[iterate-4A] jit: inline load fast-path (skip trampoline) — JIT reaches interpreter parity

Loads no longer call a trampoline on the common path. When memory exposes a flat
mapping and the address is proven non-MMIO and committed, the compiled block
loads directly from `membase + ea` (byte-swapped) with zero calls; otherwise it
falls back to the read trampoline.

Mechanism:
  * MemoryAccess::fast_mem() -> Option<FastMem { membase, page_table, mmio_mask,
    mmio_value }>. Default None; GuestMemory returns Some (flat 4 GiB mapping,
    page-table pointer, MMIO aperture pair). Wrappers that intercept accesses
    (the recompiler's speculative OverlayMemory) inherit None, so the fast path
    is disabled under the diff harness and their interception is preserved.
  * MemEnv carries membase/page_table/mmio_mask/mmio_value; MemEnv::new(mem)
    fills them (or nulls when fast_mem() is None).
  * emit_inline_load emits a 5-block diamond: membase==0 -> slow (disabled);
    (ea & mmio_mask) == mmio_value -> slow (maybe MMIO); page_table[ea>>12]
    COMMIT bit (49) clear -> slow (unmapped; the mapped check is mandatory —
    unmapped pages are PROT_NONE and a raw load would fault); else fast load
    membase+ea, bswap, zero-extend. Wired all integer loads (lbz/lhz/lwz/ld +
    x-forms) and FP loads (lfs/lfsx reuse the diamond then bitcast/fpromote;
    lfd/lfdx bit-copy). Stores and FP-punt still trampoline.

Validation (three ways, since the diff harness disables the fast path):
  * unit test jit_inline_load_matches_interpreter — real GuestMemory, both the
    mapped (fast) and unmapped (slow) address bit-match the interpreter.
  * e2e XENIA_JIT=1 boot+movie plays, clean exit.
  * diff regression: checked 149.2M blocks, MISMATCHES=0 (validates the
    unchanged slow/ALU/branch/FP logic).

Measured (2e9 instr, block-exec MIPS): interpreter 98.2 / JIT trampoline-loads
93.8 / JIT inline-loads 96.5 — inline loads recover the trampoline overhead,
bringing the JIT to parity (~1.7% slower, within noise). Beating the interpreter
needs the levers it can't do: block-linking (30% dispatch), host registers.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

crates/xenia-memory/src/access.rs

@@ -1,3 +1,29 @@
+/// Raw pointers/constants a JIT needs to inline the load fast-path (skip the
+/// trait-object call). Only the real [`crate::heap::GuestMemory`] exposes this;
+/// wrappers that intercept accesses (e.g. the recompiler's speculative overlay)
+/// return `None` from [`MemoryAccess::fast_mem`] so the JIT falls back to the
+/// trait-object slow path and their interception is preserved.
+///
+/// The flat mapping means a guest address `a` translates to `membase + a`. A
+/// load is safe to inline only when `a` is **not** MMIO and its page is
+/// committed: `(a & mmio_mask) != mmio_value` AND page-table entry
+/// `page_table[a >> 12]` has the COMMIT bit (bit 49). Unmapped pages are
+/// `PROT_NONE`, so the committed check must precede the raw load.
+#[derive(Clone, Copy)]
+pub struct FastMem {
+    /// Base of the flat 4 GiB guest mapping. `membase + guest_addr` is the host
+    /// address. Never null for a real mapping (used by the JIT as the
+    /// "inline enabled" sentinel).
+    pub membase: *mut u8,
+    /// Base of the per-page allocation table (`AtomicU64` entries, reinterpreted
+    /// as `u64`). Entry `page_table[addr >> 12]` bit 49 = COMMIT.
+    pub page_table: *const u64,
+    /// MMIO fast-reject mask/value: `(addr & mask) == value` is the *necessary*
+    /// condition for `addr` to be MMIO, so `!=` proves non-MMIO.
+    pub mmio_mask: u32,
+    pub mmio_value: u32,
+}
+
 /// Trait for all guest memory access. Every load/store goes through this,
 /// enabling MMIO checking and debugger observation on every access.
 /// This is the key abstraction that eliminates the need for MMIO exception handlers.
@@ -58,6 +84,14 @@ pub trait MemoryAccess {
         false
     }
 
+    /// Raw pointers/constants for a JIT to inline the load fast-path, or `None`
+    /// to force the trait-object slow path. Default `None` (mock memories and
+    /// interception wrappers have no flat mapping to expose). `GuestMemory`
+    /// overrides it. See [`FastMem`].
+    fn fast_mem(&self) -> Option<FastMem> {
+        None
+    }
+
     /// Get a direct host pointer for the given guest address.
     /// Returns None if the address is invalid or in an MMIO region.
     fn translate(&self, addr: u32) -> Option<*const u8>;