PGMAllPool.cpp revision 92e770dbf167ee799d35dd505ccce02be76b85fc
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * PGM Shadow Page Pool.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Copyright (C) 2006-2007 Oracle Corporation
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * This file is part of VirtualBox Open Source Edition (OSE), as
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * available from http://www.virtualbox.org. This file is free software;
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * you can redistribute it and/or modify it under the terms of the GNU
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * General Public License (GPL) as published by the Free Software
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Foundation, in version 2 as it comes in the "COPYING" file of the
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync/*******************************************************************************
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync* Header Files *
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync*******************************************************************************/
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync/*******************************************************************************
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync* Internal Functions *
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync*******************************************************************************/
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncDECLINLINE(unsigned) pgmPoolTrackGetShadowEntrySize(PGMPOOLKIND enmKind);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncDECLINLINE(unsigned) pgmPoolTrackGetGuestEntrySize(PGMPOOLKIND enmKind);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncstatic void pgmPoolTrackDeref(PPGMPOOL pPool, PPGMPOOLPAGE pPage);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncstatic int pgmPoolTrackAddUser(PPGMPOOL pPool, PPGMPOOLPAGE pPage, uint16_t iUser, uint32_t iUserTable);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncstatic void pgmPoolMonitorModifiedRemove(PPGMPOOL pPool, PPGMPOOLPAGE pPage);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncDECLEXPORT(int) pgmPoolAccessHandler(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, RTGCPHYS GCPhysFault, void *pvUser);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncstatic const char *pgmPoolPoolKindToStr(uint8_t enmKind);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync#if defined(VBOX_STRICT) && defined(PGMPOOL_WITH_OPTIMIZED_DIRTY_PT)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncstatic void pgmPoolTrackCheckPTPaePae(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PX86PTPAE pShwPT, PCX86PTPAE pGstPT);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncint pgmPoolTrackFlushGCPhysPTsSlow(PVM pVM, PPGMPAGE pPhysPage);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncPPGMPOOLPHYSEXT pgmPoolTrackPhysExtAlloc(PVM pVM, uint16_t *piPhysExt);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncvoid pgmPoolTrackPhysExtFree(PVM pVM, uint16_t iPhysExt);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncvoid pgmPoolTrackPhysExtFreeList(PVM pVM, uint16_t iPhysExt);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Checks if the specified page pool kind is for a 4MB or 2MB guest page.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * @returns true if it's the shadow of a 4MB or 2MB guest page, otherwise false.
c142e0f462e6c921a73d84ee50f41396b3a99db5vboxsync * @param enmKind The page kind.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncDECLINLINE(bool) pgmPoolIsBigPage(PGMPOOLKIND enmKind)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync return true;
5f2b03bf7695dabd71222dba123532a3f76828c1vboxsync return false;
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync/** @def PGMPOOL_PAGE_2_LOCKED_PTR
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Maps a pool page pool into the current context and lock it (RC only).
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * @returns VBox status code.
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync * @param pVM The VM handle.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pPage The pool page.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @remark In RC this uses PGMGCDynMapHCPage(), so it will consume of the
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * small page window employeed by that function. Be careful.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @remark There is no need to assert on the result.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncDECLINLINE(void *) PGMPOOL_PAGE_2_LOCKED_PTR(PVM pVM, PPGMPOOLPAGE pPage)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync void *pv = pgmPoolMapPageInlined(&pVM->pgm.s, pPage);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync /* Make sure the dynamic mapping will not be reused. */
9523921c89c66f4bececdbd5ac95aed0039eda1bvboxsync# define PGMPOOL_PAGE_2_LOCKED_PTR(pVM, pPage) PGMPOOL_PAGE_2_PTR(pVM, pPage)
9523921c89c66f4bececdbd5ac95aed0039eda1bvboxsync/** @def PGMPOOL_UNLOCK_PTR
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync * Unlock a previously locked dynamic caching (RC only).
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync * @returns VBox status code.
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync * @param pVM The VM handle.
9523921c89c66f4bececdbd5ac95aed0039eda1bvboxsync * @param pPage The pool page.
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync * @remark In RC this uses PGMGCDynMapHCPage(), so it will consume of the
9523921c89c66f4bececdbd5ac95aed0039eda1bvboxsync * small page window employeed by that function. Be careful.
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync * @remark There is no need to assert on the result.
ed9d3db07648c7e3a979105c15ad752ee9ea18devboxsyncDECLINLINE(void) PGMPOOL_UNLOCK_PTR(PVM pVM, void *pvPage)
9523921c89c66f4bececdbd5ac95aed0039eda1bvboxsync# define PGMPOOL_UNLOCK_PTR(pVM, pPage) do {} while (0)
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync * Flushes a chain of pages sharing the same access monitor.
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync * @returns VBox status code suitable for scheduling.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * @param pPool The pool.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * @param pPage A page in the chain.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncint pgmPoolMonitorChainFlush(PPGMPOOL pPool, PPGMPOOLPAGE pPage)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync LogFlow(("pgmPoolMonitorChainFlush: Flush page %RGp type=%d\n", pPage->GCPhys, pPage->enmKind));
06ea6bcf23874b662d499b3f130024c98b2dd7a6vboxsync * Find the list head.
5f2b03bf7695dabd71222dba123532a3f76828c1vboxsync * Iterate the list flushing each shadow page.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Wrapper for getting the current context pointer to the entry being modified.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @returns VBox status code suitable for scheduling.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pVM VM Handle.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pvDst Destination address
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pvSrc Source guest virtual address.
06ea6bcf23874b662d499b3f130024c98b2dd7a6vboxsync * @param GCPhysSrc The source guest physical address.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param cb Size of data to read
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncDECLINLINE(int) pgmPoolPhysSimpleReadGCPhys(PVM pVM, void *pvDst, CTXTYPE(RTGCPTR, RTHCPTR, RTGCPTR) pvSrc, RTGCPHYS GCPhysSrc, size_t cb)
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync memcpy(pvDst, (RTHCPTR)((uintptr_t)pvSrc & ~(RTHCUINTPTR)(cb - 1)), cb);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync /* @todo in RC we could attempt to use the virtual address, although this can cause many faults (PAE Windows XP guest). */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync return PGMPhysSimpleReadGCPhys(pVM, pvDst, GCPhysSrc & ~(RTGCPHYS)(cb - 1), cb);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Process shadow entries before they are changed by the guest.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * For PT entries we will clear them. For PD entries, we'll simply check
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * for mapping conflicts and set the SyncCR3 FF if found.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pVCpu VMCPU handle
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pPool The pool.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pPage The head page.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param GCPhysFault The guest physical fault address.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param uAddress In R0 and GC this is the guest context fault address (flat).
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * In R3 this is the host context 'fault' address.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * @param cbWrite Write size; might be zero if the caller knows we're not crossing entry boundaries
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncvoid pgmPoolMonitorChainChanging(PVMCPU pVCpu, PPGMPOOL pPool, PPGMPOOLPAGE pPage, RTGCPHYS GCPhysFault, CTXTYPE(RTGCPTR, RTHCPTR, RTGCPTR) pvAddress, unsigned cbWrite)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync AssertMsg(pPage->iMonitoredPrev == NIL_PGMPOOL_IDX, ("%#x (idx=%#x)\n", pPage->iMonitoredPrev, pPage->idx));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync const unsigned off = GCPhysFault & PAGE_OFFSET_MASK;
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync LogFlow(("pgmPoolMonitorChainChanging: %RGv phys=%RGp cbWrite=%d\n", (RTGCPTR)(CTXTYPE(RTGCPTR, uintptr_t, RTGCPTR))pvAddress, GCPhysFault, cbWrite));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync LogFlow(("pgmPoolMonitorChainChanging: page idx=%d phys=%RGp (next=%d) kind=%s\n", pPage->idx, pPage->GCPhys, pPage->iMonitoredNext, pgmPoolPoolKindToStr(pPage->enmKind), cbWrite));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPT));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync LogFlow(("PGMPOOLKIND_32BIT_PT_FOR_32BIT_PT iShw=%x\n", iShw));
7e8ef90d3160234df0f254131b87af4243d79476vboxsync int rc = pgmPoolPhysSimpleReadGCPhys(pVM, &GstPte, pvAddress, GCPhysFault, sizeof(GstPte));
7e8ef90d3160234df0f254131b87af4243d79476vboxsync Log4(("pgmPoolMonitorChainChanging 32_32: deref %016RX64 GCPhys %08RX32\n", uShw.pPT->a[iShw].u & X86_PTE_PAE_PG_MASK, GstPte.u & X86_PTE_PG_MASK));
7e8ef90d3160234df0f254131b87af4243d79476vboxsync /* page/2 sized */
7e8ef90d3160234df0f254131b87af4243d79476vboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPT));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync const unsigned iShw = (off / sizeof(X86PTE)) & (X86_PG_PAE_ENTRIES - 1);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync LogFlow(("PGMPOOLKIND_PAE_PT_FOR_32BIT_PT iShw=%x\n", iShw));
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync int rc = pgmPoolPhysSimpleReadGCPhys(pVM, &GstPte, pvAddress, GCPhysFault, sizeof(GstPte));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync Log4(("pgmPoolMonitorChainChanging pae_32: deref %016RX64 GCPhys %08RX32\n", uShw.pPT->a[iShw].u & X86_PTE_PAE_PG_MASK, GstPte.u & X86_PTE_PG_MASK));
1cd59fdf671ca60c64d77e3f7046aaecf7003824vboxsync LogFlow(("pgmPoolMonitorChainChanging PAE for 32 bits: iGst=%x iShw=%x idx = %d page idx=%d\n", iGst, iShw, iShwPdpt, pPage->enmKind - PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD));
1cd59fdf671ca60c64d77e3f7046aaecf7003824vboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPD));
1cd59fdf671ca60c64d77e3f7046aaecf7003824vboxsync if (iShwPdpt == pPage->enmKind - (unsigned)PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD)
1cd59fdf671ca60c64d77e3f7046aaecf7003824vboxsync for (unsigned i = 0; i < 2; i++)
1cd59fdf671ca60c64d77e3f7046aaecf7003824vboxsync if ((uShw.pPDPae->a[iShw + i].u & (PGM_PDFLAGS_MAPPING | X86_PDE_P)) == (PGM_PDFLAGS_MAPPING | X86_PDE_P))
1cd59fdf671ca60c64d77e3f7046aaecf7003824vboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShwPdpt=%#x iShw=%#x!\n", iShwPdpt, iShw+i));
1cd59fdf671ca60c64d77e3f7046aaecf7003824vboxsync# endif /* !IN_RING0 */
1cd59fdf671ca60c64d77e3f7046aaecf7003824vboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw=%#x: %RX64 -> freeing it!\n", iShw+i, uShw.pPDPae->a[iShw+i].u));
1cd59fdf671ca60c64d77e3f7046aaecf7003824vboxsync /* paranoia / a bit assumptive. */
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync if ((uShw.pPDPae->a[iShw2].u & (PGM_PDFLAGS_MAPPING | X86_PDE_P)) == (PGM_PDFLAGS_MAPPING | X86_PDE_P))
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShwPdpt=%#x iShw2=%#x!\n", iShwPdpt, iShw2));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync# endif /* !IN_RING0 */
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPDPae->a[iShw2].u));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPT));
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync int rc = pgmPoolPhysSimpleReadGCPhys(pVM, &GstPte, pvAddress, GCPhysFault, sizeof(GstPte));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync Log4(("pgmPoolMonitorChainChanging pae: deref %016RX64 GCPhys %016RX64\n", uShw.pPTPae->a[iShw].u & X86_PTE_PAE_PG_MASK, GstPte.u & X86_PTE_PAE_PG_MASK));
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync /* paranoia / a bit assumptive. */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PTEPAE);
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync int rc = pgmPoolPhysSimpleReadGCPhys(pVM, &GstPte, (RTHCPTR)((RTHCUINTPTR)pvAddress + sizeof(GstPte)), GCPhysFault + sizeof(GstPte), sizeof(GstPte));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync int rc = pgmPoolPhysSimpleReadGCPhys(pVM, &GstPte, pvAddress + sizeof(GstPte), GCPhysFault + sizeof(GstPte), sizeof(GstPte));
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync Log4(("pgmPoolMonitorChainChanging pae: deref %016RX64 GCPhys %016RX64\n", uShw.pPTPae->a[iShw2].u & X86_PTE_PAE_PG_MASK, GstPte.u & X86_PTE_PAE_PG_MASK));
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync const unsigned iShw = off / sizeof(X86PTE); // ASSUMING 32-bit guest paging!
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync LogFlow(("pgmPoolMonitorChainChanging: PGMPOOLKIND_32BIT_PD %x\n", iShw));
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPD));
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync STAM_COUNTER_INC(&(pVCpu->pgm.s.StatRZGuestCR3WriteConflict));
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShw=%#x!\n", iShw));
5366e994777f9d9391cf809dc77610f57270d75dvboxsync# endif /* !IN_RING0 */
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync# endif /* !IN_RING0 */
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync LogFlow(("pgmPoolMonitorChainChanging: 32 bit pd iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPD->a[iShw].u));
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync /* paranoia / a bit assumptive. */
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PTE);
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync STAM_COUNTER_INC(&(pVCpu->pgm.s.StatRZGuestCR3WriteConflict));
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShw2=%#x!\n", iShw2));
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync# endif /* !IN_RING0 */
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync# endif /* !IN_RING0 */
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync LogFlow(("pgmPoolMonitorChainChanging: 32 bit pd iShw=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPD->a[iShw2].u));
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync#if 0 /* useful when running PGMAssertCR3(), a bit too troublesome for general use (TLBs). */
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync LogFlow(("pgmPoolMonitorChainChanging: iShw=%#x: %RX32 -> freeing it!\n", iShw, uShw.pPD->a[iShw].u));
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync# ifdef IN_RC /* TLB load - we're pushing things a bit... */
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync pgmPoolFree(pVM, uShw.pPD->a[iShw].u & X86_PDE_PG_MASK, pPage->idx, iShw);
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPD));
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync STAM_COUNTER_INC(&(pVCpu->pgm.s.StatRZGuestCR3WriteConflict));
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShw=%#x!\n", iShw));
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync#endif /* !IN_RING0 */
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync * Causes trouble when the guest uses a PDE to refer to the whole page table level
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync * structure. (Invalidate here; faults later on when it tries to change the page
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync * table entries -> recheck; probably only applies to the RC case.)
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync# endif /* !IN_RING0 */
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPDPae->a[iShw].u));
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync /* paranoia / a bit assumptive. */
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PDEPAE);
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync STAM_COUNTER_INC(&(pVCpu->pgm.s.StatRZGuestCR3WriteConflict));
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShw2=%#x!\n", iShw2));
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync#endif /* !IN_RING0 */
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync# endif /* !IN_RING0 */
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw2=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPDPae->a[iShw2].u));
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPDPT));
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync * Hopefully this doesn't happen very often:
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync * - touching unused parts of the page
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync * - messing with the bits of pd pointers without changing the physical address
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync /* PDPT roots are not page aligned; 32 byte only! */
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync const unsigned offPdpt = GCPhysFault - pPage->GCPhys;
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync if (iShw < X86_PG_PAE_PDPE_ENTRIES) /* don't use RT_ELEMENTS(uShw.pPDPT->a), because that's for long mode only */
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync STAM_COUNTER_INC(&(pVCpu->pgm.s.StatRZGuestCR3WriteConflict));
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected pdpt conflict at iShw=%#x!\n", iShw));
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync# endif /* !IN_RING0 */
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync# endif /* !IN_RING0 */
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pdpt iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPDPT->a[iShw].u));
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync /* paranoia / a bit assumptive. */
8bc8d66f188d5357155b8340e2d489573be2b607vboxsync const unsigned iShw2 = (offPdpt + cbWrite - 1) / sizeof(X86PDPE);
88cc9bf61296bc5526344415167bb2625ae1dd99vboxsync STAM_COUNTER_INC(&(pVCpu->pgm.s.StatRZGuestCR3WriteConflict));
8bc8d66f188d5357155b8340e2d489573be2b607vboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShw2=%#x!\n", iShw2));
88cc9bf61296bc5526344415167bb2625ae1dd99vboxsync# endif /* !IN_RING0 */
88cc9bf61296bc5526344415167bb2625ae1dd99vboxsync# endif /* !IN_RING0 */
88cc9bf61296bc5526344415167bb2625ae1dd99vboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pdpt iShw=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPDPT->a[iShw2].u));
cc1ef2ef9bbc6a0ff964928d61b7298e5bfcce5fvboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPD));
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync Assert(!(uShw.pPDPae->a[iShw].u & PGM_PDFLAGS_MAPPING));
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPDPae->a[iShw].u));
907b6adfa052386a0666d5557bee9bdbc100c2e5vboxsync /* paranoia / a bit assumptive. */
907b6adfa052386a0666d5557bee9bdbc100c2e5vboxsync const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PDEPAE);
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync Assert(!(uShw.pPDPae->a[iShw2].u & PGM_PDFLAGS_MAPPING));
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw2=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPDPae->a[iShw2].u));
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPDPT));
004d74842597dacc4009803171296dfcf9398c69vboxsync * Hopefully this doesn't happen very often:
004d74842597dacc4009803171296dfcf9398c69vboxsync * - messing with the bits of pd pointers without changing the physical address
004d74842597dacc4009803171296dfcf9398c69vboxsync LogFlow(("pgmPoolMonitorChainChanging: pdpt iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPDPT->a[iShw].u));
004d74842597dacc4009803171296dfcf9398c69vboxsync pgmPoolFree(pVM, uShw.pPDPT->a[iShw].u & X86_PDPE_PG_MASK, pPage->idx, iShw);
004d74842597dacc4009803171296dfcf9398c69vboxsync /* paranoia / a bit assumptive. */
004d74842597dacc4009803171296dfcf9398c69vboxsync const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PDPE);
004d74842597dacc4009803171296dfcf9398c69vboxsync LogFlow(("pgmPoolMonitorChainChanging: pdpt iShw2=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPDPT->a[iShw2].u));
004d74842597dacc4009803171296dfcf9398c69vboxsync pgmPoolFree(pVM, uShw.pPDPT->a[iShw2].u & X86_PDPE_PG_MASK, pPage->idx, iShw2);
004d74842597dacc4009803171296dfcf9398c69vboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPML4));
004d74842597dacc4009803171296dfcf9398c69vboxsync * Hopefully this doesn't happen very often:
004d74842597dacc4009803171296dfcf9398c69vboxsync * - messing with the bits of pd pointers without changing the physical address
004d74842597dacc4009803171296dfcf9398c69vboxsync LogFlow(("pgmPoolMonitorChainChanging: pml4 iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPML4->a[iShw].u));
004d74842597dacc4009803171296dfcf9398c69vboxsync pgmPoolFree(pVM, uShw.pPML4->a[iShw].u & X86_PML4E_PG_MASK, pPage->idx, iShw);
004d74842597dacc4009803171296dfcf9398c69vboxsync /* paranoia / a bit assumptive. */
004d74842597dacc4009803171296dfcf9398c69vboxsync const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PML4E);
004d74842597dacc4009803171296dfcf9398c69vboxsync LogFlow(("pgmPoolMonitorChainChanging: pml4 iShw2=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPML4->a[iShw2].u));
004d74842597dacc4009803171296dfcf9398c69vboxsync pgmPoolFree(pVM, uShw.pPML4->a[iShw2].u & X86_PML4E_PG_MASK, pPage->idx, iShw2);
004d74842597dacc4009803171296dfcf9398c69vboxsync#endif /* IN_RING0 */
004d74842597dacc4009803171296dfcf9398c69vboxsync AssertFatalMsgFailed(("enmKind=%d\n", pPage->enmKind));
004d74842597dacc4009803171296dfcf9398c69vboxsync * Checks if a access could be a fork operation in progress.
004d74842597dacc4009803171296dfcf9398c69vboxsync * Meaning, that the guest is setting up the parent process for Copy-On-Write.
004d74842597dacc4009803171296dfcf9398c69vboxsync * @returns true if it's likly that we're forking, otherwise false.
004d74842597dacc4009803171296dfcf9398c69vboxsync * @param pPool The pool.
004d74842597dacc4009803171296dfcf9398c69vboxsync * @param pDis The disassembled instruction.
004d74842597dacc4009803171296dfcf9398c69vboxsync * @param offFault The access offset.
004d74842597dacc4009803171296dfcf9398c69vboxsyncDECLINLINE(bool) pgmPoolMonitorIsForking(PPGMPOOL pPool, PDISCPUSTATE pDis, unsigned offFault)
004d74842597dacc4009803171296dfcf9398c69vboxsync * i386 linux is using btr to clear X86_PTE_RW.
5366e994777f9d9391cf809dc77610f57270d75dvboxsync * The functions involved are (2.6.16 source inspection):
5366e994777f9d9391cf809dc77610f57270d75dvboxsync * clear_bit
5366e994777f9d9391cf809dc77610f57270d75dvboxsync * ptep_set_wrprotect
5366e994777f9d9391cf809dc77610f57270d75dvboxsync * copy_one_pte
5366e994777f9d9391cf809dc77610f57270d75dvboxsync * copy_pte_range
5366e994777f9d9391cf809dc77610f57270d75dvboxsync * copy_pmd_range
88cc9bf61296bc5526344415167bb2625ae1dd99vboxsync * copy_pud_range
88cc9bf61296bc5526344415167bb2625ae1dd99vboxsync * copy_page_range
88cc9bf61296bc5526344415167bb2625ae1dd99vboxsync * copy_process
88cc9bf61296bc5526344415167bb2625ae1dd99vboxsync /** @todo Validate that the bit index is X86_PTE_RW. */
88cc9bf61296bc5526344415167bb2625ae1dd99vboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,Fork));
88cc9bf61296bc5526344415167bb2625ae1dd99vboxsync return true;
5366e994777f9d9391cf809dc77610f57270d75dvboxsync return false;
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync * Determine whether the page is likely to have been reused.
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync * @returns true if we consider the page as being reused for a different purpose.
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync * @returns false if we consider it to still be a paging page.
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync * @param pVM VM Handle.
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync * @param pVCpu VMCPU Handle.
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync * @param pRegFrame Trap register frame.
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync * @param pDis The disassembly info for the faulting instruction.
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync * @param pvFault The fault address.
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync * @remark The REP prefix check is left to the caller because of STOSD/W.
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsyncDECLINLINE(bool) pgmPoolMonitorIsReused(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pDis, RTGCPTR pvFault)
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync /** @todo could make this general, faulting close to rsp should be a safe reuse heuristic. */
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync /* Fault caused by stack writes while trying to inject an interrupt event. */
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync Log(("pgmPoolMonitorIsReused: reused %RGv for interrupt stack (rsp=%RGv).\n", pvFault, pRegFrame->rsp));
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync return true;
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync LogFlow(("Reused instr %RGv %d at %RGv param1.flags=%x param1.reg=%d\n", pRegFrame->rip, pDis->pCurInstr->opcode, pvFault, pDis->param1.flags, pDis->param1.base.reg_gen));
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync /* Non-supervisor mode write means it's used for something else. */
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync return true;
3ff8aa7d3c74cfbe8da5f77b8ea6c748cc79213avboxsync /* call implies the actual push of the return address faulted */
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync return true;
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync return true;
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync return true;
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync return true;
5366e994777f9d9391cf809dc77610f57270d75dvboxsync return true;
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync return true;
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync case OP_MOVNTDQ: /* solaris - hwblkclr & hwblkpagecopy */
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync return true;
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync return true;
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync return false;
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync return true;
5366e994777f9d9391cf809dc77610f57270d75dvboxsync return false;
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync * Flushes the page being accessed.
5366e994777f9d9391cf809dc77610f57270d75dvboxsync * @returns VBox status code suitable for scheduling.
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync * @param pVM The VM handle.
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync * @param pVCpu The VMCPU handle.
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync * @param pPool The pool.
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync * @param pPage The pool page (head).
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync * @param pDis The disassembly of the write instruction.
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync * @param pRegFrame The trap register frame.
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync * @param GCPhysFault The fault address as guest physical address.
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync * @param pvFault The fault address.
8bc8d66f188d5357155b8340e2d489573be2b607vboxsyncstatic int pgmPoolAccessHandlerFlush(PVM pVM, PVMCPU pVCpu, PPGMPOOL pPool, PPGMPOOLPAGE pPage, PDISCPUSTATE pDis,
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, RTGCPTR pvFault)
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync * First, do the flushing.
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync * Emulate the instruction (xp/w2k problem, requires pc/cr2/sp detection). Must do this in raw mode (!); XP boot will fail otherwise
5f2b03bf7695dabd71222dba123532a3f76828c1vboxsync int rc2 = EMInterpretInstructionCPUEx(pVM, pVCpu, pDis, pRegFrame, pvFault, &cbWritten, EMCODETYPE_ALL);
40c1a23e86c79b24a917a43c186b2e54504d12c1vboxsync LogFlow(("pgmPoolAccessHandlerPTWorker: Interpretation failed for patch code %04x:%RGv, ignoring.\n",
40c1a23e86c79b24a917a43c186b2e54504d12c1vboxsync STAM_COUNTER_INC(&pPool->StatMonitorRZIntrFailPatch2);
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,EmulateInstr));
6b9d50a0f466bd5a61458ed53925480ab28a3c17vboxsync LogFlow(("pgmPoolAccessHandlerPT: returns %Rrc (flushed)\n", rc));
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync * Handles the STOSD write accesses.
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync * @returns VBox status code suitable for scheduling.
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync * @param pVM The VM handle.
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync * @param pPool The pool.
5366e994777f9d9391cf809dc77610f57270d75dvboxsync * @param pPage The pool page (head).
5366e994777f9d9391cf809dc77610f57270d75dvboxsync * @param pDis The disassembly of the write instruction.
5366e994777f9d9391cf809dc77610f57270d75dvboxsync * @param pRegFrame The trap register frame.
5366e994777f9d9391cf809dc77610f57270d75dvboxsync * @param GCPhysFault The fault address as guest physical address.
5366e994777f9d9391cf809dc77610f57270d75dvboxsync * @param pvFault The fault address.
5366e994777f9d9391cf809dc77610f57270d75dvboxsyncDECLINLINE(int) pgmPoolAccessHandlerSTOSD(PVM pVM, PPGMPOOL pPool, PPGMPOOLPAGE pPage, PDISCPUSTATE pDis,
5366e994777f9d9391cf809dc77610f57270d75dvboxsync PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, RTGCPTR pvFault)
cc1ef2ef9bbc6a0ff964928d61b7298e5bfcce5fvboxsync Assert(pDis->mode == CPUMODE_32BIT || pDis->mode == CPUMODE_64BIT);
5366e994777f9d9391cf809dc77610f57270d75dvboxsync * Increment the modification counter and insert it into the list
cc1ef2ef9bbc6a0ff964928d61b7298e5bfcce5fvboxsync * of modified pages the first time.
ed9d3db07648c7e3a979105c15ad752ee9ea18devboxsync * Execute REP STOSD.
7e8ef90d3160234df0f254131b87af4243d79476vboxsync * This ASSUMES that we're not invoked by Trap0e on in a out-of-sync
7e8ef90d3160234df0f254131b87af4243d79476vboxsync * write situation, meaning that it's safe to write here.
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync uint32_t iPrevSubset = PGMDynMapPushAutoSubset(pVCpu);
907b6adfa052386a0666d5557bee9bdbc100c2e5vboxsync pgmPoolMonitorChainChanging(pVCpu, pPool, pPage, GCPhysFault, (RTGCPTR)pu32, uIncrement);
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync pgmPoolMonitorChainChanging(pVCpu, pPool, pPage, GCPhysFault, (RTGCPTR)pu32, uIncrement);
907b6adfa052386a0666d5557bee9bdbc100c2e5vboxsync PGMPhysSimpleWriteGCPhys(pVM, GCPhysFault, &pRegFrame->rax, uIncrement);
5f2b03bf7695dabd71222dba123532a3f76828c1vboxsync * Handles the simple write accesses.
5f2b03bf7695dabd71222dba123532a3f76828c1vboxsync * @returns VBox status code suitable for scheduling.
6b9d50a0f466bd5a61458ed53925480ab28a3c17vboxsync * @param pVM The VM handle.
6b9d50a0f466bd5a61458ed53925480ab28a3c17vboxsync * @param pVCpu The VMCPU handle.
6b9d50a0f466bd5a61458ed53925480ab28a3c17vboxsync * @param pPool The pool.
5f2b03bf7695dabd71222dba123532a3f76828c1vboxsync * @param pPage The pool page (head).
5f2b03bf7695dabd71222dba123532a3f76828c1vboxsync * @param pDis The disassembly of the write instruction.
5f2b03bf7695dabd71222dba123532a3f76828c1vboxsync * @param pRegFrame The trap register frame.
5f2b03bf7695dabd71222dba123532a3f76828c1vboxsync * @param GCPhysFault The fault address as guest physical address.
5f2b03bf7695dabd71222dba123532a3f76828c1vboxsync * @param pvFault The fault address.
88cc9bf61296bc5526344415167bb2625ae1dd99vboxsync * @param pfReused Reused state (out)
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsyncDECLINLINE(int) pgmPoolAccessHandlerSimple(PVM pVM, PVMCPU pVCpu, PPGMPOOL pPool, PPGMPOOLPAGE pPage, PDISCPUSTATE pDis,
88cc9bf61296bc5526344415167bb2625ae1dd99vboxsync PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, RTGCPTR pvFault, bool *pfReused)
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync * Increment the modification counter and insert it into the list
88cc9bf61296bc5526344415167bb2625ae1dd99vboxsync * of modified pages the first time.
88cc9bf61296bc5526344415167bb2625ae1dd99vboxsync * Clear all the pages. ASSUMES that pvFault is readable.
88cc9bf61296bc5526344415167bb2625ae1dd99vboxsync uint32_t iPrevSubset = PGMDynMapPushAutoSubset(pVCpu);
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync pgmPoolMonitorChainChanging(pVCpu, pPool, pPage, GCPhysFault, pvFault, DISGetParamSize(pDis, &pDis->param1));
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync pgmPoolMonitorChainChanging(pVCpu, pPool, pPage, GCPhysFault, pvFault, DISGetParamSize(pDis, &pDis->param1));
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync * Interpret the instruction.
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync int rc = EMInterpretInstructionCPUEx(pVM, pVCpu, pDis, pRegFrame, pvFault, &cb, EMCODETYPE_ALL);
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync LogFlow(("pgmPoolAccessHandlerPTWorker: Interpretation failed for %04x:%RGv - opcode=%d\n",
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync pRegFrame->cs, (RTGCPTR)pRegFrame->rip, pDis->pCurInstr->opcode));
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,EmulateInstr));
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync#if 0 /* experimental code */
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync int rc = pgmPoolPhysSimpleReadGCPhys(pVM, &GstPte, pvFault, GCPhysFault, sizeof(GstPte));
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync /* Check the new value written by the guest. If present and with a bogus physical address, then
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync * it's fairly safe to assume the guest is reusing the PT.
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync int rc = PGMPhysGCPhys2HCPhys(pVM, GstPte.u & X86_PTE_PAE_PG_MASK, &HCPhys);
0fd108a555ae02f2fb557d5f2c40281999b60d15vboxsync LogFlow(("pgmPoolAccessHandlerSimple: returns %Rrc cb=%d\n", rc, cb));
88cc9bf61296bc5526344415167bb2625ae1dd99vboxsync * \#PF Handler callback for PT write accesses.
88cc9bf61296bc5526344415167bb2625ae1dd99vboxsync * @returns VBox status code (appropriate for GC return).
88cc9bf61296bc5526344415167bb2625ae1dd99vboxsync * @param pVM VM Handle.
0fd108a555ae02f2fb557d5f2c40281999b60d15vboxsync * @param uErrorCode CPU Error code.
88cc9bf61296bc5526344415167bb2625ae1dd99vboxsync * @param pRegFrame Trap register frame.
88cc9bf61296bc5526344415167bb2625ae1dd99vboxsync * NULL on DMA and other non CPU access.
88cc9bf61296bc5526344415167bb2625ae1dd99vboxsync * @param pvFault The fault address (cr2).
0fd108a555ae02f2fb557d5f2c40281999b60d15vboxsync * @param GCPhysFault The GC physical address corresponding to pvFault.
88cc9bf61296bc5526344415167bb2625ae1dd99vboxsync * @param pvUser User argument.
0fd108a555ae02f2fb557d5f2c40281999b60d15vboxsyncDECLEXPORT(int) pgmPoolAccessHandler(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, RTGCPHYS GCPhysFault, void *pvUser)
0fd108a555ae02f2fb557d5f2c40281999b60d15vboxsync STAM_PROFILE_START(&pVM->pgm.s.CTX_SUFF(pPool)->CTX_SUFF_Z(StatMonitor), a);
f9ce005e61f0fbb51a2cabc53d58c3485151faa9vboxsync bool fForcedFlush = false;
f9ce005e61f0fbb51a2cabc53d58c3485151faa9vboxsync LogFlow(("pgmPoolAccessHandler: pvFault=%RGv pPage=%p:{.idx=%d} GCPhysFault=%RGp\n", pvFault, pPage, pPage->idx, GCPhysFault));
f9ce005e61f0fbb51a2cabc53d58c3485151faa9vboxsync if (PHYS_PAGE_ADDRESS(GCPhysFault) != PHYS_PAGE_ADDRESS(pPage->GCPhys))
0fd108a555ae02f2fb557d5f2c40281999b60d15vboxsync /* Pool page changed while we were waiting for the lock; ignore. */
0fd108a555ae02f2fb557d5f2c40281999b60d15vboxsync Log(("CPU%d: pgmPoolAccessHandler pgm pool page for %RGp changed (to %RGp) while waiting!\n", pVCpu->idCpu, PHYS_PAGE_ADDRESS(GCPhysFault), PHYS_PAGE_ADDRESS(pPage->GCPhys)));
0fd108a555ae02f2fb557d5f2c40281999b60d15vboxsync STAM_PROFILE_STOP_EX(&pVM->pgm.s.CTX_SUFF(pPool)->CTX_SUFF_Z(StatMonitor), &pPool->CTX_MID_Z(StatMonitor,Handled), a);
f9ce005e61f0fbb51a2cabc53d58c3485151faa9vboxsync return VINF_SUCCESS; /* SMP guest case where we were blocking on the pgm lock while the same page was being marked dirty. */
f9ce005e61f0fbb51a2cabc53d58c3485151faa9vboxsync#if 0 /* test code defined(VBOX_STRICT) && defined(PGMPOOL_WITH_OPTIMIZED_DIRTY_PT) */
f9ce005e61f0fbb51a2cabc53d58c3485151faa9vboxsync if (pPage->enmKind == PGMPOOLKIND_PAE_PT_FOR_PAE_PT)
f9ce005e61f0fbb51a2cabc53d58c3485151faa9vboxsync void *pvShw = PGMPOOL_PAGE_2_LOCKED_PTR(pPool->CTX_SUFF(pVM), pPage);
f9ce005e61f0fbb51a2cabc53d58c3485151faa9vboxsync int rc = PGM_GCPHYS_2_PTR(pPool->CTX_SUFF(pVM), pPage->GCPhys, &pvGst); AssertReleaseRC(rc);
f9ce005e61f0fbb51a2cabc53d58c3485151faa9vboxsync pgmPoolTrackCheckPTPaePae(pPool, pPage, (PX86PTPAE)pvShw, (PCX86PTPAE)pvGst);
f9ce005e61f0fbb51a2cabc53d58c3485151faa9vboxsync * Disassemble the faulting instruction.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync int rc = EMInterpretDisasOne(pVM, pVCpu, pRegFrame, pDis, NULL);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync AssertMsg(rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT, ("Unexpected rc %d\n", rc));
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync * We should ALWAYS have the list head as user parameter. This
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * is because we use that page to record the changes.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync /* Maximum nr of modifications depends on the page type. */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync if (pPage->enmKind == PGMPOOLKIND_PAE_PT_FOR_PAE_PT)
0fd108a555ae02f2fb557d5f2c40281999b60d15vboxsync * Incremental page table updates should weigh more than random ones.
0fd108a555ae02f2fb557d5f2c40281999b60d15vboxsync * (Only applies when started from offset 0)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync if ( pPage->pvLastAccessHandlerRip >= pRegFrame->rip - 0x40 /* observed loops in Windows 7 x64 */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync && pPage->pvLastAccessHandlerRip < pRegFrame->rip + 0x40
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync && pvFault == (pPage->pvLastAccessHandlerFault + pDis->param1.size)
0fd108a555ae02f2fb557d5f2c40281999b60d15vboxsync && pVCpu->pgm.s.cPoolAccessHandler == (pPage->cLastAccessHandlerCount + 1))
0fd108a555ae02f2fb557d5f2c40281999b60d15vboxsync Log(("Possible page reuse cMods=%d -> %d (locked=%d type=%s)\n", pPage->cModifications, pPage->cModifications * 2, pgmPoolIsPageLocked(&pVM->pgm.s, pPage), pgmPoolPoolKindToStr(pPage->enmKind)));
0fd108a555ae02f2fb557d5f2c40281999b60d15vboxsync pPage->cLastAccessHandlerCount = pVCpu->pgm.s.cPoolAccessHandler;
0fd108a555ae02f2fb557d5f2c40281999b60d15vboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FlushReinit));
0fd108a555ae02f2fb557d5f2c40281999b60d15vboxsync Log(("Mod overflow %RGv cMods=%d (locked=%d type=%s)\n", pvFault, pPage->cModifications, pgmPoolIsPageLocked(&pVM->pgm.s, pPage), pgmPoolPoolKindToStr(pPage->enmKind)));
0fd108a555ae02f2fb557d5f2c40281999b60d15vboxsync * Check if it's worth dealing with.
0fd108a555ae02f2fb557d5f2c40281999b60d15vboxsync bool fReused = false;
0fd108a555ae02f2fb557d5f2c40281999b60d15vboxsync if ( ( pPage->cModifications < cMaxModifications /** @todo #define */ /** @todo need to check that it's not mapping EIP. */ /** @todo adjust this! */
6b9d50a0f466bd5a61458ed53925480ab28a3c17vboxsync && !(fReused = pgmPoolMonitorIsReused(pVM, pVCpu, pRegFrame, pDis, pvFault))
0fd108a555ae02f2fb557d5f2c40281999b60d15vboxsync && !pgmPoolMonitorIsForking(pPool, pDis, GCPhysFault & PAGE_OFFSET_MASK))
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Simple instructions, no REP prefix.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync rc = pgmPoolAccessHandlerSimple(pVM, pVCpu, pPool, pPage, pDis, pRegFrame, GCPhysFault, pvFault, &fReused);
0fd108a555ae02f2fb557d5f2c40281999b60d15vboxsync /* A mov instruction to change the first page table entry will be remembered so we can detect
0fd108a555ae02f2fb557d5f2c40281999b60d15vboxsync * full page table changes early on. This will reduce the amount of unnecessary traps we'll take.
0fd108a555ae02f2fb557d5f2c40281999b60d15vboxsync && !pPage->cLocked /* only applies to unlocked pages as we can't free locked ones (e.g. cr3 root). */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync pPage->cLastAccessHandlerCount = pVCpu->pgm.s.cPoolAccessHandler;
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync /* Make sure we don't kick out a page too quickly. */
0fd108a555ae02f2fb557d5f2c40281999b60d15vboxsync /* ignore the 2nd write to this page table entry. */
0fd108a555ae02f2fb557d5f2c40281999b60d15vboxsync pPage->cLastAccessHandlerCount = pVCpu->pgm.s.cPoolAccessHandler;
0fd108a555ae02f2fb557d5f2c40281999b60d15vboxsync STAM_PROFILE_STOP_EX(&pVM->pgm.s.CTX_SUFF(pPool)->CTX_SUFF_Z(StatMonitor), &pPool->CTX_MID_Z(StatMonitor,Handled), a);
0fd108a555ae02f2fb557d5f2c40281999b60d15vboxsync * Windows is frequently doing small memset() operations (netio test 4k+).
0fd108a555ae02f2fb557d5f2c40281999b60d15vboxsync * We have to deal with these or we'll kill the cache and performance.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync bool fValidStosd = false;
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync && pRegFrame->ecx * 4 <= PAGE_SIZE - ((uintptr_t)pvFault & PAGE_OFFSET_MASK)
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync && (pRegFrame->eax == 0 || pRegFrame->eax == 0x80) /* the two values observed. */
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync && pRegFrame->rcx * 8 <= PAGE_SIZE - ((uintptr_t)pvFault & PAGE_OFFSET_MASK)
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync && (pRegFrame->rax == 0 || pRegFrame->rax == 0x80) /* the two values observed. */
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync rc = pgmPoolAccessHandlerSTOSD(pVM, pPool, pPage, pDis, pRegFrame, GCPhysFault, pvFault);
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync STAM_PROFILE_STOP_EX(&pVM->pgm.s.CTX_SUFF(pPool)->CTX_SUFF_Z(StatMonitor), &pPool->CTX_MID_Z(StatMonitor,RepStosd), a);
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync /* REP prefix, don't bother. */
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,RepPrefix));
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync Log4(("pgmPoolAccessHandler: eax=%#x ecx=%#x edi=%#x esi=%#x rip=%RGv opcode=%d prefix=%#x\n",
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync pRegFrame->eax, pRegFrame->ecx, pRegFrame->edi, pRegFrame->esi, (RTGCPTR)pRegFrame->rip, pDis->pCurInstr->opcode, pDis->prefix));
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync#if defined(PGMPOOL_WITH_OPTIMIZED_DIRTY_PT) && defined(IN_RING0)
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync /* E.g. Windows 7 x64 initializes page tables and touches some pages in the table during the process. This
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync * leads to pgm pool trashing and an excessive amount of write faults due to page monitoring.
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync || ( !pgmPoolMonitorIsReused(pVM, pVCpu, pRegFrame, pDis, pvFault)
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync && !pgmPoolMonitorIsForking(pPool, pDis, GCPhysFault & PAGE_OFFSET_MASK))
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync /* Flush any monitored duplicates as we will disable write protection. */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync /* Find the monitor head. */
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync while (pPageHead->iMonitoredPrev != NIL_PGMPOOL_IDX)
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync pPageHead = &pPool->aPages[pPageHead->iMonitoredPrev];
36f3c24e4ad9c6b813767db1faeabbe7e2ecc057vboxsync Log(("Flush duplicate page idx=%d GCPhys=%RGp type=%s\n", pPageHead->idx, pPageHead->GCPhys, pgmPoolPoolKindToStr(pPageHead->enmKind)));
ca3db470494a8b6eaec69ea37468a5cda65e2da8vboxsync /* The flushing above might fail for locked pages, so double check. */
36f3c24e4ad9c6b813767db1faeabbe7e2ecc057vboxsync /* Temporarily allow write access to the page table again. */
36f3c24e4ad9c6b813767db1faeabbe7e2ecc057vboxsync rc = PGMHandlerPhysicalPageTempOff(pVM, pPage->GCPhys, pPage->GCPhys);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync rc = PGMShwModifyPage(pVCpu, pvFault, 1, X86_PTE_RW, ~(uint64_t)X86_PTE_RW);
9523921c89c66f4bececdbd5ac95aed0039eda1bvboxsync /* In the SMP case the page table might be removed while we wait for the PGM lock in the trap handler. */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync ("PGMShwModifyPage -> GCPtr=%RGv rc=%d\n", pvFault, rc));
58c0567dee3cc3ebe62dec1e27f8e35bac4ddeb0vboxsync STAM_PROFILE_STOP(&pVM->pgm.s.CTX_SUFF(pPool)->CTX_SUFF_Z(StatMonitor), a);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync#endif /* PGMPOOL_WITH_OPTIMIZED_DIRTY_PT */
58c0567dee3cc3ebe62dec1e27f8e35bac4ddeb0vboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FlushModOverflow));
58c0567dee3cc3ebe62dec1e27f8e35bac4ddeb0vboxsync * Not worth it, so flush it.
58c0567dee3cc3ebe62dec1e27f8e35bac4ddeb0vboxsync * If we considered it to be reused, don't go back to ring-3
58c0567dee3cc3ebe62dec1e27f8e35bac4ddeb0vboxsync * to emulate failed instructions since we usually cannot
58c0567dee3cc3ebe62dec1e27f8e35bac4ddeb0vboxsync * interpret then. This may be a bit risky, in which case
58c0567dee3cc3ebe62dec1e27f8e35bac4ddeb0vboxsync * the reuse detection must be fixed.
58c0567dee3cc3ebe62dec1e27f8e35bac4ddeb0vboxsync rc = pgmPoolAccessHandlerFlush(pVM, pVCpu, pPool, pPage, pDis, pRegFrame, GCPhysFault, pvFault);
58c0567dee3cc3ebe62dec1e27f8e35bac4ddeb0vboxsync /* Make sure that the current instruction still has shadow page backing, otherwise we'll end up in a loop. */
58c0567dee3cc3ebe62dec1e27f8e35bac4ddeb0vboxsync if (PGMShwGetPage(pVCpu, pRegFrame->rip, NULL, NULL) == VINF_SUCCESS)
58c0567dee3cc3ebe62dec1e27f8e35bac4ddeb0vboxsync rc = VINF_SUCCESS; /* safe to restart the instruction. */
58c0567dee3cc3ebe62dec1e27f8e35bac4ddeb0vboxsync STAM_PROFILE_STOP_EX(&pVM->pgm.s.CTX_SUFF(pPool)->CTX_SUFF_Z(StatMonitor), &pPool->CTX_MID_Z(StatMonitor,FlushPage), a);
8bc8d66f188d5357155b8340e2d489573be2b607vboxsync# endif /* !IN_RING3 */
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * Check references to guest physical memory in a PAE / PAE page table.
8bc8d66f188d5357155b8340e2d489573be2b607vboxsync * @param pPool The pool.
8bc8d66f188d5357155b8340e2d489573be2b607vboxsync * @param pPage The page.
8bc8d66f188d5357155b8340e2d489573be2b607vboxsync * @param pShwPT The shadow page table (mapping of the page).
8bc8d66f188d5357155b8340e2d489573be2b607vboxsync * @param pGstPT The guest page table.
8bc8d66f188d5357155b8340e2d489573be2b607vboxsyncstatic void pgmPoolTrackCheckPTPaePae(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PX86PTPAE pShwPT, PCX86PTPAE pGstPT)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync unsigned cErrors = 0;
8bc8d66f188d5357155b8340e2d489573be2b607vboxsync unsigned LastPTE = ~0U; /* initialized to shut up gcc */
8bc8d66f188d5357155b8340e2d489573be2b607vboxsync RTHCPHYS LastHCPhys = NIL_RTHCPHYS; /* initialized to shut up gcc */
8bc8d66f188d5357155b8340e2d489573be2b607vboxsync for (unsigned i = 0; i < RT_MIN(RT_ELEMENTS(pShwPT->a), pPage->iFirstPresent); i++)
8bc8d66f188d5357155b8340e2d489573be2b607vboxsync AssertMsg(!pShwPT->a[i].n.u1Present, ("Unexpected PTE: idx=%d %RX64 (first=%d)\n", i, pShwPT->a[i].u, pPage->iFirstPresent));
8bc8d66f188d5357155b8340e2d489573be2b607vboxsync for (unsigned i = pPage->iFirstPresent; i < RT_ELEMENTS(pShwPT->a); i++)
8bc8d66f188d5357155b8340e2d489573be2b607vboxsync int rc = PGMPhysGCPhys2HCPhys(pPool->CTX_SUFF(pVM), pGstPT->a[i].u & X86_PTE_PAE_PG_MASK, &HCPhys);
8bc8d66f188d5357155b8340e2d489573be2b607vboxsync || (pShwPT->a[i].u & X86_PTE_PAE_PG_MASK) != HCPhys)
8bc8d66f188d5357155b8340e2d489573be2b607vboxsync Log(("rc=%d idx=%d guest %RX64 shw=%RX64 vs %RHp\n", rc, i, pGstPT->a[i].u, pShwPT->a[i].u, HCPhys));
8bc8d66f188d5357155b8340e2d489573be2b607vboxsync rc = PGMPhysGCPhys2HCPhys(pPool->CTX_SUFF(pVM), pPage->GCPhys, &HCPhysPT);
8bc8d66f188d5357155b8340e2d489573be2b607vboxsync for (unsigned iPage = 0; iPage < pPool->cCurPages; iPage++)
8bc8d66f188d5357155b8340e2d489573be2b607vboxsync if (pTempPage->enmKind == PGMPOOLKIND_PAE_PT_FOR_PAE_PT)
8bc8d66f188d5357155b8340e2d489573be2b607vboxsync PX86PTPAE pShwPT2 = (PX86PTPAE)PGMPOOL_PAGE_2_LOCKED_PTR(pPool->CTX_SUFF(pVM), pTempPage);
8bc8d66f188d5357155b8340e2d489573be2b607vboxsync for (unsigned j = 0; j < RT_ELEMENTS(pShwPT->a); j++)
8bc8d66f188d5357155b8340e2d489573be2b607vboxsync && ((pShwPT2->a[j].u & X86_PTE_PAE_PG_MASK) == HCPhysPT))
8bc8d66f188d5357155b8340e2d489573be2b607vboxsync Log(("GCPhys=%RGp idx=%d %RX64 vs %RX64\n", pTempPage->GCPhys, j, pShwPT->a[j].u, pShwPT2->a[j].u));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync AssertMsg(!cErrors, ("cErrors=%d: last rc=%d idx=%d guest %RX64 shw=%RX64 vs %RHp\n", cErrors, LastRc, LastPTE, pGstPT->a[LastPTE].u, pShwPT->a[LastPTE].u, LastHCPhys));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync# endif /* VBOX_STRICT */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Clear references to guest physical memory in a PAE / PAE page table.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @returns nr of changed PTEs
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * @param pPool The pool.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * @param pPage The page.
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync * @param pShwPT The shadow page table (mapping of the page).
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync * @param pGstPT The guest page table.
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync * @param pOldGstPT The old cached guest page table.
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync * @param fAllowRemoval Bail out as soon as we encounter an invalid PTE
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pfFlush Flush reused page table (out)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncDECLINLINE(unsigned) pgmPoolTrackFlushPTPaePae(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PX86PTPAE pShwPT, PCX86PTPAE pGstPT, PCX86PTPAE pOldGstPT, bool fAllowRemoval, bool *pfFlush)
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync unsigned cChanged = 0;
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync for (unsigned i = 0; i < RT_MIN(RT_ELEMENTS(pShwPT->a), pPage->iFirstPresent); i++)
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync AssertMsg(!pShwPT->a[i].n.u1Present, ("Unexpected PTE: idx=%d %RX64 (first=%d)\n", i, pShwPT->a[i].u, pPage->iFirstPresent));
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync for (unsigned i = pPage->iFirstPresent; i < RT_ELEMENTS(pShwPT->a); i++)
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync /* Check the new value written by the guest. If present and with a bogus physical address, then
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync * it's fairly safe to assume the guest is reusing the PT.
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync if (!PGMPhysIsGCPhysValid(pPool->CTX_SUFF(pVM), pGstPT->a[i].u & X86_PTE_PAE_PG_MASK))
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync /* If the old cached PTE is identical, then there's no need to flush the shadow copy. */
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync if ((pGstPT->a[i].u & X86_PTE_PAE_PG_MASK) == (pOldGstPT->a[i].u & X86_PTE_PAE_PG_MASK))
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync int rc = PGMPhysGCPhys2HCPhys(pPool->CTX_SUFF(pVM), pGstPT->a[i].u & X86_PTE_PAE_PG_MASK, &HCPhys);
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync AssertMsg(rc == VINF_SUCCESS && (pShwPT->a[i].u & X86_PTE_PAE_PG_MASK) == HCPhys, ("rc=%d guest %RX64 old %RX64 shw=%RX64 vs %RHp\n", rc, pGstPT->a[i].u, pOldGstPT->a[i].u, pShwPT->a[i].u, HCPhys));
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync uint64_t uHostAttr = pShwPT->a[i].u & (X86_PTE_P | X86_PTE_US | X86_PTE_A | X86_PTE_D | X86_PTE_G | X86_PTE_PAE_NX);
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync uint64_t uGuestAttr = pGstPT->a[i].u & (X86_PTE_P | X86_PTE_US | X86_PTE_A | X86_PTE_D | X86_PTE_G | X86_PTE_PAE_NX);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync /* Something was changed, so flush it. */
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync Log4(("pgmPoolTrackDerefPTPaePae: i=%d pte=%RX64 hint=%RX64\n",
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync i, pShwPT->a[i].u & X86_PTE_PAE_PG_MASK, pOldGstPT->a[i].u & X86_PTE_PAE_PG_MASK));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync pgmPoolTracDerefGCPhysHint(pPool, pPage, pShwPT->a[i].u & X86_PTE_PAE_PG_MASK, pOldGstPT->a[i].u & X86_PTE_PAE_PG_MASK, i);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Flush a dirty page
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pVM VM Handle.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * @param pPool The pool.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * @param idxSlot Dirty array slot index
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param fAllowRemoval Allow a reused page table to be removed
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncstatic void pgmPoolFlushDirtyPage(PVM pVM, PPGMPOOL pPool, unsigned idxSlot, bool fAllowRemoval = false)
06ea6bcf23874b662d499b3f130024c98b2dd7a6vboxsync Assert(idxSlot < RT_ELEMENTS(pPool->aIdxDirtyPages));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync if (pPool->aIdxDirtyPages[idxSlot] == NIL_PGMPOOL_IDX)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync Assert(pPage->iMonitoredNext == NIL_PGMPOOL_IDX && pPage->iMonitoredPrev == NIL_PGMPOOL_IDX);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync AssertMsg(pPage->fDirty, ("Page %RGp (slot=%d) not marked dirty!", pPage->GCPhys, idxSlot));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync Log(("Flush dirty page %RGp cMods=%d\n", pPage->GCPhys, pPage->cModifications));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync /* First write protect the page again to catch all write accesses. (before checking for changes -> SMP) */
06ea6bcf23874b662d499b3f130024c98b2dd7a6vboxsync int rc = PGMHandlerPhysicalReset(pVM, pPage->GCPhys);
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync uint32_t iPrevSubset = PGMDynMapPushAutoSubset(VMMGetCpu(pVM));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync rc = PGMShwGetPage(VMMGetCpu(pVM), pPage->pvDirtyFault, &fFlags, &HCPhys);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync && (!(fFlags & X86_PTE_RW) || HCPhys != pPage->Core.Key))
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync /* In the SMP case the page table might be removed while we wait for the PGM lock in the trap handler. */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync ("PGMShwGetPage -> GCPtr=%RGv rc=%d flags=%RX64\n", pPage->pvDirtyFault, rc, fFlags));
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync /* Flush those PTEs that have changed. */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync void *pvShw = PGMPOOL_PAGE_2_LOCKED_PTR(pPool->CTX_SUFF(pVM), pPage);
7862f4bd000f1eb6c86289f5ac2849e9cf943ca9vboxsync rc = PGM_GCPHYS_2_PTR(pPool->CTX_SUFF(pVM), pPage->GCPhys, &pvGst); AssertReleaseRC(rc);
7862f4bd000f1eb6c86289f5ac2849e9cf943ca9vboxsync unsigned cChanges = pgmPoolTrackFlushPTPaePae(pPool, pPage, (PX86PTPAE)pvShw, (PCX86PTPAE)pvGst, (PCX86PTPAE)&pPool->aDirtyPages[idxSlot][0], fAllowRemoval, &fFlush);
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync /** Note: we might want to consider keeping the dirty page active in case there were many changes. */
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync /* This page is likely to be modified again, so reduce the nr of modifications just a bit here. */
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync pPage->cModifications = RT_MAX(1, pPage->cModifications / 2);
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync if (pPool->cDirtyPages == RT_ELEMENTS(pPool->aIdxDirtyPages))
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync Assert(pPool->cDirtyPages <= RT_ELEMENTS(pPool->aIdxDirtyPages));
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync Log(("Removed dirty page %RGp cMods=%d cChanges=%d\n", pPage->GCPhys, pPage->cModifications, cChanges));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync PGMDynMapPopAutoSubset(VMMGetCpu(pVM), iPrevSubset);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Add a new dirty page
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * @param pVM VM Handle.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * @param pPool The pool.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * @param pPage The page.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsyncvoid pgmPoolAddDirtyPage(PVM pVM, PPGMPOOL pPool, PPGMPOOLPAGE pPage)
7862f4bd000f1eb6c86289f5ac2849e9cf943ca9vboxsync AssertCompile(RT_ELEMENTS(pPool->aIdxDirtyPages) == 8 || RT_ELEMENTS(pPool->aIdxDirtyPages) == 16);
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync Assert(idxFree < RT_ELEMENTS(pPool->aIdxDirtyPages));
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync Assert(pPage->iMonitoredNext == NIL_PGMPOOL_IDX && pPage->iMonitoredPrev == NIL_PGMPOOL_IDX);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync if (pPool->cDirtyPages >= RT_ELEMENTS(pPool->aIdxDirtyPages))
9523921c89c66f4bececdbd5ac95aed0039eda1bvboxsync STAM_COUNTER_INC(&pPool->StatDirtyPageOverFlowFlush);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync pgmPoolFlushDirtyPage(pVM, pPool, idxFree, true /* allow removal of reused page tables*/);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync Assert(pPool->cDirtyPages < RT_ELEMENTS(pPool->aIdxDirtyPages));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync AssertMsg(pPool->aIdxDirtyPages[idxFree] == NIL_PGMPOOL_IDX, ("idxFree=%d cDirtyPages=%d\n", idxFree, pPool->cDirtyPages));
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync Log(("Add dirty page %RGp (slot=%d)\n", pPage->GCPhys, idxFree));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync /* Make a copy of the guest page table as we require valid GCPhys addresses when removing
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * references to physical pages. (the HCPhys linear lookup is *extremely* expensive!)
7862f4bd000f1eb6c86289f5ac2849e9cf943ca9vboxsync void *pvShw = PGMPOOL_PAGE_2_LOCKED_PTR(pPool->CTX_SUFF(pVM), pPage);
7862f4bd000f1eb6c86289f5ac2849e9cf943ca9vboxsync int rc = PGM_GCPHYS_2_PTR(pPool->CTX_SUFF(pVM), pPage->GCPhys, &pvGst); AssertReleaseRC(rc);
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync memcpy(&pPool->aDirtyPages[idxFree][0], pvGst, PAGE_SIZE);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync pgmPoolTrackCheckPTPaePae(pPool, pPage, (PX86PTPAE)pvShw, (PCX86PTPAE)pvGst);
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync pPool->idxFreeDirtyPage = (pPool->idxFreeDirtyPage + 1) & (RT_ELEMENTS(pPool->aIdxDirtyPages) - 1);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync if ( pPool->cDirtyPages < RT_ELEMENTS(pPool->aIdxDirtyPages)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync && pPool->aIdxDirtyPages[pPool->idxFreeDirtyPage] != NIL_PGMPOOL_IDX)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync unsigned i;
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync for (i = 1; i < RT_ELEMENTS(pPool->aIdxDirtyPages); i++)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync idxFree = (pPool->idxFreeDirtyPage + i) & (RT_ELEMENTS(pPool->aIdxDirtyPages) - 1);
9523921c89c66f4bececdbd5ac95aed0039eda1bvboxsync if (pPool->aIdxDirtyPages[idxFree] == NIL_PGMPOOL_IDX)
58c0567dee3cc3ebe62dec1e27f8e35bac4ddeb0vboxsync Assert(pPool->cDirtyPages == RT_ELEMENTS(pPool->aIdxDirtyPages) || pPool->aIdxDirtyPages[pPool->idxFreeDirtyPage] == NIL_PGMPOOL_IDX);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync# endif /* !IN_RING3 */
58c0567dee3cc3ebe62dec1e27f8e35bac4ddeb0vboxsync * Check if the specified page is dirty (not write monitored)
58c0567dee3cc3ebe62dec1e27f8e35bac4ddeb0vboxsync * @return dirty or not
58c0567dee3cc3ebe62dec1e27f8e35bac4ddeb0vboxsync * @param pVM VM Handle.
58c0567dee3cc3ebe62dec1e27f8e35bac4ddeb0vboxsync * @param GCPhys Guest physical address
58c0567dee3cc3ebe62dec1e27f8e35bac4ddeb0vboxsync return false;
58c0567dee3cc3ebe62dec1e27f8e35bac4ddeb0vboxsync for (unsigned i = 0; i < RT_ELEMENTS(pPool->aIdxDirtyPages); i++)
9e17ca2e9d797e845e3284141dd4086a4b817ae5vboxsync return true;
9e17ca2e9d797e845e3284141dd4086a4b817ae5vboxsync return false;
9e17ca2e9d797e845e3284141dd4086a4b817ae5vboxsync * Reset all dirty pages by reinstating page monitoring.
9e17ca2e9d797e845e3284141dd4086a4b817ae5vboxsync * @param pVM VM Handle.
004d74842597dacc4009803171296dfcf9398c69vboxsync Assert(pPool->cDirtyPages <= RT_ELEMENTS(pPool->aIdxDirtyPages));
004d74842597dacc4009803171296dfcf9398c69vboxsync for (unsigned i = 0; i < RT_ELEMENTS(pPool->aIdxDirtyPages); i++)
9e17ca2e9d797e845e3284141dd4086a4b817ae5vboxsync pgmPoolFlushDirtyPage(pVM, pPool, i, true /* allow removal of reused page tables*/);
9e17ca2e9d797e845e3284141dd4086a4b817ae5vboxsync if ( pPool->cDirtyPages != RT_ELEMENTS(pPool->aIdxDirtyPages)
9e17ca2e9d797e845e3284141dd4086a4b817ae5vboxsync && pPool->aIdxDirtyPages[pPool->idxFreeDirtyPage] != NIL_PGMPOOL_IDX)
9e17ca2e9d797e845e3284141dd4086a4b817ae5vboxsync unsigned i;
9e17ca2e9d797e845e3284141dd4086a4b817ae5vboxsync for (i = 1; i < RT_ELEMENTS(pPool->aIdxDirtyPages); i++)
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync AssertMsg(i != RT_ELEMENTS(pPool->aIdxDirtyPages), ("cDirtyPages %d", pPool->cDirtyPages));
5366e994777f9d9391cf809dc77610f57270d75dvboxsync Assert(pPool->aIdxDirtyPages[pPool->idxFreeDirtyPage] == NIL_PGMPOOL_IDX || pPool->cDirtyPages == RT_ELEMENTS(pPool->aIdxDirtyPages));
5366e994777f9d9391cf809dc77610f57270d75dvboxsync * Reset all dirty pages by reinstating page monitoring.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pVM VM Handle.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param GCPhysPT Physical address of the page table
5366e994777f9d9391cf809dc77610f57270d75dvboxsyncvoid pgmPoolInvalidateDirtyPage(PVM pVM, RTGCPHYS GCPhysPT)
5366e994777f9d9391cf809dc77610f57270d75dvboxsync Assert(pPool->cDirtyPages <= RT_ELEMENTS(pPool->aIdxDirtyPages));
5366e994777f9d9391cf809dc77610f57270d75dvboxsync unsigned idxDirtyPage = RT_ELEMENTS(pPool->aIdxDirtyPages);
5366e994777f9d9391cf809dc77610f57270d75dvboxsync for (unsigned i = 0; i < RT_ELEMENTS(pPool->aIdxDirtyPages); i++)
5366e994777f9d9391cf809dc77610f57270d75dvboxsync if (idxDirtyPage != RT_ELEMENTS(pPool->aIdxDirtyPages))
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync pgmPoolFlushDirtyPage(pVM, pPool, idxDirtyPage, true /* allow removal of reused page tables*/);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync if ( pPool->cDirtyPages != RT_ELEMENTS(pPool->aIdxDirtyPages)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync && pPool->aIdxDirtyPages[pPool->idxFreeDirtyPage] != NIL_PGMPOOL_IDX)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync unsigned i;
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync for (i = 0; i < RT_ELEMENTS(pPool->aIdxDirtyPages); i++)
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync AssertMsg(i != RT_ELEMENTS(pPool->aIdxDirtyPages), ("cDirtyPages %d", pPool->cDirtyPages));
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync# endif /* PGMPOOL_WITH_OPTIMIZED_DIRTY_PT */
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync * Inserts a page into the GCPhys hash table.
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync * @param pPool The pool.
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync * @param pPage The page.
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsyncDECLINLINE(void) pgmPoolHashInsert(PPGMPOOL pPool, PPGMPOOLPAGE pPage)
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync Log3(("pgmPoolHashInsert: %RGp\n", pPage->GCPhys));
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync Assert(pPage->GCPhys != NIL_RTGCPHYS); Assert(pPage->iNext == NIL_PGMPOOL_IDX);
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync * Removes a page from the GCPhys hash table.
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync * @param pPool The pool.
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync * @param pPage The page.
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsyncDECLINLINE(void) pgmPoolHashRemove(PPGMPOOL pPool, PPGMPOOLPAGE pPage)
4121d226ac899f17e13aff3aff42b603c8b5c1fevboxsync Log3(("pgmPoolHashRemove: %RGp\n", pPage->GCPhys));
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync AssertReleaseMsgFailed(("GCPhys=%RGp idx=%#x\n", pPage->GCPhys, pPage->idx));
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync * Frees up one cache page.
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync * @returns VBox status code.
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync * @retval VINF_SUCCESS on success.
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync * @param pPool The pool.
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync * @param iUser The user index.
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsyncstatic int pgmPoolCacheFreeOne(PPGMPOOL pPool, uint16_t iUser)
e378dfdadd62aadc0a012c9953322d979d7606e6vboxsync Assert(pPool->iAgeHead != pPool->iAgeTail); /* We shouldn't be here if there < 2 cached entries! */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Select one page from the tail of the age list.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync/* This is the alternative to the SyncCR3 pgmPoolCacheUsed calls.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync if (pPool->aPages[iToFree].iUserHead != NIL_PGMPOOL_USER_INDEX)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync uint16_t i = pPool->aPages[iToFree].iAgePrev;
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync for (unsigned j = 0; j < 10 && i != NIL_PGMPOOL_USER_INDEX; j++, i = pPool->aPages[i].iAgePrev)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync if (pPool->aPages[iToFree].iUserHead == NIL_PGMPOOL_USER_INDEX)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync iToFree = i;
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Reject any attempts at flushing the currently active shadow CR3 mapping.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Call pgmPoolCacheUsed to move the page to the head of the age list.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync if (!pgmPoolIsPageLocked(&pPool->CTX_SUFF(pVM)->pgm.s, pPage))
9523921c89c66f4bececdbd5ac95aed0039eda1bvboxsync LogFlow(("pgmPoolCacheFreeOne: refuse CR3 mapping\n"));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync AssertLogRelReturn(iLoop < 8192, VERR_INTERNAL_ERROR);
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * Found a usable page, flush it and return.
45655563f818c5d5bbf4b3d14aa48cbd92a871f1vboxsync /* This flush was initiated by us and not the guest, so explicitly flush the TLB. */
907b6adfa052386a0666d5557bee9bdbc100c2e5vboxsync /* todo: find out why this is necessary; pgmPoolFlushPage should trigger a flush if one is really needed. */
06ea6bcf23874b662d499b3f130024c98b2dd7a6vboxsync * Checks if a kind mismatch is really a page being reused
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync * or if it's just normal remappings.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @returns true if reused and the cached page (enmKind1) should be flushed
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @returns false if not reused.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param enmKind1 The kind of the cached page.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * @param enmKind2 The kind of the requested page.
687794577e2e35c3cae67e692a7f2130d1262a82vboxsyncstatic bool pgmPoolCacheReusedByKind(PGMPOOLKIND enmKind1, PGMPOOLKIND enmKind2)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Never reuse them. There is no remapping in non-paging mode.
7862f4bd000f1eb6c86289f5ac2849e9cf943ca9vboxsync case PGMPOOLKIND_PAE_PDPT_FOR_32BIT: /* never reuse them for other types */
7862f4bd000f1eb6c86289f5ac2849e9cf943ca9vboxsync return false;
7862f4bd000f1eb6c86289f5ac2849e9cf943ca9vboxsync * It's perfectly fine to reuse these, except for PAE and non-paging stuff.
907b6adfa052386a0666d5557bee9bdbc100c2e5vboxsync return true;
907b6adfa052386a0666d5557bee9bdbc100c2e5vboxsync return false;
7862f4bd000f1eb6c86289f5ac2849e9cf943ca9vboxsync * It's perfectly fine to reuse these, except for PAE and non-paging stuff.
ed9d3db07648c7e3a979105c15ad752ee9ea18devboxsync return true;
cc1ef2ef9bbc6a0ff964928d61b7298e5bfcce5fvboxsync return false;
ed9d3db07648c7e3a979105c15ad752ee9ea18devboxsync * These cannot be flushed, and it's common to reuse the PDs as PTs.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync return false;
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync * Attempts to satisfy a pgmPoolAlloc request from the cache.
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync * @returns VBox status code.
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync * @retval VINF_PGM_CACHED_PAGE on success.
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync * @retval VERR_FILE_NOT_FOUND if not found.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * @param pPool The pool.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param GCPhys The GC physical address of the page we're gonna shadow.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param enmKind The kind of mapping.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param enmAccess Access type for the mapping (only relevant for big pages)
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync * @param iUser The shadow page pool index of the user table.
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync * @param iUserTable The index into the user table (shadowed).
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync * @param ppPage Where to store the pointer to the page.
687794577e2e35c3cae67e692a7f2130d1262a82vboxsyncstatic int pgmPoolCacheAlloc(PPGMPOOL pPool, RTGCPHYS GCPhys, PGMPOOLKIND enmKind, PGMPOOLACCESS enmAccess, uint16_t iUser, uint32_t iUserTable, PPPGMPOOLPAGE ppPage)
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync * Look up the GCPhys in the hash.
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync Log3(("pgmPoolCacheAlloc: %RGp kind %s iUser=%x iUserTable=%x SLOT=%d\n", GCPhys, pgmPoolPoolKindToStr(enmKind), iUser, iUserTable, i));
06ea6bcf23874b662d499b3f130024c98b2dd7a6vboxsync Log4(("pgmPoolCacheAlloc: slot %d found page %RGp\n", i, pPage->GCPhys));
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync /* Put it at the start of the use list to make sure pgmPoolTrackAddUser
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * doesn't flush it in case there are no more free use records.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync int rc = pgmPoolTrackAddUser(pPool, pPage, iUser, iUserTable);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync pPage->cModifications = 1; /* reset counter (can't use 0, or else it will be reinserted in the modified list) */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * The kind is different. In some cases we should now flush the page
06ea6bcf23874b662d499b3f130024c98b2dd7a6vboxsync * as it has been reused, but in most cases this is normal remapping
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * of PDs as PT or big pages using the GCPhys field in a slightly
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * different way than the other kinds.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync if (pgmPoolCacheReusedByKind((PGMPOOLKIND)pPage->enmKind, enmKind))
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync } while (i != NIL_PGMPOOL_IDX);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync Log3(("pgmPoolCacheAlloc: Missed GCPhys=%RGp enmKind=%s\n", GCPhys, pgmPoolPoolKindToStr(enmKind)));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Inserts a page into the cache.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pPool The pool.
9523921c89c66f4bececdbd5ac95aed0039eda1bvboxsync * @param pPage The cached page.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param fCanBeCached Set if the page is fit for caching from the caller's point of view.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncstatic void pgmPoolCacheInsert(PPGMPOOL pPool, PPGMPOOLPAGE pPage, bool fCanBeCached)
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * Insert into the GCPhys hash if the page is fit for that.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync Log3(("pgmPoolCacheInsert: Caching %p:{.Core=%RHp, .idx=%d, .enmKind=%s, GCPhys=%RGp}\n",
if (i == NIL_PGMPOOL_IDX)
return NULL;
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PDPT:
return pPage;
case PGMPOOLKIND_ROOT_NESTED:
case PGMPOOLKIND_PAE_PD_PHYS:
} while (i != NIL_PGMPOOL_IDX);
return NULL;
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_ROOT_NESTED:
return VINF_SUCCESS;
case PGMPOOLKIND_PAE_PD_PHYS:
return VINF_SUCCESS;
int rc;
if (pPageHead)
AssertFatalMsg(!(pVCpu->pgm.s.fSyncFlags & PGM_SYNC_CLEAR_PGM_POOL) || VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3), ("fSyncFlags=%x syncff=%d\n", pVCpu->pgm.s.fSyncFlags, VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3)));
return rc;
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_ROOT_NESTED:
case PGMPOOLKIND_PAE_PD_PHYS:
return VINF_SUCCESS;
int rc;
AssertFatalMsg(!(pVCpu->pgm.s.fSyncFlags & PGM_SYNC_CLEAR_PGM_POOL) || VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3),
return rc;
#ifdef VBOX_WITH_STATISTICS
Log3(("pgmPoolMonitorModifiedRemove: idx=%d cModifications=%d\n", pPage->idx, pPage->cModifications));
return VINF_PGM_SYNC_CR3;
/* pgmPoolMonitorModifiedClearAll can cause a pgm pool flush (dirty page clearing), so make sure we handle this! */
return VINF_SUCCESS;
return rc;
DECLINLINE(int) pgmPoolTrackInsert(PPGMPOOL pPool, PPGMPOOLPAGE pPage, RTGCPHYS GCPhys, uint16_t iUser, uint32_t iUserTable)
#ifdef VBOX_STRICT
AssertMsg(paUsers[i].iUser != iUser || paUsers[i].iUserTable != iUserTable, ("%x %x vs new %x %x\n", paUsers[i].iUser, paUsers[i].iUserTable, iUser, iUserTable));
} while (i != NIL_PGMPOOL_USER_INDEX);
if (i == NIL_PGMPOOL_USER_INDEX)
return rc;
const bool fCanBeMonitored = true;
if (fCanBeMonitored)
return rc;
static int pgmPoolTrackAddUser(PPGMPOOL pPool, PPGMPOOLPAGE pPage, uint16_t iUser, uint32_t iUserTable)
Log3(("pgmPoolTrackAddUser GCPhys = %RGp iUser %x iUserTable %x\n", pPage->GCPhys, iUser, iUserTable));
# ifdef VBOX_STRICT
* Check that the entry doesn't already exists. We only allow multiple users of top-level paging structures (SHW_POOL_ROOT_IDX).
AssertMsg(iUser != PGMPOOL_IDX_PD || iUser != PGMPOOL_IDX_PDPT || iUser != PGMPOOL_IDX_NESTED_ROOT || iUser != PGMPOOL_IDX_AMD64_CR3 ||
paUsers[i].iUser != iUser || paUsers[i].iUserTable != iUserTable, ("%x %x vs new %x %x\n", paUsers[i].iUser, paUsers[i].iUserTable, iUser, iUserTable));
} while (i != NIL_PGMPOOL_USER_INDEX);
if (i == NIL_PGMPOOL_USER_INDEX)
return rc;
# ifdef PGMPOOL_WITH_OPTIMIZED_DIRTY_PT
return VINF_SUCCESS;
static void pgmPoolTrackFreeUser(PPGMPOOL pPool, PPGMPOOLPAGE pPage, uint16_t iUser, uint32_t iUserTable)
if ( i != NIL_PGMPOOL_USER_INDEX
while (i != NIL_PGMPOOL_USER_INDEX)
iPrev = i;
switch (enmKind)
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_ROOT_NESTED:
case PGMPOOLKIND_PAE_PD_PHYS:
switch (enmKind)
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_ROOT_NESTED:
case PGMPOOLKIND_PAE_PD_PHYS:
AssertFailed();
static bool pgmPoolTrackFlushGCPhysPTInt(PVM pVM, PCPGMPAGE pPhysPage, bool fFlushPTEs, uint16_t iShw, uint16_t iPte, uint16_t cRefs)
LogFlow(("pgmPoolTrackFlushGCPhysPT: pPhysPage=%RHp iShw=%d iPte=%d cRefs=%d\n", PGM_PAGE_GET_HCPHYS(pPhysPage), iShw, iPte, cRefs));
bool bRet = false;
u32AndMask = 0;
u32OrMask = 0;
if (!fFlushPTEs)
bRet = true;
u32OrMask = 0;
bRet = true;
if (!u32AndMask)
return bRet;
#ifdef LOG_ENABLED
AssertFatalMsgFailed(("cRefs=%d iFirstPresent=%d cPresent=%d u32=%RX32 poolkind=%x\n", cRefs, pPage->iFirstPresent, pPage->cPresent, u32, pPage->enmKind));
u64OrMask = 0;
u64AndMask = 0;
if (!fFlushPTEs)
bRet = true;
u64OrMask = 0;
bRet = true;
if (!u64AndMask)
return bRet;
#ifdef LOG_ENABLED
AssertFatalMsgFailed(("cRefs=%d iFirstPresent=%d cPresent=%d u64=%RX64 poolkind=%x\n", cRefs, pPage->iFirstPresent, pPage->cPresent, u64, pPage->enmKind));
#ifdef PGM_WITH_LARGE_PAGES
return bRet;
# ifdef LOG_ENABLED
AssertFatalMsgFailed(("cRefs=%d iFirstPresent=%d cPresent=%d\n", cRefs, pPage->iFirstPresent, pPage->cPresent));
case PGMPOOLKIND_PAE_PD_PHYS:
return bRet;
# ifdef LOG_ENABLED
AssertFatalMsgFailed(("cRefs=%d iFirstPresent=%d cPresent=%d\n", cRefs, pPage->iFirstPresent, pPage->cPresent));
return bRet;
static void pgmPoolTrackFlushGCPhysPT(PVM pVM, PPGMPAGE pPhysPage, bool fFlushPTEs, uint16_t iShw, uint16_t cRefs)
Log2(("pgmPoolTrackFlushGCPhysPT: pPhysPage=%RHp iShw=%d cRefs=%d\n", PGM_PAGE_GET_HCPHYS(pPhysPage), iShw, cRefs));
bool fKeptPTEs = pgmPoolTrackFlushGCPhysPTInt(pVM, pPhysPage, fFlushPTEs, iShw, PGM_PAGE_GET_PTE_INDEX(pPhysPage), cRefs);
if (!fKeptPTEs)
static void pgmPoolTrackFlushGCPhysPTs(PVM pVM, PPGMPAGE pPhysPage, bool fFlushPTEs, uint16_t iPhysExt)
bool fKeepList = false;
Log2(("pgmPoolTrackFlushGCPhysPTs: pPhysPage=%RHp iPhysExt\n", PGM_PAGE_GET_HCPHYS(pPhysPage), iPhysExt));
bool fKeptPTEs = pgmPoolTrackFlushGCPhysPTInt(pVM, pPhysPage, fFlushPTEs, pPhysExt->aidx[i], pPhysExt->apte[i], 1);
if (!fKeptPTEs)
fKeepList = true;
if (!fKeepList)
int pgmPoolTrackUpdateGCPhys(PVM pVM, RTGCPHYS GCPhysPage, PPGMPAGE pPhysPage, bool fFlushPTEs, bool *pfFlushTLBs)
#ifdef PGM_WITH_LARGE_PAGES
/* Mark the large page as disabled as we need to break it up to change a single page in the 2 MB range. */
*pfFlushTLBs = true;
return rc;
if (u16)
*pfFlushTLBs = true;
return rc;
return VINF_PGM_GCPHYS_ALIASED;
pPT->a[i].u = 0;
if (!--cPresent)
pPT->a[i].u = 0;
if (!--cPresent)
#ifndef IN_RC
pPT->a[i].u = 0;
if (!--cPresent)
if (!--cLeft)
* There is a limit to what makes sense. The above search is very expensive, so force a pgm pool flush.
return VINF_PGM_GCPHYS_ALIASED;
return VINF_SUCCESS;
LogFlow(("pgmPoolTrackClearPageUser: clear %x in %s (%RGp) (flushing %s)\n", iUserTable, pgmPoolPoolKindToStr(pUserPage->enmKind), pUserPage->Core.Key, pgmPoolPoolKindToStr(pPage->enmKind)));
#ifdef VBOX_STRICT
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_PAE_PD_PHYS:
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_ROOT_NESTED:
case PGMPOOLKIND_32BIT_PD:
#if defined(IN_RC)
/* In 32 bits PAE mode we *must* invalidate the TLB when changing a PDPT entry; the CPU fetches them only during cr3 load, so any
ASMReloadCR3();
case PGMPOOLKIND_PAE_PD_PHYS:
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_ROOT_NESTED:
AssertFatalMsgFailed(("enmKind=%d iUser=%#x iUserTable=%#x\n", pUserPage->enmKind, pUser->iUser, pUser->iUserTable));
while (i != NIL_PGMPOOL_USER_INDEX)
i = iNext;
return NULL;
return pPhysExt;
static uint16_t pgmPoolTrackPhysExtInsert(PVM pVM, uint16_t iPhysExt, uint16_t iShwPT, uint16_t iPte)
LogFlow(("pgmPoolTrackPhysExtInsert: %d:{%d pte %d} i=%d cMax=%d\n", iPhysExt, iShwPT, iPte, i, cMax));
if (!--cMax)
if (!pNew)
LogFlow(("pgmPoolTrackPhysExtInsert: added new extent %d:{%d pte %d}->%d\n", iPhysExt, iShwPT, iPte, iPhysExtStart));
uint16_t pgmPoolTrackPhysExtAddref(PVM pVM, PPGMPAGE pPhysPage, uint16_t u16, uint16_t iShwPT, uint16_t iPte)
if (pPhysExt)
LogFlow(("pgmPoolTrackPhysExtAddref: new extent: %d:{%d, %d}\n", iPhysExt, PGMPOOL_TD_GET_IDX(u16), iShwPT));
return u16;
void pgmPoolTrackPhysExtDerefGCPhys(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PPGMPAGE pPhysPage, uint16_t iPte)
AssertFatalMsg(cRefs == PGMPOOL_TD_CREFS_PHYSEXT, ("cRefs=%d pPhysPage=%R[pgmpage] pPage=%p:{.idx=%d}\n", cRefs, pPhysPage, pPage, pPage->idx));
Log2(("pgmPoolTrackPhysExtDerefGCPhys: pPhysPage=%R[pgmpage] idx=%d lonely\n", pPhysPage, pPage->idx));
Log2(("pgmPoolTrackPhysExtDerefGCPhys: pPhysPage=%R[pgmpage] idx=%d head\n", pPhysPage, pPage->idx));
Log2(("pgmPoolTrackPhysExtDerefGCPhys: pPhysPage=%R[pgmpage] idx=%d in list\n", pPhysPage, pPage->idx));
AssertFatalMsgFailed(("not-found! cRefs=%d pPhysPage=%R[pgmpage] pPage=%p:{.idx=%d}\n", cRefs, pPhysPage, pPage, pPage->idx));
static void pgmPoolTracDerefGCPhys(PPGMPOOL pPool, PPGMPOOLPAGE pPage, RTHCPHYS HCPhys, RTGCPHYS GCPhys, uint16_t iPte)
while (pRam)
#ifdef LOG_ENABLED
void pgmPoolTracDerefGCPhysHint(PPGMPOOL pPool, PPGMPOOLPAGE pPage, RTHCPHYS HCPhys, RTGCPHYS GCPhysHint, uint16_t iPte)
while (pRam)
while (pRam)
while (iPage-- > 0)
AssertFatalMsgFailed(("HCPhys=%RHp GCPhysHint=%RGp (Expected HCPhys with hint = %RHp\n", HCPhys, GCPhysHint, HCPhysExpected));
DECLINLINE(void) pgmPoolTrackDerefPT32Bit32Bit(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PX86PT pShwPT, PCX86PT pGstPT)
pgmPoolTracDerefGCPhysHint(pPool, pPage, pShwPT->a[i].u & X86_PTE_PG_MASK, pGstPT->a[i].u & X86_PTE_PG_MASK, i);
DECLINLINE(void) pgmPoolTrackDerefPTPae32Bit(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PX86PTPAE pShwPT, PCX86PT pGstPT)
pgmPoolTracDerefGCPhysHint(pPool, pPage, pShwPT->a[i].u & X86_PTE_PAE_PG_MASK, pGstPT->a[i].u & X86_PTE_PG_MASK, i);
DECLINLINE(void) pgmPoolTrackDerefPTPaePae(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PX86PTPAE pShwPT, PCX86PTPAE pGstPT)
pgmPoolTracDerefGCPhysHint(pPool, pPage, pShwPT->a[i].u & X86_PTE_PAE_PG_MASK, pGstPT->a[i].u & X86_PTE_PAE_PG_MASK, i);
PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPD->a[i].u & X86_PDE_PG_MASK);
if (pSubPage)
#ifdef PGM_WITH_LARGE_PAGES
pgmPoolTracDerefGCPhys(pPool, pPage, pShwPD->a[i].u & X86_PDE2M_PAE_PG_MASK, pPage->GCPhys /* == base of 2 MB page */, i);
PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPD->a[i].u & X86_PDE_PAE_PG_MASK);
if (pSubPage)
for (unsigned i = 0; i < X86_PG_PAE_PDPE_ENTRIES; i++)
PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPDPT->a[i].u & X86_PDPE_PG_MASK);
if (pSubPage)
PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPDPT->a[i].u & X86_PDPE_PG_MASK);
if (pSubPage)
PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPML4->a[i].u & X86_PDPE_PG_MASK);
if (pSubPage)
#ifdef PGM_WITH_LARGE_PAGES
pgmPoolTracDerefGCPhys(pPool, pPage, pShwPD->a[i].u & X86_PDE2M_PAE_PG_MASK, pPage->GCPhys /* == base of 2 MB page */, i);
PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPD->a[i].u & EPT_PDE_PG_MASK);
if (pSubPage)
PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPDPT->a[i].u & EPT_PDPTE_PG_MASK);
if (pSubPage)
void *pvGst;
void *pvGst;
void *pvGst;
case PGMPOOLKIND_PAE_PD_PHYS:
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_64BIT_PML4:
bool fFlushRequired = false;
Log(("pgmPoolFlushPage: special root page, rejected. enmKind=%s idx=%d\n", pgmPoolPoolKindToStr(pPage->enmKind), pPage->idx));
return VINF_SUCCESS;
("Can't free the shadow CR3! (%RHp vs %RHp kind=%d\n", PGMGetHyperCR3(VMMGetCpu(pVM)), pPage->Core.Key, pPage->enmKind));
Log(("pgmPoolFlushPage: current active shadow CR3, rejected. enmKind=%s idx=%d\n", pgmPoolPoolKindToStr(pPage->enmKind), pPage->idx));
return VINF_SUCCESS;
fFlushRequired = true;
if ( fFlushRequired
&& fFlush)
return rc;
#if defined(IN_RC)
/* Hack alert: we can't deal with jumps to ring 3 when called from MapCR3 and allocating pages for PAE PDs. */
#ifdef IN_RING3
return rc;
return VINF_SUCCESS;
int pgmPoolAllocEx(PVM pVM, RTGCPHYS GCPhys, PGMPOOLKIND enmKind, PGMPOOLACCESS enmAccess, uint16_t iUser, uint32_t iUserTable, PPPGMPOOLPAGE ppPage, bool fLockPage)
LogFlow(("pgmPoolAlloc: GCPhys=%RGp enmKind=%s iUser=%#x iUserTable=%#x\n", GCPhys, pgmPoolPoolKindToStr(enmKind), iUser, iUserTable));
/** @todo CSAM/PGMPrefetchPage messes up here during CSAMR3CheckGates
* Assert(!(pVM->pgm.s.fGlobalSyncFlags & PGM_SYNC_CLEAR_PGM_POOL)); */
if (fLockPage)
LogFlow(("pgmPoolAlloc: cached returns %Rrc *ppPage=%p:{.Key=%RHp, .idx=%d}\n", rc2, *ppPage, (*ppPage)->Core.Key, (*ppPage)->idx));
return rc2;
return rc;
pPool->cUsedPages++; /* physical handler registration / pgmPoolTrackFlushGCPhysPTsSlow requirement. */
return rc3;
#ifdef VBOX_WITH_STATISTICS
if (fLockPage)
LogFlow(("pgmPoolAlloc: returns %Rrc *ppPage=%p:{.Key=%RHp, .idx=%d, .fCached=%RTbool, .fMonitored=%RTbool}\n",
return rc;
PPGMPOOLPAGE pPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, HCPhys & X86_PTE_PAE_PG_MASK);
AssertFatalMsg(pPage && pPage->enmKind != PGMPOOLKIND_FREE, ("HCPhys=%RHp pPage=%p idx=%d\n", HCPhys, pPage, (pPage) ? pPage->idx : 0));
return pPage;
#ifdef IN_RING3 /* currently only used in ring 3; save some space in the R0 & GC modules (left it here as we might need it elsewhere later on) */
if (i == NIL_PGMPOOL_IDX)
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_ROOT_NESTED:
case PGMPOOLKIND_PAE_PD_PHYS:
} while (i != NIL_PGMPOOL_IDX);
#ifdef IN_RING3
for (unsigned i = 0; i < cMaxUsers; i++)
pRam;
while (iPage-- > 0)
for (unsigned i = 0; i < cMaxPhysExts; i++)
#ifdef LOG_ENABLED
switch(enmKind)
case PGMPOOLKIND_INVALID:
case PGMPOOLKIND_FREE:
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PD_PHYS:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_ROOT_NESTED: