & ~TARGET_PAGE_MASK, PAGE_WRITE);
2933	stl_phys(addr, val);
2934	}
2935
2936	static CPUReadMemoryFunc *watch_mem_read[3] = {
2937	watch_mem_readb,
2938	watch_mem_readw,
2939	watch_mem_readl,
2940	};
2941
2942	static CPUWriteMemoryFunc *watch_mem_write[3] = {
2943	watch_mem_writeb,
2944	watch_mem_writew,
2945	watch_mem_writel,
2946	};
2947
2948	static inline uint32_t subpage_readlen (subpage_t *mmio, target_phys_addr_t addr,
2949	unsigned int len)
2950	{
2951	uint32_t ret;
2952	unsigned int idx;
2953
2954	idx = SUBPAGE_IDX(addr - mmio->base);
2955	#if defined(DEBUG_SUBPAGE)
2956	printf("%s: subpage %p len %d addr " TARGET_FMT_plx " idx %d\n", __func__,
2957	mmio, len, addr, idx);
2958	#endif
2959	ret = (**mmio->mem_read[idx][len])(mmio->opaque[idx][0][len], addr);
2960
2961	return ret;
2962	}
2963
2964	static inline void subpage_writelen (subpage_t *mmio, target_phys_addr_t addr,
2965	uint32_t value, unsigned int len)
2966	{
2967	unsigned int idx;
2968
2969	idx = SUBPAGE_IDX(addr - mmio->base);
2970	#if defined(DEBUG_SUBPAGE)
2971	printf("%s: subpage %p len %d addr " TARGET_FMT_plx " idx %d value %08x\n", __func__,
2972	mmio, len, addr, idx, value);
2973	#endif
2974	(**mmio->mem_write[idx][len])(mmio->opaque[idx][1][len], addr, value);
2975	}
2976
2977	static uint32_t subpage_readb (void *opaque, target_phys_addr_t addr)
2978	{
2979	#if defined(DEBUG_SUBPAGE)
2980	printf("%s: addr " TARGET_FMT_plx "\n", __func__, addr);
2981	#endif
2982
2983	return subpage_readlen(opaque, addr, 0);
2984	}
2985
2986	static void subpage_writeb (void *opaque, target_phys_addr_t addr,
2987	uint32_t value)
2988	{
2989	#if defined(DEBUG_SUBPAGE)
2990	printf("%s: addr " TARGET_FMT_plx " val %08x\n", __func__, addr, value);
2991	#endif
2992	subpage_writelen(opaque, addr, value, 0);
2993	}
2994
2995	static uint32_t subpage_readw (void *opaque, target_phys_addr_t addr)
2996	{
2997	#if defined(DEBUG_SUBPAGE)
2998	printf("%s: addr " TARGET_FMT_plx "\n", __func__, addr);
2999	#endif
3000
3001	return subpage_readlen(opaque, addr, 1);
3002	}
3003
3004	static void subpage_writew (void *opaque, target_phys_addr_t addr,
3005	uint32_t value)
3006	{
3007	#if defined(DEBUG_SUBPAGE)
3008	printf("%s: addr " TARGET_FMT_plx " val %08x\n", __func__, addr, value);
3009	#endif
3010	subpage_writelen(opaque, addr, value, 1);
3011	}
3012
3013	static uint32_t subpage_readl (void *opaque, target_phys_addr_t addr)
3014	{
3015	#if defined(DEBUG_SUBPAGE)
3016	printf("%s: addr " TARGET_FMT_plx "\n", __func__, addr);
3017	#endif
3018
3019	return subpage_readlen(opaque, addr, 2);
3020	}
3021
3022	static void subpage_writel (void *opaque,
3023	target_phys_addr_t addr, uint32_t value)
3024	{
3025	#if defined(DEBUG_SUBPAGE)
3026	printf("%s: addr " TARGET_FMT_plx " val %08x\n", __func__, addr, value);
3027	#endif
3028	subpage_writelen(opaque, addr, value, 2);
3029	}
3030
3031	static CPUReadMemoryFunc *subpage_read[] = {
3032	&subpage_readb,
3033	&subpage_readw,
3034	&subpage_readl,
3035	};
3036
3037	static CPUWriteMemoryFunc *subpage_write[] = {
3038	&subpage_writeb,
3039	&subpage_writew,
3040	&subpage_writel,
3041	};
3042
3043	static int subpage_register (subpage_t *mmio, uint32_t start, uint32_t end,
3044	ram_addr_t memory)
3045	{
3046	int idx, eidx;
3047	unsigned int i;
3048
3049	if (start >= TARGET_PAGE_SIZE \|\| end >= TARGET_PAGE_SIZE)
3050	return -1;
3051	idx = SUBPAGE_IDX(start);
3052	eidx = SUBPAGE_IDX(end);
3053	#if defined(DEBUG_SUBPAGE)
3054	printf("%s: %p start %08x end %08x idx %08x eidx %08x mem %d\n", __func__,
3055	mmio, start, end, idx, eidx, memory);
3056	#endif
3057	memory >>= IO_MEM_SHIFT;
3058	for (; idx <= eidx; idx++) {
3059	for (i = 0; i < 4; i++) {
3060	if (io_mem_read[memory][i]) {
3061	mmio->mem_read[idx][i] = &io_mem_read[memory][i];
3062	mmio->opaque[idx][0][i] = io_mem_opaque[memory];
3063	}
3064	if (io_mem_write[memory][i]) {
3065	mmio->mem_write[idx][i] = &io_mem_write[memory][i];
3066	mmio->opaque[idx][1][i] = io_mem_opaque[memory];
3067	}
3068	}
3069	}
3070
3071	return 0;
3072	}
3073
3074	static void subpage_init (target_phys_addr_t base, ram_addr_t phys,
3075	ram_addr_t orig_memory)
3076	{
3077	subpage_t *mmio;
3078	int subpage_memory;
3079
3080	mmio = qemu_mallocz(sizeof(subpage_t));
3081	if (mmio != NULL) {
3082	mmio->base = base;
3083	subpage_memory = cpu_register_io_memory(0, subpage_read, subpage_write, mmio);
3084	#if defined(DEBUG_SUBPAGE)
3085	printf("%s: %p base " TARGET_FMT_plx " len %08x %d\n", __func__,
3086	mmio, base, TARGET_PAGE_SIZE, subpage_memory);
3087	#endif
3088	*phys = subpage_memory \| IO_MEM_SUBPAGE;
3089	subpage_register(mmio, 0, TARGET_PAGE_SIZE - 1, orig_memory);
3090	}
3091
3092	return mmio;
3093	}
3094
3095	static void io_mem_init(void)
3096	{
3097	cpu_register_io_memory(IO_MEM_ROM >> IO_MEM_SHIFT, error_mem_read, unassigned_mem_write, NULL);
3098	cpu_register_io_memory(IO_MEM_UNASSIGNED >> IO_MEM_SHIFT, unassigned_mem_read, unassigned_mem_write, NULL);
3099	cpu_register_io_memory(IO_MEM_NOTDIRTY >> IO_MEM_SHIFT, error_mem_read, notdirty_mem_write, NULL);
3100	#if defined(VBOX) && !defined(VBOX_WITH_NEW_PHYS_CODE)
3101	cpu_register_io_memory(IO_MEM_RAM_MISSING >> IO_MEM_SHIFT, unassigned_mem_read, unassigned_mem_write, NULL);
3102	io_mem_nb = 6;
3103	#else
3104	io_mem_nb = 5;
3105	#endif
3106
3107	io_mem_watch = cpu_register_io_memory(0, watch_mem_read,
3108	watch_mem_write, NULL);
3109
3110	#ifndef VBOX /* VBOX: we do this later when the RAM is allocated. */
3111	/* alloc dirty bits array */
3112	phys_ram_dirty = qemu_vmalloc(phys_ram_size >> TARGET_PAGE_BITS);
3113	memset(phys_ram_dirty, 0xff, phys_ram_size >> TARGET_PAGE_BITS);
3114	#endif /* !VBOX */
3115	}
3116
3117	/* mem_read and mem_write are arrays of functions containing the
3118	function to access byte (index 0), word (index 1) and dword (index
3119	2). Functions can be omitted with a NULL function pointer. The
3120	registered functions may be modified dynamically later.
3121	If io_index is non zero, the corresponding io zone is
3122	modified. If it is zero, a new io zone is allocated. The return
3123	value can be used with cpu_register_physical_memory(). (-1) is
3124	returned if error. */
3125	int cpu_register_io_memory(int io_index,
3126	CPUReadMemoryFunc **mem_read,
3127	CPUWriteMemoryFunc **mem_write,
3128	void *opaque)
3129	{
3130	int i, subwidth = 0;
3131
3132	if (io_index <= 0) {
3133	if (io_mem_nb >= IO_MEM_NB_ENTRIES)
3134	return -1;
3135	io_index = io_mem_nb++;
3136	} else {
3137	if (io_index >= IO_MEM_NB_ENTRIES)
3138	return -1;
3139	}
3140
3141	for(i = 0;i < 3; i++) {
3142	if (!mem_read[i] \|\| !mem_write[i])
3143	subwidth = IO_MEM_SUBWIDTH;
3144	io_mem_read[io_index][i] = mem_read[i];
3145	io_mem_write[io_index][i] = mem_write[i];
3146	}
3147	io_mem_opaque[io_index] = opaque;
3148	return (io_index << IO_MEM_SHIFT) \| subwidth;
3149	}
3150
3151	CPUWriteMemoryFunc **cpu_get_io_memory_write(int io_index)
3152	{
3153	return io_mem_write[io_index >> IO_MEM_SHIFT];
3154	}
3155
3156	CPUReadMemoryFunc **cpu_get_io_memory_read(int io_index)
3157	{
3158	return io_mem_read[io_index >> IO_MEM_SHIFT];
3159	}
3160	#endif /* !defined(CONFIG_USER_ONLY) */
3161
3162	/* physical memory access (slow version, mainly for debug) */
3163	#if defined(CONFIG_USER_ONLY)
3164	void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
3165	int len, int is_write)
3166	{
3167	int l, flags;
3168	target_ulong page;
3169	void * p;
3170
3171	while (len > 0) {
3172	page = addr & TARGET_PAGE_MASK;
3173	l = (page + TARGET_PAGE_SIZE) - addr;
3174	if (l > len)
3175	l = len;
3176	flags = page_get_flags(page);
3177	if (!(flags & PAGE_VALID))
3178	return;
3179	if (is_write) {
3180	if (!(flags & PAGE_WRITE))
3181	return;
3182	/* XXX: this code should not depend on lock_user */
3183	if (!(p = lock_user(VERIFY_WRITE, addr, l, 0)))
3184	/* FIXME - should this return an error rather than just fail? */
3185	return;
3186	memcpy(p, buf, len);
3187	unlock_user(p, addr, len);
3188	} else {
3189	if (!(flags & PAGE_READ))
3190	return;
3191	if (!(p = lock_user(VERIFY_READ, addr, l, 1)))
3192	/* FIXME - should this return an error rather than just fail? */
3193	return;
3194	memcpy(buf, p, len);
3195	unlock_user(p, addr, 0);
3196	}
3197	len -= l;
3198	buf += l;
3199	addr += l;
3200	}
3201	}
3202
3203	#else
3204	void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
3205	int len, int is_write)
3206	{
3207	int l, io_index;
3208	uint8_t *ptr;
3209	uint32_t val;
3210	target_phys_addr_t page;
3211	unsigned long pd;
3212	PhysPageDesc *p;
3213
3214	while (len > 0) {
3215	page = addr & TARGET_PAGE_MASK;
3216	l = (page + TARGET_PAGE_SIZE) - addr;
3217	if (l > len)
3218	l = len;
3219	p = phys_page_find(page >> TARGET_PAGE_BITS);
3220	if (!p) {
3221	pd = IO_MEM_UNASSIGNED;
3222	} else {
3223	pd = p->phys_offset;
3224	}
3225
3226	if (is_write) {
3227	if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
3228	io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3229	/* XXX: could force cpu_single_env to NULL to avoid
3230	potential bugs */
3231	if (l >= 4 && ((addr & 3) == 0)) {
3232	/* 32 bit write access */
3233	#if !defined(VBOX) \|\| !defined(REM_PHYS_ADDR_IN_TLB)
3234	val = ldl_p(buf);
3235	#else
3236	val = (const uint32_t )buf;
3237	#endif
3238	io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val);
3239	l = 4;
3240	} else if (l >= 2 && ((addr & 1) == 0)) {
3241	/* 16 bit write access */
3242	#if !defined(VBOX) \|\| !defined(REM_PHYS_ADDR_IN_TLB)
3243	val = lduw_p(buf);
3244	#else
3245	val = (const uint16_t )buf;
3246	#endif
3247	io_mem_write[io_index][1](io_mem_opaque[io_index], addr, val);
3248	l = 2;
3249	} else {
3250	/* 8 bit write access */
3251	#if !defined(VBOX) \|\| !defined(REM_PHYS_ADDR_IN_TLB)
3252	val = ldub_p(buf);
3253	#else
3254	val = (const uint8_t )buf;
3255	#endif
3256	io_mem_write[io_index][0](io_mem_opaque[io_index], addr, val);
3257	l = 1;
3258	}
3259	} else {
3260	unsigned long addr1;
3261	addr1 = (pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK);
3262	/* RAM case */
3263	#ifdef VBOX
3264	remR3PhysWrite(addr1, buf, l); NOREF(ptr);
3265	#else
3266	ptr = phys_ram_base + addr1;
3267	memcpy(ptr, buf, l);
3268	#endif
3269	if (!cpu_physical_memory_is_dirty(addr1)) {
3270	/* invalidate code */
3271	tb_invalidate_phys_page_range(addr1, addr1 + l, 0);
3272	/* set dirty bit */
3273	#ifdef VBOX
3274	if (RT_LIKELY((addr1 >> TARGET_PAGE_BITS) < phys_ram_dirty_size))
3275	#endif
3276	phys_ram_dirty[addr1 >> TARGET_PAGE_BITS] \|=
3277	(0xff & ~CODE_DIRTY_FLAG);
3278	}
3279	}
3280	} else {
3281	if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM &&
3282	!(pd & IO_MEM_ROMD)) {
3283	/* I/O case */
3284	io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3285	if (l >= 4 && ((addr & 3) == 0)) {
3286	/* 32 bit read access */
3287	val = io_mem_read[io_index][2](io_mem_opaque[io_index], addr);
3288	#if !defined(VBOX) \|\| !defined(REM_PHYS_ADDR_IN_TLB)
3289	stl_p(buf, val);
3290	#else
3291	(uint32_t )buf = val;
3292	#endif
3293	l = 4;
3294	} else if (l >= 2 && ((addr & 1) == 0)) {
3295	/* 16 bit read access */
3296	val = io_mem_read[io_index][1](io_mem_opaque[io_index], addr);
3297	#if !defined(VBOX) \|\| !defined(REM_PHYS_ADDR_IN_TLB)
3298	stw_p(buf, val);
3299	#else
3300	(uint16_t )buf = val;
3301	#endif
3302	l = 2;
3303	} else {
3304	/* 8 bit read access */
3305	val = io_mem_read[io_index][0](io_mem_opaque[io_index], addr);
3306	#if !defined(VBOX) \|\| !defined(REM_PHYS_ADDR_IN_TLB)
3307	stb_p(buf, val);
3308	#else
3309	(uint8_t )buf = val;
3310	#endif
3311	l = 1;
3312	}
3313	} else {
3314	/* RAM case */
3315	#ifdef VBOX
3316	remR3PhysRead((pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK), buf, l); NOREF(ptr);
3317	#else
3318	ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) +
3319	(addr & ~TARGET_PAGE_MASK);
3320	memcpy(buf, ptr, l);
3321	#endif
3322	}
3323	}
3324	len -= l;
3325	buf += l;
3326	addr += l;
3327	}
3328	}
3329
3330	#ifndef VBOX
3331	/* used for ROM loading : can write in RAM and ROM */
3332	void cpu_physical_memory_write_rom(target_phys_addr_t addr,
3333	const uint8_t *buf, int len)
3334	{
3335	int l;
3336	uint8_t *ptr;
3337	target_phys_addr_t page;
3338	unsigned long pd;
3339	PhysPageDesc *p;
3340
3341	while (len > 0) {
3342	page = addr & TARGET_PAGE_MASK;
3343	l = (page + TARGET_PAGE_SIZE) - addr;
3344	if (l > len)
3345	l = len;
3346	p = phys_page_find(page >> TARGET_PAGE_BITS);
3347	if (!p) {
3348	pd = IO_MEM_UNASSIGNED;
3349	} else {
3350	pd = p->phys_offset;
3351	}
3352
3353	if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM &&
3354	(pd & ~TARGET_PAGE_MASK) != IO_MEM_ROM &&
3355	!(pd & IO_MEM_ROMD)) {
3356	/* do nothing */
3357	} else {
3358	unsigned long addr1;
3359	addr1 = (pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK);
3360	/* ROM/RAM case */
3361	ptr = phys_ram_base + addr1;
3362	memcpy(ptr, buf, l);
3363	}
3364	len -= l;
3365	buf += l;
3366	addr += l;
3367	}
3368	}
3369	#endif /* !VBOX */
3370
3371
3372	/* warning: addr must be aligned */
3373	uint32_t ldl_phys(target_phys_addr_t addr)
3374	{
3375	int io_index;
3376	uint8_t *ptr;
3377	uint32_t val;
3378	unsigned long pd;
3379	PhysPageDesc *p;
3380
3381	p = phys_page_find(addr >> TARGET_PAGE_BITS);
3382	if (!p) {
3383	pd = IO_MEM_UNASSIGNED;
3384	} else {
3385	pd = p->phys_offset;
3386	}
3387
3388	if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM &&
3389	!(pd & IO_MEM_ROMD)) {
3390	/* I/O case */
3391	io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3392	val = io_mem_read[io_index][2](io_mem_opaque[io_index], addr);
3393	} else {
3394	/* RAM case */
3395	#ifndef VBOX
3396	ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) +
3397	(addr & ~TARGET_PAGE_MASK);
3398	val = ldl_p(ptr);
3399	#else
3400	val = remR3PhysReadU32((pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK)); NOREF(ptr);
3401	#endif
3402	}
3403	return val;
3404	}
3405
3406	/* warning: addr must be aligned */
3407	uint64_t ldq_phys(target_phys_addr_t addr)
3408	{
3409	int io_index;
3410	uint8_t *ptr;
3411	uint64_t val;
3412	unsigned long pd;
3413	PhysPageDesc *p;
3414
3415	p = phys_page_find(addr >> TARGET_PAGE_BITS);
3416	if (!p) {
3417	pd = IO_MEM_UNASSIGNED;
3418	} else {
3419	pd = p->phys_offset;
3420	}
3421
3422	if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM &&
3423	!(pd & IO_MEM_ROMD)) {
3424	/* I/O case */
3425	io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3426	#ifdef TARGET_WORDS_BIGENDIAN
3427	val = (uint64_t)io_mem_read[io_index][2](io_mem_opaque[io_index], addr) << 32;
3428	val \|= io_mem_read[io_index][2](io_mem_opaque[io_index], addr + 4);
3429	#else
3430	val = io_mem_read[io_index][2](io_mem_opaque[io_index], addr);
3431	val \|= (uint64_t)io_mem_read[io_index][2](io_mem_opaque[io_index], addr + 4) << 32;
3432	#endif
3433	} else {
3434	/* RAM case */
3435	#ifndef VBOX
3436	ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) +
3437	(addr & ~TARGET_PAGE_MASK);
3438	val = ldq_p(ptr);
3439	#else
3440	val = remR3PhysReadU64((pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK)); NOREF(ptr);
3441	#endif
3442	}
3443	return val;
3444	}
3445
3446	/* XXX: optimize */
3447	uint32_t ldub_phys(target_phys_addr_t addr)
3448	{
3449	uint8_t val;
3450	cpu_physical_memory_read(addr, &val, 1);
3451	return val;
3452	}
3453
3454	/* XXX: optimize */
3455	uint32_t lduw_phys(target_phys_addr_t addr)
3456	{
3457	uint16_t val;
3458	cpu_physical_memory_read(addr, (uint8_t *)&val, 2);
3459	return tswap16(val);
3460	}
3461
3462	/* warning: addr must be aligned. The ram page is not masked as dirty
3463	and the code inside is not invalidated. It is useful if the dirty
3464	bits are used to track modified PTEs */
3465	void stl_phys_notdirty(target_phys_addr_t addr, uint32_t val)
3466	{
3467	int io_index;
3468	uint8_t *ptr;
3469	unsigned long pd;
3470	PhysPageDesc *p;
3471
3472	p = phys_page_find(addr >> TARGET_PAGE_BITS);
3473	if (!p) {
3474	pd = IO_MEM_UNASSIGNED;
3475	} else {
3476	pd = p->phys_offset;
3477	}
3478
3479	if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
3480	io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3481	io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val);
3482	} else {
3483	#ifndef VBOX
3484	ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) +
3485	(addr & ~TARGET_PAGE_MASK);
3486	stl_p(ptr, val);
3487	#else
3488	remR3PhysWriteU32((pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK), val); NOREF(ptr);
3489	#endif
3490	#ifndef VBOX
3491	if (unlikely(in_migration)) {
3492	if (!cpu_physical_memory_is_dirty(addr1)) {
3493	/* invalidate code */
3494	tb_invalidate_phys_page_range(addr1, addr1 + 4, 0);
3495	/* set dirty bit */
3496	phys_ram_dirty[addr1 >> TARGET_PAGE_BITS] \|=
3497	(0xff & ~CODE_DIRTY_FLAG);
3498	}
3499	}
3500	#endif
3501	}
3502	}
3503
3504	void stq_phys_notdirty(target_phys_addr_t addr, uint64_t val)
3505	{
3506	int io_index;
3507	uint8_t *ptr;
3508	unsigned long pd;
3509	PhysPageDesc *p;
3510
3511	p = phys_page_find(addr >> TARGET_PAGE_BITS);
3512	if (!p) {
3513	pd = IO_MEM_UNASSIGNED;
3514	} else {
3515	pd = p->phys_offset;
3516	}
3517
3518	if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
3519	io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3520	#ifdef TARGET_WORDS_BIGENDIAN
3521	io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val >> 32);
3522	io_mem_write[io_index][2](io_mem_opaque[io_index], addr + 4, val);
3523	#else
3524	io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val);
3525	io_mem_write[io_index][2](io_mem_opaque[io_index], addr + 4, val >> 32);
3526	#endif
3527	} else {
3528	#ifndef VBOX
3529	ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) +
3530	(addr & ~TARGET_PAGE_MASK);
3531	stq_p(ptr, val);
3532	#else
3533	remR3PhysWriteU64((pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK), val); NOREF(ptr);
3534	#endif
3535	}
3536	}
3537
3538
3539	/* warning: addr must be aligned */
3540	void stl_phys(target_phys_addr_t addr, uint32_t val)
3541	{
3542	int io_index;
3543	uint8_t *ptr;
3544	unsigned long pd;
3545	PhysPageDesc *p;
3546
3547	p = phys_page_find(addr >> TARGET_PAGE_BITS);
3548	if (!p) {
3549	pd = IO_MEM_UNASSIGNED;
3550	} else {
3551	pd = p->phys_offset;
3552	}
3553
3554	if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) {
3555	io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
3556	io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val);
3557	} else {
3558	unsigned long addr1;
3559	addr1 = (pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK);
3560	/* RAM case */
3561	#ifndef VBOX
3562	ptr = phys_ram_base + addr1;
3563	stl_p(ptr, val);
3564	#else
3565	remR3PhysWriteU32((pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK), val); NOREF(ptr);
3566	#endif
3567	if (!cpu_physical_memory_is_dirty(addr1)) {
3568	/* invalidate code */
3569	tb_invalidate_phys_page_range(addr1, addr1 + 4, 0);
3570	/* set dirty bit */
3571	#ifdef VBOX
3572	if (RT_LIKELY((addr1 >> TARGET_PAGE_BITS) < phys_ram_dirty_size))
3573	#endif
3574	phys_ram_dirty[addr1 >> TARGET_PAGE_BITS] \|=
3575	(0xff & ~CODE_DIRTY_FLAG);
3576	}
3577	}
3578	}
3579
3580	/* XXX: optimize */
3581	void stb_phys(target_phys_addr_t addr, uint32_t val)
3582	{
3583	uint8_t v = val;
3584	cpu_physical_memory_write(addr, &v, 1);
3585	}
3586
3587	/* XXX: optimize */
3588	void stw_phys(target_phys_addr_t addr, uint32_t val)
3589	{
3590	uint16_t v = tswap16(val);
3591	cpu_physical_memory_write(addr, (const uint8_t *)&v, 2);
3592	}
3593
3594	/* XXX: optimize */
3595	void stq_phys(target_phys_addr_t addr, uint64_t val)
3596	{
3597	val = tswap64(val);
3598	cpu_physical_memory_write(addr, (const uint8_t *)&val, 8);
3599	}
3600
3601	#endif
3602
3603	/* virtual memory access for debug */
3604	int cpu_memory_rw_debug(CPUState *env, target_ulong addr,
3605	uint8_t *buf, int len, int is_write)
3606	{
3607	int l;
3608	target_ulong page, phys_addr;
3609
3610	while (len > 0) {
3611	page = addr & TARGET_PAGE_MASK;
3612	phys_addr = cpu_get_phys_page_debug(env, page);
3613	/* if no physical page mapped, return an error */
3614	if (phys_addr == -1)
3615	return -1;
3616	l = (page + TARGET_PAGE_SIZE) - addr;
3617	if (l > len)
3618	l = len;
3619	cpu_physical_memory_rw(phys_addr + (addr & ~TARGET_PAGE_MASK),
3620	buf, l, is_write);
3621	len -= l;
3622	buf += l;
3623	addr += l;
3624	}
3625	return 0;
3626	}
3627
3628	/* in deterministic execution mode, instructions doing device I/Os
3629	must be at the end of the TB */
3630	void cpu_io_recompile(CPUState env, void retaddr)
3631	{
3632	TranslationBlock *tb;
3633	uint32_t n, cflags;
3634	target_ulong pc, cs_base;
3635	uint64_t flags;
3636
3637	tb = tb_find_pc((unsigned long)retaddr);
3638	if (!tb) {
3639	cpu_abort(env, "cpu_io_recompile: could not find TB for pc=%p",
3640	retaddr);
3641	}
3642	n = env->icount_decr.u16.low + tb->icount;
3643	cpu_restore_state(tb, env, (unsigned long)retaddr, NULL);
3644	/* Calculate how many instructions had been executed before the fault
3645	occurred. */
3646	n = n - env->icount_decr.u16.low;
3647	/* Generate a new TB ending on the I/O insn. */
3648	n++;
3649	/* On MIPS and SH, delay slot instructions can only be restarted if
3650	they were already the first instruction in the TB. If this is not
3651	the first instruction in a TB then re-execute the preceding
3652	branch. */
3653	#if defined(TARGET_MIPS)
3654	if ((env->hflags & MIPS_HFLAG_BMASK) != 0 && n > 1) {
3655	env->active_tc.PC -= 4;
3656	env->icount_decr.u16.low++;
3657	env->hflags &= ~MIPS_HFLAG_BMASK;
3658	}
3659	#elif defined(TARGET_SH4)
3660	if ((env->flags & ((DELAY_SLOT \| DELAY_SLOT_CONDITIONAL))) != 0
3661	&& n > 1) {
3662	env->pc -= 2;
3663	env->icount_decr.u16.low++;
3664	env->flags &= ~(DELAY_SLOT \| DELAY_SLOT_CONDITIONAL);
3665	}
3666	#endif
3667	/* This should never happen. */
3668	if (n > CF_COUNT_MASK)
3669	cpu_abort(env, "TB too big during recompile");
3670
3671	cflags = n \| CF_LAST_IO;
3672	pc = tb->pc;
3673	cs_base = tb->cs_base;
3674	flags = tb->flags;
3675	tb_phys_invalidate(tb, -1);
3676	/* FIXME: In theory this could raise an exception. In practice
3677	we have already translated the block once so it's probably ok. */
3678	tb_gen_code(env, pc, cs_base, flags, cflags);
3679	/* TODO: If env->pc != tb->pc (i.e. the faulting instruction was not
3680	the first in the TB) then we end up generating a whole new TB and
3681	repeating the fault, which is horribly inefficient.
3682	Better would be to execute just this insn uncached, or generate a
3683	second new TB. */
3684	cpu_resume_from_signal(env, NULL);
3685	}
3686
3687	#ifndef VBOX
3688	void dump_exec_info(FILE *f,
3689	int (cpu_fprintf)(FILE f, const char *fmt, ...))
3690	{
3691	int i, target_code_size, max_target_code_size;
3692	int direct_jmp_count, direct_jmp2_count, cross_page;
3693	TranslationBlock *tb;
3694
3695	target_code_size = 0;
3696	max_target_code_size = 0;
3697	cross_page = 0;
3698	direct_jmp_count = 0;
3699	direct_jmp2_count = 0;
3700	for(i = 0; i < nb_tbs; i++) {
3701	tb = &tbs[i];
3702	target_code_size += tb->size;
3703	if (tb->size > max_target_code_size)
3704	max_target_code_size = tb->size;
3705	if (tb->page_addr[1] != -1)
3706	cross_page++;
3707	if (tb->tb_next_offset[0] != 0xffff) {
3708	direct_jmp_count++;
3709	if (tb->tb_next_offset[1] != 0xffff) {
3710	direct_jmp2_count++;
3711	}
3712	}
3713	}
3714	/* XXX: avoid using doubles ? */
3715	cpu_fprintf(f, "Translation buffer state:\n");
3716	cpu_fprintf(f, "gen code size %ld/%ld\n",
3717	code_gen_ptr - code_gen_buffer, code_gen_buffer_max_size);
3718	cpu_fprintf(f, "TB count %d/%d\n",
3719	nb_tbs, code_gen_max_blocks);
3720	cpu_fprintf(f, "TB avg target size %d max=%d bytes\n",
3721	nb_tbs ? target_code_size / nb_tbs : 0,
3722	max_target_code_size);
3723	cpu_fprintf(f, "TB avg host size %d bytes (expansion ratio: %0.1f)\n",
3724	nb_tbs ? (code_gen_ptr - code_gen_buffer) / nb_tbs : 0,
3725	target_code_size ? (double) (code_gen_ptr - code_gen_buffer) / target_code_size : 0);
3726	cpu_fprintf(f, "cross page TB count %d (%d%%)\n",
3727	cross_page,
3728	nb_tbs ? (cross_page * 100) / nb_tbs : 0);
3729	cpu_fprintf(f, "direct jump count %d (%d%%) (2 jumps=%d %d%%)\n",
3730	direct_jmp_count,
3731	nb_tbs ? (direct_jmp_count * 100) / nb_tbs : 0,
3732	direct_jmp2_count,
3733	nb_tbs ? (direct_jmp2_count * 100) / nb_tbs : 0);
3734	cpu_fprintf(f, "\nStatistics:\n");
3735	cpu_fprintf(f, "TB flush count %d\n", tb_flush_count);
3736	cpu_fprintf(f, "TB invalidate count %d\n", tb_phys_invalidate_count);
3737	cpu_fprintf(f, "TLB flush count %d\n", tlb_flush_count);
3738	tcg_dump_info(f, cpu_fprintf);
3739	}
3740	#endif /* !VBOX */
3741
3742	#if !defined(CONFIG_USER_ONLY)
3743
3744	#define MMUSUFFIX _cmmu
3745	#define GETPC() NULL
3746	#define env cpu_single_env
3747	#define SOFTMMU_CODE_ACCESS
3748
3749	#define SHIFT 0
3750	#include "softmmu_template.h"
3751
3752	#define SHIFT 1
3753	#include "softmmu_template.h"
3754
3755	#define SHIFT 2
3756	#include "softmmu_template.h"
3757
3758	#define SHIFT 3
3759	#include "softmmu_template.h"
3760
3761	#undef env
3762
3763	#endif

注意: 瀏覽 TracBrowser 來幫助您使用儲存庫瀏覽器

source: vbox/trunk/src/recompiler_new/exec.c@ 14974

以其他格式下載: