PGMAllPool.cpp revision a4eb337e9a5a6a72bcfe50134dc42732f5ee65c0
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync * PGM Shadow Page Pool.
e64031e20c39650a7bc902a3e1aba613b9415deevboxsync * Copyright (C) 2006-2007 Sun Microsystems, Inc.
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync * This file is part of VirtualBox Open Source Edition (OSE), as
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync * available from http://www.virtualbox.org. This file is free software;
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync * you can redistribute it and/or modify it under the terms of the GNU
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync * General Public License (GPL) as published by the Free Software
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync * Foundation, in version 2 as it comes in the "COPYING" file of the
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
0d12c7f9423f2745f8e282523d0930f91bff03b3vboxsync * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
0d12c7f9423f2745f8e282523d0930f91bff03b3vboxsync * Clara, CA 95054 USA or visit http://www.sun.com if you need
0d12c7f9423f2745f8e282523d0930f91bff03b3vboxsync * additional information or have any questions.
0d12c7f9423f2745f8e282523d0930f91bff03b3vboxsync/*******************************************************************************
0d12c7f9423f2745f8e282523d0930f91bff03b3vboxsync* Header Files *
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync*******************************************************************************/
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync/*******************************************************************************
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync* Internal Functions *
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync*******************************************************************************/
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsyncDECLINLINE(unsigned) pgmPoolTrackGetShadowEntrySize(PGMPOOLKIND enmKind);
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsyncDECLINLINE(unsigned) pgmPoolTrackGetGuestEntrySize(PGMPOOLKIND enmKind);
c2046db2cc346cc299f0cd9b2d1e160179159cfcvboxsyncstatic void pgmPoolTrackDeref(PPGMPOOL pPool, PPGMPOOLPAGE pPage);
c2046db2cc346cc299f0cd9b2d1e160179159cfcvboxsyncstatic void pgmPoolTracDerefGCPhysHint(PPGMPOOL pPool, PPGMPOOLPAGE pPage, RTHCPHYS HCPhys, RTGCPHYS GCPhysHint);
c2046db2cc346cc299f0cd9b2d1e160179159cfcvboxsyncstatic int pgmPoolTrackAddUser(PPGMPOOL pPool, PPGMPOOLPAGE pPage, uint16_t iUser, uint32_t iUserTable);
044af0d1e6474076366759db86f101778c5f20ccvboxsyncstatic void pgmPoolMonitorModifiedRemove(PPGMPOOL pPool, PPGMPOOLPAGE pPage);
044af0d1e6474076366759db86f101778c5f20ccvboxsyncDECLEXPORT(int) pgmPoolAccessHandler(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, RTGCPHYS GCPhysFault, void *pvUser);
044af0d1e6474076366759db86f101778c5f20ccvboxsyncstatic const char *pgmPoolPoolKindToStr(uint8_t enmKind);
044af0d1e6474076366759db86f101778c5f20ccvboxsyncvoid pgmPoolTrackFlushGCPhysPT(PVM pVM, PPGMPAGE pPhysPage, uint16_t iShw, uint16_t cRefs);
044af0d1e6474076366759db86f101778c5f20ccvboxsyncvoid pgmPoolTrackFlushGCPhysPTs(PVM pVM, PPGMPAGE pPhysPage, uint16_t iPhysExt);
044af0d1e6474076366759db86f101778c5f20ccvboxsyncint pgmPoolTrackFlushGCPhysPTsSlow(PVM pVM, PPGMPAGE pPhysPage);
044af0d1e6474076366759db86f101778c5f20ccvboxsyncPPGMPOOLPHYSEXT pgmPoolTrackPhysExtAlloc(PVM pVM, uint16_t *piPhysExt);
044af0d1e6474076366759db86f101778c5f20ccvboxsyncvoid pgmPoolTrackPhysExtFree(PVM pVM, uint16_t iPhysExt);
044af0d1e6474076366759db86f101778c5f20ccvboxsyncvoid pgmPoolTrackPhysExtFreeList(PVM pVM, uint16_t iPhysExt);
044af0d1e6474076366759db86f101778c5f20ccvboxsync * Checks if the specified page pool kind is for a 4MB or 2MB guest page.
044af0d1e6474076366759db86f101778c5f20ccvboxsync * @returns true if it's the shadow of a 4MB or 2MB guest page, otherwise false.
044af0d1e6474076366759db86f101778c5f20ccvboxsync * @param enmKind The page kind.
044af0d1e6474076366759db86f101778c5f20ccvboxsyncDECLINLINE(bool) pgmPoolIsBigPage(PGMPOOLKIND enmKind)
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync return true;
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync return false;
ca3da10d05961c339b5180fbd40a54587d6bad35vboxsync/** @def PGMPOOL_PAGE_2_LOCKED_PTR
ca3da10d05961c339b5180fbd40a54587d6bad35vboxsync * Maps a pool page pool into the current context and lock it (RC only).
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync * @returns VBox status code.
044af0d1e6474076366759db86f101778c5f20ccvboxsync * @param pVM The VM handle.
044af0d1e6474076366759db86f101778c5f20ccvboxsync * @param pPage The pool page.
ca3da10d05961c339b5180fbd40a54587d6bad35vboxsync * @remark In RC this uses PGMGCDynMapHCPage(), so it will consume of the
ca3da10d05961c339b5180fbd40a54587d6bad35vboxsync * small page window employeed by that function. Be careful.
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync * @remark There is no need to assert on the result.
044af0d1e6474076366759db86f101778c5f20ccvboxsyncDECLINLINE(void *) PGMPOOL_PAGE_2_LOCKED_PTR(PVM pVM, PPGMPOOLPAGE pPage)
044af0d1e6474076366759db86f101778c5f20ccvboxsync void *pv = pgmPoolMapPageInlined(&pVM->pgm.s, pPage);
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync /* Make sure the dynamic mapping will not be reused. */
ca3da10d05961c339b5180fbd40a54587d6bad35vboxsync# define PGMPOOL_PAGE_2_LOCKED_PTR(pVM, pPage) PGMPOOL_PAGE_2_PTR(pVM, pPage)
ca3da10d05961c339b5180fbd40a54587d6bad35vboxsync/** @def PGMPOOL_UNLOCK_PTR
ca3da10d05961c339b5180fbd40a54587d6bad35vboxsync * Unlock a previously locked dynamic caching (RC only).
ca3da10d05961c339b5180fbd40a54587d6bad35vboxsync * @returns VBox status code.
ca3da10d05961c339b5180fbd40a54587d6bad35vboxsync * @param pVM The VM handle.
ca3da10d05961c339b5180fbd40a54587d6bad35vboxsync * @param pPage The pool page.
ca3da10d05961c339b5180fbd40a54587d6bad35vboxsync * @remark In RC this uses PGMGCDynMapHCPage(), so it will consume of the
ca3da10d05961c339b5180fbd40a54587d6bad35vboxsync * small page window employeed by that function. Be careful.
a1df400bbe9d64aad400442e56eb637019300a5evboxsync * @remark There is no need to assert on the result.
ca3da10d05961c339b5180fbd40a54587d6bad35vboxsyncDECLINLINE(void) PGMPOOL_UNLOCK_PTR(PVM pVM, void *pvPage)
a1df400bbe9d64aad400442e56eb637019300a5evboxsync# define PGMPOOL_UNLOCK_PTR(pVM, pPage) do {} while (0)
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync * Determin the size of a write instruction.
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync * @returns number of bytes written.
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync * @param pDis The disassembler state.
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsyncstatic unsigned pgmPoolDisasWriteSize(PDISCPUSTATE pDis)
ca3da10d05961c339b5180fbd40a54587d6bad35vboxsync * This is very crude and possibly wrong for some opcodes,
ca3da10d05961c339b5180fbd40a54587d6bad35vboxsync * but since it's not really supposed to be called we can
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync * probably live with that.
044af0d1e6474076366759db86f101778c5f20ccvboxsync * Flushes a chain of pages sharing the same access monitor.
044af0d1e6474076366759db86f101778c5f20ccvboxsync * @returns VBox status code suitable for scheduling.
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync * @param pPool The pool.
ca3da10d05961c339b5180fbd40a54587d6bad35vboxsync * @param pPage A page in the chain.
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsyncint pgmPoolMonitorChainFlush(PPGMPOOL pPool, PPGMPOOLPAGE pPage)
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync LogFlow(("pgmPoolMonitorChainFlush: Flush page %RGp type=%d\n", pPage->GCPhys, pPage->enmKind));
7d80dfbe5d66fc4c6de6fe109ce96a081496dcd4vboxsync * Find the list head.
7d80dfbe5d66fc4c6de6fe109ce96a081496dcd4vboxsync * Iterate the list flushing each shadow page.
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync * Wrapper for getting the current context pointer to the entry being modified.
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync * @returns VBox status code suitable for scheduling.
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync * @param pVM VM Handle.
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync * @param pvDst Destination address
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync * @param pvSrc Source guest virtual address.
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync * @param GCPhysSrc The source guest physical address.
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync * @param cb Size of data to read
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsyncDECLINLINE(int) pgmPoolPhysSimpleReadGCPhys(PVM pVM, void *pvDst, CTXTYPE(RTGCPTR, RTHCPTR, RTGCPTR) pvSrc, RTGCPHYS GCPhysSrc, size_t cb)
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync memcpy(pvDst, (RTHCPTR)((uintptr_t)pvSrc & ~(RTHCUINTPTR)(cb - 1)), cb);
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync /* @todo in RC we could attempt to use the virtual address, although this can cause many faults (PAE Windows XP guest). */
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync return PGMPhysSimpleReadGCPhys(pVM, pvDst, GCPhysSrc & ~(RTGCPHYS)(cb - 1), cb);
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync * Process shadow entries before they are changed by the guest.
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync * For PT entries we will clear them. For PD entries, we'll simply check
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync * for mapping conflicts and set the SyncCR3 FF if found.
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync * @param pVCpu VMCPU handle
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync * @param pPool The pool.
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync * @param pPage The head page.
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync * @param GCPhysFault The guest physical fault address.
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync * @param uAddress In R0 and GC this is the guest context fault address (flat).
9939c713bffcfc4305d99d994552aa2ad9bce097vboxsync * In R3 this is the host context 'fault' address.
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync * @param pCpu The disassembler state for figuring out the write size.
9939c713bffcfc4305d99d994552aa2ad9bce097vboxsync * This need not be specified if the caller knows we won't do cross entry accesses.
9939c713bffcfc4305d99d994552aa2ad9bce097vboxsyncvoid pgmPoolMonitorChainChanging(PVMCPU pVCpu, PPGMPOOL pPool, PPGMPOOLPAGE pPage, RTGCPHYS GCPhysFault, CTXTYPE(RTGCPTR, RTHCPTR, RTGCPTR) pvAddress, PDISCPUSTATE pCpu)
9939c713bffcfc4305d99d994552aa2ad9bce097vboxsync const unsigned off = GCPhysFault & PAGE_OFFSET_MASK;
9939c713bffcfc4305d99d994552aa2ad9bce097vboxsync const unsigned cbWrite = (pCpu) ? pgmPoolDisasWriteSize(pCpu) : 0;
9939c713bffcfc4305d99d994552aa2ad9bce097vboxsync LogFlow(("pgmPoolMonitorChainChanging: %RGv phys=%RGp kind=%s cbWrite=%d\n", (RTGCPTR)pvAddress, GCPhysFault, pgmPoolPoolKindToStr(pPage->enmKind), cbWrite));
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync LogFlow(("PGMPOOLKIND_32BIT_PT_FOR_32BIT_PT iShw=%x\n", iShw));
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync int rc = pgmPoolPhysSimpleReadGCPhys(pVM, &GstPte, pvAddress, GCPhysFault, sizeof(GstPte));
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync Log4(("pgmPoolMonitorChainChanging 32_32: deref %016RX64 GCPhys %08RX32\n", uShw.pPT->a[iShw].u & X86_PTE_PAE_PG_MASK, GstPte.u & X86_PTE_PG_MASK));
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync /* page/2 sized */
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync const unsigned iShw = (off / sizeof(X86PTE)) & (X86_PG_PAE_ENTRIES - 1);
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync LogFlow(("PGMPOOLKIND_PAE_PT_FOR_32BIT_PT iShw=%x\n", iShw));
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync int rc = pgmPoolPhysSimpleReadGCPhys(pVM, &GstPte, pvAddress, GCPhysFault, sizeof(GstPte));
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync Log4(("pgmPoolMonitorChainChanging pae_32: deref %016RX64 GCPhys %08RX32\n", uShw.pPT->a[iShw].u & X86_PTE_PAE_PG_MASK, GstPte.u & X86_PTE_PG_MASK));
9939c713bffcfc4305d99d994552aa2ad9bce097vboxsync LogFlow(("pgmPoolMonitorChainChanging PAE for 32 bits: iGst=%x iShw=%x idx = %d page idx=%d\n", iGst, iShw, iShwPdpt, pPage->enmKind - PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD));
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync if (iShwPdpt == pPage->enmKind - (unsigned)PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD)
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync for (unsigned i = 0; i < 2; i++)
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync if ((uShw.pPDPae->a[iShw + i].u & (PGM_PDFLAGS_MAPPING | X86_PDE_P)) == (PGM_PDFLAGS_MAPPING | X86_PDE_P))
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShwPdpt=%#x iShw=%#x!\n", iShwPdpt, iShw+i));
9939c713bffcfc4305d99d994552aa2ad9bce097vboxsync# endif /* !IN_RING0 */
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw=%#x: %RX64 -> freeing it!\n", iShw+i, uShw.pPDPae->a[iShw+i].u));
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync /* paranoia / a bit assumptive. */
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync if ((uShw.pPDPae->a[iShw2].u & (PGM_PDFLAGS_MAPPING | X86_PDE_P)) == (PGM_PDFLAGS_MAPPING | X86_PDE_P))
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShwPdpt=%#x iShw2=%#x!\n", iShwPdpt, iShw2));
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync# endif /* !IN_RING0 */
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPDPae->a[iShw2].u));
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync int rc = pgmPoolPhysSimpleReadGCPhys(pVM, &GstPte, pvAddress, GCPhysFault, sizeof(GstPte));
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync Log4(("pgmPoolMonitorChainChanging pae: deref %016RX64 GCPhys %016RX64\n", uShw.pPTPae->a[iShw].u & X86_PTE_PAE_PG_MASK, GstPte.u & X86_PTE_PAE_PG_MASK));
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync /* paranoia / a bit assumptive. */
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PTEPAE);
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync int rc = pgmPoolPhysSimpleReadGCPhys(pVM, &GstPte, (RTHCPTR)((RTHCUINTPTR)pvAddress + sizeof(GstPte)), GCPhysFault + sizeof(GstPte), sizeof(GstPte));
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync int rc = pgmPoolPhysSimpleReadGCPhys(pVM, &GstPte, pvAddress + sizeof(GstPte), GCPhysFault + sizeof(GstPte), sizeof(GstPte));
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync Log4(("pgmPoolMonitorChainChanging pae: deref %016RX64 GCPhys %016RX64\n", uShw.pPTPae->a[iShw2].u & X86_PTE_PAE_PG_MASK, GstPte.u & X86_PTE_PAE_PG_MASK));
9b19ad593b379ebfcc8273f85b90763b14b1da63vboxsync const unsigned iShw = off / sizeof(X86PTE); // ASSUMING 32-bit guest paging!
9b19ad593b379ebfcc8273f85b90763b14b1da63vboxsync LogFlow(("pgmPoolMonitorChainChanging: PGMPOOLKIND_32BIT_PD %x\n", iShw));
9b19ad593b379ebfcc8273f85b90763b14b1da63vboxsync STAM_COUNTER_INC(&(pVCpu->pgm.s.StatRZGuestCR3WriteConflict));
9b19ad593b379ebfcc8273f85b90763b14b1da63vboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShw=%#x!\n", iShw));
9b19ad593b379ebfcc8273f85b90763b14b1da63vboxsync# endif /* !IN_RING0 */
9b19ad593b379ebfcc8273f85b90763b14b1da63vboxsync# endif /* !IN_RING0 */
9b19ad593b379ebfcc8273f85b90763b14b1da63vboxsync LogFlow(("pgmPoolMonitorChainChanging: 32 bit pd iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPD->a[iShw].u));
9b19ad593b379ebfcc8273f85b90763b14b1da63vboxsync /* paranoia / a bit assumptive. */
9b19ad593b379ebfcc8273f85b90763b14b1da63vboxsync const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PTE);
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync STAM_COUNTER_INC(&(pVCpu->pgm.s.StatRZGuestCR3WriteConflict));
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShw2=%#x!\n", iShw2));
ca3da10d05961c339b5180fbd40a54587d6bad35vboxsync# endif /* !IN_RING0 */
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync# endif /* !IN_RING0 */
ca3da10d05961c339b5180fbd40a54587d6bad35vboxsync LogFlow(("pgmPoolMonitorChainChanging: 32 bit pd iShw=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPD->a[iShw2].u));
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync#if 0 /* useful when running PGMAssertCR3(), a bit too troublesome for general use (TLBs). */
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync LogFlow(("pgmPoolMonitorChainChanging: iShw=%#x: %RX32 -> freeing it!\n", iShw, uShw.pPD->a[iShw].u));
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync# ifdef IN_RC /* TLB load - we're pushing things a bit... */
88acfa6629a7976c0583c1712d2b5b22a87a5121vboxsync pgmPoolFree(pVM, uShw.pPD->a[iShw].u & X86_PDE_PG_MASK, pPage->idx, iShw);
a1df400bbe9d64aad400442e56eb637019300a5evboxsync STAM_COUNTER_INC(&(pVCpu->pgm.s.StatRZGuestCR3WriteConflict));
a1df400bbe9d64aad400442e56eb637019300a5evboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShw=%#x!\n", iShw));
9d020a0622f95aec3aabaff436a495e88dbbd71avboxsync#endif /* !IN_RING0 */
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync * Causes trouble when the guest uses a PDE to refer to the whole page table level
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync * structure. (Invalidate here; faults later on when it tries to change the page
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync * table entries -> recheck; probably only applies to the RC case.)
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync# endif /* !IN_RING0 */
9d020a0622f95aec3aabaff436a495e88dbbd71avboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPDPae->a[iShw].u));
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync /* paranoia / a bit assumptive. */
9d020a0622f95aec3aabaff436a495e88dbbd71avboxsync const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PDEPAE);
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync STAM_COUNTER_INC(&(pVCpu->pgm.s.StatRZGuestCR3WriteConflict));
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShw2=%#x!\n", iShw2));
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync#endif /* !IN_RING0 */
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync# endif /* !IN_RING0 */
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw2=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPDPae->a[iShw2].u));
044af0d1e6474076366759db86f101778c5f20ccvboxsync * Hopefully this doesn't happen very often:
044af0d1e6474076366759db86f101778c5f20ccvboxsync * - touching unused parts of the page
044af0d1e6474076366759db86f101778c5f20ccvboxsync * - messing with the bits of pd pointers without changing the physical address
044af0d1e6474076366759db86f101778c5f20ccvboxsync /* PDPT roots are not page aligned; 32 byte only! */
044af0d1e6474076366759db86f101778c5f20ccvboxsync const unsigned offPdpt = GCPhysFault - pPage->GCPhys;
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync if (iShw < X86_PG_PAE_PDPE_ENTRIES) /* don't use RT_ELEMENTS(uShw.pPDPT->a), because that's for long mode only */
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync STAM_COUNTER_INC(&(pVCpu->pgm.s.StatRZGuestCR3WriteConflict));
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected pdpt conflict at iShw=%#x!\n", iShw));
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync# endif /* !IN_RING0 */
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync# endif /* !IN_RING0 */
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pdpt iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPDPT->a[iShw].u));
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync /* paranoia / a bit assumptive. */
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync const unsigned iShw2 = (offPdpt + cbWrite - 1) / sizeof(X86PDPE);
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync STAM_COUNTER_INC(&(pVCpu->pgm.s.StatRZGuestCR3WriteConflict));
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShw2=%#x!\n", iShw2));
9939c713bffcfc4305d99d994552aa2ad9bce097vboxsync# endif /* !IN_RING0 */
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync# endif /* !IN_RING0 */
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pdpt iShw=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPDPT->a[iShw2].u));
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync Assert(!(uShw.pPDPae->a[iShw].u & PGM_PDFLAGS_MAPPING));
4a1654dd5b9f0ae4e149d909843a3ab07b8bec33vboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPDPae->a[iShw].u));
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync /* paranoia / a bit assumptive. */
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PDEPAE);
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync Assert(!(uShw.pPDPae->a[iShw2].u & PGM_PDFLAGS_MAPPING));
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw2=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPDPae->a[iShw2].u));
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync * Hopefully this doesn't happen very often:
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync * - messing with the bits of pd pointers without changing the physical address
bbb4c0bfd5ea55e99591d8811771257a437053eevboxsync LogFlow(("pgmPoolMonitorChainChanging: pdpt iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPDPT->a[iShw].u));
bbb4c0bfd5ea55e99591d8811771257a437053eevboxsync pgmPoolFree(pVM, uShw.pPDPT->a[iShw].u & X86_PDPE_PG_MASK, pPage->idx, iShw);
bbb4c0bfd5ea55e99591d8811771257a437053eevboxsync /* paranoia / a bit assumptive. */
bbb4c0bfd5ea55e99591d8811771257a437053eevboxsync const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PDPE);
bbb4c0bfd5ea55e99591d8811771257a437053eevboxsync LogFlow(("pgmPoolMonitorChainChanging: pdpt iShw2=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPDPT->a[iShw2].u));
bbb4c0bfd5ea55e99591d8811771257a437053eevboxsync pgmPoolFree(pVM, uShw.pPDPT->a[iShw2].u & X86_PDPE_PG_MASK, pPage->idx, iShw2);
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync * Hopefully this doesn't happen very often:
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync * - messing with the bits of pd pointers without changing the physical address
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync LogFlow(("pgmPoolMonitorChainChanging: pml4 iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPML4->a[iShw].u));
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync pgmPoolFree(pVM, uShw.pPML4->a[iShw].u & X86_PML4E_PG_MASK, pPage->idx, iShw);
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync /* paranoia / a bit assumptive. */
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PML4E);
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync LogFlow(("pgmPoolMonitorChainChanging: pml4 iShw2=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPML4->a[iShw2].u));
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync pgmPoolFree(pVM, uShw.pPML4->a[iShw2].u & X86_PML4E_PG_MASK, pPage->idx, iShw2);
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync#endif /* IN_RING0 */
ad27e1d5e48ca41245120c331cc88b50464813cevboxsync AssertFatalMsgFailed(("enmKind=%d\n", pPage->enmKind));
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync * Checks if a access could be a fork operation in progress.
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync * Meaning, that the guest is setuping up the parent process for Copy-On-Write.
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync * @returns true if it's likly that we're forking, otherwise false.
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync * @param pPool The pool.
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync * @param pCpu The disassembled instruction.
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync * @param offFault The access offset.
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsyncDECLINLINE(bool) pgmPoolMonitorIsForking(PPGMPOOL pPool, PDISCPUSTATE pCpu, unsigned offFault)
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync * i386 linux is using btr to clear X86_PTE_RW.
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync * The functions involved are (2.6.16 source inspection):
044af0d1e6474076366759db86f101778c5f20ccvboxsync * clear_bit
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync * ptep_set_wrprotect
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync * copy_one_pte
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync * copy_pte_range
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync * copy_pmd_range
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync * copy_pud_range
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync * copy_page_range
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync * copy_process
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync /** @todo Validate that the bit index is X86_PTE_RW. */
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,Fork));
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync return true;
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync return false;
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync * Determine whether the page is likely to have been reused.
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync * @returns true if we consider the page as being reused for a different purpose.
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync * @returns false if we consider it to still be a paging page.
c0e27f622f9bd6d9e77d2d959aab71d69dabf0d3vboxsync * @param pVM VM Handle.
ca3da10d05961c339b5180fbd40a54587d6bad35vboxsync * @param pPage The page in question.
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync * @param pRegFrame Trap register frame.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param pCpu The disassembly info for the faulting instruction.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param pvFault The fault address.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @remark The REP prefix check is left to the caller because of STOSD/W.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsyncDECLINLINE(bool) pgmPoolMonitorIsReused(PVM pVM, PPGMPOOLPAGE pPage, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, RTGCPTR pvFault)
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync /** @todo could make this general, faulting close to rsp should be safe reuse heuristic. */
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync /* Fault caused by stack writes while trying to inject an interrupt event. */
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync Log(("pgmPoolMonitorIsReused: reused %RGv for interrupt stack (rsp=%RGv).\n", pvFault, pRegFrame->rsp));
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync return true;
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync /* call implies the actual push of the return address faulted */
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync return true;
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync return true;
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync return true;
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync return true;
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync return true;
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync return true;
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync case OP_MOVNTDQ: /* solaris - hwblkclr & hwblkpagecopy */
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync return true;
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync return true;
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync return false;
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync return true;
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync //if (pPage->fCR3Mix)
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync // return false;
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync return false;
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * Flushes the page being accessed.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @returns VBox status code suitable for scheduling.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param pVM The VM handle.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param pVCpu The VMCPU handle.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param pPool The pool.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param pPage The pool page (head).
a1df400bbe9d64aad400442e56eb637019300a5evboxsync * @param pCpu The disassembly of the write instruction.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param pRegFrame The trap register frame.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param GCPhysFault The fault address as guest physical address.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param pvFault The fault address.
ad27e1d5e48ca41245120c331cc88b50464813cevboxsyncstatic int pgmPoolAccessHandlerFlush(PVM pVM, PVMCPU pVCpu, PPGMPOOL pPool, PPGMPOOLPAGE pPage, PDISCPUSTATE pCpu,
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, RTGCPTR pvFault)
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * First, do the flushing.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * Emulate the instruction (xp/w2k problem, requires pc/cr2/sp detection).
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync int rc2 = EMInterpretInstructionCPU(pVM, pVCpu, pCpu, pRegFrame, pvFault, &cbWritten);
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync if (PATMIsPatchGCAddr(pVM, (RTRCPTR)pRegFrame->eip))
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync LogFlow(("pgmPoolAccessHandlerPTWorker: Interpretation failed for patch code %04x:%RGv, ignoring.\n",
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync STAM_COUNTER_INC(&pPool->StatMonitorRZIntrFailPatch2);
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,EmulateInstr));
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync /* See use in pgmPoolAccessHandlerSimple(). */
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync LogFlow(("pgmPoolAccessHandlerPT: returns %Rrc (flushed)\n", rc));
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * Handles the STOSD write accesses.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @returns VBox status code suitable for scheduling.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param pVM The VM handle.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param pPool The pool.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param pPage The pool page (head).
a1df400bbe9d64aad400442e56eb637019300a5evboxsync * @param pCpu The disassembly of the write instruction.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param pRegFrame The trap register frame.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param GCPhysFault The fault address as guest physical address.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param pvFault The fault address.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsyncDECLINLINE(int) pgmPoolAccessHandlerSTOSD(PVM pVM, PPGMPOOL pPool, PPGMPOOLPAGE pPage, PDISCPUSTATE pCpu,
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, RTGCPTR pvFault)
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * Increment the modification counter and insert it into the list
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * of modified pages the first time.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * Execute REP STOSD.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * This ASSUMES that we're not invoked by Trap0e on in a out-of-sync
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * write situation, meaning that it's safe to write here.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync uint32_t iPrevSubset = PGMDynMapPushAutoSubset(pVCpu);
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync pgmPoolMonitorChainChanging(pVCpu, pPool, pPage, GCPhysFault, (RTGCPTR)pu32, NULL);
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync pgmPoolMonitorChainChanging(pVCpu, pPool, pPage, GCPhysFault, (RTGCPTR)pu32, NULL);
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync PGMPhysSimpleWriteGCPhys(pVM, GCPhysFault, &pRegFrame->eax, 4);
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync /* See use in pgmPoolAccessHandlerSimple(). */
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * Handles the simple write accesses.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @returns VBox status code suitable for scheduling.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param pVM The VM handle.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param pVCpu The VMCPU handle.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param pPool The pool.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param pPage The pool page (head).
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param pCpu The disassembly of the write instruction.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param pRegFrame The trap register frame.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param GCPhysFault The fault address as guest physical address.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param pvFault The fault address.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsyncDECLINLINE(int) pgmPoolAccessHandlerSimple(PVM pVM, PVMCPU pVCpu, PPGMPOOL pPool, PPGMPOOLPAGE pPage, PDISCPUSTATE pCpu,
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, RTGCPTR pvFault)
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * Increment the modification counter and insert it into the list
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * of modified pages the first time.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * Clear all the pages. ASSUMES that pvFault is readable.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync uint32_t iPrevSubset = PGMDynMapPushAutoSubset(pVCpu);
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync pgmPoolMonitorChainChanging(pVCpu, pPool, pPage, GCPhysFault, pvFault, pCpu);
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync pgmPoolMonitorChainChanging(pVCpu, pPool, pPage, GCPhysFault, pvFault, pCpu);
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * Interpret the instruction.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync int rc = EMInterpretInstructionCPU(pVM, pVCpu, pCpu, pRegFrame, pvFault, &cb);
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync LogFlow(("pgmPoolAccessHandlerPTWorker: Interpretation failed for %04x:%RGv - opcode=%d\n",
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync pRegFrame->cs, (RTGCPTR)pRegFrame->rip, pCpu->pCurInstr->opcode));
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,EmulateInstr));
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * Quick hack, with logging enabled we're getting stale
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * code TLBs but no data TLB for EIP and crash in EMInterpretDisasOne.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * Flushing here is BAD and expensive, I think EMInterpretDisasOne will
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * have to be fixed to support this. But that'll have to wait till next week.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * An alternative is to keep track of the changed PTEs together with the
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * GCPhys from the guest PT. This may proove expensive though.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * At the moment, it's VITAL that it's done AFTER the instruction interpreting
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * because we need the stale TLBs in some cases (XP boot). This MUST be fixed properly!
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync LogFlow(("pgmPoolAccessHandlerSimple: returns %Rrc cb=%d\n", rc, cb));
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * \#PF Handler callback for PT write accesses.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @returns VBox status code (appropriate for GC return).
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param pVM VM Handle.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param uErrorCode CPU Error code.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param pRegFrame Trap register frame.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * NULL on DMA and other non CPU access.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param pvFault The fault address (cr2).
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param GCPhysFault The GC physical address corresponding to pvFault.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * @param pvUser User argument.
88acfa6629a7976c0583c1712d2b5b22a87a5121vboxsyncDECLEXPORT(int) pgmPoolAccessHandler(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, RTGCPHYS GCPhysFault, void *pvUser)
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync STAM_PROFILE_START(&pVM->pgm.s.CTX_SUFF(pPool)->CTX_SUFF_Z(StatMonitor), a);
ad27e1d5e48ca41245120c331cc88b50464813cevboxsync LogFlow(("pgmPoolAccessHandler: pvFault=%RGv pPage=%p:{.idx=%d} GCPhysFault=%RGp\n", pvFault, pPage, pPage->idx, GCPhysFault));
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * We should ALWAYS have the list head as user parameter. This
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * is because we use that page to record the changes.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * Disassemble the faulting instruction.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync int rc = EMInterpretDisasOne(pVM, pVCpu, pRegFrame, &Cpu, NULL);
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync * Check if it's worth dealing with.
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync bool fReused = false;
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync if ( ( pPage->cModifications < 48 /** @todo #define */ /** @todo need to check that it's not mapping EIP. */ /** @todo adjust this! */
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync && !(fReused = pgmPoolMonitorIsReused(pVM, pPage, pRegFrame, &Cpu, pvFault))
df8e6a449f00e1884fbf4a1fc67143614d7d528dvboxsync && !pgmPoolMonitorIsForking(pPool, &Cpu, GCPhysFault & PAGE_OFFSET_MASK))
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync * Simple instructions, no REP prefix.
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync rc = pgmPoolAccessHandlerSimple(pVM, pVCpu, pPool, pPage, &Cpu, pRegFrame, GCPhysFault, pvFault);
3a4a6501d0ccd629d9951b644d380c7bb2d46086vboxsync STAM_PROFILE_STOP_EX(&pVM->pgm.s.CTX_SUFF(pPool)->CTX_SUFF_Z(StatMonitor), &pPool->CTX_MID_Z(StatMonitor,Handled), a);
return rc;
STAM_PROFILE_STOP_EX(&pVM->pgm.s.CTX_SUFF(pPool)->CTX_SUFF_Z(StatMonitor), &pPool->CTX_MID_Z(StatMonitor,RepStosd), a);
return rc;
pRegFrame->eax, pRegFrame->ecx, pRegFrame->edi, pRegFrame->esi, (RTGCPTR)pRegFrame->rip, Cpu.pCurInstr->opcode, Cpu.prefix));
STAM_PROFILE_STOP_EX(&pVM->pgm.s.CTX_SUFF(pPool)->CTX_SUFF_Z(StatMonitor), &pPool->CTX_MID_Z(StatMonitor,FlushPage), a);
return rc;
#ifdef PGMPOOL_WITH_CACHE
if (i == NIL_PGMPOOL_IDX)
iPrev = i;
#ifndef IN_RC
return rc;
switch (enmKind1)
case PGMPOOLKIND_PAE_PD_PHYS:
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PDPT:
switch (enmKind2)
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_64BIT_PML4:
switch (enmKind2)
case PGMPOOLKIND_ROOT_NESTED:
static int pgmPoolCacheAlloc(PPGMPOOL pPool, RTGCPHYS GCPhys, PGMPOOLKIND enmKind, uint16_t iUser, uint32_t iUserTable, PPPGMPOOLPAGE ppPage)
#ifndef IN_RC
Log3(("pgmPoolCacheAlloc: %RGp kind %s iUser=%x iUserTable=%x SLOT=%d\n", GCPhys, pgmPoolPoolKindToStr(enmKind), iUser, iUserTable, i));
if (i != NIL_PGMPOOL_IDX)
return VINF_PGM_CACHED_PAGE;
return rc;
} while (i != NIL_PGMPOOL_IDX);
Log3(("pgmPoolCacheAlloc: Missed GCPhys=%RGp enmKind=%s\n", GCPhys, pgmPoolPoolKindToStr(enmKind)));
return VERR_FILE_NOT_FOUND;
if (fCanBeCached)
#ifdef PGMPOOL_WITH_MONITORING
#ifdef PGMPOOL_WITH_CACHE
if (i == NIL_PGMPOOL_IDX)
return NULL;
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PDPT:
return pPage;
case PGMPOOLKIND_ROOT_NESTED:
case PGMPOOLKIND_PAE_PD_PHYS:
} while (i != NIL_PGMPOOL_IDX);
return NULL;
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_ROOT_NESTED:
return VINF_SUCCESS;
case PGMPOOLKIND_PAE_PD_PHYS:
return VINF_SUCCESS;
#ifdef PGMPOOL_WITH_MIXED_PT_CR3
int rc;
if (pPageHead)
Assert(!(pVM->pgm.s.fGlobalSyncFlags & PGM_GLOBAL_SYNC_CLEAR_PGM_POOL) || VMCPU_FF_ISSET(VMMGetCpu(pVM), VMCPU_FF_PGM_SYNC_CR3));
return rc;
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_ROOT_NESTED:
case PGMPOOLKIND_PAE_PD_PHYS:
return VINF_SUCCESS;
#ifdef PGMPOOL_WITH_MIXED_PT_CR3
int rc;
AssertMsg(!(pVM->pgm.s.fGlobalSyncFlags & PGM_GLOBAL_SYNC_CLEAR_PGM_POOL) || VMCPU_FF_ISSET(VMMGetCpu(pVM), VMCPU_FF_PGM_SYNC_CR3),
return rc;
#ifdef VBOX_WITH_STATISTICS
Log3(("pgmPoolMonitorModifiedRemove: idx=%d cModifications=%d\n", pPage->idx, pPage->cModifications));
#ifdef IN_RING3
#ifdef PGMPOOL_WITH_USER_TRACKING
#ifdef PGMPOOL_WITH_USER_TRACKING
if (!--cLeft)
#ifndef DEBUG_michael
AssertMsg(cModifiedPages == pPool->cModifiedPages, ("%d != %d\n", cModifiedPages, pPool->cModifiedPages));
#ifdef PGMPOOL_WITH_GCPHYS_TRACKING
pRam;
while (iPage-- > 0)
for (unsigned i = 0; i < cMaxPhysExts; i++)
return VINF_SUCCESS;
return VINF_PGM_SYNC_CR3;
return VINF_SUCCESS;
#ifdef PGMPOOL_WITH_USER_TRACKING
#ifdef PGMPOOL_WITH_CACHE
return rc;
return VERR_PGM_POOL_FLUSHED;
DECLINLINE(int) pgmPoolTrackInsert(PPGMPOOL pPool, PPGMPOOLPAGE pPage, RTGCPHYS GCPhys, uint16_t iUser, uint32_t iUserTable)
#ifdef VBOX_STRICT
AssertMsg(paUsers[i].iUser != iUser || paUsers[i].iUserTable != iUserTable, ("%x %x vs new %x %x\n", paUsers[i].iUser, paUsers[i].iUserTable, iUser, iUserTable));
} while (i != NIL_PGMPOOL_USER_INDEX);
if (i == NIL_PGMPOOL_USER_INDEX)
return rc;
# ifdef PGMPOOL_WITH_MIXED_PT_CR3
const bool fCanBeMonitored = true;
|| (GCPhys & X86_PTE_PAE_PG_MASK) != (pPool->CTX_SUFF(pVM)->pgm.s.GCPhysGstCR3Monitored & X86_PTE_PAE_PG_MASK)
# ifdef PGMPOOL_WITH_CACHE
if (fCanBeMonitored)
# ifdef PGMPOOL_WITH_MONITORING
return rc;
static int pgmPoolTrackAddUser(PPGMPOOL pPool, PPGMPOOLPAGE pPage, uint16_t iUser, uint32_t iUserTable)
Log3(("pgmPoolTrackAddUser GCPhys = %RGp iUser %x iUserTable %x\n", pPage->GCPhys, iUser, iUserTable));
# ifdef VBOX_STRICT
* Check that the entry doesn't already exists. We only allow multiple users of top-level paging structures (SHW_POOL_ROOT_IDX).
AssertMsg(iUser != PGMPOOL_IDX_PD || iUser != PGMPOOL_IDX_PDPT || iUser != PGMPOOL_IDX_NESTED_ROOT || iUser != PGMPOOL_IDX_AMD64_CR3 ||
paUsers[i].iUser != iUser || paUsers[i].iUserTable != iUserTable, ("%x %x vs new %x %x\n", paUsers[i].iUser, paUsers[i].iUserTable, iUser, iUserTable));
} while (i != NIL_PGMPOOL_USER_INDEX);
if (i == NIL_PGMPOOL_USER_INDEX)
return rc;
# ifdef PGMPOOL_WITH_CACHE
return VINF_SUCCESS;
static void pgmPoolTrackFreeUser(PPGMPOOL pPool, PPGMPOOLPAGE pPage, uint16_t iUser, uint32_t iUserTable)
if ( i != NIL_PGMPOOL_USER_INDEX
while (i != NIL_PGMPOOL_USER_INDEX)
iPrev = i;
switch (enmKind)
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_ROOT_NESTED:
case PGMPOOLKIND_PAE_PD_PHYS:
switch (enmKind)
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_ROOT_NESTED:
case PGMPOOLKIND_PAE_PD_PHYS:
AssertFailed();
#ifdef PGMPOOL_WITH_GCPHYS_TRACKING
static void pgmPoolTrackFlushGCPhysPTInt(PVM pVM, PCPGMPAGE pPhysPage, uint16_t iShw, uint16_t cRefs)
LogFlow(("pgmPoolTrackFlushGCPhysPT: pPhysPage=%R[pgmpage] iShw=%d cRefs=%d\n", pPhysPage, iShw, cRefs));
pPT->a[i].u = 0;
cRefs--;
if (!cRefs)
#ifdef LOG_ENABLED
RTLogPrintf("cRefs=%d iFirstPresent=%d cPresent=%d\n", cRefs, pPage->iFirstPresent, pPage->cPresent);
pPT->a[i].u = 0;
AssertFatalMsgFailed(("cRefs=%d iFirstPresent=%d cPresent=%d\n", cRefs, pPage->iFirstPresent, pPage->cPresent));
pPT->a[i].u = 0;
cRefs--;
if (!cRefs)
#ifdef LOG_ENABLED
RTLogPrintf("cRefs=%d iFirstPresent=%d cPresent=%d\n", cRefs, pPage->iFirstPresent, pPage->cPresent);
pPT->a[i].u = 0;
AssertFatalMsgFailed(("cRefs=%d iFirstPresent=%d cPresent=%d u64=%RX64\n", cRefs, pPage->iFirstPresent, pPage->cPresent, u64));
pPT->a[i].u = 0;
cRefs--;
if (!cRefs)
#ifdef LOG_ENABLED
RTLogPrintf("cRefs=%d iFirstPresent=%d cPresent=%d\n", cRefs, pPage->iFirstPresent, pPage->cPresent);
pPT->a[i].u = 0;
AssertFatalMsgFailed(("cRefs=%d iFirstPresent=%d cPresent=%d\n", cRefs, pPage->iFirstPresent, pPage->cPresent));
LogFlow(("pgmPoolTrackFlushGCPhysPT: pPhysPage=%R[pgmpage] iShw=%d cRefs=%d\n", pPhysPage, iShw, cRefs));
#ifdef PGMPOOL_WITH_GCPHYS_TRACKING
if (u16)
*pfFlushTLBs = true;
*pfFlushTLBs = true;
return rc;
return VINF_PGM_GCPHYS_ALIASED;
pPT->a[i].u = 0;
if (!--cPresent)
pPT->a[i].u = 0;
if (!--cPresent)
if (!--cLeft)
return VINF_SUCCESS;
LogFlow(("pgmPoolTrackClearPageUser: clear %x in %s (%RGp) (flushing %s)\n", iUserTable, pgmPoolPoolKindToStr(pUserPage->enmKind), pUserPage->Core.Key, pgmPoolPoolKindToStr(pPage->enmKind)));
#ifdef VBOX_STRICT
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_PAE_PD_PHYS:
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_ROOT_NESTED:
case PGMPOOLKIND_32BIT_PD:
#if defined(IN_RC)
/* In 32 bits PAE mode we *must* invalidate the TLB when changing a PDPT entry; the CPU fetches them only during cr3 load, so any
ASMReloadCR3();
case PGMPOOLKIND_PAE_PD_PHYS:
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_ROOT_NESTED:
AssertFatalMsgFailed(("enmKind=%d iUser=%#x iUserTable=%#x\n", pUserPage->enmKind, pUser->iUser, pUser->iUserTable));
while (i != NIL_PGMPOOL_USER_INDEX)
i = iNext;
#ifdef PGMPOOL_WITH_GCPHYS_TRACKING
return NULL;
return pPhysExt;
if (!--cMax)
if (!pNew)
LogFlow(("pgmPoolTrackPhysExtAddref: added new extent %d:{%d}->%d\n", iPhysExt, iShwPT, iPhysExtStart));
if (pPhysExt)
LogFlow(("pgmPoolTrackPhysExtAddref: new extent: %d:{%d, %d}\n", iPhysExt, PGMPOOL_TD_GET_IDX(u16), iShwPT));
return u16;
AssertFatalMsg(cRefs == PGMPOOL_TD_CREFS_PHYSEXT, ("cRefs=%d pPhysPage=%R[pgmpage] pPage=%p:{.idx=%d}\n", cRefs, pPhysPage, pPage, pPage->idx));
Log2(("pgmPoolTrackPhysExtDerefGCPhys: pPhysPage=%R[pgmpage] idx=%d lonely\n", pPhysPage, pPage->idx));
Log2(("pgmPoolTrackPhysExtDerefGCPhys: pPhysPage=%R[pgmpage] idx=%d head\n", pPhysPage, pPage->idx));
AssertFatalMsgFailed(("not-found! cRefs=%d pPhysPage=%R[pgmpage] pPage=%p:{.idx=%d}\n", cRefs, pPhysPage, pPage, pPage->idx));
static void pgmPoolTracDerefGCPhys(PPGMPOOL pPool, PPGMPOOLPAGE pPage, RTHCPHYS HCPhys, RTGCPHYS GCPhys)
while (pRam)
#ifdef LOG_ENABLED
static void pgmPoolTracDerefGCPhysHint(PPGMPOOL pPool, PPGMPOOLPAGE pPage, RTHCPHYS HCPhys, RTGCPHYS GCPhysHint)
while (pRam)
while (pRam)
while (iPage-- > 0)
DECLINLINE(void) pgmPoolTrackDerefPT32Bit32Bit(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PX86PT pShwPT, PCX86PT pGstPT)
pgmPoolTracDerefGCPhysHint(pPool, pPage, pShwPT->a[i].u & X86_PTE_PG_MASK, pGstPT->a[i].u & X86_PTE_PG_MASK);
DECLINLINE(void) pgmPoolTrackDerefPTPae32Bit(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PX86PTPAE pShwPT, PCX86PT pGstPT)
pgmPoolTracDerefGCPhysHint(pPool, pPage, pShwPT->a[i].u & X86_PTE_PAE_PG_MASK, pGstPT->a[i].u & X86_PTE_PG_MASK);
DECLINLINE(void) pgmPoolTrackDerefPTPaePae(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PX86PTPAE pShwPT, PCX86PTPAE pGstPT)
pgmPoolTracDerefGCPhysHint(pPool, pPage, pShwPT->a[i].u & X86_PTE_PAE_PG_MASK, pGstPT->a[i].u & X86_PTE_PAE_PG_MASK);
PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPD->a[i].u & X86_PDE_PG_MASK);
if (pSubPage)
PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPD->a[i].u & X86_PDE_PAE_PG_MASK);
if (pSubPage)
for (unsigned i = 0; i < X86_PG_PAE_PDPE_ENTRIES; i++)
PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPDPT->a[i].u & X86_PDPE_PG_MASK);
if (pSubPage)
PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPDPT->a[i].u & X86_PDPE_PG_MASK);
if (pSubPage)
PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPML4->a[i].u & X86_PDPE_PG_MASK);
if (pSubPage)
PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPD->a[i].u & EPT_PDE_PG_MASK);
if (pSubPage)
PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPDPT->a[i].u & EPT_PDPTE_PG_MASK);
if (pSubPage)
#ifdef PGMPOOL_WITH_GCPHYS_TRACKING
void *pvGst;
void *pvGst;
void *pvGst;
case PGMPOOLKIND_PAE_PD_PHYS:
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_64BIT_PML4:
#ifdef IN_RING3
#ifdef PGMPOOL_WITH_MONITORING
#ifdef PGMPOOL_WITH_USER_TRACKING
#ifdef PGMPOOL_WITH_CACHE
#ifdef PGMPOOL_WITH_USER_TRACKING
for (unsigned i = 0; i < cMaxUsers; i++)
#ifdef PGMPOOL_WITH_GCPHYS_TRACKING
pRam;
while (iPage-- > 0)
for (unsigned i = 0; i < cMaxPhysExts; i++)
#ifdef PGMPOOL_WITH_MONITORING
#ifdef PGMPOOL_WITH_CACHE
#ifdef PGMPOOL_WITH_MONITORING
# ifdef PGMPOOL_WITH_CACHE
#ifdef PGMPOOL_WITH_USER_TRACKING
#ifdef PGMPOOL_WITH_CACHE
Log(("pgmPoolFlushPage: special root page, rejected. enmKind=%s idx=%d\n", pgmPoolPoolKindToStr(pPage->enmKind), pPage->idx));
return VINF_SUCCESS;
("Can't free the shadow CR3! (%RHp vs %RHp kind=%d\n", PGMGetHyperCR3(VMMGetCpu(pVM)), pPage->Core.Key, pPage->enmKind));
Log(("pgmPoolFlushPage: current active shadow CR3, rejected. enmKind=%s idx=%d\n", pgmPoolPoolKindToStr(pPage->enmKind), pPage->idx));
return VINF_SUCCESS;
#ifdef PGMPOOL_WITH_USER_TRACKING
#ifdef PGMPOOL_WITH_CACHE
#ifdef PGMPOOL_WITH_MONITORING
return rc;
#ifdef PGMPOOL_WITH_USER_TRACKING
#ifdef PGMPOOL_WITH_CACHE
#if defined(IN_RC)
/* Hack alert: we can't deal with jumps to ring 3 when called from MapCR3 and allocating pages for PAE PDs. */
#ifdef IN_RING3
return rc;
return VINF_SUCCESS;
#ifdef PGMPOOL_WITH_CACHE
return VERR_PGM_POOL_FLUSHED;
int pgmPoolAlloc(PVM pVM, RTGCPHYS GCPhys, PGMPOOLKIND enmKind, uint16_t iUser, uint32_t iUserTable, PPPGMPOOLPAGE ppPage)
LogFlow(("pgmPoolAlloc: GCPhys=%RGp enmKind=%s iUser=%#x iUserTable=%#x\n", GCPhys, pgmPoolPoolKindToStr(enmKind), iUser, iUserTable));
/** @todo CSAM/PGMPrefetchPage messes up here during CSAMR3CheckGates
* Assert(!(pVM->pgm.s.fGlobalSyncFlags & PGM_GLOBAL_SYNC_CLEAR_PGM_POOL)); */
#ifdef PGMPOOL_WITH_CACHE
LogFlow(("pgmPoolAlloc: cached returns %Rrc *ppPage=%p:{.Key=%RHp, .idx=%d}\n", rc2, *ppPage, (*ppPage)->Core.Key, (*ppPage)->idx));
return rc2;
return rc;
pPool->cUsedPages++; /* physical handler registration / pgmPoolTrackFlushGCPhysPTsSlow requirement. */
#ifdef PGMPOOL_WITH_MONITORING
#ifdef PGMPOOL_WITH_USER_TRACKING
return rc3;
#ifdef VBOX_WITH_STATISTICS
LogFlow(("pgmPoolAlloc: returns %Rrc *ppPage=%p:{.Key=%RHp, .idx=%d, .fCached=%RTbool, .fMonitored=%RTbool}\n",
return rc;
PPGMPOOLPAGE pPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, HCPhys & X86_PTE_PAE_PG_MASK);
AssertFatalMsg(pPage && pPage->enmKind != PGMPOOLKIND_FREE, ("HCPhys=%RHp pPage=%p idx=%d\n", HCPhys, pPage, (pPage) ? pPage->idx : 0));
return pPage;
#ifdef IN_RING3
#ifdef LOG_ENABLED
switch(enmKind)
case PGMPOOLKIND_INVALID:
case PGMPOOLKIND_FREE:
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PD_PHYS:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_ROOT_NESTED: