VBoxRecompiler.c@ 789

Last change on this file since 789 was 789, checked in by vboxsync, 18 years ago
Fix for dynamic ram
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 155.0 KB

Line
1	/** @file
2	*
3	* VBox Recompiler - QEMU.
4	*/
5
6	/*
7	* Copyright (C) 2006 InnoTek Systemberatung GmbH
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License as published by the Free Software Foundation,
13	* in version 2 as it comes in the "COPYING" file of the VirtualBox OSE
14	* distribution. VirtualBox OSE is distributed in the hope that it will
15	* be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* If you received this file as part of a commercial VirtualBox
18	* distribution, then only the terms of your commercial VirtualBox
19	* license agreement apply instead of the previous paragraph.
20	*/
21
22
23	/*******************************************************************************
24	* Header Files *
25	*******************************************************************************/
26	#include "vl.h"
27	#include "exec-all.h"
28
29	#include <VBox/rem.h>
30	#include <VBox/vmapi.h>
31	#include <VBox/tm.h>
32	#include <VBox/ssm.h>
33	#include <VBox/em.h>
34	#include <VBox/trpm.h>
35	#include <VBox/iom.h>
36	#include <VBox/mm.h>
37	#include <VBox/pgm.h>
38	#include <VBox/pdm.h>
39	#include <VBox/dbgf.h>
40	#include <VBox/dbg.h>
41	#include <VBox/hwaccm.h>
42	#include <VBox/patm.h>
43	#include <VBox/csam.h>
44	#include "REMInternal.h"
45	#include <VBox/vm.h>
46	#include <VBox/param.h>
47	#include <VBox/err.h>
48
49	#define LOG_GROUP LOG_GROUP_REM
50	#include <VBox/log.h>
51	#include <iprt/semaphore.h>
52	#include <iprt/asm.h>
53	#include <iprt/assert.h>
54	#include <iprt/thread.h>
55	#include <iprt/string.h>
56
57	////#define VBOX_RAW_V86
58
59	/* Don't wanna include everything. */
60	extern void cpu_x86_update_cr3(CPUX86State *env, target_ulong new_cr3);
61	extern void cpu_x86_update_cr0(CPUX86State *env, uint32_t new_cr0);
62	extern void cpu_x86_update_cr4(CPUX86State *env, uint32_t new_cr4);
63	extern void tlb_flush_page(CPUX86State *env, uint32_t addr);
64	extern void tlb_flush(CPUState *env, int flush_global);
65	extern void sync_seg(CPUX86State *env1, int seg_reg, int selector);
66	extern void sync_ldtr(CPUX86State *env1, int selector);
67	extern int sync_tr(CPUX86State *env1, int selector);
68
69	#ifdef VBOX_STRICT
70	unsigned long get_phys_page_offset(target_ulong addr);
71	#endif
72
73
74	/*******************************************************************************
75	* Defined Constants And Macros *
76	*******************************************************************************/
77
78	/** Copy 80-bit fpu register at pSrc to pDst.
79	* This is probably faster than calling memcpy.
80	*/
81	#define REM_COPY_FPU_REG(pDst, pSrc) \
82	do { (PX86FPUMMX)(pDst) = (const X86FPUMMX *)(pSrc); } while (0)
83
84
85	/*******************************************************************************
86	* Internal Functions *
87	*******************************************************************************/
88	static DECLCALLBACK(int) remR3Save(PVM pVM, PSSMHANDLE pSSM);
89	static DECLCALLBACK(int) remR3Load(PVM pVM, PSSMHANDLE pSSM, uint32_t u32Version);
90	static void remR3StateUpdate(PVM pVM);
91	static uint32_t remR3MMIOReadU8(void *pvVM, target_phys_addr_t GCPhys);
92	static uint32_t remR3MMIOReadU16(void *pvVM, target_phys_addr_t GCPhys);
93	static uint32_t remR3MMIOReadU32(void *pvVM, target_phys_addr_t GCPhys);
94	static void remR3MMIOWriteU8(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32);
95	static void remR3MMIOWriteU16(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32);
96	static void remR3MMIOWriteU32(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32);
97
98	static uint32_t remR3HandlerReadU8(void *pvVM, target_phys_addr_t GCPhys);
99	static uint32_t remR3HandlerReadU16(void *pvVM, target_phys_addr_t GCPhys);
100	static uint32_t remR3HandlerReadU32(void *pvVM, target_phys_addr_t GCPhys);
101	static void remR3HandlerWriteU8(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32);
102	static void remR3HandlerWriteU16(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32);
103	static void remR3HandlerWriteU32(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32);
104
105
106	/*******************************************************************************
107	* Global Variables *
108	*******************************************************************************/
109
110	/** The log level of the recompiler. */
111	#if 1
112	extern int loglevel;
113	#else
114	int loglevel = ~0;
115	FILE *logfile = NULL;
116	#endif
117
118
119	/** @todo Move stats to REM::s some rainy day we have nothing do to. */
120	#ifdef VBOX_WITH_STATISTICS
121	static STAMPROFILEADV gStatExecuteSingleInstr;
122	static STAMPROFILEADV gStatCompilationQEmu;
123	static STAMPROFILEADV gStatRunCodeQEmu;
124	static STAMPROFILEADV gStatTotalTimeQEmu;
125	static STAMPROFILEADV gStatTimers;
126	static STAMPROFILEADV gStatTBLookup;
127	static STAMPROFILEADV gStatIRQ;
128	static STAMPROFILEADV gStatRawCheck;
129	static STAMPROFILEADV gStatMemRead;
130	static STAMPROFILEADV gStatMemWrite;
131	static STAMCOUNTER gStatRefuseTFInhibit;
132	static STAMCOUNTER gStatRefuseVM86;
133	static STAMCOUNTER gStatRefusePaging;
134	static STAMCOUNTER gStatRefusePAE;
135	static STAMCOUNTER gStatRefuseIOPLNot0;
136	static STAMCOUNTER gStatRefuseIF0;
137	static STAMCOUNTER gStatRefuseCode16;
138	static STAMCOUNTER gStatRefuseWP0;
139	static STAMCOUNTER gStatRefuseRing1or2;
140	static STAMCOUNTER gStatRefuseCanExecute;
141	static STAMCOUNTER gStatREMGDTChange;
142	static STAMCOUNTER gStatREMIDTChange;
143	static STAMCOUNTER gStatREMLDTRChange;
144	static STAMCOUNTER gStatREMTRChange;
145	static STAMCOUNTER gStatSelOutOfSync[6];
146	static STAMCOUNTER gStatSelOutOfSyncStateBack[6];
147	#endif
148
149	/*
150	* Global stuff.
151	*/
152
153	/** MMIO read callbacks. */
154	CPUReadMemoryFunc *g_apfnMMIORead[3] =
155	{
156	remR3MMIOReadU8,
157	remR3MMIOReadU16,
158	remR3MMIOReadU32
159	};
160
161	/** MMIO write callbacks. */
162	CPUWriteMemoryFunc *g_apfnMMIOWrite[3] =
163	{
164	remR3MMIOWriteU8,
165	remR3MMIOWriteU16,
166	remR3MMIOWriteU32
167	};
168
169	/** Handler read callbacks. */
170	CPUReadMemoryFunc *g_apfnHandlerRead[3] =
171	{
172	remR3HandlerReadU8,
173	remR3HandlerReadU16,
174	remR3HandlerReadU32
175	};
176
177	/** Handler write callbacks. */
178	CPUWriteMemoryFunc *g_apfnHandlerWrite[3] =
179	{
180	remR3HandlerWriteU8,
181	remR3HandlerWriteU16,
182	remR3HandlerWriteU32
183	};
184
185	#ifndef PGM_DYNAMIC_RAM_ALLOC
186	/* Guest physical RAM base. Not to be used in external code. */
187	static uint8_t *phys_ram_base;
188	#endif
189
190	/*
191	* Instance stuff.
192	*/
193	/** Pointer to the cpu state. */
194	CPUState *cpu_single_env;
195
196
197	#ifdef VBOX_WITH_DEBUGGER
198	/*
199	* Debugger commands.
200	*/
201	static DECLCALLBACK(int) remR3CmdDisasEnableStepping(PCDBGCCMD pCmd, PDBGCCMDHLP pCmdHlp, PVM pVM, PCDBGCVAR paArgs, unsigned cArgs, PDBGCVAR pResult);
202
203	/** '.remstep' arguments. */
204	static const DBGCVARDESC g_aArgRemStep[] =
205	{
206	/* cTimesMin, cTimesMax, enmCategory, fFlags, pszName, pszDescription */
207	{ 0, ~0, DBGCVAR_CAT_NUMBER, 0, "on/off", "Boolean value/mnemonic indicating the new state." },
208	};
209
210	/** Command descriptors. */
211	static const DBGCCMD g_aCmds[] =
212	{
213	{
214	.pszCmd ="remstep",
215	.cArgsMin = 0,
216	.cArgsMax = 1,
217	.paArgDescs = &g_aArgRemStep[0],
218	.cArgDescs = ELEMENTS(g_aArgRemStep),
219	.pResultDesc = NULL,
220	.fFlags = 0,
221	.pfnHandler = remR3CmdDisasEnableStepping,
222	.pszSyntax = "[on/off]",
223	.pszDescription = "Enable or disable the single stepping with logged disassembly. "
224	"If no arguments show the current state."
225	}
226	};
227	#endif
228
229
230	/*******************************************************************************
231	* Internal Functions *
232	*******************************************************************************/
233	static void remAbort(int rc, const char *pszTip);
234
235
236	/* Put them here to avoid unused variable warning. */
237	AssertCompile(RT_SIZEOFMEMB(VM, rem.padding) >= RT_SIZEOFMEMB(VM, rem.s));
238	//AssertCompileMemberSize(REM, Env, REM_ENV_SIZE);
239	//AssertCompile(RT_SIZEOFMEMB(REM, Env) <= REM_ENV_SIZE);
240
241	/**
242	* Initializes the REM.
243	*
244	* @returns VBox status code.
245	* @param pVM The VM to operate on.
246	*/
247	REMR3DECL(int) REMR3Init(PVM pVM)
248	{
249	uint32_t u32Dummy;
250	AssertReleaseMsg(sizeof(pVM->rem.padding) >= sizeof(pVM->rem.s), ("%#x >= %#x; sizeof(Env)=%#x\n", sizeof(pVM->rem.padding), sizeof(pVM->rem.s), sizeof(pVM->rem.s.Env)));
251	//AssertReleaseMsg(sizeof(pVM->rem.s.Env) <= REM_ENV_SIZE, ("%#x == %#x\n", sizeof(pVM->rem.s.Env), REM_ENV_SIZE));
252	AssertReleaseMsg(!(RT_OFFSETOF(VM, rem) & 31), ("off=%#x\n", RT_OFFSETOF(VM, rem)));
253	#if 0 /* not merged yet */
254	Assert(!testmath());
255	#endif
256
257	/*
258	* Init some internal data members.
259	*/
260	pVM->rem.s.offVM = RT_OFFSETOF(VM, rem.s);
261	pVM->rem.s.Env.pVM = pVM;
262	#ifdef CPU_RAW_MODE_INIT
263	pVM->rem.s.state \|= CPU_RAW_MODE_INIT;
264	#endif
265
266	/* ctx. */
267	int rc = CPUMQueryGuestCtxPtr(pVM, &pVM->rem.s.pCtx);
268	if (VBOX_FAILURE(rc))
269	{
270	AssertMsgFailed(("Failed to obtain guest ctx pointer. rc=%Vrc\n", rc));
271	return rc;
272	}
273	AssertMsg(MMR3PhysGetRamSize(pVM) == 0, ("Init order have changed! REM depends on notification about ALL physical memory registrations\n"));
274
275	/*
276	* Init the recompiler.
277	*/
278	if (!cpu_x86_init(&pVM->rem.s.Env))
279	{
280	AssertMsgFailed(("cpu_x86_init failed - impossible!\n"));
281	return VERR_GENERAL_FAILURE;
282	}
283	CPUMGetGuestCpuId(pVM, 1, &u32Dummy, &u32Dummy, &pVM->rem.s.Env.cpuid_ext_features, &pVM->rem.s.Env.cpuid_features);
284
285	/* allocate code buffer for single instruction emulation. */
286	pVM->rem.s.Env.cbCodeBuffer = 4096;
287	pVM->rem.s.Env.pvCodeBuffer = RTMemExecAlloc(pVM->rem.s.Env.cbCodeBuffer);
288	AssertMsgReturn(pVM->rem.s.Env.pvCodeBuffer, ("Failed to allocate code buffer!\n"), VERR_NO_MEMORY);
289
290	/* finally, set the cpu_single_env global. */
291	cpu_single_env = &pVM->rem.s.Env;
292
293	/* Nothing is pending by default */
294	pVM->rem.s.u32PendingInterrupt = REM_NO_PENDING_IRQ;
295
296	#ifdef DEBUG_bird
297	//cpu_breakpoint_insert(&pVM->rem.s.Env, some-address);
298	#endif
299
300	/*
301	* Register ram types.
302	*/
303	pVM->rem.s.iMMIOMemType = cpu_register_io_memory(0, g_apfnMMIORead, g_apfnMMIOWrite, pVM);
304	AssertReleaseMsg(pVM->rem.s.iMMIOMemType > 0, ("pVM->rem.s.iMMIOMemType=%d\n", pVM->rem.s.iMMIOMemType));
305	pVM->rem.s.iHandlerMemType = cpu_register_io_memory(0, g_apfnHandlerRead, g_apfnHandlerWrite, pVM);
306	AssertReleaseMsg(pVM->rem.s.iHandlerMemType > 0, ("pVM->rem.s.iHandlerMemType=%d\n", pVM->rem.s.iHandlerMemType));
307	Log2(("REM: iMMIOMemType=%d iHandlerMemType=%d\n", pVM->rem.s.iMMIOMemType, pVM->rem.s.iHandlerMemType));
308
309	/*
310	* Register the saved state data unit.
311	*/
312	rc = SSMR3RegisterInternal(pVM, "rem", 1, REM_SAVED_STATE_VERSION, sizeof(uint32_t) * 10,
313	NULL, remR3Save, NULL,
314	NULL, remR3Load, NULL);
315	if (VBOX_FAILURE(rc))
316	return rc;
317
318	#ifdef VBOX_WITH_DEBUGGER
319	/*
320	* Debugger commands.
321	*/
322	static bool fRegisteredCmds = false;
323	if (!fRegisteredCmds)
324	{
325	int rc = DBGCRegisterCommands(&g_aCmds[0], ELEMENTS(g_aCmds));
326	if (VBOX_SUCCESS(rc))
327	fRegisteredCmds = true;
328	}
329	#endif
330
331	#ifdef VBOX_WITH_STATISTICS
332	/*
333	* Statistics.
334	*/
335	STAM_REG(pVM, &gStatExecuteSingleInstr, STAMTYPE_PROFILE, "/PROF/REM/SingleInstr",STAMUNIT_TICKS_PER_CALL, "Profiling single instruction emulation.");
336	STAM_REG(pVM, &gStatCompilationQEmu, STAMTYPE_PROFILE, "/PROF/REM/Compile", STAMUNIT_TICKS_PER_CALL, "Profiling QEmu compilation.");
337	STAM_REG(pVM, &gStatRunCodeQEmu, STAMTYPE_PROFILE, "/PROF/REM/Runcode", STAMUNIT_TICKS_PER_CALL, "Profiling QEmu code execution.");
338	STAM_REG(pVM, &gStatTotalTimeQEmu, STAMTYPE_PROFILE, "/PROF/REM/Emulate", STAMUNIT_TICKS_PER_CALL, "Profiling code emulation.");
339	STAM_REG(pVM, &gStatTimers, STAMTYPE_PROFILE, "/PROF/REM/Timers", STAMUNIT_TICKS_PER_CALL, "Profiling timer scheduling.");
340	STAM_REG(pVM, &gStatTBLookup, STAMTYPE_PROFILE, "/PROF/REM/TBLookup", STAMUNIT_TICKS_PER_CALL, "Profiling timer scheduling.");
341	STAM_REG(pVM, &gStatIRQ, STAMTYPE_PROFILE, "/PROF/REM/IRQ", STAMUNIT_TICKS_PER_CALL, "Profiling timer scheduling.");
342	STAM_REG(pVM, &gStatRawCheck, STAMTYPE_PROFILE, "/PROF/REM/RawCheck", STAMUNIT_TICKS_PER_CALL, "Profiling timer scheduling.");
343	STAM_REG(pVM, &gStatMemRead, STAMTYPE_PROFILE, "/PROF/REM/MemRead", STAMUNIT_TICKS_PER_CALL, "Profiling memory access.");
344	STAM_REG(pVM, &gStatMemWrite, STAMTYPE_PROFILE, "/PROF/REM/MemWrite", STAMUNIT_TICKS_PER_CALL, "Profiling memory access.");
345
346	STAM_REG(pVM, &gStatRefuseTFInhibit, STAMTYPE_COUNTER, "/REM/Refuse/TFInibit", STAMUNIT_OCCURENCES, "Raw mode refused because of TF or irq inhibit");
347	STAM_REG(pVM, &gStatRefuseVM86, STAMTYPE_COUNTER, "/REM/Refuse/VM86", STAMUNIT_OCCURENCES, "Raw mode refused because of VM86");
348	STAM_REG(pVM, &gStatRefusePaging, STAMTYPE_COUNTER, "/REM/Refuse/Paging", STAMUNIT_OCCURENCES, "Raw mode refused because of disabled paging/pm");
349	STAM_REG(pVM, &gStatRefusePAE, STAMTYPE_COUNTER, "/REM/Refuse/PAE", STAMUNIT_OCCURENCES, "Raw mode refused because of PAE");
350	STAM_REG(pVM, &gStatRefuseIOPLNot0, STAMTYPE_COUNTER, "/REM/Refuse/IOPLNot0", STAMUNIT_OCCURENCES, "Raw mode refused because of IOPL != 0");
351	STAM_REG(pVM, &gStatRefuseIF0, STAMTYPE_COUNTER, "/REM/Refuse/IF0", STAMUNIT_OCCURENCES, "Raw mode refused because of IF=0");
352	STAM_REG(pVM, &gStatRefuseCode16, STAMTYPE_COUNTER, "/REM/Refuse/Code16", STAMUNIT_OCCURENCES, "Raw mode refused because of 16 bit code");
353	STAM_REG(pVM, &gStatRefuseWP0, STAMTYPE_COUNTER, "/REM/Refuse/WP0", STAMUNIT_OCCURENCES, "Raw mode refused because of WP=0");
354	STAM_REG(pVM, &gStatRefuseRing1or2, STAMTYPE_COUNTER, "/REM/Refuse/Ring1or2", STAMUNIT_OCCURENCES, "Raw mode refused because of ring 1/2 execution");
355	STAM_REG(pVM, &gStatRefuseCanExecute, STAMTYPE_COUNTER, "/REM/Refuse/CanExecuteRaw", STAMUNIT_OCCURENCES, "Raw mode refused because of cCanExecuteRaw");
356
357	STAM_REG(pVM, &gStatREMGDTChange, STAMTYPE_COUNTER, "/REM/Change/GDTBase", STAMUNIT_OCCURENCES, "GDT base changes");
358	STAM_REG(pVM, &gStatREMLDTRChange, STAMTYPE_COUNTER, "/REM/Change/LDTR", STAMUNIT_OCCURENCES, "LDTR changes");
359	STAM_REG(pVM, &gStatREMIDTChange, STAMTYPE_COUNTER, "/REM/Change/IDTBase", STAMUNIT_OCCURENCES, "IDT base changes");
360	STAM_REG(pVM, &gStatREMTRChange, STAMTYPE_COUNTER, "/REM/Change/TR", STAMUNIT_OCCURENCES, "TR selector changes");
361
362	STAM_REG(pVM, &gStatSelOutOfSync[0], STAMTYPE_COUNTER, "/REM/State/SelOutOfSync/ES", STAMUNIT_OCCURENCES, "ES out of sync");
363	STAM_REG(pVM, &gStatSelOutOfSync[1], STAMTYPE_COUNTER, "/REM/State/SelOutOfSync/CS", STAMUNIT_OCCURENCES, "CS out of sync");
364	STAM_REG(pVM, &gStatSelOutOfSync[2], STAMTYPE_COUNTER, "/REM/State/SelOutOfSync/SS", STAMUNIT_OCCURENCES, "SS out of sync");
365	STAM_REG(pVM, &gStatSelOutOfSync[3], STAMTYPE_COUNTER, "/REM/State/SelOutOfSync/DS", STAMUNIT_OCCURENCES, "DS out of sync");
366	STAM_REG(pVM, &gStatSelOutOfSync[4], STAMTYPE_COUNTER, "/REM/State/SelOutOfSync/FS", STAMUNIT_OCCURENCES, "FS out of sync");
367	STAM_REG(pVM, &gStatSelOutOfSync[5], STAMTYPE_COUNTER, "/REM/State/SelOutOfSync/GS", STAMUNIT_OCCURENCES, "GS out of sync");
368
369	STAM_REG(pVM, &gStatSelOutOfSyncStateBack[0], STAMTYPE_COUNTER, "/REM/StateBack/SelOutOfSync/ES", STAMUNIT_OCCURENCES, "ES out of sync");
370	STAM_REG(pVM, &gStatSelOutOfSyncStateBack[1], STAMTYPE_COUNTER, "/REM/StateBack/SelOutOfSync/CS", STAMUNIT_OCCURENCES, "CS out of sync");
371	STAM_REG(pVM, &gStatSelOutOfSyncStateBack[2], STAMTYPE_COUNTER, "/REM/StateBack/SelOutOfSync/SS", STAMUNIT_OCCURENCES, "SS out of sync");
372	STAM_REG(pVM, &gStatSelOutOfSyncStateBack[3], STAMTYPE_COUNTER, "/REM/StateBack/SelOutOfSync/DS", STAMUNIT_OCCURENCES, "DS out of sync");
373	STAM_REG(pVM, &gStatSelOutOfSyncStateBack[4], STAMTYPE_COUNTER, "/REM/StateBack/SelOutOfSync/FS", STAMUNIT_OCCURENCES, "FS out of sync");
374	STAM_REG(pVM, &gStatSelOutOfSyncStateBack[5], STAMTYPE_COUNTER, "/REM/StateBack/SelOutOfSync/GS", STAMUNIT_OCCURENCES, "GS out of sync");
375
376	#endif
377	return rc;
378	}
379
380
381	/**
382	* Terminates the REM.
383	*
384	* Termination means cleaning up and freeing all resources,
385	* the VM it self is at this point powered off or suspended.
386	*
387	* @returns VBox status code.
388	* @param pVM The VM to operate on.
389	*/
390	REMR3DECL(int) REMR3Term(PVM pVM)
391	{
392	return VINF_SUCCESS;
393	}
394
395
396	/**
397	* The VM is being reset.
398	*
399	* For the REM component this means to call the cpu_reset() and
400	* reinitialize some state variables.
401	*
402	* @param pVM VM handle.
403	*/
404	REMR3DECL(void) REMR3Reset(PVM pVM)
405	{
406	pVM->rem.s.fIgnoreCR3Load = true;
407	pVM->rem.s.fIgnoreInvlPg = true;
408	pVM->rem.s.fIgnoreCpuMode = true;
409
410	/*
411	* Reset the REM cpu.
412	*/
413	cpu_reset(&pVM->rem.s.Env);
414	pVM->rem.s.cInvalidatedPages = 0;
415
416	pVM->rem.s.fIgnoreCR3Load = false;
417	pVM->rem.s.fIgnoreInvlPg = false;
418	pVM->rem.s.fIgnoreCpuMode = false;
419
420	#ifdef PGM_DYNAMIC_RAM_ALLOC
421	pVM->rem.s.cPhysRegistrations = 0;
422	#endif
423	}
424
425
426	/**
427	* Execute state save operation.
428	*
429	* @returns VBox status code.
430	* @param pVM VM Handle.
431	* @param pSSM SSM operation handle.
432	*/
433	static DECLCALLBACK(int) remR3Save(PVM pVM, PSSMHANDLE pSSM)
434	{
435	LogFlow(("remR3Save:\n"));
436
437	/*
438	* Save the required CPU Env bits.
439	* (Not much because we're never in REM when doing the save.)
440	*/
441	PREM pRem = &pVM->rem.s;
442	Assert(!pRem->fInREM);
443	SSMR3PutU32(pSSM, pRem->Env.hflags);
444	SSMR3PutMem(pSSM, &pRem->Env, RT_OFFSETOF(CPUState, jmp_env));
445	SSMR3PutU32(pSSM, ~0); /* separator */
446
447	/*
448	* Save the REM stuff.
449	*/
450	SSMR3PutUInt(pSSM, pRem->cInvalidatedPages);
451	unsigned i;
452	for (i = 0; i < pRem->cInvalidatedPages; i++)
453	SSMR3PutGCPtr(pSSM, pRem->aGCPtrInvalidatedPages[i]);
454
455	SSMR3PutUInt(pSSM, pVM->rem.s.u32PendingInterrupt);
456
457	return SSMR3PutU32(pSSM, ~0); /* terminator */
458	}
459
460
461	/**
462	* Execute state load operation.
463	*
464	* @returns VBox status code.
465	* @param pVM VM Handle.
466	* @param pSSM SSM operation handle.
467	* @param u32Version Data layout version.
468	*/
469	static DECLCALLBACK(int) remR3Load(PVM pVM, PSSMHANDLE pSSM, uint32_t u32Version)
470	{
471	uint32_t u32Dummy;
472	LogFlow(("remR3Load:\n"));
473
474	/*
475	* Validate version.
476	*/
477	if (u32Version != REM_SAVED_STATE_VERSION)
478	{
479	Log(("remR3Load: Invalid version u32Version=%d!\n", u32Version));
480	return VERR_SSM_UNSUPPORTED_DATA_UNIT_VERSION;
481	}
482
483	/*
484	* Do a reset to be on the safe side...
485	*/
486	REMR3Reset(pVM);
487
488	/*
489	* Ignore all ignorable notifications.
490	* Not doing this will cause big trouble.
491	*/
492	pVM->rem.s.fIgnoreCR3Load = true;
493	pVM->rem.s.fIgnoreInvlPg = true;
494	pVM->rem.s.fIgnoreCpuMode = true;
495
496	/*
497	* Load the required CPU Env bits.
498	* (Not much because we're never in REM when doing the save.)
499	*/
500	PREM pRem = &pVM->rem.s;
501	Assert(!pRem->fInREM);
502	SSMR3GetU32(pSSM, &pRem->Env.hflags);
503	SSMR3GetMem(pSSM, &pRem->Env, RT_OFFSETOF(CPUState, jmp_env));
504	uint32_t u32Sep;
505	int rc = SSMR3GetU32(pSSM, &u32Sep); /* separator */
506	if (VBOX_FAILURE(rc))
507	return rc;
508	if (u32Sep != ~0)
509	{
510	AssertMsgFailed(("u32Sep=%#x\n", u32Sep));
511	return VERR_SSM_DATA_UNIT_FORMAT_CHANGED;
512	}
513
514	/*
515	* Load the REM stuff.
516	*/
517	rc = SSMR3GetUInt(pSSM, &pRem->cInvalidatedPages);
518	if (VBOX_FAILURE(rc))
519	return rc;
520	if (pRem->cInvalidatedPages > ELEMENTS(pRem->aGCPtrInvalidatedPages))
521	{
522	AssertMsgFailed(("cInvalidatedPages=%#x\n", pRem->cInvalidatedPages));
523	return VERR_SSM_DATA_UNIT_FORMAT_CHANGED;
524	}
525	unsigned i;
526	for (i = 0; i < pRem->cInvalidatedPages; i++)
527	SSMR3GetGCPtr(pSSM, &pRem->aGCPtrInvalidatedPages[i]);
528
529	rc = SSMR3GetUInt(pSSM, &pVM->rem.s.u32PendingInterrupt);
530	if (VBOX_FAILURE(rc))
531	return rc;
532
533	/* check the terminator. */
534	rc = SSMR3GetU32(pSSM, &u32Sep);
535	if (VBOX_FAILURE(rc))
536	return rc;
537	if (u32Sep != ~0)
538	{
539	AssertMsgFailed(("u32Sep=%#x (term)\n", u32Sep));
540	return VERR_SSM_DATA_UNIT_FORMAT_CHANGED;
541	}
542
543	/*
544	* Get the CPUID features.
545	*/
546	CPUMGetGuestCpuId(pVM, 1, &u32Dummy, &u32Dummy, &pVM->rem.s.Env.cpuid_ext_features, &pVM->rem.s.Env.cpuid_features);
547
548	/*
549	* Sync the Load Flush the TLB
550	*/
551	tlb_flush(&pRem->Env, 1);
552
553	#if 0 /** @todo r=bird: this doesn't make sense. WHY? */
554	/*
555	* Clear all lazy flags (only FPU sync for now).
556	*/
557	CPUMGetAndClearFPUUsedREM(pVM);
558	#endif
559
560	/*
561	* Stop ignoring ignornable notifications.
562	*/
563	pVM->rem.s.fIgnoreCpuMode = false;
564	pVM->rem.s.fIgnoreInvlPg = false;
565	pVM->rem.s.fIgnoreCR3Load = false;
566
567	return VINF_SUCCESS;
568	}
569
570
571
572	#undef LOG_GROUP
573	#define LOG_GROUP LOG_GROUP_REM_RUN
574
575	/**
576	* Single steps an instruction in recompiled mode.
577	*
578	* Before calling this function the REM state needs to be in sync with
579	* the VM. Call REMR3State() to perform the sync. It's only necessary
580	* (and permitted) to sync at the first call to REMR3Step()/REMR3Run()
581	* and after calling REMR3StateBack().
582	*
583	* @returns VBox status code.
584	*
585	* @param pVM VM Handle.
586	*/
587	REMR3DECL(int) REMR3Step(PVM pVM)
588	{
589	/*
590	* Lock the REM - we don't wanna have anyone interrupting us
591	* while stepping - and enabled single stepping. We also ignore
592	* pending interrupts and suchlike.
593	*/
594	int interrupt_request = pVM->rem.s.Env.interrupt_request;
595	Assert(!(interrupt_request & ~(CPU_INTERRUPT_HARD \| CPU_INTERRUPT_EXIT \| CPU_INTERRUPT_EXITTB \| CPU_INTERRUPT_TIMER \| CPU_INTERRUPT_EXTERNAL_HARD \| CPU_INTERRUPT_EXTERNAL_EXIT \| CPU_INTERRUPT_EXTERNAL_TIMER)));
596	pVM->rem.s.Env.interrupt_request = 0;
597	cpu_single_step(&pVM->rem.s.Env, 1);
598
599	/*
600	* If we're standing at a breakpoint, that have to be disabled before we start stepping.
601	*/
602	RTGCPTR GCPtrPC = pVM->rem.s.Env.eip + pVM->rem.s.Env.segs[R_CS].base;
603	bool fBp = !cpu_breakpoint_remove(&pVM->rem.s.Env, GCPtrPC);
604
605	/*
606	* Execute and handle the return code.
607	* We execute without enabling the cpu tick, so on success we'll
608	* just flip it on and off to make sure it moves
609	*/
610	int rc = cpu_exec(&pVM->rem.s.Env);
611	if (rc == EXCP_DEBUG)
612	{
613	TMCpuTickResume(pVM);
614	TMCpuTickPause(pVM);
615	TMVirtualResume(pVM);
616	TMVirtualPause(pVM);
617	rc = VINF_EM_DBG_STEPPED;
618	}
619	else
620	{
621	AssertMsgFailed(("Damn, this shouldn't happen! cpu_exec returned %d while singlestepping\n", rc));
622	switch (rc)
623	{
624	case EXCP_INTERRUPT: rc = VINF_SUCCESS; break;
625	case EXCP_HLT: rc = VINF_EM_HALT; break;
626	case EXCP_RC:
627	rc = pVM->rem.s.rc;
628	pVM->rem.s.rc = VERR_INTERNAL_ERROR;
629	break;
630	default:
631	AssertReleaseMsgFailed(("This really shouldn't happen, rc=%d!\n", rc));
632	rc = VERR_INTERNAL_ERROR;
633	break;
634	}
635	}
636
637	/*
638	* Restore the stuff we changed to prevent interruption.
639	* Unlock the REM.
640	*/
641	if (fBp)
642	{
643	int rc2 = cpu_breakpoint_insert(&pVM->rem.s.Env, GCPtrPC);
644	Assert(rc2 == 0); NOREF(rc2);
645	}
646	cpu_single_step(&pVM->rem.s.Env, 0);
647	pVM->rem.s.Env.interrupt_request = interrupt_request;
648
649	return rc;
650	}
651
652
653	/**
654	* Set a breakpoint using the REM facilities.
655	*
656	* @returns VBox status code.
657	* @param pVM The VM handle.
658	* @param Address The breakpoint address.
659	* @thread The emulation thread.
660	*/
661	REMR3DECL(int) REMR3BreakpointSet(PVM pVM, RTGCUINTPTR Address)
662	{
663	VM_ASSERT_EMT(pVM);
664	if (!cpu_breakpoint_insert(&pVM->rem.s.Env, Address))
665	{
666	LogFlow(("REMR3BreakpointSet: Address=%VGv\n", Address));
667	return VINF_SUCCESS;
668	}
669	LogFlow(("REMR3BreakpointSet: Address=%VGv - failed!\n", Address));
670	return VERR_REM_NO_MORE_BP_SLOTS;
671	}
672
673
674	/**
675	* Clears a breakpoint set by REMR3BreakpointSet().
676	*
677	* @returns VBox status code.
678	* @param pVM The VM handle.
679	* @param Address The breakpoint address.
680	* @thread The emulation thread.
681	*/
682	REMR3DECL(int) REMR3BreakpointClear(PVM pVM, RTGCUINTPTR Address)
683	{
684	VM_ASSERT_EMT(pVM);
685	if (!cpu_breakpoint_remove(&pVM->rem.s.Env, Address))
686	{
687	LogFlow(("REMR3BreakpointClear: Address=%VGv\n", Address));
688	return VINF_SUCCESS;
689	}
690	LogFlow(("REMR3BreakpointClear: Address=%VGv - not found!\n", Address));
691	return VERR_REM_BP_NOT_FOUND;
692	}
693
694
695	/**
696	* Emulate an instruction.
697	*
698	* This function executes one instruction without letting anyone
699	* interrupt it. This is intended for being called while being in
700	* raw mode and thus will take care of all the state syncing between
701	* REM and the rest.
702	*
703	* @returns VBox status code.
704	* @param pVM VM handle.
705	*/
706	REMR3DECL(int) REMR3EmulateInstruction(PVM pVM)
707	{
708	Log2(("REMR3EmulateInstruction: (cs:eip=%04x:%08x)\n", pVM->rem.s.Env.segs[R_CS].selector, pVM->rem.s.Env.eip));
709
710	/*
711	* Sync the state and enable single instruction / single stepping.
712	*/
713	int rc = REMR3State(pVM);
714	if (VBOX_SUCCESS(rc))
715	{
716	int interrupt_request = pVM->rem.s.Env.interrupt_request;
717	Assert(!(interrupt_request & ~(CPU_INTERRUPT_HARD \| CPU_INTERRUPT_EXIT \| CPU_INTERRUPT_EXITTB \| CPU_INTERRUPT_TIMER \| CPU_INTERRUPT_EXTERNAL_HARD \| CPU_INTERRUPT_EXTERNAL_EXIT \| CPU_INTERRUPT_EXTERNAL_TIMER)));
718	Assert(!pVM->rem.s.Env.singlestep_enabled);
719	#if 1
720
721	/*
722	* Now we set the execute single instruction flag and enter the cpu_exec loop.
723	*/
724	pVM->rem.s.Env.interrupt_request = CPU_INTERRUPT_SINGLE_INSTR;
725	TMCpuTickResume(pVM);
726	rc = cpu_exec(&pVM->rem.s.Env);
727	TMCpuTickPause(pVM);
728	switch (rc)
729	{
730	/*
731	* Executed without anything out of the way happening.
732	*/
733	case EXCP_SINGLE_INSTR:
734	rc = VINF_EM_RESCHEDULE;
735	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_SINGLE_INSTR\n"));
736	break;
737
738	/*
739	* If we take a trap or start servicing a pending interrupt, we might end up here.
740	* (Timer thread or some other thread wishing EMT's attention.)
741	*/
742	case EXCP_INTERRUPT:
743	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_INTERRUPT\n"));
744	rc = VINF_EM_RESCHEDULE;
745	break;
746
747	/*
748	* Single step, we assume!
749	* If there was a breakpoint there we're fucked now.
750	*/
751	case EXCP_DEBUG:
752	{
753	/* breakpoint or single step? */
754	RTGCPTR GCPtrPC = pVM->rem.s.Env.eip + pVM->rem.s.Env.segs[R_CS].base;
755	int iBP;
756	rc = VINF_EM_DBG_STEPPED;
757	for (iBP = 0; iBP < pVM->rem.s.Env.nb_breakpoints; iBP++)
758	if (pVM->rem.s.Env.breakpoints[iBP] == GCPtrPC)
759	{
760	rc = VINF_EM_DBG_BREAKPOINT;
761	break;
762	}
763	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_DEBUG rc=%Vrc iBP=%d GCPtrPC=%VGv\n", rc, iBP, GCPtrPC));
764	break;
765	}
766
767	/*
768	* hlt instruction.
769	*/
770	case EXCP_HLT:
771	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_HLT\n"));
772	rc = VINF_EM_HALT;
773	break;
774
775	/*
776	* Switch to RAW-mode.
777	*/
778	case EXCP_EXECUTE_RAW:
779	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_EXECUTE_RAW\n"));
780	rc = VINF_EM_RESCHEDULE_RAW;
781	break;
782
783	/*
784	* Switch to hardware accelerated RAW-mode.
785	*/
786	case EXCP_EXECUTE_HWACC:
787	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_EXECUTE_HWACC\n"));
788	rc = VINF_EM_RESCHEDULE_HWACC;
789	break;
790
791	/*
792	* An EM RC was raised (VMR3Reset/Suspend/PowerOff).
793	*/
794	case EXCP_RC:
795	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_RC\n"));
796	rc = pVM->rem.s.rc;
797	pVM->rem.s.rc = VERR_INTERNAL_ERROR;
798	break;
799
800	/*
801	* Figure out the rest when they arrive....
802	*/
803	default:
804	AssertMsgFailed(("rc=%d\n", rc));
805	Log2(("REMR3EmulateInstruction: cpu_exec -> %d\n", rc));
806	rc = VINF_EM_RESCHEDULE;
807	break;
808	}
809
810	/*
811	* Switch back the state.
812	*/
813	#else
814	pVM->rem.s.Env.interrupt_request = 0;
815	cpu_single_step(&pVM->rem.s.Env, 1);
816
817	/*
818	* Execute and handle the return code.
819	* We execute without enabling the cpu tick, so on success we'll
820	* just flip it on and off to make sure it moves.
821	*
822	* (We do not use emulate_single_instr() because that doesn't enter the
823	* right way in will cause serious trouble if a longjmp was attempted.)
824	*/
825	#ifdef DEBUG_bird
826	remR3DisasInstr(&pVM->rem.s.Env, 1, "REMR3EmulateInstruction");
827	#endif
828	int cTimesMax = 16384;
829	uint32_t eip = pVM->rem.s.Env.eip;
830	do
831	{
832	TMCpuTickResume(pVM);
833	rc = cpu_exec(&pVM->rem.s.Env);
834	TMCpuTickPause(pVM);
835
836	} while ( eip == pVM->rem.s.Env.eip
837	&& (rc == EXCP_DEBUG \|\| rc == EXCP_EXECUTE_RAW)
838	&& --cTimesMax > 0);
839	switch (rc)
840	{
841	/*
842	* Single step, we assume!
843	* If there was a breakpoint there we're fucked now.
844	*/
845	case EXCP_DEBUG:
846	{
847	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_DEBUG\n"));
848	rc = VINF_EM_RESCHEDULE;
849	break;
850	}
851
852	/*
853	* We cannot be interrupted!
854	*/
855	case EXCP_INTERRUPT:
856	AssertMsgFailed(("Shouldn't happen! Everything was locked!\n"));
857	rc = VERR_INTERNAL_ERROR;
858	break;
859
860	/*
861	* hlt instruction.
862	*/
863	case EXCP_HLT:
864	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_HLT\n"));
865	rc = VINF_EM_HALT;
866	break;
867
868	/*
869	* Switch to RAW-mode.
870	*/
871	case EXCP_EXECUTE_RAW:
872	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_EXECUTE_RAW\n"));
873	rc = VINF_EM_RESCHEDULE_RAW;
874	break;
875
876	/*
877	* Switch to hardware accelerated RAW-mode.
878	*/
879	case EXCP_EXECUTE_HWACC:
880	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_EXECUTE_HWACC\n"));
881	rc = VINF_EM_RESCHEDULE_HWACC;
882	break;
883
884	/*
885	* An EM RC was raised (VMR3Reset/Suspend/PowerOff).
886	*/
887	case EXCP_RC:
888	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_RC rc=%Vrc\n", pVM->rem.s.rc));
889	rc = pVM->rem.s.rc;
890	pVM->rem.s.rc = VERR_INTERNAL_ERROR;
891	break;
892
893	/*
894	* Figure out the rest when they arrive....
895	*/
896	default:
897	AssertMsgFailed(("rc=%d\n", rc));
898	Log2(("REMR3EmulateInstruction: cpu_exec -> %d\n", rc));
899	rc = VINF_SUCCESS;
900	break;
901	}
902
903	/*
904	* Switch back the state.
905	*/
906	cpu_single_step(&pVM->rem.s.Env, 0);
907	#endif
908	pVM->rem.s.Env.interrupt_request = interrupt_request;
909	int rc2 = REMR3StateBack(pVM);
910	AssertRC(rc2);
911	}
912
913	Log2(("REMR3EmulateInstruction: returns %Vrc (cs:eip=%04x:%08x)\n",
914	rc, pVM->rem.s.Env.segs[R_CS].selector, pVM->rem.s.Env.eip));
915	return rc;
916	}
917
918
919	/**
920	* Runs code in recompiled mode.
921	*
922	* Before calling this function the REM state needs to be in sync with
923	* the VM. Call REMR3State() to perform the sync. It's only necessary
924	* (and permitted) to sync at the first call to REMR3Step()/REMR3Run()
925	* and after calling REMR3StateBack().
926	*
927	* @returns VBox status code.
928	*
929	* @param pVM VM Handle.
930	*/
931	REMR3DECL(int) REMR3Run(PVM pVM)
932	{
933	Log2(("REMR3Run: (cs:eip=%04x:%08x)\n", pVM->rem.s.Env.segs[R_CS].selector, pVM->rem.s.Env.eip));
934	Assert(pVM->rem.s.fInREM);
935	////Keyboard / tb stuff:
936	//if ( pVM->rem.s.Env.segs[R_CS].selector == 0xf000
937	// && pVM->rem.s.Env.eip >= 0xe860
938	// && pVM->rem.s.Env.eip <= 0xe880)
939	// pVM->rem.s.Env.state \|= CPU_EMULATE_SINGLE_STEP;
940	////A20:
941	//if ( pVM->rem.s.Env.segs[R_CS].selector == 0x9020
942	// && pVM->rem.s.Env.eip >= 0x970
943	// && pVM->rem.s.Env.eip <= 0x9a0)
944	// pVM->rem.s.Env.state \|= CPU_EMULATE_SINGLE_STEP;
945	////Speaker (port 61h)
946	//if ( pVM->rem.s.Env.segs[R_CS].selector == 0x0010
947	// && ( (pVM->rem.s.Env.eip >= 0x90278c10 && pVM->rem.s.Env.eip <= 0x90278c30)
948	// \|\| (pVM->rem.s.Env.eip >= 0x9010e250 && pVM->rem.s.Env.eip <= 0x9010e260)
949	// )
950	// )
951	// pVM->rem.s.Env.state \|= CPU_EMULATE_SINGLE_STEP;
952	//DBGFR3InfoLog(pVM, "timers", NULL);
953
954
955	TMCpuTickResume(pVM);
956	int rc = cpu_exec(&pVM->rem.s.Env);
957	TMCpuTickPause(pVM);
958	switch (rc)
959	{
960	/*
961	* This happens when the execution was interrupted
962	* by an external event, like pending timers.
963	*/
964	case EXCP_INTERRUPT:
965	Log2(("REMR3Run: cpu_exec -> EXCP_INTERRUPT\n"));
966	rc = VINF_SUCCESS;
967	break;
968
969	/*
970	* hlt instruction.
971	*/
972	case EXCP_HLT:
973	Log2(("REMR3Run: cpu_exec -> EXCP_HLT\n"));
974	rc = VINF_EM_HALT;
975	break;
976
977	/*
978	* Breakpoint/single step.
979	*/
980	case EXCP_DEBUG:
981	{
982	#if 0//def DEBUG_bird
983	static int iBP = 0;
984	printf("howdy, breakpoint! iBP=%d\n", iBP);
985	switch (iBP)
986	{
987	case 0:
988	cpu_breakpoint_remove(&pVM->rem.s.Env, pVM->rem.s.Env.eip + pVM->rem.s.Env.segs[R_CS].base);
989	pVM->rem.s.Env.state \|= CPU_EMULATE_SINGLE_STEP;
990	//pVM->rem.s.Env.interrupt_request = 0;
991	//pVM->rem.s.Env.exception_index = -1;
992	//g_fInterruptDisabled = 1;
993	rc = VINF_SUCCESS;
994	asm("int3");
995	break;
996	default:
997	asm("int3");
998	break;
999	}
1000	iBP++;
1001	#else
1002	/* breakpoint or single step? */
1003	RTGCPTR GCPtrPC = pVM->rem.s.Env.eip + pVM->rem.s.Env.segs[R_CS].base;
1004	int iBP;
1005	rc = VINF_EM_DBG_STEPPED;
1006	for (iBP = 0; iBP < pVM->rem.s.Env.nb_breakpoints; iBP++)
1007	if (pVM->rem.s.Env.breakpoints[iBP] == GCPtrPC)
1008	{
1009	rc = VINF_EM_DBG_BREAKPOINT;
1010	break;
1011	}
1012	Log2(("REMR3Run: cpu_exec -> EXCP_DEBUG rc=%Vrc iBP=%d GCPtrPC=%VGv\n", rc, iBP, GCPtrPC));
1013	#endif
1014	break;
1015	}
1016
1017	/*
1018	* Switch to RAW-mode.
1019	*/
1020	case EXCP_EXECUTE_RAW:
1021	Log2(("REMR3Run: cpu_exec -> EXCP_EXECUTE_RAW\n"));
1022	rc = VINF_EM_RESCHEDULE_RAW;
1023	break;
1024
1025	/*
1026	* Switch to hardware accelerated RAW-mode.
1027	*/
1028	case EXCP_EXECUTE_HWACC:
1029	Log2(("REMR3EmulateInstruction: cpu_exec -> EXCP_EXECUTE_HWACC\n"));
1030	rc = VINF_EM_RESCHEDULE_HWACC;
1031	break;
1032
1033	/*
1034	* An EM RC was raised (VMR3Reset/Suspend/PowerOff).
1035	*/
1036	case EXCP_RC:
1037	Log2(("REMR3Run: cpu_exec -> EXCP_RC rc=%Vrc\n", pVM->rem.s.rc));
1038	rc = pVM->rem.s.rc;
1039	pVM->rem.s.rc = VERR_INTERNAL_ERROR;
1040	break;
1041
1042	/*
1043	* Figure out the rest when they arrive....
1044	*/
1045	default:
1046	AssertMsgFailed(("rc=%d\n", rc));
1047	Log2(("REMR3Run: cpu_exec -> %d\n", rc));
1048	rc = VINF_SUCCESS;
1049	break;
1050	}
1051
1052	Log2(("REMR3Run: returns %Vrc (cs:eip=%04x:%08x)\n", rc, pVM->rem.s.Env.segs[R_CS].selector, pVM->rem.s.Env.eip));
1053	return rc;
1054	}
1055
1056
1057	/**
1058	* Check if the cpu state is suitable for Raw execution.
1059	*
1060	* @returns boolean
1061	* @param env The CPU env struct.
1062	* @param eip The EIP to check this for (might differ from env->eip).
1063	* @param fFlags hflags OR'ed with IOPL, TF and VM from eflags.
1064	* @param pExceptionIndex Stores EXCP_EXECUTE_RAW/HWACC in case raw mode is supported in this context
1065	*
1066	* @remark This function must be kept in perfect sync with the scheduler in EM.cpp!
1067	*/
1068	bool remR3CanExecuteRaw(CPUState env, RTGCPTR eip, unsigned fFlags, uint32_t pExceptionIndex)
1069	{
1070	/* !!! THIS MUST BE IN SYNC WITH emR3Reschedule !!! */
1071	/* !!! THIS MUST BE IN SYNC WITH emR3Reschedule !!! */
1072	/* !!! THIS MUST BE IN SYNC WITH emR3Reschedule !!! */
1073
1074	/* Update counter. */
1075	env->pVM->rem.s.cCanExecuteRaw++;
1076
1077	if (HWACCMIsEnabled(env->pVM))
1078	{
1079	env->state \|= CPU_RAW_HWACC;
1080
1081	/*
1082	* Create partial context for HWACCMR3CanExecuteGuest
1083	*/
1084	CPUMCTX Ctx;
1085	Ctx.cr0 = env->cr[0];
1086	Ctx.cr3 = env->cr[3];
1087	Ctx.cr4 = env->cr[4];
1088
1089	Ctx.tr = env->tr.selector;
1090	Ctx.trHid.u32Base = (uint32_t)env->tr.base;
1091	Ctx.trHid.u32Limit = env->tr.limit;
1092	Ctx.trHid.Attr.u = (env->tr.flags >> 8) & 0xF0FF;
1093
1094	Ctx.idtr.cbIdt = env->idt.limit;
1095	Ctx.idtr.pIdt = (uint32_t)env->idt.base;
1096
1097	Ctx.eflags.u32 = env->eflags;
1098
1099	Ctx.cs = env->segs[R_CS].selector;
1100	Ctx.csHid.u32Base = (uint32_t)env->segs[R_CS].base;
1101	Ctx.csHid.u32Limit = env->segs[R_CS].limit;
1102	Ctx.csHid.Attr.u = (env->segs[R_CS].flags >> 8) & 0xF0FF;
1103
1104	Ctx.ss = env->segs[R_SS].selector;
1105	Ctx.ssHid.u32Base = (uint32_t)env->segs[R_SS].base;
1106	Ctx.ssHid.u32Limit = env->segs[R_SS].limit;
1107	Ctx.ssHid.Attr.u = (env->segs[R_SS].flags >> 8) & 0xF0FF;
1108
1109	/* Hardware accelerated raw-mode:
1110	*
1111	* Typically only 32-bits protected mode, with paging enabled, code is allowed here.
1112	*/
1113	if (HWACCMR3CanExecuteGuest(env->pVM, &Ctx) == true)
1114	{
1115	*pExceptionIndex = EXCP_EXECUTE_HWACC;
1116	return true;
1117	}
1118	return false;
1119	}
1120
1121	/*
1122	* Here we only support 16 & 32 bits protected mode ring 3 code that has no IO privileges
1123	* or 32 bits protected mode ring 0 code
1124	*
1125	* The tests are ordered by the likelyhood of being true during normal execution.
1126	*/
1127	if (fFlags & (HF_TF_MASK \| HF_INHIBIT_IRQ_MASK))
1128	{
1129	STAM_COUNTER_INC(&gStatRefuseTFInhibit);
1130	Log2(("raw mode refused: fFlags=%#x\n", fFlags));
1131	return false;
1132	}
1133
1134	#ifndef VBOX_RAW_V86
1135	if (fFlags & VM_MASK) {
1136	STAM_COUNTER_INC(&gStatRefuseVM86);
1137	Log2(("raw mode refused: VM_MASK\n"));
1138	return false;
1139	}
1140	#endif
1141
1142	if (env->state & CPU_EMULATE_SINGLE_INSTR)
1143	{
1144	#ifndef DEBUG_bird
1145	Log2(("raw mode refused: CPU_EMULATE_SINGLE_INSTR\n"));
1146	#endif
1147	return false;
1148	}
1149
1150	if (env->singlestep_enabled)
1151	{
1152	//Log2(("raw mode refused: Single step\n"));
1153	return false;
1154	}
1155
1156	if (env->nb_breakpoints > 0)
1157	{
1158	//Log2(("raw mode refused: Breakpoints\n"));
1159	return false;
1160	}
1161
1162	uint32_t u32CR0 = env->cr[0];
1163	if ((u32CR0 & (X86_CR0_PG \| X86_CR0_PE)) != (X86_CR0_PG \| X86_CR0_PE))
1164	{
1165	STAM_COUNTER_INC(&gStatRefusePaging);
1166	//Log2(("raw mode refused: %s%s%s\n", (u32CR0 & X86_CR0_PG) ? "" : " !PG", (u32CR0 & X86_CR0_PE) ? "" : " !PE", (u32CR0 & X86_CR0_AM) ? "" : " !AM"));
1167	return false;
1168	}
1169
1170	if (env->cr[4] & CR4_PAE_MASK)
1171	{
1172	STAM_COUNTER_INC(&gStatRefusePAE);
1173	//Log2(("raw mode refused: PAE\n"));
1174	return false;
1175	}
1176
1177	if (((fFlags >> HF_CPL_SHIFT) & 3) == 3)
1178	{
1179	if (!EMIsRawRing3Enabled(env->pVM))
1180	return false;
1181
1182	if (!(env->eflags & IF_MASK))
1183	{
1184	#ifdef VBOX_RAW_V86
1185	if(!(fFlags & VM_MASK))
1186	return false;
1187	#else
1188	STAM_COUNTER_INC(&gStatRefuseIF0);
1189	Log2(("raw mode refused: IF (RawR3)\n"));
1190	return false;
1191	#endif
1192	}
1193
1194	if (!(u32CR0 & CR0_WP_MASK) && EMIsRawRing0Enabled(env->pVM))
1195	{
1196	STAM_COUNTER_INC(&gStatRefuseWP0);
1197	Log2(("raw mode refused: CR0.WP + RawR0\n"));
1198	return false;
1199	}
1200	}
1201	else
1202	{
1203	if (!EMIsRawRing0Enabled(env->pVM))
1204	return false;
1205
1206	// Let's start with pure 32 bits ring 0 code first
1207	if ((fFlags & (HF_SS32_MASK \| HF_CS32_MASK)) != (HF_SS32_MASK \| HF_CS32_MASK))
1208	{
1209	STAM_COUNTER_INC(&gStatRefuseCode16);
1210	Log2(("raw r0 mode refused: HF_[S\|C]S32_MASK fFlags=%#x\n", fFlags));
1211	return false;
1212	}
1213
1214	// Only R0
1215	if (((fFlags >> HF_CPL_SHIFT) & 3) != 0)
1216	{
1217	STAM_COUNTER_INC(&gStatRefuseRing1or2);
1218	Log2(("raw r0 mode refused: CPL %d\n", ((fFlags >> HF_CPL_SHIFT) & 3) ));
1219	return false;
1220	}
1221
1222	if (!(u32CR0 & CR0_WP_MASK))
1223	{
1224	STAM_COUNTER_INC(&gStatRefuseWP0);
1225	Log2(("raw r0 mode refused: CR0.WP=0!\n"));
1226	return false;
1227	}
1228
1229	if (PATMIsPatchGCAddr(env->pVM, eip))
1230	{
1231	Log2(("raw r0 mode forced: patch code\n"));
1232	*pExceptionIndex = EXCP_EXECUTE_RAW;
1233	return true;
1234	}
1235
1236	#if !defined(VBOX_ALLOW_IF0) && !defined(VBOX_RUN_INTERRUPT_GATE_HANDLERS)
1237	if (!(env->eflags & IF_MASK))
1238	{
1239	STAM_COUNTER_INC(&gStatRefuseIF0);
1240	////Log2(("R0: IF=0 VIF=%d %08X\n", eip, *env->pVMeflags));
1241	//Log2(("RR0: Interrupts turned off; fall back to emulation\n"));
1242	return false;
1243	}
1244	#endif
1245
1246	env->state \|= CPU_RAW_RING0;
1247	}
1248
1249	/*
1250	* Don't reschedule the first time we're called, because there might be
1251	* special reasons why we're here that is not covered by the above checks.
1252	*/
1253	if (env->pVM->rem.s.cCanExecuteRaw == 1)
1254	{
1255	Log2(("raw mode refused: first scheduling\n"));
1256	STAM_COUNTER_INC(&gStatRefuseCanExecute);
1257	return false;
1258	}
1259
1260	Assert(PGMPhysIsA20Enabled(env->pVM));
1261	*pExceptionIndex = EXCP_EXECUTE_RAW;
1262	return true;
1263	}
1264
1265
1266	/**
1267	* Fetches a code byte.
1268	*
1269	* @returns Success indicator (bool) for ease of use.
1270	* @param env The CPU environment structure.
1271	* @param GCPtrInstr Where to fetch code.
1272	* @param pu8Byte Where to store the byte on success
1273	*/
1274	bool remR3GetOpcode(CPUState env, RTGCPTR GCPtrInstr, uint8_t pu8Byte)
1275	{
1276	int rc = PATMR3QueryOpcode(env->pVM, GCPtrInstr, pu8Byte);
1277	if (VBOX_SUCCESS(rc))
1278	return true;
1279	return false;
1280	}
1281
1282
1283	/**
1284	* Flush (or invalidate if you like) page table/dir entry.
1285	*
1286	* (invlpg instruction; tlb_flush_page)
1287	*
1288	* @param env Pointer to cpu environment.
1289	* @param GCPtr The virtual address which page table/dir entry should be invalidated.
1290	*/
1291	void remR3FlushPage(CPUState *env, RTGCPTR GCPtr)
1292	{
1293	PVM pVM = env->pVM;
1294
1295	/*
1296	* When we're replaying invlpg instructions or restoring a saved
1297	* state we disable this path.
1298	*/
1299	if (pVM->rem.s.fIgnoreInvlPg)
1300	return;
1301	Log(("remR3FlushPage: GCPtr=%VGv\n", GCPtr));
1302
1303	//RAWEx_ProfileStop(env, STATS_QEMU_TOTAL);
1304
1305	/*
1306	* Update the control registers before calling PGMFlushPage.
1307	*/
1308	PCPUMCTX pCtx = (PCPUMCTX)pVM->rem.s.pCtx;
1309	pCtx->cr0 = env->cr[0];
1310	pCtx->cr3 = env->cr[3];
1311	pCtx->cr4 = env->cr[4];
1312
1313	/*
1314	* Let PGM do the rest.
1315	*/
1316	int rc = PGMInvalidatePage(pVM, GCPtr);
1317	if (VBOX_FAILURE(rc))
1318	{
1319	AssertMsgFailed(("remR3FlushPage %x %x %x %d failed!!\n", GCPtr));
1320	VM_FF_SET(pVM, VM_FF_PGM_SYNC_CR3);
1321	}
1322	//RAWEx_ProfileStart(env, STATS_QEMU_TOTAL);
1323	}
1324
1325	/**
1326	* Set page table/dir entry. (called from tlb_set_page)
1327	*
1328	* @param env Pointer to cpu environment.
1329	*/
1330	void remR3SetPage(CPUState env, CPUTLBEntry pRead, CPUTLBEntry *pWrite, int prot, int is_user)
1331	{
1332	uint32_t virt_addr, addend;
1333
1334	Log2(("tlb_set_page_raw read (%x-%x) write (%x-%x) prot %x is_user %d\n", pRead->address, pRead->addend, pWrite->address, pWrite->addend, prot, is_user));
1335
1336	if (prot & PAGE_WRITE)
1337	{
1338	addend = pWrite->addend;
1339	virt_addr = pWrite->address;
1340	}
1341	else
1342	if (prot & PAGE_READ)
1343	{
1344	addend = pRead->addend;
1345	virt_addr = pRead->address;
1346	}
1347	else
1348	{
1349	// Should never happen!
1350	AssertMsgFailed(("tlb_set_page_raw unexpected protection flags %x\n", prot));
1351	return;
1352	}
1353
1354	// Clear IO_* flags (TODO: are they actually useful for us??)
1355	virt_addr &= ~0xFFF;
1356
1357	/*
1358	* Update the control registers before calling PGMFlushPage.
1359	*/
1360	PCPUMCTX pCtx = (PCPUMCTX)env->pVM->rem.s.pCtx;
1361	pCtx->cr0 = env->cr[0];
1362	pCtx->cr3 = env->cr[3];
1363	pCtx->cr4 = env->cr[4];
1364
1365	/*
1366	* Let PGM do the rest.
1367	*/
1368	int rc = PGMInvalidatePage(env->pVM, (RTGCPTR)virt_addr);
1369	if (VBOX_FAILURE(rc))
1370	{
1371	AssertMsgFailed(("RAWEx_SetPageEntry %x %x %d failed!!\n", virt_addr, prot, is_user));
1372	VM_FF_SET(env->pVM, VM_FF_PGM_SYNC_CR3);
1373	}
1374	}
1375
1376	/**
1377	* Called from tlb_protect_code in order to write monitor a code page.
1378	*
1379	* @param env Pointer to the CPU environment.
1380	* @param GCPtr Code page to monitor
1381	*/
1382	void remR3ProtectCode(CPUState *env, RTGCPTR GCPtr)
1383	{
1384	if ( (env->cr[0] & X86_CR0_PG) /* paging must be enabled */
1385	&& !(env->state & CPU_EMULATE_SINGLE_INSTR) /* ignore during single instruction execution */
1386	&& (((env->hflags >> HF_CPL_SHIFT) & 3) == 0) /* supervisor mode only */
1387	&& !(env->eflags & VM_MASK) /* no V86 mode */
1388	&& !HWACCMIsEnabled(env->pVM))
1389	CSAMR3MonitorPage(env->pVM, GCPtr, CSAM_TAG_REM);
1390	}
1391
1392	/**
1393	* Called when the CPU is initialized, any of the CRx registers are changed or
1394	* when the A20 line is modified.
1395	*
1396	* @param env Pointer to the CPU environment.
1397	* @param fGlobal Set if the flush is global.
1398	*/
1399	void remR3FlushTLB(CPUState *env, bool fGlobal)
1400	{
1401	PVM pVM = env->pVM;
1402
1403	/*
1404	* When we're replaying invlpg instructions or restoring a saved
1405	* state we disable this path.
1406	*/
1407	if (pVM->rem.s.fIgnoreCR3Load)
1408	return;
1409
1410	/*
1411	* The caller doesn't check cr4, so we have to do that for ourselves.
1412	*/
1413	if (!fGlobal && !(env->cr[4] & X86_CR4_PGE))
1414	fGlobal = true;
1415	Log(("remR3FlushTLB: CR0=%VGp CR3=%VGp CR4=%VGp %s\n", env->cr[0], env->cr[3], env->cr[4], fGlobal ? " global" : ""));
1416
1417	/*
1418	* Update the control registers before calling PGMR3FlushTLB.
1419	*/
1420	PCPUMCTX pCtx = (PCPUMCTX)pVM->rem.s.pCtx;
1421	pCtx->cr0 = env->cr[0];
1422	pCtx->cr3 = env->cr[3];
1423	pCtx->cr4 = env->cr[4];
1424
1425	/*
1426	* Let PGM do the rest.
1427	*/
1428	PGMFlushTLB(pVM, env->cr[3], fGlobal);
1429	}
1430
1431
1432	/**
1433	* Called when any of the cr0, cr4 or efer registers is updated.
1434	*
1435	* @param env Pointer to the CPU environment.
1436	*/
1437	void remR3ChangeCpuMode(CPUState *env)
1438	{
1439	int rc;
1440	PVM pVM = env->pVM;
1441
1442	/*
1443	* When we're replaying loads or restoring a saved
1444	* state this path is disabled.
1445	*/
1446	if (pVM->rem.s.fIgnoreCpuMode)
1447	return;
1448
1449	/*
1450	* Update the control registers before calling PGMR3ChangeMode()
1451	* as it may need to map whatever cr3 is pointing to.
1452	*/
1453	PCPUMCTX pCtx = (PCPUMCTX)pVM->rem.s.pCtx;
1454	pCtx->cr0 = env->cr[0];
1455	pCtx->cr3 = env->cr[3];
1456	pCtx->cr4 = env->cr[4];
1457
1458	#ifdef TARGET_X86_64
1459	rc = PGMChangeMode(pVM, env->cr[0], env->cr[4], env->efer);
1460	if (rc != VINF_SUCCESS)
1461	cpu_abort(env, "PGMChangeMode(, %08x, %08x, %016llx) -> %Vrc\n", env->cr[0], env->cr[4], env->efer, rc);
1462	#else
1463	rc = PGMChangeMode(pVM, env->cr[0], env->cr[4], 0);
1464	if (rc != VINF_SUCCESS)
1465	cpu_abort(env, "PGMChangeMode(, %08x, %08x, %016llx) -> %Vrc\n", env->cr[0], env->cr[4], 0LL, rc);
1466	#endif
1467	}
1468
1469
1470	/**
1471	* Called from compiled code to run dma.
1472	*
1473	* @param env Pointer to the CPU environment.
1474	*/
1475	void remR3DmaRun(CPUState *env)
1476	{
1477	remR3ProfileStop(STATS_QEMU_RUN_EMULATED_CODE);
1478	PDMR3DmaRun(env->pVM);
1479	remR3ProfileStart(STATS_QEMU_RUN_EMULATED_CODE);
1480	}
1481
1482	/**
1483	* Called from compiled code to schedule pending timers in VMM
1484	*
1485	* @param env Pointer to the CPU environment.
1486	*/
1487	void remR3TimersRun(CPUState *env)
1488	{
1489	remR3ProfileStop(STATS_QEMU_RUN_EMULATED_CODE);
1490	remR3ProfileStart(STATS_QEMU_RUN_TIMERS);
1491	TMR3TimerQueuesDo(env->pVM);
1492	remR3ProfileStop(STATS_QEMU_RUN_TIMERS);
1493	remR3ProfileStart(STATS_QEMU_RUN_EMULATED_CODE);
1494	}
1495
1496	/**
1497	* Record trap occurance
1498	*
1499	* @returns VBox status code
1500	* @param env Pointer to the CPU environment.
1501	* @param uTrap Trap nr
1502	* @param uErrorCode Error code
1503	* @param pvNextEIP Next EIP
1504	*/
1505	int remR3NotifyTrap(CPUState *env, uint32_t uTrap, uint32_t uErrorCode, uint32_t pvNextEIP)
1506	{
1507	PVM pVM = (PVM)env->pVM;
1508	#ifdef VBOX_WITH_STATISTICS
1509	static STAMCOUNTER aStatTrap[255];
1510	static bool aRegisters[ELEMENTS(aStatTrap)];
1511	#endif
1512
1513	#ifdef VBOX_WITH_STATISTICS
1514	if (uTrap < 255)
1515	{
1516	if (!aRegisters[uTrap])
1517	{
1518	aRegisters[uTrap] = true;
1519	char szStatName[64];
1520	RTStrPrintf(szStatName, sizeof(szStatName), "/REM/Trap/0x%02X", uTrap);
1521	STAM_REG(env->pVM, &aStatTrap[uTrap], STAMTYPE_COUNTER, szStatName, STAMUNIT_OCCURENCES, "Trap stats.");
1522	}
1523	STAM_COUNTER_INC(&aStatTrap[uTrap]);
1524	}
1525	#endif
1526	#ifdef DEBUG
1527	// if (uTrap == 6)
1528	{
1529	Log(("remR3NotifyTrap: uTrap=%x error=%x next_eip=%VGv eip=%VGv cr2=%08x\n", uTrap, uErrorCode, pvNextEIP, env->eip, env->cr[2]));
1530	}
1531	#endif
1532	// if (uTrap == 6) AssertReleaseFailed();
1533	if(uTrap < 0x20)
1534	{
1535	remR3DisasInstr(env, 1, "remR3NotifyTrap: ");
1536
1537	if(pVM->rem.s.uPendingException == uTrap && ++pVM->rem.s.cPendingExceptions > 128)
1538	{
1539	LogRel(("VERR_REM_TOO_MANY_TRAPS -> uTrap=%x error=%x next_eip=%VGv eip=%VGv cr2=%08x\n", uTrap, uErrorCode, pvNextEIP, env->eip, env->cr[2]));
1540	remR3RaiseRC(env->pVM, VERR_REM_TOO_MANY_TRAPS);
1541	return VERR_REM_TOO_MANY_TRAPS;
1542	}
1543	if(pVM->rem.s.uPendingException != uTrap \|\| pVM->rem.s.uPendingExcptEIP != env->eip \|\| pVM->rem.s.uPendingExcptCR2 != env->cr[2])
1544	pVM->rem.s.cPendingExceptions = 1;
1545	pVM->rem.s.uPendingException = uTrap;
1546	pVM->rem.s.uPendingExcptEIP = env->eip;
1547	pVM->rem.s.uPendingExcptCR2 = env->cr[2];
1548	}
1549	else
1550	{
1551	pVM->rem.s.cPendingExceptions = 0;
1552	pVM->rem.s.uPendingException = uTrap;
1553	pVM->rem.s.uPendingExcptEIP = env->eip;
1554	pVM->rem.s.uPendingExcptCR2 = env->cr[2];
1555	}
1556	return VINF_SUCCESS;
1557	}
1558
1559	/*
1560	* Clear current active trap
1561	*
1562	* @param pVM VM Handle.
1563	*/
1564	void remR3TrapClear(PVM pVM)
1565	{
1566	pVM->rem.s.cPendingExceptions = 0;
1567	pVM->rem.s.uPendingException = 0;
1568	pVM->rem.s.uPendingExcptEIP = 0;
1569	pVM->rem.s.uPendingExcptCR2 = 0;
1570	}
1571
1572
1573	/**
1574	* Syncs the internal REM state with the VM.
1575	*
1576	* This must be called before REMR3Run() is invoked whenever when the REM
1577	* state is not up to date. Calling it several times in a row is not
1578	* permitted.
1579	*
1580	* @returns VBox status code.
1581	*
1582	* @param pVM VM Handle.
1583	*
1584	* @remark The caller has to check for important FFs before calling REMR3Run. REMR3State will
1585	* no do this since the majority of the callers don't want any unnecessary of events
1586	* pending that would immediatly interrupt execution.
1587	*/
1588	REMR3DECL(int) REMR3State(PVM pVM)
1589	{
1590	Assert(!pVM->rem.s.fInREM);
1591	Log2(("REMR3State:\n"));
1592	STAM_PROFILE_START(&pVM->rem.s.StatsState, a);
1593	register const CPUMCTX *pCtx = pVM->rem.s.pCtx;
1594	register unsigned fFlags;
1595
1596	/*
1597	* Copy the registers which requires no special handling.
1598	*/
1599	Assert(R_EAX == 0);
1600	pVM->rem.s.Env.regs[R_EAX] = pCtx->eax;
1601	Assert(R_ECX == 1);
1602	pVM->rem.s.Env.regs[R_ECX] = pCtx->ecx;
1603	Assert(R_EDX == 2);
1604	pVM->rem.s.Env.regs[R_EDX] = pCtx->edx;
1605	Assert(R_EBX == 3);
1606	pVM->rem.s.Env.regs[R_EBX] = pCtx->ebx;
1607	Assert(R_ESP == 4);
1608	pVM->rem.s.Env.regs[R_ESP] = pCtx->esp;
1609	Assert(R_EBP == 5);
1610	pVM->rem.s.Env.regs[R_EBP] = pCtx->ebp;
1611	Assert(R_ESI == 6);
1612	pVM->rem.s.Env.regs[R_ESI] = pCtx->esi;
1613	Assert(R_EDI == 7);
1614	pVM->rem.s.Env.regs[R_EDI] = pCtx->edi;
1615	pVM->rem.s.Env.eip = pCtx->eip;
1616
1617	pVM->rem.s.Env.eflags = pCtx->eflags.u32;
1618
1619	pVM->rem.s.Env.cr[2] = pCtx->cr2;
1620
1621	/** @todo we could probably benefit from using a CPUM_CHANGED_DRx flag too! */
1622	pVM->rem.s.Env.dr[0] = pCtx->dr0;
1623	pVM->rem.s.Env.dr[1] = pCtx->dr1;
1624	pVM->rem.s.Env.dr[2] = pCtx->dr2;
1625	pVM->rem.s.Env.dr[3] = pCtx->dr3;
1626	pVM->rem.s.Env.dr[4] = pCtx->dr4;
1627	pVM->rem.s.Env.dr[5] = pCtx->dr5;
1628	pVM->rem.s.Env.dr[6] = pCtx->dr6;
1629	pVM->rem.s.Env.dr[7] = pCtx->dr7;
1630
1631	/*
1632	* Replay invlpg?
1633	*/
1634	if (pVM->rem.s.cInvalidatedPages)
1635	{
1636	pVM->rem.s.fIgnoreInvlPg = true;
1637	RTUINT i;
1638	for (i = 0; i < pVM->rem.s.cInvalidatedPages; i++)
1639	{
1640	Log2(("REMR3State: invlpg %VGv\n", pVM->rem.s.aGCPtrInvalidatedPages[i]));
1641	tlb_flush_page(&pVM->rem.s.Env, pVM->rem.s.aGCPtrInvalidatedPages[i]);
1642	}
1643	pVM->rem.s.fIgnoreInvlPg = false;
1644	pVM->rem.s.cInvalidatedPages = 0;
1645	}
1646
1647	/*
1648	* Registers which are seldomly changed and require special handling / order when changed.
1649	*/
1650	fFlags = CPUMGetAndClearChangedFlagsREM(pVM);
1651	if (fFlags & ( CPUM_CHANGED_CR4 \| CPUM_CHANGED_CR3 \| CPUM_CHANGED_CR0
1652	\| CPUM_CHANGED_GDTR \| CPUM_CHANGED_IDTR \| CPUM_CHANGED_LDTR \| CPUM_CHANGED_TR
1653	\| CPUM_CHANGED_FPU_REM \| CPUM_CHANGED_SYSENTER_MSR))
1654	{
1655	if (fFlags & CPUM_CHANGED_FPU_REM)
1656	save_raw_fp_state(&pVM->rem.s.Env, (uint8_t )&pCtx->fpu); / 'save' is an excellent name. */
1657
1658	if (fFlags & CPUM_CHANGED_GLOBAL_TLB_FLUSH)
1659	{
1660	pVM->rem.s.fIgnoreCR3Load = true;
1661	tlb_flush(&pVM->rem.s.Env, true);
1662	pVM->rem.s.fIgnoreCR3Load = false;
1663	}
1664
1665	if (fFlags & CPUM_CHANGED_CR4)
1666	{
1667	pVM->rem.s.fIgnoreCR3Load = true;
1668	pVM->rem.s.fIgnoreCpuMode = true;
1669	cpu_x86_update_cr4(&pVM->rem.s.Env, pCtx->cr4);
1670	pVM->rem.s.fIgnoreCpuMode = false;
1671	pVM->rem.s.fIgnoreCR3Load = false;
1672	}
1673
1674	if (fFlags & CPUM_CHANGED_CR0)
1675	{
1676	pVM->rem.s.fIgnoreCR3Load = true;
1677	pVM->rem.s.fIgnoreCpuMode = true;
1678	cpu_x86_update_cr0(&pVM->rem.s.Env, pCtx->cr0);
1679	pVM->rem.s.fIgnoreCpuMode = false;
1680	pVM->rem.s.fIgnoreCR3Load = false;
1681	}
1682
1683	if (fFlags & CPUM_CHANGED_CR3)
1684	{
1685	pVM->rem.s.fIgnoreCR3Load = true;
1686	cpu_x86_update_cr3(&pVM->rem.s.Env, pCtx->cr3);
1687	pVM->rem.s.fIgnoreCR3Load = false;
1688	}
1689
1690	if (fFlags & CPUM_CHANGED_GDTR)
1691	{
1692	pVM->rem.s.Env.gdt.base = pCtx->gdtr.pGdt;
1693	pVM->rem.s.Env.gdt.limit = pCtx->gdtr.cbGdt;
1694	}
1695
1696	if (fFlags & CPUM_CHANGED_IDTR)
1697	{
1698	pVM->rem.s.Env.idt.base = pCtx->idtr.pIdt;
1699	pVM->rem.s.Env.idt.limit = pCtx->idtr.cbIdt;
1700	}
1701
1702	if (fFlags & CPUM_CHANGED_SYSENTER_MSR)
1703	{
1704	pVM->rem.s.Env.sysenter_cs = pCtx->SysEnter.cs;
1705	pVM->rem.s.Env.sysenter_eip = pCtx->SysEnter.eip;
1706	pVM->rem.s.Env.sysenter_esp = pCtx->SysEnter.esp;
1707	}
1708
1709	if (fFlags & CPUM_CHANGED_LDTR)
1710	{
1711	if (fFlags & CPUM_CHANGED_HIDDEN_SEL_REGS)
1712	{
1713	pVM->rem.s.Env.ldt.selector = pCtx->ldtr;
1714	pVM->rem.s.Env.ldt.base = pCtx->ldtrHid.u32Base;
1715	pVM->rem.s.Env.ldt.limit = pCtx->ldtrHid.u32Limit;
1716	pVM->rem.s.Env.ldt.flags = (pCtx->ldtrHid.Attr.u << 8) & 0xFFFFFF;;
1717	}
1718	else
1719	sync_ldtr(&pVM->rem.s.Env, pCtx->ldtr);
1720	}
1721
1722	if (fFlags & CPUM_CHANGED_TR)
1723	{
1724	if (fFlags & CPUM_CHANGED_HIDDEN_SEL_REGS)
1725	{
1726	pVM->rem.s.Env.tr.selector = pCtx->tr;
1727	pVM->rem.s.Env.tr.base = pCtx->trHid.u32Base;
1728	pVM->rem.s.Env.tr.limit = pCtx->trHid.u32Limit;
1729	pVM->rem.s.Env.tr.flags = (pCtx->trHid.Attr.u << 8) & 0xFFFFFF;;
1730	}
1731	else
1732	sync_tr(&pVM->rem.s.Env, pCtx->tr);
1733
1734	/** @note do_interrupt will fault if the busy flag is still set.... */
1735	pVM->rem.s.Env.tr.flags &= ~DESC_TSS_BUSY_MASK;
1736	}
1737	}
1738
1739	/*
1740	* Update selector registers.
1741	* This must be done after we've synced gdt, ldt and crX registers
1742	* since we're reading the GDT/LDT om sync_seg. This will happen with
1743	* saved state which takes a quick dip into rawmode for instance.
1744	*/
1745	/*
1746	* Stack; Note first check this one as the CPL might have changed. The
1747	* wrong CPL can cause QEmu to raise an exception in sync_seg!!
1748	*/
1749
1750	if (fFlags & CPUM_CHANGED_HIDDEN_SEL_REGS)
1751	{
1752	/* The hidden selector registers are valid in the CPU context. */
1753	/** @note QEmu saves the 2nd dword of the descriptor; we should convert the attribute word back! */
1754
1755	cpu_x86_load_seg_cache(&pVM->rem.s.Env, R_CS, pCtx->cs, pCtx->csHid.u32Base, pCtx->csHid.u32Limit, (pCtx->csHid.Attr.u << 8) & 0xFFFFFF);
1756	cpu_x86_load_seg_cache(&pVM->rem.s.Env, R_SS, pCtx->ss, pCtx->ssHid.u32Base, pCtx->ssHid.u32Limit, (pCtx->ssHid.Attr.u << 8) & 0xFFFFFF);
1757	cpu_x86_load_seg_cache(&pVM->rem.s.Env, R_DS, pCtx->ds, pCtx->dsHid.u32Base, pCtx->dsHid.u32Limit, (pCtx->dsHid.Attr.u << 8) & 0xFFFFFF);
1758	cpu_x86_load_seg_cache(&pVM->rem.s.Env, R_ES, pCtx->es, pCtx->esHid.u32Base, pCtx->esHid.u32Limit, (pCtx->esHid.Attr.u << 8) & 0xFFFFFF);
1759	cpu_x86_load_seg_cache(&pVM->rem.s.Env, R_FS, pCtx->fs, pCtx->fsHid.u32Base, pCtx->fsHid.u32Limit, (pCtx->fsHid.Attr.u << 8) & 0xFFFFFF);
1760	cpu_x86_load_seg_cache(&pVM->rem.s.Env, R_GS, pCtx->gs, pCtx->gsHid.u32Base, pCtx->gsHid.u32Limit, (pCtx->gsHid.Attr.u << 8) & 0xFFFFFF);
1761
1762	/* Set current CPL. */
1763	if (pCtx->eflags.Bits.u1VM == 1)
1764	cpu_x86_set_cpl(&pVM->rem.s.Env, 3);
1765	else
1766	cpu_x86_set_cpl(&pVM->rem.s.Env, pCtx->ss & 3);
1767	}
1768	else
1769	{
1770	/* In 'normal' raw mode we don't have access to the hidden selector registers. */
1771	if (pVM->rem.s.Env.segs[R_SS].selector != (uint16_t)pCtx->ss)
1772	{
1773	Log2(("REMR3State: SS changed from %04x to %04x!\n", pVM->rem.s.Env.segs[R_SS].selector, pCtx->ss));
1774	if (pCtx->eflags.Bits.u1VM == 1)
1775	{
1776	cpu_x86_set_cpl(&pVM->rem.s.Env, 3);
1777	pVM->rem.s.Env.segs[R_SS].selector = (uint16_t)pCtx->ss;
1778	}
1779	else
1780	{
1781	cpu_x86_set_cpl(&pVM->rem.s.Env, pCtx->ss & 3);
1782	sync_seg(&pVM->rem.s.Env, R_SS, pCtx->ss);
1783	#ifdef VBOX_WITH_STATISTICS
1784	if (pVM->rem.s.Env.segs[R_SS].newselector)
1785	{
1786	STAM_COUNTER_INC(&gStatSelOutOfSync[R_SS]);
1787	}
1788	#endif
1789	}
1790	}
1791	else
1792	pVM->rem.s.Env.segs[R_SS].newselector = 0;
1793
1794	if (pVM->rem.s.Env.segs[R_ES].selector != pCtx->es)
1795	{
1796	Log2(("REMR3State: ES changed from %04x to %04x!\n", pVM->rem.s.Env.segs[R_ES].selector, pCtx->es));
1797	if (pCtx->eflags.Bits.u1VM == 1)
1798	{
1799	pVM->rem.s.Env.segs[R_ES].selector = (uint16_t)pCtx->es;
1800	}
1801	else
1802	{
1803	sync_seg(&pVM->rem.s.Env, R_ES, pCtx->es);
1804	#ifdef VBOX_WITH_STATISTICS
1805	if (pVM->rem.s.Env.segs[R_ES].newselector)
1806	{
1807	STAM_COUNTER_INC(&gStatSelOutOfSync[R_ES]);
1808	}
1809	#endif
1810	}
1811	}
1812	else
1813	pVM->rem.s.Env.segs[R_ES].newselector = 0;
1814
1815	if (pVM->rem.s.Env.segs[R_CS].selector != pCtx->cs)
1816	{
1817	Log2(("REMR3State: CS changed from %04x to %04x!\n", pVM->rem.s.Env.segs[R_CS].selector, pCtx->cs));
1818	if (pCtx->eflags.Bits.u1VM == 1)
1819	{
1820	pVM->rem.s.Env.segs[R_CS].selector = (uint16_t)pCtx->cs;
1821	}
1822	else
1823	{
1824	sync_seg(&pVM->rem.s.Env, R_CS, pCtx->cs);
1825	#ifdef VBOX_WITH_STATISTICS
1826	if (pVM->rem.s.Env.segs[R_CS].newselector)
1827	{
1828	STAM_COUNTER_INC(&gStatSelOutOfSync[R_CS]);
1829	}
1830	#endif
1831	}
1832	}
1833	else
1834	pVM->rem.s.Env.segs[R_CS].newselector = 0;
1835
1836	if (pVM->rem.s.Env.segs[R_DS].selector != pCtx->ds)
1837	{
1838	Log2(("REMR3State: DS changed from %04x to %04x!\n", pVM->rem.s.Env.segs[R_DS].selector, pCtx->ds));
1839	if (pCtx->eflags.Bits.u1VM == 1)
1840	{
1841	pVM->rem.s.Env.segs[R_DS].selector = (uint16_t)pCtx->ds;
1842	}
1843	else
1844	{
1845	sync_seg(&pVM->rem.s.Env, R_DS, pCtx->ds);
1846	#ifdef VBOX_WITH_STATISTICS
1847	if (pVM->rem.s.Env.segs[R_DS].newselector)
1848	{
1849	STAM_COUNTER_INC(&gStatSelOutOfSync[R_DS]);
1850	}
1851	#endif
1852	}
1853	}
1854	else
1855	pVM->rem.s.Env.segs[R_DS].newselector = 0;
1856
1857	/** @todo need to find a way to communicate potential GDT/LDT changes and thread switches. The selector might
1858	* be the same but not the base/limit. */
1859	if (pVM->rem.s.Env.segs[R_FS].selector != pCtx->fs)
1860	{
1861	Log2(("REMR3State: FS changed from %04x to %04x!\n", pVM->rem.s.Env.segs[R_FS].selector, pCtx->fs));
1862	if (pCtx->eflags.Bits.u1VM == 1)
1863	{
1864	pVM->rem.s.Env.segs[R_FS].selector = (uint16_t)pCtx->fs;
1865	}
1866	else
1867	{
1868	sync_seg(&pVM->rem.s.Env, R_FS, pCtx->fs);
1869	#ifdef VBOX_WITH_STATISTICS
1870	if (pVM->rem.s.Env.segs[R_FS].newselector)
1871	{
1872	STAM_COUNTER_INC(&gStatSelOutOfSync[R_FS]);
1873	}
1874	#endif
1875	}
1876	}
1877	else
1878	pVM->rem.s.Env.segs[R_FS].newselector = 0;
1879
1880	if (pVM->rem.s.Env.segs[R_GS].selector != pCtx->gs)
1881	{
1882	Log2(("REMR3State: GS changed from %04x to %04x!\n", pVM->rem.s.Env.segs[R_GS].selector, pCtx->gs));
1883	if (pCtx->eflags.Bits.u1VM == 1)
1884	{
1885	pVM->rem.s.Env.segs[R_GS].selector = (uint16_t)pCtx->gs;
1886	}
1887	else
1888	{
1889	sync_seg(&pVM->rem.s.Env, R_GS, pCtx->gs);
1890	#ifdef VBOX_WITH_STATISTICS
1891	if (pVM->rem.s.Env.segs[R_GS].newselector)
1892	{
1893	STAM_COUNTER_INC(&gStatSelOutOfSync[R_GS]);
1894	}
1895	#endif
1896	}
1897	}
1898	else
1899	pVM->rem.s.Env.segs[R_GS].newselector = 0;
1900	}
1901
1902	/*
1903	* Check for traps.
1904	*/
1905	pVM->rem.s.Env.exception_index = -1; /** @todo this won't work :/ */
1906	bool fIsSoftwareInterrupt;
1907	uint8_t u8TrapNo;
1908	int rc = TRPMQueryTrap(pVM, &u8TrapNo, &fIsSoftwareInterrupt);
1909	if (VBOX_SUCCESS(rc))
1910	{
1911	#ifdef DEBUG
1912	if (u8TrapNo == 0x80)
1913	{
1914	remR3DumpLnxSyscall(pVM);
1915	remR3DumpOBsdSyscall(pVM);
1916	}
1917	#endif
1918
1919	pVM->rem.s.Env.exception_index = u8TrapNo;
1920	if (!fIsSoftwareInterrupt)
1921	{
1922	pVM->rem.s.Env.exception_is_int = 0;
1923	pVM->rem.s.Env.exception_next_eip = pVM->rem.s.Env.eip;
1924	}
1925	else
1926	{
1927	/*
1928	* The there are two 1 byte opcodes and one 2 byte opcode for software interrupts.
1929	* We ASSUME that there are no prefixes and sets the default to 2 byte, and checks
1930	* for int03 and into.
1931	*/
1932	pVM->rem.s.Env.exception_is_int = 1;
1933	pVM->rem.s.Env.exception_next_eip = pCtx->eip + 2;
1934	/* int 3 may be generated by one-byte 0xcc */
1935	if (u8TrapNo == 3)
1936	{
1937	if (read_byte(&pVM->rem.s.Env, pVM->rem.s.Env.segs[R_CS].base + pCtx->eip) == 0xcc)
1938	pVM->rem.s.Env.exception_next_eip = pCtx->eip + 1;
1939	}
1940	/* int 4 may be generated by one-byte 0xce */
1941	else if (u8TrapNo == 4)
1942	{
1943	if (read_byte(&pVM->rem.s.Env, pVM->rem.s.Env.segs[R_CS].base + pCtx->eip) == 0xce)
1944	pVM->rem.s.Env.exception_next_eip = pCtx->eip + 1;
1945	}
1946	}
1947
1948	/* get error code and cr2 if needed. */
1949	switch (u8TrapNo)
1950	{
1951	case 0x0e:
1952	pVM->rem.s.Env.cr[2] = TRPMGetFaultAddress(pVM);
1953	/* fallthru */
1954	case 0x0a: case 0x0b: case 0x0c: case 0x0d:
1955	pVM->rem.s.Env.error_code = TRPMGetErrorCode(pVM);
1956	break;
1957
1958	case 0x11: case 0x08:
1959	default:
1960	pVM->rem.s.Env.error_code = 0;
1961	break;
1962	}
1963
1964	/*
1965	* We can now reset the active trap since the recompiler is gonna have a go at it.
1966	*/
1967	rc = TRPMResetTrap(pVM);
1968	AssertRC(rc);
1969	Log2(("REMR3State: trap=%02x errcd=%VGv cr2=%VGv nexteip=%VGv%s\n", pVM->rem.s.Env.exception_index, pVM->rem.s.Env.error_code,
1970	pVM->rem.s.Env.cr[2], pVM->rem.s.Env.exception_next_eip, pVM->rem.s.Env.exception_is_int ? " software" : ""));
1971	//if (pVM->rem.s.Env.eip == 0x40005a2f)
1972	// pVM->rem.s.Env.state \|= CPU_EMULATE_SINGLE_STEP \| CPU_RAW_MODE_DISABLED \| CPU_RAWR0_MODE_DISABLED;
1973	}
1974
1975	/*
1976	* Clear old interrupt request flags; Check for pending hardware interrupts.
1977	* (See @remark for why we don't check for other FFs.)
1978	*/
1979	pVM->rem.s.Env.interrupt_request &= ~(CPU_INTERRUPT_HARD \| CPU_INTERRUPT_EXIT \| CPU_INTERRUPT_EXITTB \| CPU_INTERRUPT_TIMER);
1980	if ( pVM->rem.s.u32PendingInterrupt != REM_NO_PENDING_IRQ
1981	\|\| VM_FF_ISPENDING(pVM, VM_FF_INTERRUPT_APIC \| VM_FF_INTERRUPT_PIC))
1982	pVM->rem.s.Env.interrupt_request \|= CPU_INTERRUPT_HARD;
1983
1984	/*
1985	* We're now in REM mode.
1986	*/
1987	pVM->rem.s.fInREM = true;
1988	pVM->rem.s.cCanExecuteRaw = 0;
1989	STAM_PROFILE_STOP(&pVM->rem.s.StatsState, a);
1990	Log2(("REMR3State: returns VINF_SUCCESS\n"));
1991	return VINF_SUCCESS;
1992	}
1993
1994
1995	/**
1996	* Syncs back changes in the REM state to the the VM state.
1997	*
1998	* This must be called after invoking REMR3Run().
1999	* Calling it several times in a row is not permitted.
2000	*
2001	* @returns VBox status code.
2002	*
2003	* @param pVM VM Handle.
2004	*/
2005	REMR3DECL(int) REMR3StateBack(PVM pVM)
2006	{
2007	Log2(("REMR3StateBack:\n"));
2008	Assert(pVM->rem.s.fInREM);
2009	STAM_PROFILE_START(&pVM->rem.s.StatsStateBack, a);
2010	register PCPUMCTX pCtx = pVM->rem.s.pCtx;
2011
2012	/*
2013	* Copy back the registers.
2014	* This is done in the order they are declared in the CPUMCTX structure.
2015	*/
2016
2017	/** @todo FOP */
2018	/** @todo FPUIP */
2019	/** @todo CS */
2020	/** @todo FPUDP */
2021	/** @todo DS */
2022	/** @todo Fix MXCSR support in QEMU so we don't overwrite MXCSR with 0 when we shouldn't! */
2023	pCtx->fpu.MXCSR = 0;
2024	pCtx->fpu.MXCSR_MASK = 0;
2025
2026	/** @todo check if FPU/XMM was actually used in the recompiler */
2027	restore_raw_fp_state(&pVM->rem.s.Env, (uint8_t *)&pCtx->fpu);
2028	//// dprintf2(("FPU state CW=%04X TT=%04X SW=%04X (%04X)\n", env->fpuc, env->fpstt, env->fpus, pVMCtx->fpu.FSW));
2029
2030	pCtx->edi = pVM->rem.s.Env.regs[R_EDI];
2031	pCtx->esi = pVM->rem.s.Env.regs[R_ESI];
2032	pCtx->ebp = pVM->rem.s.Env.regs[R_EBP];
2033	pCtx->eax = pVM->rem.s.Env.regs[R_EAX];
2034	pCtx->ebx = pVM->rem.s.Env.regs[R_EBX];
2035	pCtx->edx = pVM->rem.s.Env.regs[R_EDX];
2036	pCtx->ecx = pVM->rem.s.Env.regs[R_ECX];
2037
2038	pCtx->esp = pVM->rem.s.Env.regs[R_ESP];
2039	pCtx->ss = pVM->rem.s.Env.segs[R_SS].selector;
2040
2041	#ifdef VBOX_WITH_STATISTICS
2042	if (pVM->rem.s.Env.segs[R_SS].newselector)
2043	{
2044	STAM_COUNTER_INC(&gStatSelOutOfSyncStateBack[R_SS]);
2045	}
2046	if (pVM->rem.s.Env.segs[R_GS].newselector)
2047	{
2048	STAM_COUNTER_INC(&gStatSelOutOfSyncStateBack[R_GS]);
2049	}
2050	if (pVM->rem.s.Env.segs[R_FS].newselector)
2051	{
2052	STAM_COUNTER_INC(&gStatSelOutOfSyncStateBack[R_FS]);
2053	}
2054	if (pVM->rem.s.Env.segs[R_ES].newselector)
2055	{
2056	STAM_COUNTER_INC(&gStatSelOutOfSyncStateBack[R_ES]);
2057	}
2058	if (pVM->rem.s.Env.segs[R_DS].newselector)
2059	{
2060	STAM_COUNTER_INC(&gStatSelOutOfSyncStateBack[R_DS]);
2061	}
2062	if (pVM->rem.s.Env.segs[R_CS].newselector)
2063	{
2064	STAM_COUNTER_INC(&gStatSelOutOfSyncStateBack[R_CS]);
2065	}
2066	#endif
2067	pCtx->gs = pVM->rem.s.Env.segs[R_GS].selector;
2068	pCtx->fs = pVM->rem.s.Env.segs[R_FS].selector;
2069	pCtx->es = pVM->rem.s.Env.segs[R_ES].selector;
2070	pCtx->ds = pVM->rem.s.Env.segs[R_DS].selector;
2071	pCtx->cs = pVM->rem.s.Env.segs[R_CS].selector;
2072
2073	pCtx->eip = pVM->rem.s.Env.eip;
2074	pCtx->eflags.u32 = pVM->rem.s.Env.eflags;
2075
2076	pCtx->cr0 = pVM->rem.s.Env.cr[0];
2077	pCtx->cr2 = pVM->rem.s.Env.cr[2];
2078	pCtx->cr3 = pVM->rem.s.Env.cr[3];
2079	pCtx->cr4 = pVM->rem.s.Env.cr[4];
2080
2081	pCtx->dr0 = pVM->rem.s.Env.dr[0];
2082	pCtx->dr1 = pVM->rem.s.Env.dr[1];
2083	pCtx->dr2 = pVM->rem.s.Env.dr[2];
2084	pCtx->dr3 = pVM->rem.s.Env.dr[3];
2085	pCtx->dr4 = pVM->rem.s.Env.dr[4];
2086	pCtx->dr5 = pVM->rem.s.Env.dr[5];
2087	pCtx->dr6 = pVM->rem.s.Env.dr[6];
2088	pCtx->dr7 = pVM->rem.s.Env.dr[7];
2089
2090	pCtx->gdtr.cbGdt = pVM->rem.s.Env.gdt.limit;
2091	if (pCtx->gdtr.pGdt != (uint32_t)pVM->rem.s.Env.gdt.base)
2092	{
2093	pCtx->gdtr.pGdt = (uint32_t)pVM->rem.s.Env.gdt.base;
2094	STAM_COUNTER_INC(&gStatREMGDTChange);
2095	VM_FF_SET(pVM, VM_FF_SELM_SYNC_GDT);
2096	}
2097
2098	pCtx->idtr.cbIdt = pVM->rem.s.Env.idt.limit;
2099	if (pCtx->idtr.pIdt != (uint32_t)pVM->rem.s.Env.idt.base)
2100	{
2101	pCtx->idtr.pIdt = (uint32_t)pVM->rem.s.Env.idt.base;
2102	STAM_COUNTER_INC(&gStatREMIDTChange);
2103	VM_FF_SET(pVM, VM_FF_TRPM_SYNC_IDT);
2104	}
2105
2106	if (pCtx->ldtr != pVM->rem.s.Env.ldt.selector)
2107	{
2108	pCtx->ldtr = pVM->rem.s.Env.ldt.selector;
2109	STAM_COUNTER_INC(&gStatREMLDTRChange);
2110	VM_FF_SET(pVM, VM_FF_SELM_SYNC_LDT);
2111	}
2112	if (pCtx->tr != pVM->rem.s.Env.tr.selector)
2113	{
2114	pCtx->tr = pVM->rem.s.Env.tr.selector;
2115	STAM_COUNTER_INC(&gStatREMTRChange);
2116	VM_FF_SET(pVM, VM_FF_SELM_SYNC_TSS);
2117	}
2118
2119	/** @todo These values could still be out of sync! */
2120	pCtx->csHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_CS].base;
2121	pCtx->csHid.u32Limit = pVM->rem.s.Env.segs[R_CS].limit;
2122	/** @note QEmu saves the 2nd dword of the descriptor; we should store the attribute word only! */
2123	pCtx->csHid.Attr.u = (pVM->rem.s.Env.segs[R_CS].flags >> 8) & 0xF0FF;
2124
2125	pCtx->dsHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_DS].base;
2126	pCtx->dsHid.u32Limit = pVM->rem.s.Env.segs[R_DS].limit;
2127	pCtx->dsHid.Attr.u = (pVM->rem.s.Env.segs[R_DS].flags >> 8) & 0xF0FF;
2128
2129	pCtx->esHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_ES].base;
2130	pCtx->esHid.u32Limit = pVM->rem.s.Env.segs[R_ES].limit;
2131	pCtx->esHid.Attr.u = (pVM->rem.s.Env.segs[R_ES].flags >> 8) & 0xF0FF;
2132
2133	pCtx->fsHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_FS].base;
2134	pCtx->fsHid.u32Limit = pVM->rem.s.Env.segs[R_FS].limit;
2135	pCtx->fsHid.Attr.u = (pVM->rem.s.Env.segs[R_FS].flags >> 8) & 0xF0FF;
2136
2137	pCtx->gsHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_GS].base;
2138	pCtx->gsHid.u32Limit = pVM->rem.s.Env.segs[R_GS].limit;
2139	pCtx->gsHid.Attr.u = (pVM->rem.s.Env.segs[R_GS].flags >> 8) & 0xF0FF;
2140
2141	pCtx->ssHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_SS].base;
2142	pCtx->ssHid.u32Limit = pVM->rem.s.Env.segs[R_SS].limit;
2143	pCtx->ssHid.Attr.u = (pVM->rem.s.Env.segs[R_SS].flags >> 8) & 0xF0FF;
2144
2145	pCtx->ldtrHid.u32Base = (uint32_t)pVM->rem.s.Env.ldt.base;
2146	pCtx->ldtrHid.u32Limit = pVM->rem.s.Env.ldt.limit;
2147	pCtx->ldtrHid.Attr.u = (pVM->rem.s.Env.ldt.flags >> 8) & 0xF0FF;
2148
2149	pCtx->trHid.u32Base = (uint32_t)pVM->rem.s.Env.tr.base;
2150	pCtx->trHid.u32Limit = pVM->rem.s.Env.tr.limit;
2151	pCtx->trHid.Attr.u = (pVM->rem.s.Env.tr.flags >> 8) & 0xF0FF;
2152
2153	/* Sysenter MSR */
2154	pCtx->SysEnter.cs = pVM->rem.s.Env.sysenter_cs;
2155	pCtx->SysEnter.eip = pVM->rem.s.Env.sysenter_eip;
2156	pCtx->SysEnter.esp = pVM->rem.s.Env.sysenter_esp;
2157
2158	remR3TrapClear(pVM);
2159
2160	/*
2161	* Check for traps.
2162	*/
2163	if ( pVM->rem.s.Env.exception_index >= 0
2164	&& pVM->rem.s.Env.exception_index < 256)
2165	{
2166	Log(("REMR3StateBack: Pending trap %x %d\n", pVM->rem.s.Env.exception_index, pVM->rem.s.Env.exception_is_int));
2167	int rc = TRPMAssertTrap(pVM, pVM->rem.s.Env.exception_index, pVM->rem.s.Env.exception_is_int);
2168	AssertRC(rc);
2169	switch (pVM->rem.s.Env.exception_index)
2170	{
2171	case 0x0e:
2172	TRPMSetFaultAddress(pVM, pCtx->cr2);
2173	/* fallthru */
2174	case 0x0a: case 0x0b: case 0x0c: case 0x0d:
2175	case 0x11: case 0x08: /* 0 */
2176	TRPMSetErrorCode(pVM, pVM->rem.s.Env.error_code);
2177	break;
2178	}
2179
2180	}
2181
2182	/*
2183	* We're not longer in REM mode.
2184	*/
2185	pVM->rem.s.fInREM = false;
2186	STAM_PROFILE_STOP(&pVM->rem.s.StatsStateBack, a);
2187	Log2(("REMR3StateBack: returns VINF_SUCCESS\n"));
2188	return VINF_SUCCESS;
2189	}
2190
2191
2192	/**
2193	* This is called by the disassembler when it wants to update the cpu state
2194	* before for instance doing a register dump.
2195	*/
2196	static void remR3StateUpdate(PVM pVM)
2197	{
2198	Assert(pVM->rem.s.fInREM);
2199	register PCPUMCTX pCtx = pVM->rem.s.pCtx;
2200
2201	/*
2202	* Copy back the registers.
2203	* This is done in the order they are declared in the CPUMCTX structure.
2204	*/
2205
2206	/** @todo FOP */
2207	/** @todo FPUIP */
2208	/** @todo CS */
2209	/** @todo FPUDP */
2210	/** @todo DS */
2211	/** @todo Fix MXCSR support in QEMU so we don't overwrite MXCSR with 0 when we shouldn't! */
2212	pCtx->fpu.MXCSR = 0;
2213	pCtx->fpu.MXCSR_MASK = 0;
2214
2215	/** @todo check if FPU/XMM was actually used in the recompiler */
2216	restore_raw_fp_state(&pVM->rem.s.Env, (uint8_t *)&pCtx->fpu);
2217	//// dprintf2(("FPU state CW=%04X TT=%04X SW=%04X (%04X)\n", env->fpuc, env->fpstt, env->fpus, pVMCtx->fpu.FSW));
2218
2219	pCtx->edi = pVM->rem.s.Env.regs[R_EDI];
2220	pCtx->esi = pVM->rem.s.Env.regs[R_ESI];
2221	pCtx->ebp = pVM->rem.s.Env.regs[R_EBP];
2222	pCtx->eax = pVM->rem.s.Env.regs[R_EAX];
2223	pCtx->ebx = pVM->rem.s.Env.regs[R_EBX];
2224	pCtx->edx = pVM->rem.s.Env.regs[R_EDX];
2225	pCtx->ecx = pVM->rem.s.Env.regs[R_ECX];
2226
2227	pCtx->esp = pVM->rem.s.Env.regs[R_ESP];
2228	pCtx->ss = pVM->rem.s.Env.segs[R_SS].selector;
2229
2230	pCtx->gs = pVM->rem.s.Env.segs[R_GS].selector;
2231	pCtx->fs = pVM->rem.s.Env.segs[R_FS].selector;
2232	pCtx->es = pVM->rem.s.Env.segs[R_ES].selector;
2233	pCtx->ds = pVM->rem.s.Env.segs[R_DS].selector;
2234	pCtx->cs = pVM->rem.s.Env.segs[R_CS].selector;
2235
2236	pCtx->eip = pVM->rem.s.Env.eip;
2237	pCtx->eflags.u32 = pVM->rem.s.Env.eflags;
2238
2239	pCtx->cr0 = pVM->rem.s.Env.cr[0];
2240	pCtx->cr2 = pVM->rem.s.Env.cr[2];
2241	pCtx->cr3 = pVM->rem.s.Env.cr[3];
2242	pCtx->cr4 = pVM->rem.s.Env.cr[4];
2243
2244	pCtx->dr0 = pVM->rem.s.Env.dr[0];
2245	pCtx->dr1 = pVM->rem.s.Env.dr[1];
2246	pCtx->dr2 = pVM->rem.s.Env.dr[2];
2247	pCtx->dr3 = pVM->rem.s.Env.dr[3];
2248	pCtx->dr4 = pVM->rem.s.Env.dr[4];
2249	pCtx->dr5 = pVM->rem.s.Env.dr[5];
2250	pCtx->dr6 = pVM->rem.s.Env.dr[6];
2251	pCtx->dr7 = pVM->rem.s.Env.dr[7];
2252
2253	pCtx->gdtr.cbGdt = pVM->rem.s.Env.gdt.limit;
2254	if (pCtx->gdtr.pGdt != (uint32_t)pVM->rem.s.Env.gdt.base)
2255	{
2256	pCtx->gdtr.pGdt = (uint32_t)pVM->rem.s.Env.gdt.base;
2257	STAM_COUNTER_INC(&gStatREMGDTChange);
2258	VM_FF_SET(pVM, VM_FF_SELM_SYNC_GDT);
2259	}
2260
2261	pCtx->idtr.cbIdt = pVM->rem.s.Env.idt.limit;
2262	if (pCtx->idtr.pIdt != (uint32_t)pVM->rem.s.Env.idt.base)
2263	{
2264	pCtx->idtr.pIdt = (uint32_t)pVM->rem.s.Env.idt.base;
2265	STAM_COUNTER_INC(&gStatREMIDTChange);
2266	VM_FF_SET(pVM, VM_FF_TRPM_SYNC_IDT);
2267	}
2268
2269	if (pCtx->ldtr != pVM->rem.s.Env.ldt.selector)
2270	{
2271	pCtx->ldtr = pVM->rem.s.Env.ldt.selector;
2272	STAM_COUNTER_INC(&gStatREMLDTRChange);
2273	VM_FF_SET(pVM, VM_FF_SELM_SYNC_LDT);
2274	}
2275	if (pCtx->tr != pVM->rem.s.Env.tr.selector)
2276	{
2277	pCtx->tr = pVM->rem.s.Env.tr.selector;
2278	STAM_COUNTER_INC(&gStatREMTRChange);
2279	VM_FF_SET(pVM, VM_FF_SELM_SYNC_TSS);
2280	}
2281
2282	/** @todo These values could still be out of sync! */
2283	pCtx->csHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_CS].base;
2284	pCtx->csHid.u32Limit = pVM->rem.s.Env.segs[R_CS].limit;
2285	/** @note QEmu saves the 2nd dword of the descriptor; we should store the attribute word only! */
2286	pCtx->csHid.Attr.u = (pVM->rem.s.Env.segs[R_CS].flags >> 8) & 0xFFFF;
2287
2288	pCtx->dsHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_DS].base;
2289	pCtx->dsHid.u32Limit = pVM->rem.s.Env.segs[R_DS].limit;
2290	pCtx->dsHid.Attr.u = (pVM->rem.s.Env.segs[R_DS].flags >> 8) & 0xFFFF;
2291
2292	pCtx->esHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_ES].base;
2293	pCtx->esHid.u32Limit = pVM->rem.s.Env.segs[R_ES].limit;
2294	pCtx->esHid.Attr.u = (pVM->rem.s.Env.segs[R_ES].flags >> 8) & 0xFFFF;
2295
2296	pCtx->fsHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_FS].base;
2297	pCtx->fsHid.u32Limit = pVM->rem.s.Env.segs[R_FS].limit;
2298	pCtx->fsHid.Attr.u = (pVM->rem.s.Env.segs[R_FS].flags >> 8) & 0xFFFF;
2299
2300	pCtx->gsHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_GS].base;
2301	pCtx->gsHid.u32Limit = pVM->rem.s.Env.segs[R_GS].limit;
2302	pCtx->gsHid.Attr.u = (pVM->rem.s.Env.segs[R_GS].flags >> 8) & 0xFFFF;
2303
2304	pCtx->ssHid.u32Base = (uint32_t)pVM->rem.s.Env.segs[R_SS].base;
2305	pCtx->ssHid.u32Limit = pVM->rem.s.Env.segs[R_SS].limit;
2306	pCtx->ssHid.Attr.u = (pVM->rem.s.Env.segs[R_SS].flags >> 8) & 0xFFFF;
2307
2308	pCtx->ldtrHid.u32Base = (uint32_t)pVM->rem.s.Env.ldt.base;
2309	pCtx->ldtrHid.u32Limit = pVM->rem.s.Env.ldt.limit;
2310	pCtx->ldtrHid.Attr.u = (pVM->rem.s.Env.ldt.flags >> 8) & 0xFFFF;
2311
2312	pCtx->trHid.u32Base = (uint32_t)pVM->rem.s.Env.tr.base;
2313	pCtx->trHid.u32Limit = pVM->rem.s.Env.tr.limit;
2314	pCtx->trHid.Attr.u = (pVM->rem.s.Env.tr.flags >> 8) & 0xFFFF;
2315
2316	/* Sysenter MSR */
2317	pCtx->SysEnter.cs = pVM->rem.s.Env.sysenter_cs;
2318	pCtx->SysEnter.eip = pVM->rem.s.Env.sysenter_eip;
2319	pCtx->SysEnter.esp = pVM->rem.s.Env.sysenter_esp;
2320	}
2321
2322
2323	/**
2324	* Update the VMM state information if we're currently in REM.
2325	*
2326	* This method is used by the DBGF and PDMDevice when there is any uncertainty of whether
2327	* we're currently executing in REM and the VMM state is invalid. This method will of
2328	* course check that we're executing in REM before syncing any data over to the VMM.
2329	*
2330	* @param pVM The VM handle.
2331	*/
2332	REMR3DECL(void) REMR3StateUpdate(PVM pVM)
2333	{
2334	if (pVM->rem.s.fInREM)
2335	remR3StateUpdate(pVM);
2336	}
2337
2338
2339	#undef LOG_GROUP
2340	#define LOG_GROUP LOG_GROUP_REM
2341
2342
2343	/**
2344	* Notify the recompiler about Address Gate 20 state change.
2345	*
2346	* This notification is required since A20 gate changes are
2347	* initialized from a device driver and the VM might just as
2348	* well be in REM mode as in RAW mode.
2349	*
2350	* @param pVM VM handle.
2351	* @param fEnable True if the gate should be enabled.
2352	* False if the gate should be disabled.
2353	*/
2354	REMR3DECL(void) REMR3A20Set(PVM pVM, bool fEnable)
2355	{
2356	LogFlow(("REMR3A20Set: fEnable=%d\n", fEnable));
2357	VM_ASSERT_EMT(pVM);
2358	cpu_x86_set_a20(&pVM->rem.s.Env, fEnable);
2359	}
2360
2361
2362	/**
2363	* Replays the invalidated recorded pages.
2364	* Called in response to VERR_REM_FLUSHED_PAGES_OVERFLOW from the RAW execution loop.
2365	*
2366	* @param pVM VM handle.
2367	*/
2368	REMR3DECL(void) REMR3ReplayInvalidatedPages(PVM pVM)
2369	{
2370	VM_ASSERT_EMT(pVM);
2371
2372	/*
2373	* Sync the required registers.
2374	*/
2375	pVM->rem.s.Env.cr[0] = pVM->rem.s.pCtx->cr0;
2376	pVM->rem.s.Env.cr[2] = pVM->rem.s.pCtx->cr2;
2377	pVM->rem.s.Env.cr[3] = pVM->rem.s.pCtx->cr3;
2378	pVM->rem.s.Env.cr[4] = pVM->rem.s.pCtx->cr4;
2379
2380	/*
2381	* Replay the flushes.
2382	*/
2383	pVM->rem.s.fIgnoreInvlPg = true;
2384	RTUINT i;
2385	for (i = 0; i < pVM->rem.s.cInvalidatedPages; i++)
2386	{
2387	Log2(("REMR3ReplayInvalidatedPages: invlpg %VGv\n", pVM->rem.s.aGCPtrInvalidatedPages[i]));
2388	tlb_flush_page(&pVM->rem.s.Env, pVM->rem.s.aGCPtrInvalidatedPages[i]);
2389	}
2390	pVM->rem.s.fIgnoreInvlPg = false;
2391	pVM->rem.s.cInvalidatedPages = 0;
2392	}
2393
2394
2395	/**
2396	* Replays the invalidated recorded pages.
2397	* Called in response to VERR_REM_FLUSHED_PAGES_OVERFLOW from the RAW execution loop.
2398	*
2399	* @param pVM VM handle.
2400	*/
2401	REMR3DECL(void) REMR3ReplayHandlerNotifications(PVM pVM)
2402	{
2403	LogFlow(("REMR3ReplayInvalidatedPages:\n"));
2404	VM_ASSERT_EMT(pVM);
2405
2406	/*
2407	* Replay the flushes.
2408	*/
2409	RTUINT i;
2410	const RTUINT c = pVM->rem.s.cHandlerNotifications;
2411	pVM->rem.s.cHandlerNotifications = 0;
2412	for (i = 0; i < c; i++)
2413	{
2414	PREMHANDLERNOTIFICATION pRec = &pVM->rem.s.aHandlerNotifications[i];
2415	switch (pRec->enmKind)
2416	{
2417	case REMHANDLERNOTIFICATIONKIND_PHYSICAL_REGISTER:
2418	REMR3NotifyHandlerPhysicalRegister(pVM,
2419	pRec->u.PhysicalRegister.enmType,
2420	pRec->u.PhysicalRegister.GCPhys,
2421	pRec->u.PhysicalRegister.cb,
2422	pRec->u.PhysicalRegister.fHasHCHandler);
2423	break;
2424
2425	case REMHANDLERNOTIFICATIONKIND_PHYSICAL_DEREGISTER:
2426	REMR3NotifyHandlerPhysicalDeregister(pVM,
2427	pRec->u.PhysicalDeregister.enmType,
2428	pRec->u.PhysicalDeregister.GCPhys,
2429	pRec->u.PhysicalDeregister.cb,
2430	pRec->u.PhysicalDeregister.fHasHCHandler,
2431	pRec->u.PhysicalDeregister.pvHCPtr);
2432	break;
2433
2434	case REMHANDLERNOTIFICATIONKIND_PHYSICAL_MODIFY:
2435	REMR3NotifyHandlerPhysicalModify(pVM,
2436	pRec->u.PhysicalModify.enmType,
2437	pRec->u.PhysicalModify.GCPhysOld,
2438	pRec->u.PhysicalModify.GCPhysNew,
2439	pRec->u.PhysicalModify.cb,
2440	pRec->u.PhysicalModify.fHasHCHandler,
2441	pRec->u.PhysicalModify.pvHCPtr);
2442	break;
2443
2444	default:
2445	AssertReleaseMsgFailed(("enmKind=%d\n", pRec->enmKind));
2446	break;
2447	}
2448	}
2449	}
2450
2451
2452	/**
2453	* Notify REM about changed code page.
2454	*
2455	* @returns VBox status code.
2456	* @param pVM VM handle.
2457	* @param pvCodePage Code page address
2458	*/
2459	REMR3DECL(int) REMR3NotifyCodePageChanged(PVM pVM, RTGCPTR pvCodePage)
2460	{
2461	int rc;
2462	RTGCPHYS PhysGC;
2463	uint64_t flags;
2464
2465	VM_ASSERT_EMT(pVM);
2466
2467	/*
2468	* Get the physical page address.
2469	*/
2470	rc = PGMGstGetPage(pVM, pvCodePage, &flags, &PhysGC);
2471	if (rc == VINF_SUCCESS)
2472	{
2473	/*
2474	* Sync the required registers and flush the whole page.
2475	* (Easier to do the whole page than notifying it about each physical
2476	* byte that was changed.
2477	*/
2478	pVM->rem.s.Env.cr[0] = pVM->rem.s.pCtx->cr0;
2479	pVM->rem.s.Env.cr[2] = pVM->rem.s.pCtx->cr2;
2480	pVM->rem.s.Env.cr[3] = pVM->rem.s.pCtx->cr3;
2481	pVM->rem.s.Env.cr[4] = pVM->rem.s.pCtx->cr4;
2482
2483	tb_invalidate_phys_page_range(PhysGC, PhysGC + PAGE_SIZE - 1, 0);
2484	}
2485	return VINF_SUCCESS;
2486	}
2487
2488	/**
2489	* Notification about a successful MMR3PhysRegister() call.
2490	*
2491	* @param pVM VM handle.
2492	* @param GCPhys The physical address the RAM.
2493	* @param cb Size of the memory.
2494	* @param pvRam The HC address of the RAM.
2495	* @param fFlags Flags of the MM_RAM_FLAGS_* defines.
2496	*/
2497	REMR3DECL(void) REMR3NotifyPhysRamRegister(PVM pVM, RTGCPHYS GCPhys, RTUINT cb, void *pvRam, unsigned fFlags)
2498	{
2499	Log(("REMR3NotifyPhysRamRegister: GCPhys=%VGp cb=%d pvRam=%p fFlags=%d\n", GCPhys, cb, pvRam, fFlags));
2500	VM_ASSERT_EMT(pVM);
2501
2502	/*
2503	* Validate input - we trust the caller.
2504	*/
2505	Assert(!GCPhys \|\| pvRam);
2506	Assert(RT_ALIGN_P(pvRam, PAGE_SIZE) == pvRam);
2507	Assert(RT_ALIGN_T(GCPhys, PAGE_SIZE, RTGCPHYS) == GCPhys);
2508	Assert(cb);
2509	Assert(RT_ALIGN_Z(cb, PAGE_SIZE) == cb);
2510
2511	/*
2512	* Base ram?
2513	*/
2514	if (!GCPhys)
2515	{
2516	#ifndef PGM_DYNAMIC_RAM_ALLOC
2517	AssertRelease(!phys_ram_base);
2518	phys_ram_base = pvRam;
2519	#endif
2520	phys_ram_size = cb;
2521	phys_ram_dirty = MMR3HeapAllocZ(pVM, MM_TAG_REM, cb >> PAGE_SHIFT);
2522	AssertReleaseMsg(phys_ram_dirty, ("failed to allocate %d bytes of dirty bytes\n", cb >> PAGE_SHIFT));
2523	}
2524	#ifndef PGM_DYNAMIC_RAM_ALLOC
2525	AssertRelease(phys_ram_base);
2526	#endif
2527
2528	/*
2529	* Register the ram.
2530	*/
2531	#ifdef PGM_DYNAMIC_RAM_ALLOC
2532	if (!GCPhys)
2533	cpu_register_physical_memory(GCPhys, cb, GCPhys \| IO_MEM_RAM_MISSING);
2534	else
2535	{
2536	cpu_register_physical_memory(GCPhys, cb, GCPhys \| (fFlags & MM_RAM_FLAGS_RESERVED ? IO_MEM_UNASSIGNED : 0));
2537
2538	AssertRelease(pVM->rem.s.cPhysRegistrations < REM_MAX_PHYS_REGISTRATIONS);
2539	pVM->rem.s.aPhysReg[pVM->rem.s.cPhysRegistrations].GCPhys = GCPhys;
2540	pVM->rem.s.aPhysReg[pVM->rem.s.cPhysRegistrations].HCVirt = (RTHCUINTPTR)pvRam;
2541	pVM->rem.s.aPhysReg[pVM->rem.s.cPhysRegistrations].cb = cb;
2542	pVM->rem.s.cPhysRegistrations++;
2543	}
2544	#else
2545	cpu_register_physical_memory(GCPhys, cb, ((uintptr_t)pvRam - (uintptr_t)phys_ram_base)
2546	\| (fFlags & MM_RAM_FLAGS_RESERVED ? IO_MEM_UNASSIGNED : 0));
2547	#endif
2548	}
2549
2550
2551	/**
2552	* Notification about a successful PGMR3PhysRegisterChunk() call.
2553	*
2554	* @param pVM VM handle.
2555	* @param GCPhys The physical address the RAM.
2556	* @param cb Size of the memory.
2557	* @param pvRam The HC address of the RAM.
2558	* @param fFlags Flags of the MM_RAM_FLAGS_* defines.
2559	*/
2560	REMR3DECL(void) REMR3NotifyPhysRamChunkRegister(PVM pVM, RTGCPHYS GCPhys, RTUINT cb, RTHCUINTPTR pvRam, unsigned fFlags)
2561	{
2562	uint32_t idx;
2563
2564	Log(("REMR3NotifyPhysRamChunkRegister: GCPhys=%VGp cb=%d pvRam=%p fFlags=%d\n", GCPhys, cb, pvRam, fFlags));
2565	VM_ASSERT_EMT(pVM);
2566
2567	/*
2568	* Validate input - we trust the caller.
2569	*/
2570	Assert(pvRam);
2571	Assert(RT_ALIGN(pvRam, PAGE_SIZE) == pvRam);
2572	Assert(RT_ALIGN_T(GCPhys, PAGE_SIZE, RTGCPHYS) == GCPhys);
2573	Assert(cb == PGM_DYNAMIC_CHUNK_SIZE);
2574	Assert(fFlags == 0 /* normal RAM */);
2575
2576	if (!pVM->rem.s.paHCVirtToGCPhys)
2577	{
2578	uint32_t size = (_4G >> PGM_DYNAMIC_CHUNK_SHIFT) * sizeof(REMCHUNKINFO);
2579
2580	Assert(phys_ram_size);
2581
2582	pVM->rem.s.paHCVirtToGCPhys = (PREMCHUNKINFO)MMR3HeapAllocZ(pVM, MM_TAG_REM, size);
2583	pVM->rem.s.paGCPhysToHCVirt = (RTHCPTR)MMR3HeapAllocZ(pVM, MM_TAG_REM, (phys_ram_size >> PGM_DYNAMIC_CHUNK_SHIFT)*sizeof(RTHCPTR));
2584	}
2585	pVM->rem.s.paGCPhysToHCVirt[GCPhys >> PGM_DYNAMIC_CHUNK_SHIFT] = pvRam;
2586
2587	idx = (pvRam >> PGM_DYNAMIC_CHUNK_SHIFT);
2588	if (!pVM->rem.s.paHCVirtToGCPhys[idx].pChunk1)
2589	{
2590	pVM->rem.s.paHCVirtToGCPhys[idx].pChunk1 = pvRam;
2591	pVM->rem.s.paHCVirtToGCPhys[idx].GCPhys1 = GCPhys;
2592	}
2593	else
2594	{
2595	Assert(!pVM->rem.s.paHCVirtToGCPhys[idx].pChunk2);
2596	pVM->rem.s.paHCVirtToGCPhys[idx].pChunk2 = pvRam;
2597	pVM->rem.s.paHCVirtToGCPhys[idx].GCPhys2 = GCPhys;
2598	}
2599	/* Does the region spawn two chunks? */
2600	if (pvRam & PGM_DYNAMIC_CHUNK_OFFSET_MASK)
2601	{
2602	if (!pVM->rem.s.paHCVirtToGCPhys[idx+1].pChunk1)
2603	{
2604	pVM->rem.s.paHCVirtToGCPhys[idx+1].pChunk1 = pvRam;
2605	pVM->rem.s.paHCVirtToGCPhys[idx+1].GCPhys1 = GCPhys;
2606	}
2607	else
2608	{
2609	Assert(!pVM->rem.s.paHCVirtToGCPhys[idx+1].pChunk2);
2610	pVM->rem.s.paHCVirtToGCPhys[idx+1].pChunk2 = pvRam;
2611	pVM->rem.s.paHCVirtToGCPhys[idx+1].GCPhys2 = GCPhys;
2612	}
2613	}
2614	cpu_register_physical_memory(GCPhys, cb, GCPhys);
2615	}
2616
2617	/**
2618	* Convert GC physical address to HC virt
2619	*
2620	* @returns The HC virt address corresponding to addr.
2621	* @param env The cpu environment.
2622	* @param addr The physical address.
2623	*/
2624	void remR3GCPhys2HCVirt(void env, target_ulong addr)
2625	{
2626	#ifdef PGM_DYNAMIC_RAM_ALLOC
2627	PVM pVM = ((CPUState *)env)->pVM;
2628	uint32_t i;
2629
2630	/* lookup in pVM->rem.s.aPhysReg array first (for ROM range(s) inside the guest's RAM) */
2631	for (i=0;i<pVM->rem.s.cPhysRegistrations;i++)
2632	{
2633	uint32_t off = addr - pVM->rem.s.aPhysReg[i].GCPhys;
2634	if (off < pVM->rem.s.aPhysReg[i].cb)
2635	{
2636	Log(("remR3GCPhys2HCVirt: %x -> %x\n", addr, pVM->rem.s.aPhysReg[i].HCVirt + off));
2637	return (void *)(pVM->rem.s.aPhysReg[i].HCVirt + off);
2638	}
2639	}
2640	Assert(addr < phys_ram_size);
2641	Log(("remR3GCPhys2HCVirt: %x -> %x\n", addr, pVM->rem.s.paGCPhysToHCVirt[addr >> PGM_DYNAMIC_CHUNK_SHIFT] + (addr & PGM_DYNAMIC_CHUNK_OFFSET_MASK)));
2642	return (void *)(pVM->rem.s.paGCPhysToHCVirt[addr >> PGM_DYNAMIC_CHUNK_SHIFT] + (addr & PGM_DYNAMIC_CHUNK_OFFSET_MASK));
2643	#else
2644	return phys_ram_base + addr;
2645	#endif
2646	}
2647
2648	/**
2649	* Convert GC physical address to HC virt
2650	*
2651	* @returns The HC virt address corresponding to addr.
2652	* @param env The cpu environment.
2653	* @param addr The physical address.
2654	*/
2655	target_ulong remR3HCVirt2GCPhys(void env, void addr)
2656	{
2657	#ifdef PGM_DYNAMIC_RAM_ALLOC
2658	PVM pVM = ((CPUState *)env)->pVM;
2659	RTHCUINTPTR HCVirt = (RTHCUINTPTR)addr;
2660	uint32_t idx = (HCVirt >> PGM_DYNAMIC_CHUNK_SHIFT);
2661	RTHCUINTPTR off;
2662	RTUINT i;
2663
2664	off = HCVirt - pVM->rem.s.paHCVirtToGCPhys[idx].pChunk1;
2665
2666	if ( pVM->rem.s.paHCVirtToGCPhys[idx].pChunk1
2667	&& off < PGM_DYNAMIC_CHUNK_SIZE)
2668	{
2669	Log(("remR3HCVirt2GCPhys %x -> %x\n", addr, pVM->rem.s.paHCVirtToGCPhys[idx].GCPhys1 + off));
2670	return pVM->rem.s.paHCVirtToGCPhys[idx].GCPhys1 + off;
2671	}
2672
2673	off = HCVirt - pVM->rem.s.paHCVirtToGCPhys[idx].pChunk2;
2674	if ( pVM->rem.s.paHCVirtToGCPhys[idx].pChunk2
2675	&& off < PGM_DYNAMIC_CHUNK_SIZE)
2676	{
2677	Log(("remR3HCVirt2GCPhys %x -> %x\n", addr, pVM->rem.s.paHCVirtToGCPhys[idx].GCPhys2 + off));
2678	return pVM->rem.s.paHCVirtToGCPhys[idx].GCPhys2 + off;
2679	}
2680
2681	/* Must be externally registered RAM/ROM range */
2682	for (i=0;i<pVM->rem.s.cPhysRegistrations;i++)
2683	{
2684	uint32_t off = HCVirt - pVM->rem.s.aPhysReg[i].HCVirt;
2685	if (off < pVM->rem.s.aPhysReg[i].cb)
2686	{
2687	Log(("remR3HCVirt2GCPhys %x -> %x\n", addr, pVM->rem.s.aPhysReg[i].GCPhys + off));
2688	return pVM->rem.s.aPhysReg[i].GCPhys + off;
2689	}
2690	}
2691	AssertReleaseMsgFailed(("No translation for physical address %p???\n", addr));
2692	return 0;
2693	#else
2694	return (target_ulong)addr - (target_ulong)phys_ram_base;
2695	#endif
2696	}
2697
2698	/**
2699	* Grows dynamically allocated guest RAM.
2700	* Will raise a fatal error if the operation fails.
2701	*
2702	* @param physaddr The physical address.
2703	*/
2704	void remR3GrowDynRange(unsigned long physaddr)
2705	{
2706	int rc;
2707	PVM pVM = cpu_single_env->pVM;
2708
2709	Log(("remR3GrowDynRange %VGp\n", physaddr));
2710	rc = PGM3PhysGrowRange(pVM, (RTGCPHYS)physaddr);
2711	if (VBOX_SUCCESS(rc))
2712	return;
2713
2714	LogRel(("\nUnable to allocate guest RAM chunk at %VGp\n", physaddr));
2715	cpu_abort(cpu_single_env, "Unable to allocate guest RAM chunk at %VGp\n", physaddr);
2716	AssertFatalFailed();
2717	}
2718
2719	/**
2720	* Notification about a successful MMR3PhysRomRegister() call.
2721	*
2722	* @param pVM VM handle.
2723	* @param GCPhys The physical address of the ROM.
2724	* @param cb The size of the ROM.
2725	* @param pvCopy Pointer to the ROM copy.
2726	*/
2727	REMR3DECL(void) REMR3NotifyPhysRomRegister(PVM pVM, RTGCPHYS GCPhys, RTUINT cb, void *pvCopy)
2728	{
2729	Log(("REMR3NotifyPhysRomRegister: GCPhys=%VGp cb=%d pvCopy=%p\n", GCPhys, cb, pvCopy));
2730	VM_ASSERT_EMT(pVM);
2731
2732	/*
2733	* Validate input - we trust the caller.
2734	*/
2735	Assert(RT_ALIGN_T(GCPhys, PAGE_SIZE, RTGCPHYS) == GCPhys);
2736	Assert(cb);
2737	Assert(RT_ALIGN_Z(cb, PAGE_SIZE) == cb);
2738	Assert(pvCopy);
2739	Assert(RT_ALIGN_P(pvCopy, PAGE_SIZE) == pvCopy);
2740
2741	/*
2742	* Register the rom.
2743	*/
2744	#ifdef PGM_DYNAMIC_RAM_ALLOC
2745	cpu_register_physical_memory(GCPhys, cb, GCPhys \| IO_MEM_ROM);
2746	AssertRelease(pVM->rem.s.cPhysRegistrations < REM_MAX_PHYS_REGISTRATIONS);
2747	pVM->rem.s.aPhysReg[pVM->rem.s.cPhysRegistrations].GCPhys = GCPhys;
2748	pVM->rem.s.aPhysReg[pVM->rem.s.cPhysRegistrations].HCVirt = (RTHCUINTPTR)pvCopy;
2749	pVM->rem.s.aPhysReg[pVM->rem.s.cPhysRegistrations].cb = cb;
2750	pVM->rem.s.cPhysRegistrations++;
2751	#else
2752	AssertRelease(phys_ram_base);
2753	cpu_register_physical_memory(GCPhys, cb, ((uintptr_t)pvCopy - (uintptr_t)phys_ram_base) \| IO_MEM_ROM);
2754	#endif
2755	Log2(("%.64Vhxd\n", (char *)pvCopy + cb - 64));
2756	}
2757
2758
2759	/**
2760	* Notification about a successful MMR3PhysRegister() call.
2761	*
2762	* @param pVM VM Handle.
2763	* @param GCPhys Start physical address.
2764	* @param cb The size of the range.
2765	*/
2766	REMR3DECL(void) REMR3NotifyPhysReserve(PVM pVM, RTGCPHYS GCPhys, RTUINT cb)
2767	{
2768	LogFlow(("REMR3NotifyPhysReserve: GCPhys=%VGp cb=%d\n", GCPhys, cb));
2769	VM_ASSERT_EMT(pVM);
2770
2771	/*
2772	* Validate input - we trust the caller.
2773	*/
2774	Assert(RT_ALIGN_T(GCPhys, PAGE_SIZE, RTGCPHYS) == GCPhys);
2775	Assert(cb);
2776	Assert(RT_ALIGN_Z(cb, PAGE_SIZE) == cb);
2777
2778	/*
2779	* Unassigning the memory.
2780	*/
2781	cpu_register_physical_memory(GCPhys, cb, IO_MEM_UNASSIGNED);
2782	}
2783
2784
2785	/**
2786	* Notification about a successful PGMR3HandlerPhysicalRegister() call.
2787	*
2788	* @param pVM VM Handle.
2789	* @param enmType Handler type.
2790	* @param GCPhys Handler range address.
2791	* @param cb Size of the handler range.
2792	* @param fHasHCHandler Set if the handler has a HC callback function.
2793	*
2794	* @remark MMR3PhysRomRegister assumes that this function will not apply the
2795	* Handler memory type to memory which has no HC handler.
2796	*/
2797	REMR3DECL(void) REMR3NotifyHandlerPhysicalRegister(PVM pVM, PGMPHYSHANDLERTYPE enmType, RTGCPHYS GCPhys, RTGCPHYS cb, bool fHasHCHandler)
2798	{
2799	LogFlow(("REMR3NotifyHandlerPhysicalRegister: enmType=%d GCPhys=%VGp cb=%d fHasHCHandler=%d\n",
2800	enmType, GCPhys, cb, fHasHCHandler));
2801	VM_ASSERT_EMT(pVM);
2802	Assert(RT_ALIGN_T(GCPhys, PAGE_SIZE, RTGCPHYS) == GCPhys);
2803	Assert(RT_ALIGN_T(cb, PAGE_SIZE, RTGCPHYS) == cb);
2804
2805	if (pVM->rem.s.cHandlerNotifications)
2806	REMR3ReplayHandlerNotifications(pVM);
2807
2808	if (enmType == PGMPHYSHANDLERTYPE_MMIO)
2809	cpu_register_physical_memory(GCPhys, cb, pVM->rem.s.iMMIOMemType);
2810	else if (fHasHCHandler)
2811	cpu_register_physical_memory(GCPhys, cb, pVM->rem.s.iHandlerMemType);
2812	}
2813
2814
2815	/**
2816	* Notification about a successful PGMR3HandlerPhysicalDeregister() operation.
2817	*
2818	* @param pVM VM Handle.
2819	* @param enmType Handler type.
2820	* @param GCPhys Handler range address.
2821	* @param cb Size of the handler range.
2822	* @param fHasHCHandler Set if the handler has a HC callback function.
2823	* @param pvHCPtr The HC virtual address corresponding to GCPhys if available.
2824	*/
2825	REMR3DECL(void) REMR3NotifyHandlerPhysicalDeregister(PVM pVM, PGMPHYSHANDLERTYPE enmType, RTGCPHYS GCPhys, RTGCPHYS cb, bool fHasHCHandler, void *pvHCPtr)
2826	{
2827	LogFlow(("REMR3NotifyHandlerPhysicalDeregister: enmType=%d GCPhys=%VGp cb=%d fHasHCHandler=%d pvHCPtr=%p RAM=%08x\n",
2828	enmType, GCPhys, cb, fHasHCHandler, pvHCPtr, MMR3PhysGetRamSize(pVM)));
2829	VM_ASSERT_EMT(pVM);
2830
2831	if (pVM->rem.s.cHandlerNotifications)
2832	REMR3ReplayHandlerNotifications(pVM);
2833
2834	if (enmType == PGMPHYSHANDLERTYPE_MMIO)
2835	cpu_register_physical_memory(GCPhys, cb, IO_MEM_UNASSIGNED);
2836	else if (fHasHCHandler)
2837	{
2838	if (!pvHCPtr)
2839	{
2840	Assert(GCPhys > MMR3PhysGetRamSize(pVM));
2841	cpu_register_physical_memory(GCPhys, cb, IO_MEM_UNASSIGNED);
2842	}
2843	else
2844	{
2845	/* This is not prefect, but it'll do for PD monitoring... */
2846	Assert(cb == PAGE_SIZE);
2847	Assert(RT_ALIGN_T(GCPhys, PAGE_SIZE, RTGCPHYS) == GCPhys);
2848	Assert(remR3HCVirt2GCPhys(cpu_single_env, pvHCPtr) < MMR3PhysGetRamSize(pVM));
2849	#ifdef PGM_DYNAMIC_RAM_ALLOC
2850	cpu_register_physical_memory(GCPhys, cb, GCPhys);
2851	#else
2852	cpu_register_physical_memory(GCPhys, cb, remR3HCVirt2GCPhys(cpu_single_env, pvHCPtr));
2853	#endif
2854	}
2855	}
2856	}
2857
2858
2859	/**
2860	* Notification about a successful PGMR3HandlerPhysicalModify() call.
2861	*
2862	* @param pVM VM Handle.
2863	* @param enmType Handler type.
2864	* @param GCPhysOld Old handler range address.
2865	* @param GCPhysNew New handler range address.
2866	* @param cb Size of the handler range.
2867	* @param fHasHCHandler Set if the handler has a HC callback function.
2868	* @param pvHCPtr The HC virtual address corresponding to GCPhys if available.
2869	*/
2870	REMR3DECL(void) REMR3NotifyHandlerPhysicalModify(PVM pVM, PGMPHYSHANDLERTYPE enmType, RTGCPHYS GCPhysOld, RTGCPHYS GCPhysNew, RTGCPHYS cb, bool fHasHCHandler, void *pvHCPtr)
2871	{
2872	LogFlow(("REMR3NotifyHandlerPhysicalModify: enmType=%d GCPhysOld=%VGp GCPhysNew=%VGp cb=%d fHasHCHandler=%d pvHCPtr=%p\n",
2873	enmType, GCPhysOld, GCPhysNew, cb, fHasHCHandler, pvHCPtr));
2874	VM_ASSERT_EMT(pVM);
2875	AssertReleaseMsg(enmType != PGMPHYSHANDLERTYPE_MMIO, ("enmType=%d\n", enmType));
2876
2877	if (pVM->rem.s.cHandlerNotifications)
2878	REMR3ReplayHandlerNotifications(pVM);
2879
2880	if (fHasHCHandler)
2881	{
2882	/*
2883	* Reset the old page.
2884	*/
2885	if (!pvHCPtr)
2886	cpu_register_physical_memory(GCPhysOld, cb, IO_MEM_UNASSIGNED);
2887	else
2888	{
2889	/* This is not prefect, but it'll do for PD monitoring... */
2890	Assert(cb == PAGE_SIZE);
2891	Assert(RT_ALIGN_T(GCPhysOld, PAGE_SIZE, RTGCPHYS) == GCPhysOld);
2892	Assert(remR3HCVirt2GCPhys(cpu_single_env, pvHCPtr) < MMR3PhysGetRamSize(pVM));
2893	#ifdef PGM_DYNAMIC_RAM_ALLOC
2894	cpu_register_physical_memory(GCPhysOld, cb, GCPhysOld);
2895	#else
2896	cpu_register_physical_memory(GCPhysOld, cb, remR3HCVirt2GCPhys(cpu_single_env, pvHCPtr));
2897	#endif
2898	}
2899
2900	/*
2901	* Update the new page.
2902	*/
2903	Assert(RT_ALIGN_T(GCPhysNew, PAGE_SIZE, RTGCPHYS) == GCPhysNew);
2904	Assert(RT_ALIGN_T(cb, PAGE_SIZE, RTGCPHYS) == cb);
2905	cpu_register_physical_memory(GCPhysNew, cb, pVM->rem.s.iHandlerMemType);
2906	}
2907	}
2908
2909
2910	/**
2911	* Checks if we're handling access to this page or not.
2912	*
2913	* @returns true if we're trapping access.
2914	* @returns false if we aren't.
2915	* @param pVM The VM handle.
2916	* @param GCPhys The physical address.
2917	*
2918	* @remark This function will only work correctly in VBOX_STRICT builds!
2919	*/
2920	REMDECL(bool) REMR3IsPageAccessHandled(PVM pVM, RTGCPHYS GCPhys)
2921	{
2922	#ifdef VBOX_STRICT
2923	if (pVM->rem.s.cHandlerNotifications)
2924	REMR3ReplayHandlerNotifications(pVM);
2925
2926	unsigned long off = get_phys_page_offset(GCPhys);
2927	return (off & PAGE_OFFSET_MASK) == pVM->rem.s.iHandlerMemType
2928	\|\| (off & PAGE_OFFSET_MASK) == pVM->rem.s.iMMIOMemType
2929	\|\| (off & PAGE_OFFSET_MASK) == IO_MEM_ROM;
2930	#else
2931	return false;
2932	#endif
2933	}
2934
2935
2936	/**
2937	* Deals with a rare case in get_phys_addr_code where the code
2938	* is being monitored.
2939	*
2940	* It could also be an MMIO page, in which case we will raise a fatal error.
2941	*
2942	* @returns The physical address corresponding to addr.
2943	* @param env The cpu environment.
2944	* @param addr The virtual address.
2945	* @param pTLBEntry The TLB entry.
2946	*/
2947	target_ulong remR3PhysGetPhysicalAddressCode(CPUState env, target_ulong addr, CPUTLBEntry pTLBEntry)
2948	{
2949	PVM pVM = env->pVM;
2950	if ((pTLBEntry->address & ~TARGET_PAGE_MASK) == pVM->rem.s.iHandlerMemType)
2951	{
2952	target_ulong ret = pTLBEntry->addend + addr;
2953	AssertMsg2("remR3PhysGetPhysicalAddressCode: addr=%VGv address=%VGv addend=%VGp ret=%VGp\n",
2954	(RTGCPTR)addr, (RTGCPTR)pTLBEntry->address, (RTGCPHYS)pTLBEntry->addend, ret);
2955	return ret;
2956	}
2957	LogRel(("\nTrying to execute code with memory type address=%VGv addend=%VGp at %VGv! (iHandlerMemType=%#x iMMIOMemType=%#x)\n"
2958	"*** handlers\n",
2959	(RTGCPTR)pTLBEntry->address, (RTGCPHYS)pTLBEntry->addend, (RTGCPTR)addr, pVM->rem.s.iHandlerMemType, pVM->rem.s.iMMIOMemType));
2960	DBGFR3Info(pVM, "handlers", NULL, DBGFR3InfoLogRelHlp());
2961	LogRel(("*** mmio\n"));
2962	DBGFR3Info(pVM, "mmio", NULL, DBGFR3InfoLogRelHlp());
2963	LogRel(("*** phys\n"));
2964	DBGFR3Info(pVM, "phys", NULL, DBGFR3InfoLogRelHlp());
2965	cpu_abort(env, "Trying to execute code with memory type address=%VGv addend=%VGp at %VGv. (iHandlerMemType=%#x iMMIOMemType=%#x)\n",
2966	(RTGCPTR)pTLBEntry->address, (RTGCPHYS)pTLBEntry->addend, (RTGCPTR)addr, pVM->rem.s.iHandlerMemType, pVM->rem.s.iMMIOMemType);
2967	AssertFatalFailed();
2968	}
2969
2970	/**
2971	* Read guest RAM and ROM.
2972	*
2973	* @param pbSrcPhys The source address. Relative to guest RAM.
2974	* @param pvDst The destination address.
2975	* @param cb Number of bytes
2976	*/
2977	void remR3PhysReadBytes(uint8_t pbSrcPhys, void pvDst, unsigned cb)
2978	{
2979	STAM_PROFILE_ADV_START(&gStatMemRead, a);
2980
2981	/*
2982	* Calc the physical address ('off') and check that it's within the RAM.
2983	* ROM is accessed this way, even if it's not part of the RAM.
2984	*/
2985	/** @todo This is rather ugly, but there's no other way when we don't wish to touch many other files. */
2986	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbSrcPhys);
2987	if (off < (uintptr_t)phys_ram_size)
2988	PGMPhysRead(cpu_single_env->pVM, (RTGCPHYS)off, pvDst, cb);
2989	else
2990	{
2991	/* ROM range outside physical RAM, HC address passed directly */
2992	Log4(("remR3PhysReadBytes ROM: %p\n", pbSrcPhys));
2993	memcpy(pvDst, pbSrcPhys, cb);
2994	}
2995	STAM_PROFILE_ADV_STOP(&gStatMemRead, a);
2996	}
2997
2998	/** @todo r=bird: s/Byte/U8/ s/Word/U16/ s/Dword/U32/, see MMIO and other functions.
2999	* It could be an idea to inline these wrapper functions... */
3000
3001	/**
3002	* Read guest RAM and ROM.
3003	*
3004	* @param pbSrcPhys The source address. Relative to guest RAM.
3005	*/
3006	uint8_t remR3PhysReadUByte(uint8_t *pbSrcPhys)
3007	{
3008	uint8_t val;
3009
3010	STAM_PROFILE_ADV_START(&gStatMemRead, a);
3011
3012	/*
3013	* Calc the physical address ('off') and check that it's within the RAM.
3014	* ROM is accessed this way, even if it's not part of the RAM.
3015	*/
3016	/** @todo This is rather ugly, but there's no other way when we don't wish to touch many other files. */
3017	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbSrcPhys);
3018	if (off < (uintptr_t)phys_ram_size)
3019	val = PGMR3PhysReadByte(cpu_single_env->pVM, (RTGCPHYS)off);
3020	else
3021	{
3022	/* ROM range outside physical RAM, HC address passed directly */
3023	Log4(("remR3PhysReadBytes ROM: %p\n", pbSrcPhys));
3024	val = *pbSrcPhys;
3025	}
3026	STAM_PROFILE_ADV_STOP(&gStatMemRead, a);
3027	return val;
3028	}
3029
3030	/**
3031	* Read guest RAM and ROM.
3032	*
3033	* @param pbSrcPhys The source address. Relative to guest RAM.
3034	*/
3035	int8_t remR3PhysReadSByte(uint8_t *pbSrcPhys)
3036	{
3037	int8_t val;
3038
3039	STAM_PROFILE_ADV_START(&gStatMemRead, a);
3040
3041	/*
3042	* Calc the physical address ('off') and check that it's within the RAM.
3043	* ROM is accessed this way, even if it's not part of the RAM.
3044	*/
3045	/** @todo This is rather ugly, but there's no other way when we don't wish to touch many other files. */
3046	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbSrcPhys);
3047	if (off < (uintptr_t)phys_ram_size)
3048	val = PGMR3PhysReadByte(cpu_single_env->pVM, (RTGCPHYS)off);
3049	else
3050	{
3051	/* ROM range outside physical RAM, HC address passed directly */
3052	Log4(("remR3PhysReadBytes ROM: %p\n", pbSrcPhys));
3053	val = (int8_t )pbSrcPhys;
3054	}
3055	STAM_PROFILE_ADV_STOP(&gStatMemRead, a);
3056	return val;
3057	}
3058
3059	/**
3060	* Read guest RAM and ROM.
3061	*
3062	* @param pbSrcPhys The source address. Relative to guest RAM.
3063	*/
3064	uint16_t remR3PhysReadUWord(uint8_t *pbSrcPhys)
3065	{
3066	uint16_t val;
3067
3068	STAM_PROFILE_ADV_START(&gStatMemRead, a);
3069
3070	/*
3071	* Calc the physical address ('off') and check that it's within the RAM.
3072	* ROM is accessed this way, even if it's not part of the RAM.
3073	*/
3074	/** @todo This is rather ugly, but there's no other way when we don't wish to touch many other files. */
3075	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbSrcPhys);
3076	if (off < (uintptr_t)phys_ram_size)
3077	val = PGMR3PhysReadWord(cpu_single_env->pVM, (RTGCPHYS)off);
3078	else
3079	{
3080	/* ROM range outside physical RAM, HC address passed directly */
3081	Log4(("remR3PhysReadBytes ROM: %p\n", pbSrcPhys));
3082	val = (uint16_t )pbSrcPhys;
3083	}
3084	STAM_PROFILE_ADV_STOP(&gStatMemRead, a);
3085	return val;
3086	}
3087
3088	/**
3089	* Read guest RAM and ROM.
3090	*
3091	* @param pbSrcPhys The source address. Relative to guest RAM.
3092	*/
3093	int16_t remR3PhysReadSWord(uint8_t *pbSrcPhys)
3094	{
3095	int16_t val;
3096
3097	STAM_PROFILE_ADV_START(&gStatMemRead, a);
3098
3099	/*
3100	* Calc the physical address ('off') and check that it's within the RAM.
3101	* ROM is accessed this way, even if it's not part of the RAM.
3102	*/
3103	/** @todo This is rather ugly, but there's no other way when we don't wish to touch many other files. */
3104	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbSrcPhys);
3105	if (off < (uintptr_t)phys_ram_size)
3106	val = PGMR3PhysReadWord(cpu_single_env->pVM, (RTGCPHYS)off);
3107	else
3108	{
3109	/* ROM range outside physical RAM, HC address passed directly */
3110	Log4(("remR3PhysReadBytes ROM: %p\n", pbSrcPhys));
3111	val = (int16_t )pbSrcPhys;
3112	}
3113	STAM_PROFILE_ADV_STOP(&gStatMemRead, a);
3114	return val;
3115	}
3116
3117	/**
3118	* Read guest RAM and ROM.
3119	*
3120	* @param pbSrcPhys The source address. Relative to guest RAM.
3121	*/
3122	uint32_t remR3PhysReadULong(uint8_t *pbSrcPhys)
3123	{
3124	uint32_t val;
3125
3126	STAM_PROFILE_ADV_START(&gStatMemRead, a);
3127
3128	/*
3129	* Calc the physical address ('off') and check that it's within the RAM.
3130	* ROM is accessed this way, even if it's not part of the RAM.
3131	*/
3132	/** @todo This is rather ugly, but there's no other way when we don't wish to touch many other files. */
3133	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbSrcPhys);
3134	if (off < (uintptr_t)phys_ram_size)
3135	val = PGMR3PhysReadDword(cpu_single_env->pVM, (RTGCPHYS)off);
3136	else
3137	{
3138	/* ROM range outside physical RAM, HC address passed directly */
3139	Log4(("remR3PhysReadBytes ROM: %p\n", pbSrcPhys));
3140	val = (uint32_t )pbSrcPhys;
3141	}
3142	STAM_PROFILE_ADV_STOP(&gStatMemRead, a);
3143	return val;
3144	}
3145
3146	/**
3147	* Read guest RAM and ROM.
3148	*
3149	* @param pbSrcPhys The source address. Relative to guest RAM.
3150	*/
3151	int32_t remR3PhysReadSLong(uint8_t *pbSrcPhys)
3152	{
3153	int32_t val;
3154
3155	STAM_PROFILE_ADV_START(&gStatMemRead, a);
3156
3157	/*
3158	* Calc the physical address ('off') and check that it's within the RAM.
3159	* ROM is accessed this way, even if it's not part of the RAM.
3160	*/
3161	/** @todo This is rather ugly, but there's no other way when we don't wish to touch many other files. */
3162	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbSrcPhys);
3163	if (off < (uintptr_t)phys_ram_size)
3164	val = PGMR3PhysReadDword(cpu_single_env->pVM, (RTGCPHYS)off);
3165	else
3166	{
3167	/* ROM range outside physical RAM, HC address passed directly */
3168	Log4(("remR3PhysReadBytes ROM: %p\n", pbSrcPhys));
3169	val = (int32_t )pbSrcPhys;
3170	}
3171	STAM_PROFILE_ADV_STOP(&gStatMemRead, a);
3172	return val;
3173	}
3174
3175	/**
3176	* Write guest RAM.
3177	*
3178	* @param pbDstPhys The destination address. Relative to guest RAM.
3179	* @param pvSrc The source address.
3180	* @param cb Number of bytes to write
3181	*/
3182	void remR3PhysWriteBytes(uint8_t pbDstPhys, const void pvSrc, unsigned cb)
3183	{
3184	STAM_PROFILE_ADV_START(&gStatMemWrite, a);
3185	/*
3186	* Calc the physical address ('off') and check that it's within the RAM.
3187	*/
3188	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbDstPhys);
3189	if (off < (uintptr_t)phys_ram_size)
3190	PGMPhysWrite(cpu_single_env->pVM, (RTGCPHYS)off, pvSrc, cb);
3191	else
3192	AssertMsgFailed(("pbDstPhys=%p off=%p cb=%d\n", pbDstPhys, off, cb));
3193	STAM_PROFILE_ADV_STOP(&gStatMemWrite, a);
3194	}
3195
3196
3197	/**
3198	* Write guest RAM.
3199	*
3200	* @param pbDstPhys The destination address. Relative to guest RAM.
3201	* @param val Value
3202	*/
3203	void remR3PhysWriteByte(uint8_t *pbDstPhys, uint8_t val)
3204	{
3205	STAM_PROFILE_ADV_START(&gStatMemWrite, a);
3206	/*
3207	* Calc the physical address ('off') and check that it's within the RAM.
3208	*/
3209	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbDstPhys);
3210	if (off < (uintptr_t)phys_ram_size)
3211	PGMR3PhysWriteByte(cpu_single_env->pVM, (RTGCPHYS)off, val);
3212	else
3213	AssertMsgFailed(("pbDstPhys=%p off=%p cb=%d\n", pbDstPhys, off, 1));
3214	STAM_PROFILE_ADV_STOP(&gStatMemWrite, a);
3215	}
3216
3217	/**
3218	* Write guest RAM.
3219	*
3220	* @param pbDstPhys The destination address. Relative to guest RAM.
3221	* @param val Value
3222	*/
3223	void remR3PhysWriteWord(uint8_t *pbDstPhys, uint16_t val)
3224	{
3225	STAM_PROFILE_ADV_START(&gStatMemWrite, a);
3226	/*
3227	* Calc the physical address ('off') and check that it's within the RAM.
3228	*/
3229	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbDstPhys);
3230	if (off < (uintptr_t)phys_ram_size)
3231	PGMR3PhysWriteWord(cpu_single_env->pVM, (RTGCPHYS)off, val);
3232	else
3233	AssertMsgFailed(("pbDstPhys=%p off=%p cb=%d\n", pbDstPhys, off, 2));
3234	STAM_PROFILE_ADV_STOP(&gStatMemWrite, a);
3235	}
3236
3237	/**
3238	* Write guest RAM.
3239	*
3240	* @param pbDstPhys The destination address. Relative to guest RAM.
3241	* @param val Value
3242	*/
3243	void remR3PhysWriteDword(uint8_t *pbDstPhys, uint32_t val)
3244	{
3245	STAM_PROFILE_ADV_START(&gStatMemWrite, a);
3246	/*
3247	* Calc the physical address ('off') and check that it's within the RAM.
3248	*/
3249	uintptr_t off = remR3HCVirt2GCPhys(cpu_single_env, pbDstPhys);
3250	if (off < (uintptr_t)phys_ram_size)
3251	PGMR3PhysWriteDword(cpu_single_env->pVM, (RTGCPHYS)off, val);
3252	else
3253	AssertMsgFailed(("pbDstPhys=%p off=%p cb=%d\n", pbDstPhys, off, 4));
3254	STAM_PROFILE_ADV_STOP(&gStatMemWrite, a);
3255	}
3256
3257
3258
3259	#undef LOG_GROUP
3260	#define LOG_GROUP LOG_GROUP_REM_MMIO
3261
3262	/** Read MMIO memory. */
3263	static uint32_t remR3MMIOReadU8(void *pvVM, target_phys_addr_t GCPhys)
3264	{
3265	uint32_t u32 = 0;
3266	int rc = IOMMMIORead((PVM)pvVM, GCPhys, &u32, 1);
3267	AssertMsg(rc == VINF_SUCCESS, ("rc=%Vrc\n", rc)); NOREF(rc);
3268	Log2(("remR3MMIOReadU8: GCPhys=%VGp -> %02x\n", GCPhys, u32));
3269	return u32;
3270	}
3271
3272	/** Read MMIO memory. */
3273	static uint32_t remR3MMIOReadU16(void *pvVM, target_phys_addr_t GCPhys)
3274	{
3275	uint32_t u32 = 0;
3276	int rc = IOMMMIORead((PVM)pvVM, GCPhys, &u32, 2);
3277	AssertMsg(rc == VINF_SUCCESS, ("rc=%Vrc\n", rc)); NOREF(rc);
3278	Log2(("remR3MMIOReadU16: GCPhys=%VGp -> %04x\n", GCPhys, u32));
3279	return u32;
3280	}
3281
3282	/** Read MMIO memory. */
3283	static uint32_t remR3MMIOReadU32(void *pvVM, target_phys_addr_t GCPhys)
3284	{
3285	uint32_t u32 = 0;
3286	int rc = IOMMMIORead((PVM)pvVM, GCPhys, &u32, 4);
3287	AssertMsg(rc == VINF_SUCCESS, ("rc=%Vrc\n", rc)); NOREF(rc);
3288	Log2(("remR3MMIOReadU32: GCPhys=%VGp -> %08x\n", GCPhys, u32));
3289	return u32;
3290	}
3291
3292	/** Write to MMIO memory. */
3293	static void remR3MMIOWriteU8(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32)
3294	{
3295	Log2(("remR3MMIOWriteU8: GCPhys=%VGp u32=%#x\n", GCPhys, u32));
3296	int rc = IOMMMIOWrite((PVM)pvVM, GCPhys, u32, 1);
3297	AssertMsg(rc == VINF_SUCCESS, ("rc=%Vrc\n", rc)); NOREF(rc);
3298	}
3299
3300	/** Write to MMIO memory. */
3301	static void remR3MMIOWriteU16(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32)
3302	{
3303	Log2(("remR3MMIOWriteU16: GCPhys=%VGp u32=%#x\n", GCPhys, u32));
3304	int rc = IOMMMIOWrite((PVM)pvVM, GCPhys, u32, 2);
3305	AssertMsg(rc == VINF_SUCCESS, ("rc=%Vrc\n", rc)); NOREF(rc);
3306	}
3307
3308	/** Write to MMIO memory. */
3309	static void remR3MMIOWriteU32(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32)
3310	{
3311	Log2(("remR3MMIOWriteU32: GCPhys=%VGp u32=%#x\n", GCPhys, u32));
3312	int rc = IOMMMIOWrite((PVM)pvVM, GCPhys, u32, 4);
3313	AssertMsg(rc == VINF_SUCCESS, ("rc=%Vrc\n", rc)); NOREF(rc);
3314	}
3315
3316
3317	#undef LOG_GROUP
3318	#define LOG_GROUP LOG_GROUP_REM_HANDLER
3319
3320	/* !!!WARNING!!! This is extremely hackish right now, we assume it's only for LFB access! !!!WARNING!!! */
3321
3322	static uint32_t remR3HandlerReadU8(void *pvVM, target_phys_addr_t GCPhys)
3323	{
3324	Log2(("remR3HandlerReadU8: GCPhys=%VGp\n", GCPhys));
3325	uint8_t u8;
3326	PGMPhysRead((PVM)pvVM, GCPhys, &u8, sizeof(u8));
3327	return u8;
3328	}
3329
3330	static uint32_t remR3HandlerReadU16(void *pvVM, target_phys_addr_t GCPhys)
3331	{
3332	Log2(("remR3HandlerReadU16: GCPhys=%VGp\n", GCPhys));
3333	uint16_t u16;
3334	PGMPhysRead((PVM)pvVM, GCPhys, &u16, sizeof(u16));
3335	return u16;
3336	}
3337
3338	static uint32_t remR3HandlerReadU32(void *pvVM, target_phys_addr_t GCPhys)
3339	{
3340	Log2(("remR3HandlerReadU32: GCPhys=%VGp\n", GCPhys));
3341	uint32_t u32;
3342	PGMPhysRead((PVM)pvVM, GCPhys, &u32, sizeof(u32));
3343	return u32;
3344	}
3345
3346	static void remR3HandlerWriteU8(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32)
3347	{
3348	Log2(("remR3HandlerWriteU8: GCPhys=%VGp u32=%#x\n", GCPhys, u32));
3349	PGMPhysWrite((PVM)pvVM, GCPhys, &u32, sizeof(uint8_t));
3350	}
3351
3352	static void remR3HandlerWriteU16(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32)
3353	{
3354	Log2(("remR3HandlerWriteU16: GCPhys=%VGp u32=%#x\n", GCPhys, u32));
3355	PGMPhysWrite((PVM)pvVM, GCPhys, &u32, sizeof(uint16_t));
3356	}
3357
3358	static void remR3HandlerWriteU32(void *pvVM, target_phys_addr_t GCPhys, uint32_t u32)
3359	{
3360	Log2(("remR3HandlerWriteU32: GCPhys=%VGp u32=%#x\n", GCPhys, u32));
3361	PGMPhysWrite((PVM)pvVM, GCPhys, &u32, sizeof(uint32_t));
3362	}
3363
3364	/* -+- disassembly -+- */
3365
3366	#undef LOG_GROUP
3367	#define LOG_GROUP LOG_GROUP_REM_DISAS
3368
3369
3370	/**
3371	* Enables or disables singled stepped disassembly.
3372	*
3373	* @returns VBox status code.
3374	* @param pVM VM handle.
3375	* @param fEnable To enable set this flag, to disable clear it.
3376	*/
3377	static DECLCALLBACK(int) remR3DisasEnableStepping(PVM pVM, bool fEnable)
3378	{
3379	LogFlow(("remR3DisasEnableStepping: fEnable=%d\n", fEnable));
3380	VM_ASSERT_EMT(pVM);
3381
3382	if (fEnable)
3383	pVM->rem.s.Env.state \|= CPU_EMULATE_SINGLE_STEP;
3384	else
3385	pVM->rem.s.Env.state &= ~CPU_EMULATE_SINGLE_STEP;
3386	return VINF_SUCCESS;
3387	}
3388
3389
3390	/**
3391	* Enables or disables singled stepped disassembly.
3392	*
3393	* @returns VBox status code.
3394	* @param pVM VM handle.
3395	* @param fEnable To enable set this flag, to disable clear it.
3396	*/
3397	REMR3DECL(int) REMR3DisasEnableStepping(PVM pVM, bool fEnable)
3398	{
3399	PVMREQ pReq;
3400	int rc;
3401
3402	LogFlow(("REMR3DisasEnableStepping: fEnable=%d\n", fEnable));
3403	if (VM_IS_EMT(pVM))
3404	return remR3DisasEnableStepping(pVM, fEnable);
3405
3406	rc = VMR3ReqCall(pVM, &pReq, RT_INDEFINITE_WAIT, (PFNRT)remR3DisasEnableStepping, 2, pVM, fEnable);
3407	AssertRC(rc);
3408	if (VBOX_SUCCESS(rc))
3409	rc = pReq->iStatus;
3410	VMR3ReqFree(pReq);
3411	return rc;
3412	}
3413
3414
3415	#ifdef VBOX_WITH_DEBUGGER
3416	/**
3417	* External Debugger Command: .remstep [on\|off\|1\|0]
3418	*/
3419	static DECLCALLBACK(int) remR3CmdDisasEnableStepping(PCDBGCCMD pCmd, PDBGCCMDHLP pCmdHlp, PVM pVM, PCDBGCVAR paArgs, unsigned cArgs, PDBGCVAR pResult)
3420	{
3421	bool fEnable;
3422	int rc;
3423
3424	/* print status */
3425	if (cArgs == 0)
3426	return pCmdHlp->pfnPrintf(pCmdHlp, NULL, "DisasStepping is %s\n",
3427	pVM->rem.s.Env.state & CPU_EMULATE_SINGLE_STEP ? "enabled" : "disabled");
3428
3429	/* convert the argument and change the mode. */
3430	rc = pCmdHlp->pfnVarToBool(pCmdHlp, &paArgs[0], &fEnable);
3431	if (VBOX_FAILURE(rc))
3432	return pCmdHlp->pfnVBoxError(pCmdHlp, rc, "boolean conversion failed!\n");
3433	rc = REMR3DisasEnableStepping(pVM, fEnable);
3434	if (VBOX_FAILURE(rc))
3435	return pCmdHlp->pfnVBoxError(pCmdHlp, rc, "REMR3DisasEnableStepping failed!\n");
3436	return rc;
3437	}
3438	#endif
3439
3440
3441	/**
3442	* Disassembles n instructions and prints them to the log.
3443	*
3444	* @returns Success indicator.
3445	* @param env Pointer to the recompiler CPU structure.
3446	* @param f32BitCode Indicates that whether or not the code should
3447	* be disassembled as 16 or 32 bit. If -1 the CS
3448	* selector will be inspected.
3449	* @param nrInstructions Nr of instructions to disassemble
3450	* @param pszPrefix
3451	* @remark not currently used for anything but ad-hoc debugging.
3452	*/
3453	bool remR3DisasBlock(CPUState env, int f32BitCode, int nrInstructions, char pszPrefix)
3454	{
3455	int i;
3456
3457	/*
3458	* Determin 16/32 bit mode.
3459	*/
3460	if (f32BitCode == -1)
3461	f32BitCode = !!(env->segs[R_CS].flags & X86_DESC_DB); /** @todo is this right?!!?!?!?!? */
3462
3463	/*
3464	* Convert cs:eip to host context address.
3465	* We don't care to much about cross page correctness presently.
3466	*/
3467	RTGCPTR GCPtrPC = env->segs[R_CS].base + env->eip;
3468	void *pvPC;
3469	if (f32BitCode && (env->cr[0] & (X86_CR0_PE \| X86_CR0_PG)) == (X86_CR0_PE \| X86_CR0_PG))
3470	{
3471	/* convert eip to physical address. */
3472	int rc = PGMPhysGCPtr2HCPtrByGstCR3(env->pVM,
3473	GCPtrPC,
3474	env->cr[3],
3475	env->cr[4] & (X86_CR4_PSE \| X86_CR4_PAE), /** @todo add longmode flag */
3476	&pvPC);
3477	if (VBOX_FAILURE(rc))
3478	{
3479	if (!PATMIsPatchGCAddr(env->pVM, GCPtrPC))
3480	return false;
3481	pvPC = (char *)PATMR3QueryPatchMemHC(env->pVM, NULL)
3482	+ (GCPtrPC - PATMR3QueryPatchMemGC(env->pVM, NULL));
3483	}
3484	}
3485	else
3486	{
3487	/* physical address */
3488	int rc = PGMPhysGCPhys2HCPtr(env->pVM, (RTGCPHYS)GCPtrPC, &pvPC);
3489	if (VBOX_FAILURE(rc))
3490	return false;
3491	}
3492
3493	/*
3494	* Disassemble.
3495	*/
3496	RTINTPTR off = env->eip - (RTINTPTR)pvPC;
3497	DISCPUSTATE Cpu;
3498	Cpu.mode = f32BitCode ? CPUMODE_32BIT : CPUMODE_16BIT;
3499	Cpu.pfnReadBytes = NULL; /** @todo make cs:eip reader for the disassembler. */
3500	//Cpu.dwUserData[0] = (uintptr_t)pVM;
3501	//Cpu.dwUserData[1] = (uintptr_t)pvPC;
3502	//Cpu.dwUserData[2] = GCPtrPC;
3503
3504	for (i=0;i<nrInstructions;i++)
3505	{
3506	char szOutput[256];
3507	uint32_t cbOp;
3508	if (!DISInstr(&Cpu, (uintptr_t)pvPC, off, &cbOp, &szOutput[0]))
3509	return false;
3510	if (pszPrefix)
3511	Log(("%s: %s", pszPrefix, szOutput));
3512	else
3513	Log(("%s", szOutput));
3514
3515	pvPC += cbOp;
3516	}
3517	return true;
3518	}
3519
3520
3521	/** @todo need to test the new code, using the old code in the mean while. */
3522	#define USE_OLD_DUMP_AND_DISASSEMBLY
3523
3524	/**
3525	* Disassembles one instruction and prints it to the log.
3526	*
3527	* @returns Success indicator.
3528	* @param env Pointer to the recompiler CPU structure.
3529	* @param f32BitCode Indicates that whether or not the code should
3530	* be disassembled as 16 or 32 bit. If -1 the CS
3531	* selector will be inspected.
3532	* @param pszPrefix
3533	*/
3534	bool remR3DisasInstr(CPUState env, int f32BitCode, char pszPrefix)
3535	{
3536	#ifdef USE_OLD_DUMP_AND_DISASSEMBLY
3537	PVM pVM = env->pVM;
3538
3539	/*
3540	* Determin 16/32 bit mode.
3541	*/
3542	if (f32BitCode == -1)
3543	f32BitCode = !!(env->segs[R_CS].flags & X86_DESC_DB); /** @todo is this right?!!?!?!?!? */
3544
3545	/*
3546	* Log registers
3547	*/
3548	if (LogIs2Enabled())
3549	{
3550	remR3StateUpdate(pVM);
3551	DBGFR3InfoLog(pVM, "cpumguest", pszPrefix);
3552	}
3553
3554	/*
3555	* Convert cs:eip to host context address.
3556	* We don't care to much about cross page correctness presently.
3557	*/
3558	RTGCPTR GCPtrPC = env->segs[R_CS].base + env->eip;
3559	void *pvPC;
3560	if ((env->cr[0] & (X86_CR0_PE \| X86_CR0_PG)) == (X86_CR0_PE \| X86_CR0_PG))
3561	{
3562	/* convert eip to physical address. */
3563	int rc = PGMPhysGCPtr2HCPtrByGstCR3(pVM,
3564	GCPtrPC,
3565	env->cr[3],
3566	env->cr[4] & (X86_CR4_PSE \| X86_CR4_PAE),
3567	&pvPC);
3568	if (VBOX_FAILURE(rc))
3569	{
3570	if (!PATMIsPatchGCAddr(pVM, GCPtrPC))
3571	return false;
3572	pvPC = (char *)PATMR3QueryPatchMemHC(pVM, NULL)
3573	+ (GCPtrPC - PATMR3QueryPatchMemGC(pVM, NULL));
3574	}
3575	}
3576	else
3577	{
3578
3579	/* physical address */
3580	int rc = PGMPhysGCPhys2HCPtr(pVM, (RTGCPHYS)GCPtrPC, &pvPC);
3581	if (VBOX_FAILURE(rc))
3582	return false;
3583	}
3584
3585	/*
3586	* Disassemble.
3587	*/
3588	RTINTPTR off = env->eip - (RTINTPTR)pvPC;
3589	DISCPUSTATE Cpu;
3590	Cpu.mode = f32BitCode ? CPUMODE_32BIT : CPUMODE_16BIT;
3591	Cpu.pfnReadBytes = NULL; /** @todo make cs:eip reader for the disassembler. */
3592	//Cpu.dwUserData[0] = (uintptr_t)pVM;
3593	//Cpu.dwUserData[1] = (uintptr_t)pvPC;
3594	//Cpu.dwUserData[2] = GCPtrPC;
3595	char szOutput[256];
3596	uint32_t cbOp;
3597	if (!DISInstr(&Cpu, (uintptr_t)pvPC, off, &cbOp, &szOutput[0]))
3598	return false;
3599
3600	if (!f32BitCode)
3601	{
3602	if (pszPrefix)
3603	Log(("%s: %04X:%s", pszPrefix, env->segs[R_CS].selector, szOutput));
3604	else
3605	Log(("%04X:%s", env->segs[R_CS].selector, szOutput));
3606	}
3607	else
3608	{
3609	if (pszPrefix)
3610	Log(("%s: %s", pszPrefix, szOutput));
3611	else
3612	Log(("%s", szOutput));
3613	}
3614	return true;
3615
3616	#else /* !USE_OLD_DUMP_AND_DISASSEMBLY */
3617	PVM pVM = env->pVM;
3618	const bool fLog = LogIsEnabled();
3619	const bool fLog2 = LogIs2Enabled();
3620	int rc = VINF_SUCCESS;
3621
3622	/*
3623	* Don't bother if there ain't any log output to do.
3624	*/
3625	if (!fLog && !fLog2)
3626	return true;
3627
3628	/*
3629	* Update the state so DBGF reads the correct register values.
3630	*/
3631	remR3StateUpdate(pVM);
3632
3633	/*
3634	* Log registers if requested.
3635	*/
3636	if (!fLog2)
3637	DBGFR3InfoLog(pVM, "cpumguest", pszPrefix);
3638
3639	/*
3640	* Disassemble to log.
3641	*/
3642	if (fLog)
3643	rc = DBGFR3DisasInstrCurrentLogInternal(pVM, pszPrefix);
3644
3645	return VBOX_SUCCESS(rc);
3646	#endif
3647	}
3648
3649
3650	/**
3651	* Disassemble recompiled code.
3652	*
3653	* @param phFileIgnored Ignored, logfile usually.
3654	* @param pvCode Pointer to the code block.
3655	* @param cb Size of the code block.
3656	*/
3657	void disas(FILE phFileIgnored, void pvCode, unsigned long cb)
3658	{
3659	if (LogIs2Enabled())
3660	{
3661	unsigned off = 0;
3662	char szOutput[256];
3663	DISCPUSTATE Cpu = {0};
3664	Cpu.mode = CPUMODE_32BIT;
3665
3666	RTLogPrintf("Recompiled Code: %p %#lx (%ld) bytes\n", pvCode, cb, cb);
3667	while (off < cb)
3668	{
3669	uint32_t cbInstr;
3670	if (DISInstr(&Cpu, (uintptr_t)pvCode + off, 0, &cbInstr, szOutput))
3671	RTLogPrintf("%s", szOutput);
3672	else
3673	{
3674	RTLogPrintf("disas error\n");
3675	cbInstr = 1;
3676	}
3677	off += cbInstr;
3678	}
3679	}
3680	NOREF(phFileIgnored);
3681	}
3682
3683
3684	/**
3685	* Disassemble guest code.
3686	*
3687	* @param phFileIgnored Ignored, logfile usually.
3688	* @param uCode The guest address of the code to disassemble. (flat?)
3689	* @param cb Number of bytes to disassemble.
3690	* @param fFlags Flags, probably something which tells if this is 16, 32 or 64 bit code.
3691	*/
3692	void target_disas(FILE *phFileIgnored, target_ulong uCode, target_ulong cb, int fFlags)
3693	{
3694	if (LogIs2Enabled())
3695	{
3696	PVM pVM = cpu_single_env->pVM;
3697
3698	/*
3699	* Update the state so DBGF reads the correct register values (flags).
3700	*/
3701	remR3StateUpdate(pVM);
3702
3703	/*
3704	* Do the disassembling.
3705	*/
3706	RTLogPrintf("Guest Code: PC=%VGp #VGp (%VGp) bytes fFlags=%d\n", uCode, cb, cb, fFlags);
3707	RTSEL cs = cpu_single_env->segs[R_CS].selector;
3708	RTGCUINTPTR eip = uCode - cpu_single_env->segs[R_CS].base;
3709	for (;;)
3710	{
3711	char szBuf[256];
3712	size_t cbInstr;
3713	int rc = DBGFR3DisasInstrEx(pVM,
3714	cs,
3715	eip,
3716	0,
3717	szBuf, sizeof(szBuf),
3718	&cbInstr);
3719	if (VBOX_SUCCESS(rc))
3720	RTLogPrintf("%VGp %s\n", uCode, szBuf);
3721	else
3722	{
3723	RTLogPrintf("%VGp %04x:%VGp: %s\n", uCode, cs, eip, szBuf);
3724	cbInstr = 1;
3725	}
3726
3727	/* next */
3728	if (cb <= cbInstr)
3729	break;
3730	cb -= cbInstr;
3731	uCode += cbInstr;
3732	eip += cbInstr;
3733	}
3734	}
3735	NOREF(phFileIgnored);
3736	}
3737
3738
3739	/**
3740	* Looks up a guest symbol.
3741	*
3742	* @returns Pointer to symbol name. This is a static buffer.
3743	* @param orig_addr The address in question.
3744	*/
3745	const char *lookup_symbol(target_ulong orig_addr)
3746	{
3747	RTGCINTPTR off = 0;
3748	DBGFSYMBOL Sym;
3749	PVM pVM = cpu_single_env->pVM;
3750	int rc = DBGFR3SymbolByAddr(pVM, orig_addr, &off, &Sym);
3751	if (VBOX_SUCCESS(rc))
3752	{
3753	static char szSym[sizeof(Sym.szName) + 48];
3754	if (!off)
3755	RTStrPrintf(szSym, sizeof(szSym), "%s\n", Sym.szName);
3756	else if (off > 0)
3757	RTStrPrintf(szSym, sizeof(szSym), "%s+%x\n", Sym.szName, off);
3758	else
3759	RTStrPrintf(szSym, sizeof(szSym), "%s-%x\n", Sym.szName, -off);
3760	return szSym;
3761	}
3762	return "<N/A>";
3763	}
3764
3765
3766	#undef LOG_GROUP
3767	#define LOG_GROUP LOG_GROUP_REM
3768
3769
3770	/* -+- FF notifications -+- */
3771
3772
3773	/**
3774	* Notification about a pending interrupt.
3775	*
3776	* @param pVM VM Handle.
3777	* @param u8Interrupt Interrupt
3778	* @thread The emulation thread.
3779	*/
3780	REMR3DECL(void) REMR3NotifyPendingInterrupt(PVM pVM, uint8_t u8Interrupt)
3781	{
3782	Assert(pVM->rem.s.u32PendingInterrupt == REM_NO_PENDING_IRQ);
3783	pVM->rem.s.u32PendingInterrupt = u8Interrupt;
3784	}
3785
3786	/**
3787	* Notification about a pending interrupt.
3788	*
3789	* @returns Pending interrupt or REM_NO_PENDING_IRQ
3790	* @param pVM VM Handle.
3791	* @thread The emulation thread.
3792	*/
3793	REMR3DECL(uint32_t) REMR3QueryPendingInterrupt(PVM pVM)
3794	{
3795	return pVM->rem.s.u32PendingInterrupt;
3796	}
3797
3798	/**
3799	* Notification about the interrupt FF being set.
3800	*
3801	* @param pVM VM Handle.
3802	* @thread The emulation thread.
3803	*/
3804	REMR3DECL(void) REMR3NotifyInterruptSet(PVM pVM)
3805	{
3806	LogFlow(("REMR3NotifyInterruptSet: fInRem=%d interrupts %s\n", pVM->rem.s.fInREM,
3807	(pVM->rem.s.Env.eflags & IF_MASK) && !(pVM->rem.s.Env.hflags & HF_INHIBIT_IRQ_MASK) ? "enabled" : "disabled"));
3808	if (pVM->rem.s.fInREM)
3809	{
3810	if (VM_IS_EMT(pVM))
3811	cpu_interrupt(cpu_single_env, CPU_INTERRUPT_HARD);
3812	else
3813	ASMAtomicOrS32(&cpu_single_env->interrupt_request, CPU_INTERRUPT_EXTERNAL_HARD);
3814	}
3815	}
3816
3817
3818	/**
3819	* Notification about the interrupt FF being set.
3820	*
3821	* @param pVM VM Handle.
3822	* @thread The emulation thread.
3823	*/
3824	REMR3DECL(void) REMR3NotifyInterruptClear(PVM pVM)
3825	{
3826	LogFlow(("REMR3NotifyInterruptClear:\n"));
3827	VM_ASSERT_EMT(pVM);
3828	if (pVM->rem.s.fInREM)
3829	cpu_reset_interrupt(cpu_single_env, CPU_INTERRUPT_HARD);
3830	}
3831
3832
3833	/**
3834	* Notification about pending timer(s).
3835	*
3836	* @param pVM VM Handle.
3837	* @thread Any.
3838	*/
3839	REMR3DECL(void) REMR3NotifyTimerPending(PVM pVM)
3840	{
3841	#ifndef DEBUG_bird
3842	LogFlow(("REMR3NotifyTimerPending: fInRem=%d\n", pVM->rem.s.fInREM));
3843	#endif
3844	if (pVM->rem.s.fInREM)
3845	{
3846	if (VM_IS_EMT(pVM))
3847	cpu_interrupt(cpu_single_env, CPU_INTERRUPT_EXIT);
3848	else
3849	ASMAtomicOrS32(&cpu_single_env->interrupt_request, CPU_INTERRUPT_EXTERNAL_TIMER);
3850	}
3851	}
3852
3853
3854	/**
3855	* Notification about pending DMA transfers.
3856	*
3857	* @param pVM VM Handle.
3858	* @thread Any.
3859	*/
3860	REMR3DECL(void) REMR3NotifyDmaPending(PVM pVM)
3861	{
3862	LogFlow(("REMR3NotifyDmaPending: fInRem=%d\n", pVM->rem.s.fInREM));
3863	if (pVM->rem.s.fInREM)
3864	{
3865	if (VM_IS_EMT(pVM))
3866	cpu_interrupt(cpu_single_env, CPU_INTERRUPT_EXIT);
3867	else
3868	ASMAtomicOrS32(&cpu_single_env->interrupt_request, CPU_INTERRUPT_EXTERNAL_DMA);
3869	}
3870	}
3871
3872
3873	/**
3874	* Notification about pending timer(s).
3875	*
3876	* @param pVM VM Handle.
3877	* @thread Any.
3878	*/
3879	REMR3DECL(void) REMR3NotifyQueuePending(PVM pVM)
3880	{
3881	LogFlow(("REMR3NotifyQueuePending: fInRem=%d\n", pVM->rem.s.fInREM));
3882	if (pVM->rem.s.fInREM)
3883	{
3884	if (VM_IS_EMT(pVM))
3885	cpu_interrupt(cpu_single_env, CPU_INTERRUPT_EXIT);
3886	else
3887	ASMAtomicOrS32(&cpu_single_env->interrupt_request, CPU_INTERRUPT_EXTERNAL_EXIT);
3888	}
3889	}
3890
3891
3892	/**
3893	* Notification about pending FF set by an external thread.
3894	*
3895	* @param pVM VM handle.
3896	* @thread Any.
3897	*/
3898	REMR3DECL(void) REMR3NotifyFF(PVM pVM)
3899	{
3900	LogFlow(("REMR3NotifyFF: fInRem=%d\n", pVM->rem.s.fInREM));
3901	if (pVM->rem.s.fInREM)
3902	{
3903	if (VM_IS_EMT(pVM))
3904	cpu_interrupt(cpu_single_env, CPU_INTERRUPT_EXIT);
3905	else
3906	ASMAtomicOrS32(&cpu_single_env->interrupt_request, CPU_INTERRUPT_EXTERNAL_EXIT);
3907	}
3908	}
3909
3910
3911	#ifdef VBOX_WITH_STATISTICS
3912	void remR3ProfileStart(int statcode)
3913	{
3914	STAMPROFILEADV *pStat;
3915	switch(statcode)
3916	{
3917	case STATS_EMULATE_SINGLE_INSTR:
3918	pStat = &gStatExecuteSingleInstr;
3919	break;
3920	case STATS_QEMU_COMPILATION:
3921	pStat = &gStatCompilationQEmu;
3922	break;
3923	case STATS_QEMU_RUN_EMULATED_CODE:
3924	pStat = &gStatRunCodeQEmu;
3925	break;
3926	case STATS_QEMU_TOTAL:
3927	pStat = &gStatTotalTimeQEmu;
3928	break;
3929	case STATS_QEMU_RUN_TIMERS:
3930	pStat = &gStatTimers;
3931	break;
3932	case STATS_TLB_LOOKUP:
3933	pStat= &gStatTBLookup;
3934	break;
3935	case STATS_IRQ_HANDLING:
3936	pStat= &gStatIRQ;
3937	break;
3938	case STATS_RAW_CHECK:
3939	pStat = &gStatRawCheck;
3940	break;
3941
3942	default:
3943	AssertMsgFailed(("unknown stat %d\n", statcode));
3944	return;
3945	}
3946	STAM_PROFILE_ADV_START(pStat, a);
3947	}
3948
3949
3950	void remR3ProfileStop(int statcode)
3951	{
3952	STAMPROFILEADV *pStat;
3953	switch(statcode)
3954	{
3955	case STATS_EMULATE_SINGLE_INSTR:
3956	pStat = &gStatExecuteSingleInstr;
3957	break;
3958	case STATS_QEMU_COMPILATION:
3959	pStat = &gStatCompilationQEmu;
3960	break;
3961	case STATS_QEMU_RUN_EMULATED_CODE:
3962	pStat = &gStatRunCodeQEmu;
3963	break;
3964	case STATS_QEMU_TOTAL:
3965	pStat = &gStatTotalTimeQEmu;
3966	break;
3967	case STATS_QEMU_RUN_TIMERS:
3968	pStat = &gStatTimers;
3969	break;
3970	case STATS_TLB_LOOKUP:
3971	pStat= &gStatTBLookup;
3972	break;
3973	case STATS_IRQ_HANDLING:
3974	pStat= &gStatIRQ;
3975	break;
3976	case STATS_RAW_CHECK:
3977	pStat = &gStatRawCheck;
3978	break;
3979	default:
3980	AssertMsgFailed(("unknown stat %d\n", statcode));
3981	return;
3982	}
3983	STAM_PROFILE_ADV_STOP(pStat, a);
3984	}
3985	#endif
3986
3987	/**
3988	* Raise an RC, force rem exit.
3989	*
3990	* @param pVM VM handle.
3991	* @param rc The rc.
3992	*/
3993	void remR3RaiseRC(PVM pVM, int rc)
3994	{
3995	Log(("remR3RaiseRC: rc=%Vrc\n", rc));
3996	Assert(pVM->rem.s.fInREM);
3997	VM_ASSERT_EMT(pVM);
3998	pVM->rem.s.rc = rc;
3999	cpu_interrupt(&pVM->rem.s.Env, CPU_INTERRUPT_RC);
4000	}
4001
4002
4003	/* -+- timers -+- */
4004
4005	uint64_t cpu_get_tsc(CPUX86State *env)
4006	{
4007	return TMCpuTickGet(env->pVM);
4008	}
4009
4010
4011	/* -+- interrupts -+- */
4012
4013	void cpu_set_ferr(CPUX86State *env)
4014	{
4015	int rc = PDMIsaSetIrq(env->pVM, 13, 1);
4016	LogFlow(("cpu_set_ferr: rc=%d\n", rc)); NOREF(rc);
4017	}
4018
4019	int cpu_get_pic_interrupt(CPUState *env)
4020	{
4021	uint8_t u8Interrupt;
4022	int rc;
4023
4024	/* When we fail to forward interrupts directly in raw mode, we fall back to the recompiler.
4025	* In that case we can't call PDMGetInterrupt anymore, because it has already cleared the interrupt
4026	* with the (a)pic.
4027	*/
4028	/** @note We assume we will go directly to the recompiler to handle the pending interrupt! */
4029	/** @todo r=bird: In the long run we should just do the interrupt handling in EM/CPUM/TRPM/somewhere and
4030	* if we cannot execute the interrupt handler in raw-mode just reschedule to REM. Once that is done we
4031	* remove this kludge. */
4032	if (env->pVM->rem.s.u32PendingInterrupt != REM_NO_PENDING_IRQ)
4033	{
4034	rc = VINF_SUCCESS;
4035	Assert(env->pVM->rem.s.u32PendingInterrupt >= 0 && env->pVM->rem.s.u32PendingInterrupt <= 255);
4036	u8Interrupt = env->pVM->rem.s.u32PendingInterrupt;
4037	env->pVM->rem.s.u32PendingInterrupt = REM_NO_PENDING_IRQ;
4038	}
4039	else
4040	rc = PDMGetInterrupt(env->pVM, &u8Interrupt);
4041
4042	LogFlow(("cpu_get_pic_interrupt: u8Interrupt=%d rc=%Vrc\n", u8Interrupt, rc));
4043	if (VBOX_SUCCESS(rc))
4044	{
4045	if (VM_FF_ISPENDING(env->pVM, VM_FF_INTERRUPT_APIC \| VM_FF_INTERRUPT_PIC))
4046	env->interrupt_request \|= CPU_INTERRUPT_HARD;
4047	return u8Interrupt;
4048	}
4049	return -1;
4050	}
4051
4052
4053	/* -+- local apic -+- */
4054
4055	void cpu_set_apic_base(CPUX86State *env, uint64_t val)
4056	{
4057	int rc = PDMApicSetBase(env->pVM, val);
4058	LogFlow(("cpu_set_apic_base: val=%#llx rc=%Vrc\n", val, rc)); NOREF(rc);
4059	}
4060
4061	uint64_t cpu_get_apic_base(CPUX86State *env)
4062	{
4063	uint64_t u64;
4064	int rc = PDMApicGetBase(env->pVM, &u64);
4065	if (VBOX_SUCCESS(rc))
4066	{
4067	LogFlow(("cpu_get_apic_base: returns %#llx \n", u64));
4068	return u64;
4069	}
4070	LogFlow(("cpu_get_apic_base: returns 0 (rc=%Vrc)\n", rc));
4071	return 0;
4072	}
4073
4074	void cpu_set_apic_tpr(CPUX86State *env, uint8_t val)
4075	{
4076	int rc = PDMApicSetTPR(env->pVM, val);
4077	LogFlow(("cpu_set_apic_tpr: val=%#x rc=%Vrc\n", val, rc)); NOREF(rc);
4078	}
4079
4080	uint8_t cpu_get_apic_tpr(CPUX86State *env)
4081	{
4082	uint8_t u8;
4083	int rc = PDMApicGetTPR(env->pVM, &u8);
4084	if (VBOX_SUCCESS(rc))
4085	{
4086	LogFlow(("cpu_get_apic_tpr: returns %#x\n", u8));
4087	return u8;
4088	}
4089	LogFlow(("cpu_get_apic_tpr: returns 0 (rc=%Vrc)\n", rc));
4090	return 0;
4091	}
4092
4093
4094	/* -+- I/O Ports -+- */
4095
4096	#undef LOG_GROUP
4097	#define LOG_GROUP LOG_GROUP_REM_IOPORT
4098
4099	void cpu_outb(CPUState *env, int addr, int val)
4100	{
4101	if (addr != 0x80 && addr != 0x70 && addr != 0x61)
4102	Log2(("cpu_outb: addr=%#06x val=%#x\n", addr, val));
4103
4104	int rc = IOMIOPortWrite(env->pVM, (RTIOPORT)addr, val, 1);
4105	if (rc == VINF_SUCCESS)
4106	return;
4107	if (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST)
4108	{
4109	Log(("cpu_outb: addr=%#06x val=%#x -> %Vrc\n", addr, val, rc));
4110	remR3RaiseRC(env->pVM, rc);
4111	return;
4112	}
4113	remAbort(rc, __FUNCTION__);
4114	}
4115
4116	void cpu_outw(CPUState *env, int addr, int val)
4117	{
4118	//Log2(("cpu_outw: addr=%#06x val=%#x\n", addr, val));
4119	int rc = IOMIOPortWrite(env->pVM, (RTIOPORT)addr, val, 2);
4120	if (rc == VINF_SUCCESS)
4121	return;
4122	if (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST)
4123	{
4124	Log(("cpu_outw: addr=%#06x val=%#x -> %Vrc\n", addr, val, rc));
4125	remR3RaiseRC(env->pVM, rc);
4126	return;
4127	}
4128	remAbort(rc, __FUNCTION__);
4129	}
4130
4131	void cpu_outl(CPUState *env, int addr, int val)
4132	{
4133	Log2(("cpu_outl: addr=%#06x val=%#x\n", addr, val));
4134	int rc = IOMIOPortWrite(env->pVM, (RTIOPORT)addr, val, 4);
4135	if (rc == VINF_SUCCESS)
4136	return;
4137	if (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST)
4138	{
4139	Log(("cpu_outl: addr=%#06x val=%#x -> %Vrc\n", addr, val, rc));
4140	remR3RaiseRC(env->pVM, rc);
4141	return;
4142	}
4143	remAbort(rc, __FUNCTION__);
4144	}
4145
4146	int cpu_inb(CPUState *env, int addr)
4147	{
4148	uint32_t u32 = 0;
4149	int rc = IOMIOPortRead(env->pVM, (RTIOPORT)addr, &u32, 1);
4150	if (rc == VINF_SUCCESS)
4151	{
4152	if (/addr != 0x61 && /addr != 0x71)
4153	Log2(("cpu_inb: addr=%#06x -> %#x\n", addr, u32));
4154	return (int)u32;
4155	}
4156	if (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST)
4157	{
4158	Log(("cpu_inb: addr=%#06x -> %#x rc=%Vrc\n", addr, u32, rc));
4159	remR3RaiseRC(env->pVM, rc);
4160	return (int)u32;
4161	}
4162	remAbort(rc, __FUNCTION__);
4163	return 0xff;
4164	}
4165
4166	int cpu_inw(CPUState *env, int addr)
4167	{
4168	uint32_t u32 = 0;
4169	int rc = IOMIOPortRead(env->pVM, (RTIOPORT)addr, &u32, 2);
4170	if (rc == VINF_SUCCESS)
4171	{
4172	Log2(("cpu_inw: addr=%#06x -> %#x\n", addr, u32));
4173	return (int)u32;
4174	}
4175	if (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST)
4176	{
4177	Log(("cpu_inw: addr=%#06x -> %#x rc=%Vrc\n", addr, u32, rc));
4178	remR3RaiseRC(env->pVM, rc);
4179	return (int)u32;
4180	}
4181	remAbort(rc, __FUNCTION__);
4182	return 0xffff;
4183	}
4184
4185	int cpu_inl(CPUState *env, int addr)
4186	{
4187	uint32_t u32 = 0;
4188	int rc = IOMIOPortRead(env->pVM, (RTIOPORT)addr, &u32, 4);
4189	if (rc == VINF_SUCCESS)
4190	{
4191	//if (addr==0x01f0 && u32 == 0x6b6d)
4192	// loglevel = ~0;
4193	Log2(("cpu_inl: addr=%#06x -> %#x\n", addr, u32));
4194	return (int)u32;
4195	}
4196	if (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST)
4197	{
4198	Log(("cpu_inl: addr=%#06x -> %#x rc=%Vrc\n", addr, u32, rc));
4199	remR3RaiseRC(env->pVM, rc);
4200	return (int)u32;
4201	}
4202	remAbort(rc, __FUNCTION__);
4203	return 0xffffffff;
4204	}
4205
4206	#undef LOG_GROUP
4207	#define LOG_GROUP LOG_GROUP_REM
4208
4209
4210	/* -+- helpers and misc other interfaces -+- */
4211
4212	/**
4213	* Perform the CPUID instruction.
4214	*
4215	* ASMCpuId cannot be invoked from some source files where this is used because of global
4216	* register allocations.
4217	*
4218	* @param env Pointer to the recompiler CPU structure.
4219	* @param uOperator CPUID operation (eax).
4220	* @param pvEAX Where to store eax.
4221	* @param pvEBX Where to store ebx.
4222	* @param pvECX Where to store ecx.
4223	* @param pvEDX Where to store edx.
4224	*/
4225	void remR3CpuId(CPUState env, unsigned uOperator, void pvEAX, void pvEBX, void pvECX, void *pvEDX)
4226	{
4227	CPUMGetGuestCpuId(env->pVM, uOperator, (uint32_t )pvEAX, (uint32_t )pvEBX, (uint32_t )pvECX, (uint32_t )pvEDX);
4228	}
4229
4230
4231	#if 0 /* not used */
4232	/**
4233	* Interface for qemu hardware to report back fatal errors.
4234	*/
4235	void hw_error(const char *pszFormat, ...)
4236	{
4237	/*
4238	* Bitch about it.
4239	*/
4240	/** @todo Add support for nested arg lists in the LogPrintfV routine! I've code for
4241	* this in my Odin32 tree at home! */
4242	va_list args;
4243	va_start(args, pszFormat);
4244	RTLogPrintf("fatal error in virtual hardware:");
4245	RTLogPrintfV(pszFormat, args);
4246	va_end(args);
4247	AssertReleaseMsgFailed(("fatal error in virtual hardware: %s\n", pszFormat));
4248
4249	/*
4250	* If we're in REM context we'll sync back the state before 'jumping' to
4251	* the EMs failure handling.
4252	*/
4253	PVM pVM = cpu_single_env->pVM;
4254	if (pVM->rem.s.fInREM)
4255	REMR3StateBack(pVM);
4256	EMR3FatalError(pVM, VERR_REM_VIRTUAL_HARDWARE_ERROR);
4257	AssertMsgFailed(("EMR3FatalError returned!\n"));
4258	}
4259	#endif
4260
4261	/**
4262	* Interface for the qemu cpu to report unhandled situation
4263	* raising a fatal VM error.
4264	*/
4265	void cpu_abort(CPUState env, const char pszFormat, ...)
4266	{
4267	/*
4268	* Bitch about it.
4269	*/
4270	RTLogFlags(NULL, "nodisabled nobuffered");
4271	va_list args;
4272	va_start(args, pszFormat);
4273	RTLogPrintf("fatal error in recompiler cpu: %N\n", pszFormat, &args);
4274	va_end(args);
4275	va_start(args, pszFormat);
4276	AssertReleaseMsgFailed(("fatal error in recompiler cpu: %N\n", pszFormat, &args));
4277	va_end(args);
4278
4279	/*
4280	* If we're in REM context we'll sync back the state before 'jumping' to
4281	* the EMs failure handling.
4282	*/
4283	PVM pVM = cpu_single_env->pVM;
4284	if (pVM->rem.s.fInREM)
4285	REMR3StateBack(pVM);
4286	EMR3FatalError(pVM, VERR_REM_VIRTUAL_CPU_ERROR);
4287	AssertMsgFailed(("EMR3FatalError returned!\n"));
4288	}
4289
4290
4291	/**
4292	* Aborts the VM.
4293	*
4294	* @param rc VBox error code.
4295	* @param pszTip Hint about why/when this happend.
4296	*/
4297	static void remAbort(int rc, const char *pszTip)
4298	{
4299	/*
4300	* Bitch about it.
4301	*/
4302	RTLogPrintf("internal REM fatal error: rc=%Vrc %s\n", rc, pszTip);
4303	AssertReleaseMsgFailed(("internal REM fatal error: rc=%Vrc %s\n", rc, pszTip));
4304
4305	/*
4306	* Jump back to where we entered the recompiler.
4307	*/
4308	PVM pVM = cpu_single_env->pVM;
4309	if (pVM->rem.s.fInREM)
4310	REMR3StateBack(pVM);
4311	EMR3FatalError(pVM, rc);
4312	AssertMsgFailed(("EMR3FatalError returned!\n"));
4313	}
4314
4315
4316	/**
4317	* Dumps a linux system call.
4318	* @param pVM VM handle.
4319	*/
4320	void remR3DumpLnxSyscall(PVM pVM)
4321	{
4322	static const char *apsz[] =
4323	{
4324	"sys_restart_syscall", /* 0 - old "setup()" system call, used for restarting */
4325	"sys_exit",
4326	"sys_fork",
4327	"sys_read",
4328	"sys_write",
4329	"sys_open", /* 5 */
4330	"sys_close",
4331	"sys_waitpid",
4332	"sys_creat",
4333	"sys_link",
4334	"sys_unlink", /* 10 */
4335	"sys_execve",
4336	"sys_chdir",
4337	"sys_time",
4338	"sys_mknod",
4339	"sys_chmod", /* 15 */
4340	"sys_lchown16",
4341	"sys_ni_syscall", /* old break syscall holder */
4342	"sys_stat",
4343	"sys_lseek",
4344	"sys_getpid", /* 20 */
4345	"sys_mount",
4346	"sys_oldumount",
4347	"sys_setuid16",
4348	"sys_getuid16",
4349	"sys_stime", /* 25 */
4350	"sys_ptrace",
4351	"sys_alarm",
4352	"sys_fstat",
4353	"sys_pause",
4354	"sys_utime", /* 30 */
4355	"sys_ni_syscall", /* old stty syscall holder */
4356	"sys_ni_syscall", /* old gtty syscall holder */
4357	"sys_access",
4358	"sys_nice",
4359	"sys_ni_syscall", /* 35 - old ftime syscall holder */
4360	"sys_sync",
4361	"sys_kill",
4362	"sys_rename",
4363	"sys_mkdir",
4364	"sys_rmdir", /* 40 */
4365	"sys_dup",
4366	"sys_pipe",
4367	"sys_times",
4368	"sys_ni_syscall", /* old prof syscall holder */
4369	"sys_brk", /* 45 */
4370	"sys_setgid16",
4371	"sys_getgid16",
4372	"sys_signal",
4373	"sys_geteuid16",
4374	"sys_getegid16", /* 50 */
4375	"sys_acct",
4376	"sys_umount", /* recycled never used phys() */
4377	"sys_ni_syscall", /* old lock syscall holder */
4378	"sys_ioctl",
4379	"sys_fcntl", /* 55 */
4380	"sys_ni_syscall", /* old mpx syscall holder */
4381	"sys_setpgid",
4382	"sys_ni_syscall", /* old ulimit syscall holder */
4383	"sys_olduname",
4384	"sys_umask", /* 60 */
4385	"sys_chroot",
4386	"sys_ustat",
4387	"sys_dup2",
4388	"sys_getppid",
4389	"sys_getpgrp", /* 65 */
4390	"sys_setsid",
4391	"sys_sigaction",
4392	"sys_sgetmask",
4393	"sys_ssetmask",
4394	"sys_setreuid16", /* 70 */
4395	"sys_setregid16",
4396	"sys_sigsuspend",
4397	"sys_sigpending",
4398	"sys_sethostname",
4399	"sys_setrlimit", /* 75 */
4400	"sys_old_getrlimit",
4401	"sys_getrusage",
4402	"sys_gettimeofday",
4403	"sys_settimeofday",
4404	"sys_getgroups16", /* 80 */
4405	"sys_setgroups16",
4406	"old_select",
4407	"sys_symlink",
4408	"sys_lstat",
4409	"sys_readlink", /* 85 */
4410	"sys_uselib",
4411	"sys_swapon",
4412	"sys_reboot",
4413	"old_readdir",
4414	"old_mmap", /* 90 */
4415	"sys_munmap",
4416	"sys_truncate",
4417	"sys_ftruncate",
4418	"sys_fchmod",
4419	"sys_fchown16", /* 95 */
4420	"sys_getpriority",
4421	"sys_setpriority",
4422	"sys_ni_syscall", /* old profil syscall holder */
4423	"sys_statfs",
4424	"sys_fstatfs", /* 100 */
4425	"sys_ioperm",
4426	"sys_socketcall",
4427	"sys_syslog",
4428	"sys_setitimer",
4429	"sys_getitimer", /* 105 */
4430	"sys_newstat",
4431	"sys_newlstat",
4432	"sys_newfstat",
4433	"sys_uname",
4434	"sys_iopl", /* 110 */
4435	"sys_vhangup",
4436	"sys_ni_syscall", /* old "idle" system call */
4437	"sys_vm86old",
4438	"sys_wait4",
4439	"sys_swapoff", /* 115 */
4440	"sys_sysinfo",
4441	"sys_ipc",
4442	"sys_fsync",
4443	"sys_sigreturn",
4444	"sys_clone", /* 120 */
4445	"sys_setdomainname",
4446	"sys_newuname",
4447	"sys_modify_ldt",
4448	"sys_adjtimex",
4449	"sys_mprotect", /* 125 */
4450	"sys_sigprocmask",
4451	"sys_ni_syscall", /* old "create_module" */
4452	"sys_init_module",
4453	"sys_delete_module",
4454	"sys_ni_syscall", /* 130: old "get_kernel_syms" */
4455	"sys_quotactl",
4456	"sys_getpgid",
4457	"sys_fchdir",
4458	"sys_bdflush",
4459	"sys_sysfs", /* 135 */
4460	"sys_personality",
4461	"sys_ni_syscall", /* reserved for afs_syscall */
4462	"sys_setfsuid16",
4463	"sys_setfsgid16",
4464	"sys_llseek", /* 140 */
4465	"sys_getdents",
4466	"sys_select",
4467	"sys_flock",
4468	"sys_msync",
4469	"sys_readv", /* 145 */
4470	"sys_writev",
4471	"sys_getsid",
4472	"sys_fdatasync",
4473	"sys_sysctl",
4474	"sys_mlock", /* 150 */
4475	"sys_munlock",
4476	"sys_mlockall",
4477	"sys_munlockall",
4478	"sys_sched_setparam",
4479	"sys_sched_getparam", /* 155 */
4480	"sys_sched_setscheduler",
4481	"sys_sched_getscheduler",
4482	"sys_sched_yield",
4483	"sys_sched_get_priority_max",
4484	"sys_sched_get_priority_min", /* 160 */
4485	"sys_sched_rr_get_interval",
4486	"sys_nanosleep",
4487	"sys_mremap",
4488	"sys_setresuid16",
4489	"sys_getresuid16", /* 165 */
4490	"sys_vm86",
4491	"sys_ni_syscall", /* Old sys_query_module */
4492	"sys_poll",
4493	"sys_nfsservctl",
4494	"sys_setresgid16", /* 170 */
4495	"sys_getresgid16",
4496	"sys_prctl",
4497	"sys_rt_sigreturn",
4498	"sys_rt_sigaction",
4499	"sys_rt_sigprocmask", /* 175 */
4500	"sys_rt_sigpending",
4501	"sys_rt_sigtimedwait",
4502	"sys_rt_sigqueueinfo",
4503	"sys_rt_sigsuspend",
4504	"sys_pread64", /* 180 */
4505	"sys_pwrite64",
4506	"sys_chown16",
4507	"sys_getcwd",
4508	"sys_capget",
4509	"sys_capset", /* 185 */
4510	"sys_sigaltstack",
4511	"sys_sendfile",
4512	"sys_ni_syscall", /* reserved for streams1 */
4513	"sys_ni_syscall", /* reserved for streams2 */
4514	"sys_vfork", /* 190 */
4515	"sys_getrlimit",
4516	"sys_mmap2",
4517	"sys_truncate64",
4518	"sys_ftruncate64",
4519	"sys_stat64", /* 195 */
4520	"sys_lstat64",
4521	"sys_fstat64",
4522	"sys_lchown",
4523	"sys_getuid",
4524	"sys_getgid", /* 200 */
4525	"sys_geteuid",
4526	"sys_getegid",
4527	"sys_setreuid",
4528	"sys_setregid",
4529	"sys_getgroups", /* 205 */
4530	"sys_setgroups",
4531	"sys_fchown",
4532	"sys_setresuid",
4533	"sys_getresuid",
4534	"sys_setresgid", /* 210 */
4535	"sys_getresgid",
4536	"sys_chown",
4537	"sys_setuid",
4538	"sys_setgid",
4539	"sys_setfsuid", /* 215 */
4540	"sys_setfsgid",
4541	"sys_pivot_root",
4542	"sys_mincore",
4543	"sys_madvise",
4544	"sys_getdents64", /* 220 */
4545	"sys_fcntl64",
4546	"sys_ni_syscall", /* reserved for TUX */
4547	"sys_ni_syscall",
4548	"sys_gettid",
4549	"sys_readahead", /* 225 */
4550	"sys_setxattr",
4551	"sys_lsetxattr",
4552	"sys_fsetxattr",
4553	"sys_getxattr",
4554	"sys_lgetxattr", /* 230 */
4555	"sys_fgetxattr",
4556	"sys_listxattr",
4557	"sys_llistxattr",
4558	"sys_flistxattr",
4559	"sys_removexattr", /* 235 */
4560	"sys_lremovexattr",
4561	"sys_fremovexattr",
4562	"sys_tkill",
4563	"sys_sendfile64",
4564	"sys_futex", /* 240 */
4565	"sys_sched_setaffinity",
4566	"sys_sched_getaffinity",
4567	"sys_set_thread_area",
4568	"sys_get_thread_area",
4569	"sys_io_setup", /* 245 */
4570	"sys_io_destroy",
4571	"sys_io_getevents",
4572	"sys_io_submit",
4573	"sys_io_cancel",
4574	"sys_fadvise64", /* 250 */
4575	"sys_ni_syscall",
4576	"sys_exit_group",
4577	"sys_lookup_dcookie",
4578	"sys_epoll_create",
4579	"sys_epoll_ctl", /* 255 */
4580	"sys_epoll_wait",
4581	"sys_remap_file_pages",
4582	"sys_set_tid_address",
4583	"sys_timer_create",
4584	"sys_timer_settime", /* 260 */
4585	"sys_timer_gettime",
4586	"sys_timer_getoverrun",
4587	"sys_timer_delete",
4588	"sys_clock_settime",
4589	"sys_clock_gettime", /* 265 */
4590	"sys_clock_getres",
4591	"sys_clock_nanosleep",
4592	"sys_statfs64",
4593	"sys_fstatfs64",
4594	"sys_tgkill", /* 270 */
4595	"sys_utimes",
4596	"sys_fadvise64_64",
4597	"sys_ni_syscall" /* sys_vserver */
4598	};
4599
4600	uint32_t uEAX = CPUMGetGuestEAX(pVM);
4601	switch (uEAX)
4602	{
4603	default:
4604	if (uEAX < ELEMENTS(apsz))
4605	Log(("REM: linux syscall %3d: %s (eip=%VGv ebx=%08x ecx=%08x edx=%08x esi=%08x edi=%08x ebp=%08x)\n",
4606	uEAX, apsz[uEAX], CPUMGetGuestEIP(pVM), CPUMGetGuestEBX(pVM), CPUMGetGuestECX(pVM),
4607	CPUMGetGuestEDX(pVM), CPUMGetGuestESI(pVM), CPUMGetGuestEDI(pVM), CPUMGetGuestEBP(pVM)));
4608	else
4609	Log(("eip=%08x: linux syscall %d (#%x) unknown\n", CPUMGetGuestEIP(pVM), uEAX, uEAX));
4610	break;
4611
4612	}
4613	}
4614
4615
4616	/**
4617	* Dumps an OpenBSD system call.
4618	* @param pVM VM handle.
4619	*/
4620	void remR3DumpOBsdSyscall(PVM pVM)
4621	{
4622	static const char *apsz[] =
4623	{
4624	"SYS_syscall", //0
4625	"SYS_exit", //1
4626	"SYS_fork", //2
4627	"SYS_read", //3
4628	"SYS_write", //4
4629	"SYS_open", //5
4630	"SYS_close", //6
4631	"SYS_wait4", //7
4632	"SYS_8",
4633	"SYS_link", //9
4634	"SYS_unlink", //10
4635	"SYS_11",
4636	"SYS_chdir", //12
4637	"SYS_fchdir", //13
4638	"SYS_mknod", //14
4639	"SYS_chmod", //15
4640	"SYS_chown", //16
4641	"SYS_break", //17
4642	"SYS_18",
4643	"SYS_19",
4644	"SYS_getpid", //20
4645	"SYS_mount", //21
4646	"SYS_unmount", //22
4647	"SYS_setuid", //23
4648	"SYS_getuid", //24
4649	"SYS_geteuid", //25
4650	"SYS_ptrace", //26
4651	"SYS_recvmsg", //27
4652	"SYS_sendmsg", //28
4653	"SYS_recvfrom", //29
4654	"SYS_accept", //30
4655	"SYS_getpeername", //31
4656	"SYS_getsockname", //32
4657	"SYS_access", //33
4658	"SYS_chflags", //34
4659	"SYS_fchflags", //35
4660	"SYS_sync", //36
4661	"SYS_kill", //37
4662	"SYS_38",
4663	"SYS_getppid", //39
4664	"SYS_40",
4665	"SYS_dup", //41
4666	"SYS_opipe", //42
4667	"SYS_getegid", //43
4668	"SYS_profil", //44
4669	"SYS_ktrace", //45
4670	"SYS_sigaction", //46
4671	"SYS_getgid", //47
4672	"SYS_sigprocmask", //48
4673	"SYS_getlogin", //49
4674	"SYS_setlogin", //50
4675	"SYS_acct", //51
4676	"SYS_sigpending", //52
4677	"SYS_osigaltstack", //53
4678	"SYS_ioctl", //54
4679	"SYS_reboot", //55
4680	"SYS_revoke", //56
4681	"SYS_symlink", //57
4682	"SYS_readlink", //58
4683	"SYS_execve", //59
4684	"SYS_umask", //60
4685	"SYS_chroot", //61
4686	"SYS_62",
4687	"SYS_63",
4688	"SYS_64",
4689	"SYS_65",
4690	"SYS_vfork", //66
4691	"SYS_67",
4692	"SYS_68",
4693	"SYS_sbrk", //69
4694	"SYS_sstk", //70
4695	"SYS_61",
4696	"SYS_vadvise", //72
4697	"SYS_munmap", //73
4698	"SYS_mprotect", //74
4699	"SYS_madvise", //75
4700	"SYS_76",
4701	"SYS_77",
4702	"SYS_mincore", //78
4703	"SYS_getgroups", //79
4704	"SYS_setgroups", //80
4705	"SYS_getpgrp", //81
4706	"SYS_setpgid", //82
4707	"SYS_setitimer", //83
4708	"SYS_84",
4709	"SYS_85",
4710	"SYS_getitimer", //86
4711	"SYS_87",
4712	"SYS_88",
4713	"SYS_89",
4714	"SYS_dup2", //90
4715	"SYS_91",
4716	"SYS_fcntl", //92
4717	"SYS_select", //93
4718	"SYS_94",
4719	"SYS_fsync", //95
4720	"SYS_setpriority", //96
4721	"SYS_socket", //97
4722	"SYS_connect", //98
4723	"SYS_99",
4724	"SYS_getpriority", //100
4725	"SYS_101",
4726	"SYS_102",
4727	"SYS_sigreturn", //103
4728	"SYS_bind", //104
4729	"SYS_setsockopt", //105
4730	"SYS_listen", //106
4731	"SYS_107",
4732	"SYS_108",
4733	"SYS_109",
4734	"SYS_110",
4735	"SYS_sigsuspend", //111
4736	"SYS_112",
4737	"SYS_113",
4738	"SYS_114",
4739	"SYS_115",
4740	"SYS_gettimeofday", //116
4741	"SYS_getrusage", //117
4742	"SYS_getsockopt", //118
4743	"SYS_119",
4744	"SYS_readv", //120
4745	"SYS_writev", //121
4746	"SYS_settimeofday", //122
4747	"SYS_fchown", //123
4748	"SYS_fchmod", //124
4749	"SYS_125",
4750	"SYS_setreuid", //126
4751	"SYS_setregid", //127
4752	"SYS_rename", //128
4753	"SYS_129",
4754	"SYS_130",
4755	"SYS_flock", //131
4756	"SYS_mkfifo", //132
4757	"SYS_sendto", //133
4758	"SYS_shutdown", //134
4759	"SYS_socketpair", //135
4760	"SYS_mkdir", //136
4761	"SYS_rmdir", //137
4762	"SYS_utimes", //138
4763	"SYS_139",
4764	"SYS_adjtime", //140
4765	"SYS_141",
4766	"SYS_142",
4767	"SYS_143",
4768	"SYS_144",
4769	"SYS_145",
4770	"SYS_146",
4771	"SYS_setsid", //147
4772	"SYS_quotactl", //148
4773	"SYS_149",
4774	"SYS_150",
4775	"SYS_151",
4776	"SYS_152",
4777	"SYS_153",
4778	"SYS_154",
4779	"SYS_nfssvc", //155
4780	"SYS_156",
4781	"SYS_157",
4782	"SYS_158",
4783	"SYS_159",
4784	"SYS_160",
4785	"SYS_getfh", //161
4786	"SYS_162",
4787	"SYS_163",
4788	"SYS_164",
4789	"SYS_sysarch", //165
4790	"SYS_166",
4791	"SYS_167",
4792	"SYS_168",
4793	"SYS_169",
4794	"SYS_170",
4795	"SYS_171",
4796	"SYS_172",
4797	"SYS_pread", //173
4798	"SYS_pwrite", //174
4799	"SYS_175",
4800	"SYS_176",
4801	"SYS_177",
4802	"SYS_178",
4803	"SYS_179",
4804	"SYS_180",
4805	"SYS_setgid", //181
4806	"SYS_setegid", //182
4807	"SYS_seteuid", //183
4808	"SYS_lfs_bmapv", //184
4809	"SYS_lfs_markv", //185
4810	"SYS_lfs_segclean", //186
4811	"SYS_lfs_segwait", //187
4812	"SYS_188",
4813	"SYS_189",
4814	"SYS_190",
4815	"SYS_pathconf", //191
4816	"SYS_fpathconf", //192
4817	"SYS_swapctl", //193
4818	"SYS_getrlimit", //194
4819	"SYS_setrlimit", //195
4820	"SYS_getdirentries", //196
4821	"SYS_mmap", //197
4822	"SYS___syscall", //198
4823	"SYS_lseek", //199
4824	"SYS_truncate", //200
4825	"SYS_ftruncate", //201
4826	"SYS___sysctl", //202
4827	"SYS_mlock", //203
4828	"SYS_munlock", //204
4829	"SYS_205",
4830	"SYS_futimes", //206
4831	"SYS_getpgid", //207
4832	"SYS_xfspioctl", //208
4833	"SYS_209",
4834	"SYS_210",
4835	"SYS_211",
4836	"SYS_212",
4837	"SYS_213",
4838	"SYS_214",
4839	"SYS_215",
4840	"SYS_216",
4841	"SYS_217",
4842	"SYS_218",
4843	"SYS_219",
4844	"SYS_220",
4845	"SYS_semget", //221
4846	"SYS_222",
4847	"SYS_223",
4848	"SYS_224",
4849	"SYS_msgget", //225
4850	"SYS_msgsnd", //226
4851	"SYS_msgrcv", //227
4852	"SYS_shmat", //228
4853	"SYS_229",
4854	"SYS_shmdt", //230
4855	"SYS_231",
4856	"SYS_clock_gettime", //232
4857	"SYS_clock_settime", //233
4858	"SYS_clock_getres", //234
4859	"SYS_235",
4860	"SYS_236",
4861	"SYS_237",
4862	"SYS_238",
4863	"SYS_239",
4864	"SYS_nanosleep", //240
4865	"SYS_241",
4866	"SYS_242",
4867	"SYS_243",
4868	"SYS_244",
4869	"SYS_245",
4870	"SYS_246",
4871	"SYS_247",
4872	"SYS_248",
4873	"SYS_249",
4874	"SYS_minherit", //250
4875	"SYS_rfork", //251
4876	"SYS_poll", //252
4877	"SYS_issetugid", //253
4878	"SYS_lchown", //254
4879	"SYS_getsid", //255
4880	"SYS_msync", //256
4881	"SYS_257",
4882	"SYS_258",
4883	"SYS_259",
4884	"SYS_getfsstat", //260
4885	"SYS_statfs", //261
4886	"SYS_fstatfs", //262
4887	"SYS_pipe", //263
4888	"SYS_fhopen", //264
4889	"SYS_265",
4890	"SYS_fhstatfs", //266
4891	"SYS_preadv", //267
4892	"SYS_pwritev", //268
4893	"SYS_kqueue", //269
4894	"SYS_kevent", //270
4895	"SYS_mlockall", //271
4896	"SYS_munlockall", //272
4897	"SYS_getpeereid", //273
4898	"SYS_274",
4899	"SYS_275",
4900	"SYS_276",
4901	"SYS_277",
4902	"SYS_278",
4903	"SYS_279",
4904	"SYS_280",
4905	"SYS_getresuid", //281
4906	"SYS_setresuid", //282
4907	"SYS_getresgid", //283
4908	"SYS_setresgid", //284
4909	"SYS_285",
4910	"SYS_mquery", //286
4911	"SYS_closefrom", //287
4912	"SYS_sigaltstack", //288
4913	"SYS_shmget", //289
4914	"SYS_semop", //290
4915	"SYS_stat", //291
4916	"SYS_fstat", //292
4917	"SYS_lstat", //293
4918	"SYS_fhstat", //294
4919	"SYS___semctl", //295
4920	"SYS_shmctl", //296
4921	"SYS_msgctl", //297
4922	"SYS_MAXSYSCALL", //298
4923	//299
4924	//300
4925	};
4926	uint32_t uEAX;
4927	#ifndef DEBUG_bird
4928	if (!LogIsEnabled())
4929	return;
4930	#endif
4931	uEAX = CPUMGetGuestEAX(pVM);
4932	switch (uEAX)
4933	{
4934	default:
4935	if (uEAX < ELEMENTS(apsz))
4936	{
4937	uint32_t au32Args[8] = {0};
4938	PGMPhysReadGCPtr(pVM, au32Args, CPUMGetGuestESP(pVM), sizeof(au32Args));
4939	RTLogPrintf("REM: OpenBSD syscall %3d: %s (eip=%08x %08x %08x %08x %08x %08x %08x %08x %08x)\n",
4940	uEAX, apsz[uEAX], CPUMGetGuestEIP(pVM), au32Args[0], au32Args[1], au32Args[2], au32Args[3],
4941	au32Args[4], au32Args[5], au32Args[6], au32Args[7]);
4942	}
4943	else
4944	RTLogPrintf("eip=%08x: OpenBSD syscall %d (#%x) unknown!!\n", CPUMGetGuestEIP(pVM), uEAX, uEAX);
4945	break;
4946	}
4947	}

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/recompiler/VBoxRecompiler.c@ 789

Download in other formats: