Merge pull request #1804 from FioraAeterna/fastermmu2_master

MMU: various improvements, bugfixes, optimizations

Source/Core/Common/x64ABI.cpp

@@ -181,20 +181,26 @@ void XEmitter::ABI_CallFunctionR(const void *func, X64Reg reg1)
 // Pass two registers as parameters.
 void XEmitter::ABI_CallFunctionRR(const void *func, X64Reg reg1, X64Reg reg2)
 {
-	MOVTwo(64, ABI_PARAM1, reg1, ABI_PARAM2, reg2);
+	MOVTwo(64, ABI_PARAM1, reg1, 0, ABI_PARAM2, reg2);
 	ABI_CallFunction(func);
 }
 
-void XEmitter::MOVTwo(int bits, Gen::X64Reg dst1, Gen::X64Reg src1, Gen::X64Reg dst2, Gen::X64Reg src2)
+void XEmitter::MOVTwo(int bits, Gen::X64Reg dst1, Gen::X64Reg src1, s32 offset1, Gen::X64Reg dst2, Gen::X64Reg src2)
 {
 	if (dst1 == src2 && dst2 == src1)
 	{
 		XCHG(bits, R(src1), R(src2));
+		if (offset1)
+			ADD(bits, R(dst1), Imm32(offset1));
 	}
 	else if (src2 != dst1)
 	{
-		if (dst1 != src1)
+		if (dst1 != src1 && offset1)
+			LEA(bits, dst1, MDisp(src1, offset1));
+		else if (dst1 != src1)
 			MOV(bits, R(dst1), R(src1));
+		else if (offset1)
+			ADD(bits, R(dst1), Imm32(offset1));
 		if (dst2 != src2)
 			MOV(bits, R(dst2), R(src2));
 	}
@@ -202,8 +208,12 @@ void XEmitter::MOVTwo(int bits, Gen::X64Reg dst1, Gen::X64Reg src1, Gen::X64Reg
 	{
 		if (dst2 != src2)
 			MOV(bits, R(dst2), R(src2));
-		if (dst1 != src1)
+		if (dst1 != src1 && offset1)
+			LEA(bits, dst1, MDisp(src1, offset1));
+		else if (dst1 != src1)
 			MOV(bits, R(dst1), R(src1));
+		else if (offset1)
+			ADD(bits, R(dst1), Imm32(offset1));
 	}
 }
 

Source/Core/Common/x64Emitter.h

@@ -888,7 +888,7 @@ public:
 	void ABI_CallFunctionRR(const void *func, X64Reg reg1, X64Reg reg2);
 
 	// Helper method for the above, or can be used separately.
-	void MOVTwo(int bits, Gen::X64Reg dst1, Gen::X64Reg src1, Gen::X64Reg dst2, Gen::X64Reg src2);
+	void MOVTwo(int bits, Gen::X64Reg dst1, Gen::X64Reg src1, s32 offset, Gen::X64Reg dst2, Gen::X64Reg src2);
 
 	// Saves/restores the registers and adjusts the stack to be aligned as
 	// required by the ABI, where the previous alignment was as specified.

Source/Core/Core/Debugger/PPCDebugInterface.cpp

@@ -28,7 +28,7 @@ std::string PPCDebugInterface::Disassemble(unsigned int address)
 		if (!Memory::IsRAMAddress(address, true, true))
 		{
 			if (!SConfig::GetInstance().m_LocalCoreStartupParameter.bMMU || !((address & JIT_ICACHE_VMEM_BIT) &&
-				Memory::TranslateAddress(address, Memory::FLAG_NO_EXCEPTION)))
+				Memory::TranslateAddress<Memory::FLAG_NO_EXCEPTION>(address)))
 			{
 				return "(No RAM here)";
 			}

Source/Core/Core/HW/Memmap.cpp

@@ -188,9 +188,9 @@ bool AreMemoryBreakpointsActivated()
 #endif
 }
 
-u32 Read_Instruction(const u32 em_address)
+u32 Read_Instruction(const u32 address)
 {
-	UGeckoInstruction inst = ReadUnchecked_U32(em_address);
+	UGeckoInstruction inst = ReadUnchecked_U32(address);
 	return inst.hex;
 }
 
@@ -235,48 +235,48 @@ void Memset(const u32 _Address, const u8 _iValue, const u32 _iLength)
 	}
 }
 
-void ClearCacheLine(const u32 _Address)
+void ClearCacheLine(const u32 address)
 {
 	// FIXME: does this do the right thing if dcbz is run on hardware memory, e.g.
 	// the FIFO? Do games even do that? Probably not, but we should try to be correct...
 	for (u32 i = 0; i < 32; i += 8)
-		Write_U64(0, _Address + i);
+		Write_U64(0, address + i);
 }
 
-void DMA_LCToMemory(const u32 _MemAddr, const u32 _CacheAddr, const u32 _iNumBlocks)
+void DMA_LCToMemory(const u32 memAddr, const u32 cacheAddr, const u32 numBlocks)
 {
-	const u8* src = m_pL1Cache + (_CacheAddr & 0x3FFFF);
-	u8* dst = GetPointer(_MemAddr);
+	const u8* src = m_pL1Cache + (cacheAddr & 0x3FFFF);
+	u8* dst = GetPointer(memAddr);
 
-	if ((dst != nullptr) && (src != nullptr) && (_MemAddr & 3) == 0 && (_CacheAddr & 3) == 0)
+	if ((dst != nullptr) && (src != nullptr) && (memAddr & 3) == 0 && (cacheAddr & 3) == 0)
 	{
-		memcpy(dst, src, 32 * _iNumBlocks);
+		memcpy(dst, src, 32 * numBlocks);
 	}
 	else
 	{
-		for (u32 i = 0; i < 32 * _iNumBlocks; i++)
+		for (u32 i = 0; i < 32 * numBlocks; i++)
 		{
-			u8 Temp = Read_U8(_CacheAddr + i);
-			Write_U8(Temp, _MemAddr + i);
+			u8 Temp = Read_U8(cacheAddr + i);
+			Write_U8(Temp, memAddr + i);
 		}
 	}
 }
 
-void DMA_MemoryToLC(const u32 _CacheAddr, const u32 _MemAddr, const u32 _iNumBlocks)
+void DMA_MemoryToLC(const u32 cacheAddr, const u32 memAddr, const u32 numBlocks)
 {
-	const u8* src = GetPointer(_MemAddr);
-	u8* dst = m_pL1Cache + (_CacheAddr & 0x3FFFF);
+	const u8* src = GetPointer(memAddr);
+	u8* dst = m_pL1Cache + (cacheAddr & 0x3FFFF);
 
-	if ((dst != nullptr) && (src != nullptr) && (_MemAddr & 3) == 0 && (_CacheAddr & 3) == 0)
+	if ((dst != nullptr) && (src != nullptr) && (memAddr & 3) == 0 && (cacheAddr & 3) == 0)
 	{
-		memcpy(dst, src, 32 * _iNumBlocks);
+		memcpy(dst, src, 32 * numBlocks);
 	}
 	else
 	{
-		for (u32 i = 0; i < 32 * _iNumBlocks; i++)
+		for (u32 i = 0; i < 32 * numBlocks; i++)
 		{
-			u8 Temp = Read_U8(_MemAddr + i);
-			Write_U8(Temp, _CacheAddr + i);
+			u8 Temp = Read_U8(memAddr + i);
+			Write_U8(Temp, cacheAddr + i);
 		}
 	}
 }
@@ -301,16 +301,16 @@ std::string GetString(u32 em_address, size_t size)
 // GetPointer must always return an address in the bottom 32 bits of address space, so that 64-bit
 // programs don't have problems directly addressing any part of memory.
 // TODO re-think with respect to other BAT setups...
-u8* GetPointer(const u32 _Address)
+u8* GetPointer(const u32 address)
 {
-	switch (_Address >> 28)
+	switch (address >> 28)
 	{
 	case 0x0:
 	case 0x8:
-		if ((_Address & 0xfffffff) < REALRAM_SIZE)
-			return m_pRAM + (_Address & RAM_MASK);
+		if ((address & 0xfffffff) < REALRAM_SIZE)
+			return m_pRAM + (address & RAM_MASK);
 	case 0xc:
-		switch (_Address >> 24)
+		switch (address >> 24)
 		{
 		case 0xcc:
 		case 0xcd:
@@ -320,8 +320,8 @@ u8* GetPointer(const u32 _Address)
 			break;
 
 		default:
-			if ((_Address & 0xfffffff) < REALRAM_SIZE)
-				return m_pRAM + (_Address & RAM_MASK);
+			if ((address & 0xfffffff) < REALRAM_SIZE)
+				return m_pRAM + (address & RAM_MASK);
 		}
 
 	case 0x1:
@@ -329,53 +329,53 @@ u8* GetPointer(const u32 _Address)
 	case 0xd:
 		if (SConfig::GetInstance().m_LocalCoreStartupParameter.bWii)
 		{
-			if ((_Address & 0xfffffff) < EXRAM_SIZE)
-				return m_pEXRAM + (_Address & EXRAM_MASK);
+			if ((address & 0xfffffff) < EXRAM_SIZE)
+				return m_pEXRAM + (address & EXRAM_MASK);
 		}
 		else
 			break;
 
 	case 0xe:
-		if (_Address < (0xE0000000 + L1_CACHE_SIZE))
-			return m_pL1Cache + (_Address & L1_CACHE_MASK);
+		if (address < (0xE0000000 + L1_CACHE_SIZE))
+			return m_pL1Cache + (address & L1_CACHE_MASK);
 		else
 			break;
 
 	default:
 		if (bFakeVMEM)
-			return m_pFakeVMEM + (_Address & FAKEVMEM_MASK);
+			return m_pFakeVMEM + (address & FAKEVMEM_MASK);
 	}
 
-	ERROR_LOG(MEMMAP, "Unknown Pointer %#8x PC %#8x LR %#8x", _Address, PC, LR);
+	ERROR_LOG(MEMMAP, "Unknown Pointer %#8x PC %#8x LR %#8x", address, PC, LR);
 
 	return nullptr;
 }
 
-bool IsRAMAddress(const u32 addr, bool allow_locked_cache, bool allow_fake_vmem)
+bool IsRAMAddress(const u32 address, bool allow_locked_cache, bool allow_fake_vmem)
 {
-	switch ((addr >> 24) & 0xFC)
+	switch ((address >> 24) & 0xFC)
 	{
 	case 0x00:
 	case 0x80:
 	case 0xC0:
-		if ((addr & 0x1FFFFFFF) < RAM_SIZE)
+		if ((address & 0x1FFFFFFF) < RAM_SIZE)
 			return true;
 		else
 			return false;
 	case 0x10:
 	case 0x90:
 	case 0xD0:
-		if (SConfig::GetInstance().m_LocalCoreStartupParameter.bWii && (addr & 0x0FFFFFFF) < EXRAM_SIZE)
+		if (SConfig::GetInstance().m_LocalCoreStartupParameter.bWii && (address & 0x0FFFFFFF) < EXRAM_SIZE)
 			return true;
 		else
 			return false;
 	case 0xE0:
-		if (allow_locked_cache && addr - 0xE0000000 < L1_CACHE_SIZE)
+		if (allow_locked_cache && address - 0xE0000000 < L1_CACHE_SIZE)
 			return true;
 		else
 			return false;
 	case 0x7C:
-		if (allow_fake_vmem && bFakeVMEM && addr >= 0x7E000000)
+		if (allow_fake_vmem && bFakeVMEM && address >= 0x7E000000)
 			return true;
 		else
 			return false;

Source/Core/Core/HW/Memmap.h

@@ -74,64 +74,57 @@ void Clear();
 bool AreMemoryBreakpointsActivated();
 
 // ONLY for use by GUI
-u8 ReadUnchecked_U8(const u32 _Address);
-u32 ReadUnchecked_U32(const u32 _Address);
+u8 ReadUnchecked_U8(const u32 address);
+u32 ReadUnchecked_U32(const u32 address);
 
-void WriteUnchecked_U8(const u8 _Data, const u32 _Address);
-void WriteUnchecked_U32(const u32 _Data, const u32 _Address);
+void WriteUnchecked_U8(const u8 var, const u32 address);
+void WriteUnchecked_U32(const u32 var, const u32 address);
 
-bool IsRAMAddress(const u32 addr, bool allow_locked_cache = false, bool allow_fake_vmem = false);
+bool IsRAMAddress(const u32 address, bool allow_locked_cache = false, bool allow_fake_vmem = false);
 
 // used by interpreter to read instructions, uses iCache
-u32 Read_Opcode(const u32 _Address);
+u32 Read_Opcode(const u32 address);
 // this is used by Debugger a lot.
 // For now, just reads from memory!
-u32 Read_Instruction(const u32 _Address);
+u32 Read_Instruction(const u32 address);
 
 
 // For use by emulator
 
-u8  Read_U8(const u32 _Address);
-u16 Read_U16(const u32 _Address);
-u32 Read_U32(const u32 _Address);
-u64 Read_U64(const u32 _Address);
-
-u32 Read_S8_Val(u32 address, u32 val);
-u32 Read_U8_Val(u32 address, u32 val);
-u32 Read_S16_Val(u32 address, u32 val);
-u32 Read_U16_Val(u32 address, u32 val);
-u32 Read_U32_Val(u32 address, u32 val);
-u64 Read_U64_Val(u32 address, u64 val);
+u8  Read_U8(const u32 address);
+u16 Read_U16(const u32 address);
+u32 Read_U32(const u32 address);
+u64 Read_U64(const u32 address);
 
 // Useful helper functions, used by ARM JIT
-float Read_F32(const u32 _Address);
-double Read_F64(const u32 _Address);
+float Read_F32(const u32 address);
+double Read_F64(const u32 address);
 
 // used by JIT. Return zero-extended 32bit values
-u32 Read_U8_ZX(const u32 _Address);
-u32 Read_U16_ZX(const u32 _Address);
+u32 Read_U8_ZX(const u32 address);
+u32 Read_U16_ZX(const u32 address);
 
-void Write_U8(const u8 _Data, const u32 _Address);
-void Write_U16(const u16 _Data, const u32 _Address);
-void Write_U32(const u32 _Data, const u32 _Address);
-void Write_U64(const u64 _Data, const u32 _Address);
+void Write_U8(const u8 var, const u32 address);
+void Write_U16(const u16 var, const u32 address);
+void Write_U32(const u32 var, const u32 address);
+void Write_U64(const u64 var, const u32 address);
 
-void Write_U16_Swap(const u16 _Data, const u32 _Address);
-void Write_U32_Swap(const u32 _Data, const u32 _Address);
-void Write_U64_Swap(const u64 _Data, const u32 _Address);
+void Write_U16_Swap(const u16 var, const u32 address);
+void Write_U32_Swap(const u32 var, const u32 address);
+void Write_U64_Swap(const u64 var, const u32 address);
 
 // Useful helper functions, used by ARM JIT
-void Write_F64(const double _Data, const u32 _Address);
+void Write_F64(const double var, const u32 address);
 
 std::string GetString(u32 em_address, size_t size = 0);
 
-u8* GetPointer(const u32 _Address);
-void DMA_LCToMemory(const u32 _iMemAddr, const u32 _iCacheAddr, const u32 _iNumBlocks);
-void DMA_MemoryToLC(const u32 _iCacheAddr, const u32 _iMemAddr, const u32 _iNumBlocks);
+u8* GetPointer(const u32 address);
+void DMA_LCToMemory(const u32 memAddr, const u32 cacheAddr, const u32 numBlocks);
+void DMA_MemoryToLC(const u32 cacheAddr, const u32 memAddr, const u32 numBlocks);
 void CopyFromEmu(void* data, u32 address, size_t size);
 void CopyToEmu(u32 address, const void* data, size_t size);
-void Memset(const u32 _Address, const u8 _Data, const u32 _iLength);
-void ClearCacheLine(const u32 _Address); // Zeroes 32 bytes; address should be 32-byte-aligned
+void Memset(const u32 address, const u8 var, const u32 length);
+void ClearCacheLine(const u32 address); // Zeroes 32 bytes; address should be 32-byte-aligned
 
 // TLB functions
 void SDRUpdated();
@@ -142,8 +135,8 @@ enum XCheckTLBFlag
 	FLAG_WRITE,
 	FLAG_OPCODE,
 };
-u32 TranslateAddress(u32 _Address, XCheckTLBFlag _Flag);
-void InvalidateTLBEntry(u32 _Address);
+template <const XCheckTLBFlag flag> u32 TranslateAddress(const u32 address);
+void InvalidateTLBEntry(u32 address);
 extern u32 pagetable_base;
 extern u32 pagetable_hashmask;
 }

Source/Core/Core/PowerPC/Jit64/Jit.cpp

@@ -178,11 +178,12 @@ void Jit64::Init()
 	jo.optimizeGatherPipe = true;
 	jo.accurateSinglePrecision = true;
 	js.memcheck = SConfig::GetInstance().m_LocalCoreStartupParameter.bMMU;
+	js.fastmemLoadStore = NULL;
 
 	gpr.SetEmitter(this);
 	fpr.SetEmitter(this);
 
-	trampolines.Init();
+	trampolines.Init(js.memcheck ? TRAMPOLINE_CODE_SIZE_MMU : TRAMPOLINE_CODE_SIZE);
 	AllocCodeSpace(CODE_SIZE);
 
 	// BLR optimization has the same consequences as block linking, as well as
@@ -493,9 +494,10 @@ void Jit64::Jit(u32 em_address)
 {
 	if (GetSpaceLeft() < 0x10000 ||
 	    farcode.GetSpaceLeft() < 0x10000 ||
-		blocks.IsFull() ||
-		SConfig::GetInstance().m_LocalCoreStartupParameter.bJITNoBlockCache ||
-		m_clear_cache_asap)
+	    trampolines.GetSpaceLeft() < 0x10000 ||
+	    blocks.IsFull() ||
+	    SConfig::GetInstance().m_LocalCoreStartupParameter.bJITNoBlockCache ||
+	    m_clear_cache_asap)
 	{
 		ClearCache();
 	}
@@ -612,6 +614,10 @@ const u8* Jit64::DoJit(u32 em_address, PPCAnalyst::CodeBuffer *code_buf, JitBloc
 		js.instructionsLeft = (code_block.m_num_instructions - 1) - i;
 		const GekkoOPInfo *opinfo = ops[i].opinfo;
 		js.downcountAmount += opinfo->numCycles;
+		js.fastmemLoadStore = NULL;
+		js.fixupExceptionHandler = false;
+		js.revertGprLoad = -1;
+		js.revertFprLoad = -1;
 
 		if (i == (code_block.m_num_instructions - 1))
 		{
@@ -761,22 +767,37 @@ const u8* Jit64::DoJit(u32 em_address, PPCAnalyst::CodeBuffer *code_buf, JitBloc
 
 			Jit64Tables::CompileInstruction(ops[i]);
 
-			// If we have a register that will never be used again, flush it.
-			for (int j : ~ops[i].gprInUse)
-				gpr.StoreFromRegister(j);
-			for (int j : ~ops[i].fprInUse)
-				fpr.StoreFromRegister(j);
-
 			if (js.memcheck && (opinfo->flags & FL_LOADSTORE))
 			{
-				TEST(32, PPCSTATE(Exceptions), Imm32(EXCEPTION_DSI));
-				FixupBranch memException = J_CC(CC_NZ, true);
+				// If we have a fastmem loadstore, we can omit the exception check and let fastmem handle it.
+				FixupBranch memException;
+				_assert_msg_(DYNA_REC, !(js.fastmemLoadStore && js.fixupExceptionHandler),
+					"Fastmem loadstores shouldn't have exception handler fixups (PC=%x)!", ops[i].address);
+				if (!js.fastmemLoadStore && !js.fixupExceptionHandler)
+				{
+					TEST(32, PPCSTATE(Exceptions), Imm32(EXCEPTION_DSI));
+					memException = J_CC(CC_NZ, true);
+				}
 
 				SwitchToFarCode();
-				SetJumpTarget(memException);
+				if (!js.fastmemLoadStore)
+				{
+					exceptionHandlerAtLoc[js.fastmemLoadStore] = NULL;
+					SetJumpTarget(js.fixupExceptionHandler ? js.exceptionHandler : memException);
+				}
+				else
+				{
+					exceptionHandlerAtLoc[js.fastmemLoadStore] = GetWritableCodePtr();
+				}
 
-				gpr.Flush(FLUSH_MAINTAIN_STATE);
-				fpr.Flush(FLUSH_MAINTAIN_STATE);
+				BitSet32 gprToFlush = BitSet32::AllTrue(32);
+				BitSet32 fprToFlush = BitSet32::AllTrue(32);
+				if (js.revertGprLoad >= 0)
+					gprToFlush[js.revertGprLoad] = false;
+				if (js.revertFprLoad >= 0)
+					fprToFlush[js.revertFprLoad] = false;
+				gpr.Flush(FLUSH_MAINTAIN_STATE, gprToFlush);
+				fpr.Flush(FLUSH_MAINTAIN_STATE, fprToFlush);
 
 				// If a memory exception occurs, the exception handler will read
 				// from PC.  Update PC with the latest value in case that happens.
@@ -785,6 +806,12 @@ const u8* Jit64::DoJit(u32 em_address, PPCAnalyst::CodeBuffer *code_buf, JitBloc
 				SwitchToNearCode();
 			}
 
+			// If we have a register that will never be used again, flush it.
+			for (int j : ~ops[i].gprInUse)
+				gpr.StoreFromRegister(j);
+			for (int j : ~ops[i].fprInUse)
+				fpr.StoreFromRegister(j);
+
 			if (opinfo->flags & FL_LOADSTORE)
 				++jit->js.numLoadStoreInst;
 

Source/Core/Core/PowerPC/Jit64/Jit.h

@@ -133,6 +133,7 @@ public:
 	// Clobbers RDX.
 	void SetCRFieldBit(int field, int bit, Gen::X64Reg in);
 	void ClearCRFieldBit(int field, int bit);
+	void SetCRFieldBit(int field, int bit);
 
 	// Generates a branch that will check if a given bit of a CR register part
 	// is set or not.

Source/Core/Core/PowerPC/Jit64/JitAsm.cpp

@@ -226,6 +226,8 @@ void Jit64AsmRoutineManager::GenerateCommon()
 	GenFrsqrte();
 	fres = AlignCode4();
 	GenFres();
+	mfcr = AlignCode4();
+	GenMfcr();
 
 	GenQuantizedLoads();
 	GenQuantizedStores();

Source/Core/Core/PowerPC/Jit64/JitRegCache.cpp

@@ -401,7 +401,7 @@ void FPURegCache::StoreRegister(size_t preg, OpArg newLoc)
 	emit->MOVAPD(newLoc, regs[preg].location.GetSimpleReg());
 }
 
-void RegCache::Flush(FlushMode mode)
+void RegCache::Flush(FlushMode mode, BitSet32 regsToFlush)
 {
 	for (unsigned int i = 0; i < xregs.size(); i++)
 	{
@@ -409,7 +409,7 @@ void RegCache::Flush(FlushMode mode)
 			PanicAlert("Someone forgot to unlock X64 reg %u", i);
 	}
 
-	for (unsigned int i = 0; i < regs.size(); i++)
+	for (unsigned int i : regsToFlush)
 	{
 		if (regs[i].locked)
 		{

Source/Core/Core/PowerPC/Jit64/JitRegCache.h

@@ -81,7 +81,7 @@ public:
 		LockX(reg1); LockX(reg2);
 	}
 
-	void Flush(FlushMode mode = FLUSH_ALL);
+	void Flush(FlushMode mode = FLUSH_ALL, BitSet32 regsToFlush = BitSet32::AllTrue(32));
 	void Flush(PPCAnalyst::CodeOp *op) {Flush();}
 	int SanityCheck() const;
 	void KillImmediate(size_t preg, bool doLoad, bool makeDirty);

Source/Core/Core/PowerPC/Jit64/Jit_LoadStore.cpp

@@ -246,29 +246,41 @@ void Jit64::lXXx(UGeckoInstruction inst)
 	}
 
 	gpr.Lock(a, b, d);
-	gpr.BindToRegister(d, js.memcheck, true);
-	BitSet32 registersInUse = CallerSavedRegistersInUse();
+
 	if (update && storeAddress)
+		gpr.BindToRegister(a, true, true);
+
+	// A bit of an evil hack here. We need to retain the original value of this register for the
+	// exception path, but we'd rather not needlessly pass it around if we don't have to, since
+	// the exception path is very rare. So we store the value in the regcache, let the load path
+	// clobber it, then restore the value in the exception path.
+	// TODO: no other load has to do this at the moment, since no other loads go directly to the
+	// target registers, but if that ever changes, we need to do it there too.
+	if (js.memcheck)
 	{
-		// We need to save the (usually scratch) address register for the update.
-		registersInUse[RSCRATCH2] = true;
+		gpr.StoreFromRegister(d);
+		js.revertGprLoad = d;
 	}
+	gpr.BindToRegister(d, false, true);
+
+	BitSet32 registersInUse = CallerSavedRegistersInUse();
+	// We need to save the (usually scratch) address register for the update.
+	if (update && storeAddress)
+		registersInUse[RSCRATCH2] = true;
+
 	SafeLoadToReg(gpr.RX(d), opAddress, accessSize, loadOffset, registersInUse, signExtend);
 
 	if (update && storeAddress)
 	{
-		gpr.BindToRegister(a, true, true);
-		MEMCHECK_START(false)
+		MemoryExceptionCheck();
 		MOV(32, gpr.R(a), opAddress);
-		MEMCHECK_END
 	}
 
 	// TODO: support no-swap in SafeLoadToReg instead
 	if (byte_reversed)
 	{
-		MEMCHECK_START(false)
+		MemoryExceptionCheck();
 		BSWAP(accessSize, gpr.RX(d));
-		MEMCHECK_END
 	}
 
 	gpr.UnlockAll();
@@ -372,9 +384,8 @@ void Jit64::stX(UGeckoInstruction inst)
 			else
 			{
 				gpr.KillImmediate(a, true, true);
-				MEMCHECK_START(false)
+				MemoryExceptionCheck();
 				ADD(32, gpr.R(a), Imm32((u32)offset));
-				MEMCHECK_END
 			}
 		}
 	}
@@ -404,9 +415,8 @@ void Jit64::stX(UGeckoInstruction inst)
 
 		if (update)
 		{
-			MEMCHECK_START(false)
+			MemoryExceptionCheck();
 			ADD(32, gpr.R(a), Imm32((u32)offset));
-			MEMCHECK_END
 		}
 	}
 	gpr.UnlockAll();
@@ -425,12 +435,9 @@ void Jit64::stXx(UGeckoInstruction inst)
 	gpr.Lock(a, b, s);
 
 	if (update)
-	{
 		gpr.BindToRegister(a, true, true);
-		ADD(32, gpr.R(a), gpr.R(b));
-		MOV(32, R(RSCRATCH2), gpr.R(a));
-	}
-	else if (gpr.R(a).IsSimpleReg() && gpr.R(b).IsSimpleReg())
+
+	if (gpr.R(a).IsSimpleReg() && gpr.R(b).IsSimpleReg())
 	{
 		LEA(32, RSCRATCH2, MComplex(gpr.RX(a), gpr.RX(b), SCALE_1, 0));
 	}
@@ -462,7 +469,10 @@ void Jit64::stXx(UGeckoInstruction inst)
 
 	if (gpr.R(s).IsImm())
 	{
-		SafeWriteRegToReg(gpr.R(s), RSCRATCH2, accessSize, 0, CallerSavedRegistersInUse(), byte_reverse ? SAFE_LOADSTORE_NO_SWAP : 0);
+		BitSet32 registersInUse = CallerSavedRegistersInUse();
+		if (update)
+			registersInUse[RSCRATCH2] = true;
+		SafeWriteRegToReg(gpr.R(s), RSCRATCH2, accessSize, 0, registersInUse, byte_reverse ? SAFE_LOADSTORE_NO_SWAP : 0);
 	}
 	else
 	{
@@ -477,15 +487,16 @@ void Jit64::stXx(UGeckoInstruction inst)
 			gpr.BindToRegister(s, true, false);
 			reg_value = gpr.RX(s);
 		}
-		SafeWriteRegToReg(reg_value, RSCRATCH2, accessSize, 0, CallerSavedRegistersInUse(), byte_reverse ? SAFE_LOADSTORE_NO_SWAP : 0);
+		BitSet32 registersInUse = CallerSavedRegistersInUse();
+		if (update)
+			registersInUse[RSCRATCH2] = true;
+		SafeWriteRegToReg(reg_value, RSCRATCH2, accessSize, 0, registersInUse, byte_reverse ? SAFE_LOADSTORE_NO_SWAP : 0);
 	}
 
-	if (update && js.memcheck)
+	if (update)
 	{
-		// revert the address change if an exception occurred
-		MEMCHECK_START(true)
-		SUB(32, gpr.R(a), gpr.R(b));
-		MEMCHECK_END;
+		MemoryExceptionCheck();
+		MOV(32, gpr.R(a), R(RSCRATCH2));
 	}
 
 	gpr.UnlockAll();

Source/Core/Core/PowerPC/Jit64/Jit_LoadStoreFloating.cpp

@@ -46,9 +46,9 @@ void Jit64::lfXXX(UGeckoInstruction inst)
 		}
 		else
 		{
-			addr = R(RSCRATCH);
+			addr = R(RSCRATCH2);
 			if (a && gpr.R(a).IsSimpleReg() && gpr.R(b).IsSimpleReg())
-				LEA(32, RSCRATCH, MComplex(gpr.RX(a), gpr.RX(b), SCALE_1, 0));
+				LEA(32, RSCRATCH2, MComplex(gpr.RX(a), gpr.RX(b), SCALE_1, 0));
 			else
 			{
 				MOV(32, addr, gpr.R(b));
@@ -65,14 +65,19 @@ void Jit64::lfXXX(UGeckoInstruction inst)
 			offset = (s16)inst.SIMM_16;
 	}
 
+	fpr.Lock(d);
+	if (js.memcheck && single)
+	{
+		fpr.StoreFromRegister(d);
+		js.revertFprLoad = d;
+	}
+	fpr.BindToRegister(d, !single);
 	BitSet32 registersInUse = CallerSavedRegistersInUse();
 	if (update && js.memcheck)
 		registersInUse[RSCRATCH2] = true;
 	SafeLoadToReg(RSCRATCH, addr, single ? 32 : 64, offset, registersInUse, false);
-	fpr.Lock(d);
-	fpr.BindToRegister(d, js.memcheck || !single);
 
-	MEMCHECK_START(false)
+	MemoryExceptionCheck();
 	if (single)
 	{
 		ConvertSingleToDouble(fpr.RX(d), RSCRATCH, true);
@@ -84,7 +89,6 @@ void Jit64::lfXXX(UGeckoInstruction inst)
 	}
 	if (update && js.memcheck)
 		MOV(32, gpr.R(a), addr);
-	MEMCHECK_END
 	fpr.UnlockAll();
 	gpr.UnlockAll();
 }
@@ -141,9 +145,8 @@ void Jit64::stfXXX(UGeckoInstruction inst)
 			else
 			{
 				gpr.KillImmediate(a, true, true);
-				MEMCHECK_START(false)
+				MemoryExceptionCheck();
 				ADD(32, gpr.R(a), Imm32((u32)imm));
-				MEMCHECK_END
 			}
 		}
 		fpr.UnlockAll();
@@ -152,48 +155,43 @@ void Jit64::stfXXX(UGeckoInstruction inst)
 	}
 
 	s32 offset = 0;
+	if (update)
+		gpr.BindToRegister(a, true, true);
 	if (indexed)
 	{
-		if (update)
-		{
-			gpr.BindToRegister(a, true, true);
-			ADD(32, gpr.R(a), gpr.R(b));
-			MOV(32, R(RSCRATCH2), gpr.R(a));
-		}
+		if (a && gpr.R(a).IsSimpleReg() && gpr.R(b).IsSimpleReg())
+			LEA(32, RSCRATCH2, MComplex(gpr.RX(a), gpr.RX(b), SCALE_1, 0));
 		else
 		{
-			if (a && gpr.R(a).IsSimpleReg() && gpr.R(b).IsSimpleReg())
-				LEA(32, RSCRATCH2, MComplex(gpr.RX(a), gpr.RX(b), SCALE_1, 0));
-			else
-			{
-				MOV(32, R(RSCRATCH2), gpr.R(b));
-				if (a)
-					ADD(32, R(RSCRATCH2), gpr.R(a));
-			}
+			MOV(32, R(RSCRATCH2), gpr.R(b));
+			if (a)
+				ADD(32, R(RSCRATCH2), gpr.R(a));
 		}
 	}
 	else
 	{
 		if (update)
 		{
-			gpr.BindToRegister(a, true, true);
-			ADD(32, gpr.R(a), Imm32(imm));
+			LEA(32, RSCRATCH2, MDisp(gpr.RX(a), imm));
 		}
 		else
 		{
 			offset = imm;
+			MOV(32, R(RSCRATCH2), gpr.R(a));
 		}
-		MOV(32, R(RSCRATCH2), gpr.R(a));
 	}
 
-	SafeWriteRegToReg(RSCRATCH, RSCRATCH2, accessSize, offset, CallerSavedRegistersInUse());
+	BitSet32 registersInUse = CallerSavedRegistersInUse();
+	// We need to save the (usually scratch) address register for the update.
+	if (update)
+		registersInUse[RSCRATCH2] = true;
 
-	if (js.memcheck && update)
+	SafeWriteRegToReg(RSCRATCH, RSCRATCH2, accessSize, offset, registersInUse);
+
+	if (update)
 	{
-		// revert the address change if an exception occurred
-		MEMCHECK_START(true)
-		SUB(32, gpr.R(a), indexed ? gpr.R(b) : Imm32(imm));
-		MEMCHECK_END
+		MemoryExceptionCheck();
+		MOV(32, gpr.R(a), R(RSCRATCH2));
 	}
 
 	fpr.UnlockAll();

Source/Core/Core/PowerPC/Jit64/Jit_LoadStorePaired.cpp

@@ -78,12 +78,11 @@ void Jit64::psq_stXX(UGeckoInstruction inst)
 
 	if (update && js.memcheck)
 	{
-		MEMCHECK_START(false)
+		MemoryExceptionCheck();
 		if (indexed)
 			ADD(32, gpr.R(a), gpr.R(b));
 		else
 			ADD(32, gpr.R(a), Imm32((u32)offset));
-		MEMCHECK_END
 	}
 	gpr.UnlockAll();
 	gpr.UnlockAllX();
@@ -137,7 +136,7 @@ void Jit64::psq_lXX(UGeckoInstruction inst)
 
 	CALLptr(MScaled(RSCRATCH, SCALE_8, (u32)(u64)(&asm_routines.pairedLoadQuantized[w * 8])));
 
-	MEMCHECK_START(false)
+	MemoryExceptionCheck();
 	CVTPS2PD(fpr.RX(s), R(XMM0));
 	if (update && js.memcheck)
 	{
@@ -146,7 +145,6 @@ void Jit64::psq_lXX(UGeckoInstruction inst)
 		else
 			ADD(32, gpr.R(a), Imm32((u32)offset));
 	}
-	MEMCHECK_END
 
 	gpr.UnlockAll();
 	gpr.UnlockAllX();

Source/Core/Core/PowerPC/Jit64/Jit_SystemRegisters.cpp

@@ -112,6 +112,41 @@ void Jit64::ClearCRFieldBit(int field, int bit)
 	// We don't need to set bit 32; the cases where that's needed only come up when setting bits, not clearing.
 }
 
+void Jit64::SetCRFieldBit(int field, int bit)
+{
+	MOV(64, R(RSCRATCH), PPCSTATE(cr_val[field]));
+	if (bit != CR_GT_BIT)
+	{
+		TEST(64, R(RSCRATCH), R(RSCRATCH));
+		FixupBranch dont_clear_gt = J_CC(CC_NZ);
+		BTS(64, R(RSCRATCH), Imm8(63));
+		SetJumpTarget(dont_clear_gt);
+	}
+
+	switch (bit)
+	{
+	case CR_SO_BIT:
+		BTS(64, PPCSTATE(cr_val[field]), Imm8(61));
+		break;
+
+	case CR_EQ_BIT:
+		SHR(64, R(RSCRATCH), Imm8(32));
+		SHL(64, R(RSCRATCH), Imm8(32));
+		break;
+
+	case CR_GT_BIT:
+		BTR(64, PPCSTATE(cr_val[field]), Imm8(63));
+		break;
+
+	case CR_LT_BIT:
+		BTS(64, PPCSTATE(cr_val[field]), Imm8(62));
+		break;
+	}
+
+	BTS(64, R(RSCRATCH), Imm8(32));
+	MOV(64, PPCSTATE(cr_val[field]), R(RSCRATCH));
+}
+
 FixupBranch Jit64::JumpIfCRFieldBit(int field, int bit, bool jump_if_set)
 {
 	switch (bit)
@@ -371,39 +406,12 @@ void Jit64::mfcr(UGeckoInstruction inst)
 {
 	INSTRUCTION_START
 	JITDISABLE(bJITSystemRegistersOff);
-	// USES_CR
 	int d = inst.RD;
+	gpr.FlushLockX(RSCRATCH_EXTRA);
+	CALL((void *)asm_routines.mfcr);
+	gpr.Lock(d);
 	gpr.BindToRegister(d, false, true);
-	XOR(32, gpr.R(d), gpr.R(d));
-
-	X64Reg cr_val = RSCRATCH2;
-	// we only need to zero the high bits of RSCRATCH once
-	XOR(32, R(RSCRATCH), R(RSCRATCH));
-	for (int i = 0; i < 8; i++)
-	{
-		static const u8 m_flagTable[8] = {0x0,0x1,0x8,0x9,0x0,0x1,0x8,0x9};
-		if (i != 0)
-			SHL(32, gpr.R(d), Imm8(4));
-
-		MOV(64, R(cr_val), PPCSTATE(cr_val[i]));
-
-		// EQ: Bits 31-0 == 0; set flag bit 1
-		TEST(32, R(cr_val), R(cr_val));
-		SETcc(CC_Z, R(RSCRATCH));
-		LEA(32, gpr.RX(d), MComplex(gpr.RX(d), RSCRATCH, SCALE_2, 0));
-
-		// GT: Value > 0; set flag bit 2
-		TEST(64, R(cr_val), R(cr_val));
-		SETcc(CC_G, R(RSCRATCH));
-		LEA(32, gpr.RX(d), MComplex(gpr.RX(d), RSCRATCH, SCALE_4, 0));
-
-		// SO: Bit 61 set; set flag bit 0
-		// LT: Bit 62 set; set flag bit 3
-		SHR(64, R(cr_val), Imm8(61));
-		MOVZX(32, 8, RSCRATCH, MDisp(cr_val, (u32)(u64)m_flagTable));
-		OR(32, gpr.R(d), R(RSCRATCH));
-	}
-
+	MOV(32, gpr.R(d), R(RSCRATCH));
 	gpr.UnlockAll();
 	gpr.UnlockAllX();
 }
@@ -506,6 +514,13 @@ void Jit64::crXXX(UGeckoInstruction inst)
 		return;
 	}
 
+	// Special case: crset
+	if (inst.CRBA == inst.CRBB && inst.CRBA == inst.CRBD && inst.SUBOP10 == 289)
+	{
+		SetCRFieldBit(inst.CRBD >> 2, 3 - (inst.CRBD & 3));
+		return;
+	}
+
 	// TODO(delroth): Potential optimizations could be applied here. For
 	// instance, if the two CR bits being loaded are the same, two loads are
 	// not required.

Source/Core/Core/PowerPC/Jit64IL/JitIL.cpp

@@ -249,7 +249,7 @@ void JitIL::Init()
 	jo.accurateSinglePrecision = false;
 	js.memcheck = SConfig::GetInstance().m_LocalCoreStartupParameter.bMMU;
 
-	trampolines.Init();
+	trampolines.Init(js.memcheck ? TRAMPOLINE_CODE_SIZE_MMU : TRAMPOLINE_CODE_SIZE);
 	AllocCodeSpace(CODE_SIZE);
 	blocks.Init();
 	asm_routines.Init(nullptr);

Source/Core/Core/PowerPC/JitCommon/JitAsmCommon.cpp

@@ -151,6 +151,44 @@ void CommonAsmRoutines::GenFres()
 	RET();
 }
 
+void CommonAsmRoutines::GenMfcr()
+{
+	// Input: none
+	// Output: RSCRATCH
+	// This function clobbers all three RSCRATCH.
+	X64Reg dst = RSCRATCH;
+	X64Reg tmp = RSCRATCH2;
+	X64Reg cr_val = RSCRATCH_EXTRA;
+	XOR(32, R(dst), R(dst));
+	// we only need to zero the high bits of tmp once
+	XOR(32, R(tmp), R(tmp));
+	for (int i = 0; i < 8; i++)
+	{
+		static const u32 m_flagTable[8] = { 0x0, 0x1, 0x8, 0x9, 0x0, 0x1, 0x8, 0x9 };
+		if (i != 0)
+			SHL(32, R(dst), Imm8(4));
+
+		MOV(64, R(cr_val), PPCSTATE(cr_val[i]));
+
+		// EQ: Bits 31-0 == 0; set flag bit 1
+		TEST(32, R(cr_val), R(cr_val));
+		// FIXME: is there a better way to do this without the partial register merging?
+		SETcc(CC_Z, R(tmp));
+		LEA(32, dst, MComplex(dst, tmp, SCALE_2, 0));
+
+		// GT: Value > 0; set flag bit 2
+		TEST(64, R(cr_val), R(cr_val));
+		SETcc(CC_G, R(tmp));
+		LEA(32, dst, MComplex(dst, tmp, SCALE_4, 0));
+
+		// SO: Bit 61 set; set flag bit 0
+		// LT: Bit 62 set; set flag bit 3
+		SHR(64, R(cr_val), Imm8(61));
+		OR(32, R(dst), MScaled(cr_val, SCALE_4, (u32)(u64)m_flagTable));
+	}
+	RET();
+}
+
 // Safe + Fast Quantizers, originally from JITIL by magumagu
 
 static const u8 GC_ALIGNED16(pbswapShuffle1x4[16]) = { 3, 2, 1, 0, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 };

Source/Core/Core/PowerPC/JitCommon/JitAsmCommon.h

@@ -25,6 +25,7 @@ public:
 
 	const u8 *frsqrte;
 	const u8 *fres;
+	const u8 *mfcr;
 
 	// In: array index: GQR to use.
 	// In: ECX: Address to read from.
@@ -58,4 +59,5 @@ public:
 	void GenFifoWrite(int size);
 	void GenFrsqrte();
 	void GenFres();
+	void GenMfcr();
 };

Source/Core/Core/PowerPC/JitCommon/JitBackpatch.cpp

@@ -73,9 +73,16 @@ bool Jitx86Base::BackPatch(u32 emAddress, SContext* ctx)
 
 	BitSet32 registersInUse = it->second;
 
+	u8* exceptionHandler = NULL;
+	if (jit->js.memcheck)
+	{
+		auto it2 = exceptionHandlerAtLoc.find(codePtr);
+		if (it2 != exceptionHandlerAtLoc.end())
+			exceptionHandler = it2->second;
+	}
+
 	if (!info.isMemoryWrite)
 	{
-		XEmitter emitter(codePtr);
 		int bswapNopCount;
 		if (info.byteSwap || info.operandSize == 1)
 			bswapNopCount = 0;
@@ -101,9 +108,11 @@ bool Jitx86Base::BackPatch(u32 emAddress, SContext* ctx)
 			totalSize += 3;
 		}
 
-		const u8 *trampoline = trampolines.GetReadTrampoline(info, registersInUse);
-		emitter.CALL((void *)trampoline);
+		XEmitter emitter(codePtr);
 		int padding = totalSize - BACKPATCH_SIZE;
+		u8* returnPtr = codePtr + 5 + padding;
+		const u8* trampoline = trampolines.GenerateReadTrampoline(info, registersInUse, exceptionHandler, returnPtr);
+		emitter.JMP(trampoline, true);
 		if (padding > 0)
 		{
 			emitter.NOP(padding);
@@ -113,14 +122,14 @@ bool Jitx86Base::BackPatch(u32 emAddress, SContext* ctx)
 	else
 	{
 		// TODO: special case FIFO writes. Also, support 32-bit mode.
-		auto it2 = pcAtLoc.find(codePtr);
-		if (it2 == pcAtLoc.end())
+		auto it3 = pcAtLoc.find(codePtr);
+		if (it3 == pcAtLoc.end())
 		{
 			PanicAlert("BackPatch: no pc entry for address %p", codePtr);
 			return nullptr;
 		}
 
-		u32 pc = it2->second;
+		u32 pc = it3->second;
 
 		u8 *start;
 		if (info.byteSwap || info.hasImmediate)
@@ -154,9 +163,10 @@ bool Jitx86Base::BackPatch(u32 emAddress, SContext* ctx)
 			start = codePtr - bswapSize;
 		}
 		XEmitter emitter(start);
-		const u8 *trampoline = trampolines.GetWriteTrampoline(info, registersInUse, pc);
-		emitter.CALL((void *)trampoline);
-		ptrdiff_t padding = (codePtr - emitter.GetCodePtr()) + info.instructionSize;
+		ptrdiff_t padding = (codePtr - (start + 5)) + info.instructionSize;
+		u8* returnPtr = start + 5 + padding;
+		const u8* trampoline = trampolines.GenerateWriteTrampoline(info, registersInUse, exceptionHandler, returnPtr, pc);
+		emitter.JMP(trampoline, true);
 		if (padding > 0)
 		{
 			emitter.NOP(padding);

Source/Core/Core/PowerPC/JitCommon/JitBase.h

@@ -73,6 +73,16 @@ protected:
 		int downcountAmount;
 		u32 numLoadStoreInst;
 		u32 numFloatingPointInst;
+		// If this is set, we need to generate an exception handler for the fastmem load.
+		u8* fastmemLoadStore;
+		// If this is set, a load or store already prepared a jump to the exception handler for us,
+		// so just fixup that branch instead of testing for a DSI again.
+		bool fixupExceptionHandler;
+		Gen::FixupBranch exceptionHandler;
+		// If these are set, we've stored the old value of a register which will be loaded in revertLoad,
+		// which lets us revert it on the exception path.
+		int revertGprLoad;
+		int revertFprLoad;
 
 		bool firstFPInstructionFound;
 		bool isLastInstruction;