PGMAllPool.cpp revision d2c3a05f6abe8acac0ef5781fc55ccac9513f0dd
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * PGM Shadow Page Pool.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Copyright (C) 2006-2007 Sun Microsystems, Inc.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * This file is part of VirtualBox Open Source Edition (OSE), as
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * available from http://www.virtualbox.org. This file is free software;
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * you can redistribute it and/or modify it under the terms of the GNU
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * General Public License (GPL) as published by the Free Software
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Foundation, in version 2 as it comes in the "COPYING" file of the
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Clara, CA 95054 USA or visit http://www.sun.com if you need
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * additional information or have any questions.
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync/*******************************************************************************
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync* Header Files *
7b9f0c34e9ea328981c99e97054bdf8684d9d620vboxsync*******************************************************************************/
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync/*******************************************************************************
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync* Internal Functions *
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync*******************************************************************************/
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncDECLINLINE(unsigned) pgmPoolTrackGetShadowEntrySize(PGMPOOLKIND enmKind);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncDECLINLINE(unsigned) pgmPoolTrackGetGuestEntrySize(PGMPOOLKIND enmKind);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncstatic void pgmPoolTrackDeref(PPGMPOOL pPool, PPGMPOOLPAGE pPage);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncstatic int pgmPoolTrackAddUser(PPGMPOOL pPool, PPGMPOOLPAGE pPage, uint16_t iUser, uint32_t iUserTable);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncstatic void pgmPoolMonitorModifiedRemove(PPGMPOOL pPool, PPGMPOOLPAGE pPage);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncDECLEXPORT(int) pgmPoolAccessHandler(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, RTGCPHYS GCPhysFault, void *pvUser);
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsyncstatic const char *pgmPoolPoolKindToStr(uint8_t enmKind);
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync#if defined(VBOX_STRICT) && defined(PGMPOOL_WITH_OPTIMIZED_DIRTY_PT)
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsyncstatic void pgmPoolTrackCheckPTPaePae(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PX86PTPAE pShwPT, PCX86PTPAE pGstPT);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncint pgmPoolTrackFlushGCPhysPTsSlow(PVM pVM, PPGMPAGE pPhysPage);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncPPGMPOOLPHYSEXT pgmPoolTrackPhysExtAlloc(PVM pVM, uint16_t *piPhysExt);
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsyncvoid pgmPoolTrackPhysExtFree(PVM pVM, uint16_t iPhysExt);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncvoid pgmPoolTrackPhysExtFreeList(PVM pVM, uint16_t iPhysExt);
5f2b03bf7695dabd71222dba123532a3f76828c1vboxsync * Checks if the specified page pool kind is for a 4MB or 2MB guest page.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @returns true if it's the shadow of a 4MB or 2MB guest page, otherwise false.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param enmKind The page kind.
02f7c106d33c45f99ec412a5fe0adde868f700fcvboxsyncDECLINLINE(bool) pgmPoolIsBigPage(PGMPOOLKIND enmKind)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync return true;
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync return false;
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync/** @def PGMPOOL_PAGE_2_LOCKED_PTR
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * Maps a pool page pool into the current context and lock it (RC only).
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @returns VBox status code.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pVM The VM handle.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pPage The pool page.
9523921c89c66f4bececdbd5ac95aed0039eda1bvboxsync * @remark In RC this uses PGMGCDynMapHCPage(), so it will consume of the
9523921c89c66f4bececdbd5ac95aed0039eda1bvboxsync * small page window employeed by that function. Be careful.
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync * @remark There is no need to assert on the result.
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsyncDECLINLINE(void *) PGMPOOL_PAGE_2_LOCKED_PTR(PVM pVM, PPGMPOOLPAGE pPage)
9523921c89c66f4bececdbd5ac95aed0039eda1bvboxsync void *pv = pgmPoolMapPageInlined(&pVM->pgm.s, pPage);
9523921c89c66f4bececdbd5ac95aed0039eda1bvboxsync /* Make sure the dynamic mapping will not be reused. */
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync# define PGMPOOL_PAGE_2_LOCKED_PTR(pVM, pPage) PGMPOOL_PAGE_2_PTR(pVM, pPage)
ed9d3db07648c7e3a979105c15ad752ee9ea18devboxsync/** @def PGMPOOL_UNLOCK_PTR
ed9d3db07648c7e3a979105c15ad752ee9ea18devboxsync * Unlock a previously locked dynamic caching (RC only).
ed9d3db07648c7e3a979105c15ad752ee9ea18devboxsync * @returns VBox status code.
ed9d3db07648c7e3a979105c15ad752ee9ea18devboxsync * @param pVM The VM handle.
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync * @param pPage The pool page.
9523921c89c66f4bececdbd5ac95aed0039eda1bvboxsync * @remark In RC this uses PGMGCDynMapHCPage(), so it will consume of the
5f2b03bf7695dabd71222dba123532a3f76828c1vboxsync * small page window employeed by that function. Be careful.
5f2b03bf7695dabd71222dba123532a3f76828c1vboxsync * @remark There is no need to assert on the result.
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsyncDECLINLINE(void) PGMPOOL_UNLOCK_PTR(PVM pVM, void *pvPage)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync# define PGMPOOL_UNLOCK_PTR(pVM, pPage) do {} while (0)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Flushes a chain of pages sharing the same access monitor.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @returns VBox status code suitable for scheduling.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pPool The pool.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * @param pPage A page in the chain.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncint pgmPoolMonitorChainFlush(PPGMPOOL pPool, PPGMPOOLPAGE pPage)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync LogFlow(("pgmPoolMonitorChainFlush: Flush page %RGp type=%d\n", pPage->GCPhys, pPage->enmKind));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Find the list head.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * Iterate the list flushing each shadow page.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * Wrapper for getting the current context pointer to the entry being modified.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @returns VBox status code suitable for scheduling.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pVM VM Handle.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pvDst Destination address
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pvSrc Source guest virtual address.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param GCPhysSrc The source guest physical address.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param cb Size of data to read
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncDECLINLINE(int) pgmPoolPhysSimpleReadGCPhys(PVM pVM, void *pvDst, CTXTYPE(RTGCPTR, RTHCPTR, RTGCPTR) pvSrc, RTGCPHYS GCPhysSrc, size_t cb)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync memcpy(pvDst, (RTHCPTR)((uintptr_t)pvSrc & ~(RTHCUINTPTR)(cb - 1)), cb);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync /* @todo in RC we could attempt to use the virtual address, although this can cause many faults (PAE Windows XP guest). */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync return PGMPhysSimpleReadGCPhys(pVM, pvDst, GCPhysSrc & ~(RTGCPHYS)(cb - 1), cb);
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * Process shadow entries before they are changed by the guest.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * For PT entries we will clear them. For PD entries, we'll simply check
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * for mapping conflicts and set the SyncCR3 FF if found.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pVCpu VMCPU handle
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pPool The pool.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pPage The head page.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param GCPhysFault The guest physical fault address.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param uAddress In R0 and GC this is the guest context fault address (flat).
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * In R3 this is the host context 'fault' address.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param cbWrite Write size; might be zero if the caller knows we're not crossing entry boundaries
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncvoid pgmPoolMonitorChainChanging(PVMCPU pVCpu, PPGMPOOL pPool, PPGMPOOLPAGE pPage, RTGCPHYS GCPhysFault, CTXTYPE(RTGCPTR, RTHCPTR, RTGCPTR) pvAddress, unsigned cbWrite)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync AssertMsg(pPage->iMonitoredPrev == NIL_PGMPOOL_IDX, ("%#x (idx=%#x)\n", pPage->iMonitoredPrev, pPage->idx));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync const unsigned off = GCPhysFault & PAGE_OFFSET_MASK;
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync LogFlow(("pgmPoolMonitorChainChanging: %RGv phys=%RGp cbWrite=%d\n", (RTGCPTR)pvAddress, GCPhysFault, cbWrite));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync LogFlow(("pgmPoolMonitorChainChanging: page idx=%d phys=%RGp (next=%d) kind=%s\n", pPage->idx, pPage->GCPhys, pPage->iMonitoredNext, pgmPoolPoolKindToStr(pPage->enmKind), cbWrite));
7e8ef90d3160234df0f254131b87af4243d79476vboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPT));
7e8ef90d3160234df0f254131b87af4243d79476vboxsync LogFlow(("PGMPOOLKIND_32BIT_PT_FOR_32BIT_PT iShw=%x\n", iShw));
7e8ef90d3160234df0f254131b87af4243d79476vboxsync int rc = pgmPoolPhysSimpleReadGCPhys(pVM, &GstPte, pvAddress, GCPhysFault, sizeof(GstPte));
7e8ef90d3160234df0f254131b87af4243d79476vboxsync Log4(("pgmPoolMonitorChainChanging 32_32: deref %016RX64 GCPhys %08RX32\n", uShw.pPT->a[iShw].u & X86_PTE_PAE_PG_MASK, GstPte.u & X86_PTE_PG_MASK));
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync /* page/2 sized */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPT));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync const unsigned iShw = (off / sizeof(X86PTE)) & (X86_PG_PAE_ENTRIES - 1);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync LogFlow(("PGMPOOLKIND_PAE_PT_FOR_32BIT_PT iShw=%x\n", iShw));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync int rc = pgmPoolPhysSimpleReadGCPhys(pVM, &GstPte, pvAddress, GCPhysFault, sizeof(GstPte));
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync Log4(("pgmPoolMonitorChainChanging pae_32: deref %016RX64 GCPhys %08RX32\n", uShw.pPT->a[iShw].u & X86_PTE_PAE_PG_MASK, GstPte.u & X86_PTE_PG_MASK));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync LogFlow(("pgmPoolMonitorChainChanging PAE for 32 bits: iGst=%x iShw=%x idx = %d page idx=%d\n", iGst, iShw, iShwPdpt, pPage->enmKind - PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPD));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync if (iShwPdpt == pPage->enmKind - (unsigned)PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync for (unsigned i = 0; i < 2; i++)
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync if ((uShw.pPDPae->a[iShw + i].u & (PGM_PDFLAGS_MAPPING | X86_PDE_P)) == (PGM_PDFLAGS_MAPPING | X86_PDE_P))
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShwPdpt=%#x iShw=%#x!\n", iShwPdpt, iShw+i));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync# endif /* !IN_RING0 */
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw=%#x: %RX64 -> freeing it!\n", iShw+i, uShw.pPDPae->a[iShw+i].u));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync /* paranoia / a bit assumptive. */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync if ((uShw.pPDPae->a[iShw2].u & (PGM_PDFLAGS_MAPPING | X86_PDE_P)) == (PGM_PDFLAGS_MAPPING | X86_PDE_P))
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShwPdpt=%#x iShw2=%#x!\n", iShwPdpt, iShw2));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync# endif /* !IN_RING0 */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPDPae->a[iShw2].u));
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPT));
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync int rc = pgmPoolPhysSimpleReadGCPhys(pVM, &GstPte, pvAddress, GCPhysFault, sizeof(GstPte));
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync Log4(("pgmPoolMonitorChainChanging pae: deref %016RX64 GCPhys %016RX64\n", uShw.pPTPae->a[iShw].u & X86_PTE_PAE_PG_MASK, GstPte.u & X86_PTE_PAE_PG_MASK));
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync /* paranoia / a bit assumptive. */
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PTEPAE);
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync int rc = pgmPoolPhysSimpleReadGCPhys(pVM, &GstPte, (RTHCPTR)((RTHCUINTPTR)pvAddress + sizeof(GstPte)), GCPhysFault + sizeof(GstPte), sizeof(GstPte));
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync int rc = pgmPoolPhysSimpleReadGCPhys(pVM, &GstPte, pvAddress + sizeof(GstPte), GCPhysFault + sizeof(GstPte), sizeof(GstPte));
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync Log4(("pgmPoolMonitorChainChanging pae: deref %016RX64 GCPhys %016RX64\n", uShw.pPTPae->a[iShw2].u & X86_PTE_PAE_PG_MASK, GstPte.u & X86_PTE_PAE_PG_MASK));
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync const unsigned iShw = off / sizeof(X86PTE); // ASSUMING 32-bit guest paging!
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync LogFlow(("pgmPoolMonitorChainChanging: PGMPOOLKIND_32BIT_PD %x\n", iShw));
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPD));
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync STAM_COUNTER_INC(&(pVCpu->pgm.s.StatRZGuestCR3WriteConflict));
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShw=%#x!\n", iShw));
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync# endif /* !IN_RING0 */
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync# endif /* !IN_RING0 */
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync LogFlow(("pgmPoolMonitorChainChanging: 32 bit pd iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPD->a[iShw].u));
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync /* paranoia / a bit assumptive. */
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PTE);
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync STAM_COUNTER_INC(&(pVCpu->pgm.s.StatRZGuestCR3WriteConflict));
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShw2=%#x!\n", iShw2));
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync# endif /* !IN_RING0 */
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync# endif /* !IN_RING0 */
907b6adfa052386a0666d5557bee9bdbc100c2e5vboxsync LogFlow(("pgmPoolMonitorChainChanging: 32 bit pd iShw=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPD->a[iShw2].u));
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync#if 0 /* useful when running PGMAssertCR3(), a bit too troublesome for general use (TLBs). */
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync LogFlow(("pgmPoolMonitorChainChanging: iShw=%#x: %RX32 -> freeing it!\n", iShw, uShw.pPD->a[iShw].u));
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync# ifdef IN_RC /* TLB load - we're pushing things a bit... */
907b6adfa052386a0666d5557bee9bdbc100c2e5vboxsync pgmPoolFree(pVM, uShw.pPD->a[iShw].u & X86_PDE_PG_MASK, pPage->idx, iShw);
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPD));
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync STAM_COUNTER_INC(&(pVCpu->pgm.s.StatRZGuestCR3WriteConflict));
5f2b03bf7695dabd71222dba123532a3f76828c1vboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShw=%#x!\n", iShw));
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync#endif /* !IN_RING0 */
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync * Causes trouble when the guest uses a PDE to refer to the whole page table level
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync * structure. (Invalidate here; faults later on when it tries to change the page
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync * table entries -> recheck; probably only applies to the RC case.)
5f2b03bf7695dabd71222dba123532a3f76828c1vboxsync# endif /* !IN_RING0 */
7862f4bd000f1eb6c86289f5ac2849e9cf943ca9vboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPDPae->a[iShw].u));
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync /* paranoia / a bit assumptive. */
5f2b03bf7695dabd71222dba123532a3f76828c1vboxsync const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PDEPAE);
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync STAM_COUNTER_INC(&(pVCpu->pgm.s.StatRZGuestCR3WriteConflict));
cc1ef2ef9bbc6a0ff964928d61b7298e5bfcce5fvboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShw2=%#x!\n", iShw2));
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync#endif /* !IN_RING0 */
ed9d3db07648c7e3a979105c15ad752ee9ea18devboxsync# endif /* !IN_RING0 */
7e8ef90d3160234df0f254131b87af4243d79476vboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw2=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPDPae->a[iShw2].u));
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPDPT));
cc1ef2ef9bbc6a0ff964928d61b7298e5bfcce5fvboxsync * Hopefully this doesn't happen very often:
cc1ef2ef9bbc6a0ff964928d61b7298e5bfcce5fvboxsync * - touching unused parts of the page
907b6adfa052386a0666d5557bee9bdbc100c2e5vboxsync * - messing with the bits of pd pointers without changing the physical address
907b6adfa052386a0666d5557bee9bdbc100c2e5vboxsync /* PDPT roots are not page aligned; 32 byte only! */
5f2b03bf7695dabd71222dba123532a3f76828c1vboxsync const unsigned offPdpt = GCPhysFault - pPage->GCPhys;
5f2b03bf7695dabd71222dba123532a3f76828c1vboxsync if (iShw < X86_PG_PAE_PDPE_ENTRIES) /* don't use RT_ELEMENTS(uShw.pPDPT->a), because that's for long mode only */
5f2b03bf7695dabd71222dba123532a3f76828c1vboxsync STAM_COUNTER_INC(&(pVCpu->pgm.s.StatRZGuestCR3WriteConflict));
5f2b03bf7695dabd71222dba123532a3f76828c1vboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected pdpt conflict at iShw=%#x!\n", iShw));
02f7c106d33c45f99ec412a5fe0adde868f700fcvboxsync# endif /* !IN_RING0 */
5f2b03bf7695dabd71222dba123532a3f76828c1vboxsync# endif /* !IN_RING0 */
5f2b03bf7695dabd71222dba123532a3f76828c1vboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pdpt iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPDPT->a[iShw].u));
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync /* paranoia / a bit assumptive. */
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync const unsigned iShw2 = (offPdpt + cbWrite - 1) / sizeof(X86PDPE);
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync STAM_COUNTER_INC(&(pVCpu->pgm.s.StatRZGuestCR3WriteConflict));
d4a9d525e6f2111d462d2d96462dced6b9ec00efvboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShw2=%#x!\n", iShw2));
5f2b03bf7695dabd71222dba123532a3f76828c1vboxsync# endif /* !IN_RING0 */
5f2b03bf7695dabd71222dba123532a3f76828c1vboxsync# endif /* !IN_RING0 */
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pdpt iShw=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPDPT->a[iShw2].u));
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPD));
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync Assert(!(uShw.pPDPae->a[iShw].u & PGM_PDFLAGS_MAPPING));
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPDPae->a[iShw].u));
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync /* paranoia / a bit assumptive. */
f9ce005e61f0fbb51a2cabc53d58c3485151faa9vboxsync const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PDEPAE);
f9ce005e61f0fbb51a2cabc53d58c3485151faa9vboxsync Assert(!(uShw.pPDPae->a[iShw2].u & PGM_PDFLAGS_MAPPING));
f9ce005e61f0fbb51a2cabc53d58c3485151faa9vboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw2=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPDPae->a[iShw2].u));
f9ce005e61f0fbb51a2cabc53d58c3485151faa9vboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPDPT));
f9ce005e61f0fbb51a2cabc53d58c3485151faa9vboxsync * Hopefully this doesn't happen very often:
f9ce005e61f0fbb51a2cabc53d58c3485151faa9vboxsync * - messing with the bits of pd pointers without changing the physical address
f9ce005e61f0fbb51a2cabc53d58c3485151faa9vboxsync LogFlow(("pgmPoolMonitorChainChanging: pdpt iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPDPT->a[iShw].u));
f9ce005e61f0fbb51a2cabc53d58c3485151faa9vboxsync pgmPoolFree(pVM, uShw.pPDPT->a[iShw].u & X86_PDPE_PG_MASK, pPage->idx, iShw);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync /* paranoia / a bit assumptive. */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PDPE);
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync LogFlow(("pgmPoolMonitorChainChanging: pdpt iShw2=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPDPT->a[iShw2].u));
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync pgmPoolFree(pVM, uShw.pPDPT->a[iShw2].u & X86_PDPE_PG_MASK, pPage->idx, iShw2);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPML4));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Hopefully this doesn't happen very often:
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * - messing with the bits of pd pointers without changing the physical address
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync LogFlow(("pgmPoolMonitorChainChanging: pml4 iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPML4->a[iShw].u));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync pgmPoolFree(pVM, uShw.pPML4->a[iShw].u & X86_PML4E_PG_MASK, pPage->idx, iShw);
06ea6bcf23874b662d499b3f130024c98b2dd7a6vboxsync /* paranoia / a bit assumptive. */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PML4E);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync LogFlow(("pgmPoolMonitorChainChanging: pml4 iShw2=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPML4->a[iShw2].u));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync pgmPoolFree(pVM, uShw.pPML4->a[iShw2].u & X86_PML4E_PG_MASK, pPage->idx, iShw2);
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync#endif /* IN_RING0 */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync AssertFatalMsgFailed(("enmKind=%d\n", pPage->enmKind));
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync * Checks if a access could be a fork operation in progress.
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync * Meaning, that the guest is setting up the parent process for Copy-On-Write.
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync * @returns true if it's likly that we're forking, otherwise false.
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync * @param pPool The pool.
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync * @param pDis The disassembled instruction.
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync * @param offFault The access offset.
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsyncDECLINLINE(bool) pgmPoolMonitorIsForking(PPGMPOOL pPool, PDISCPUSTATE pDis, unsigned offFault)
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync * i386 linux is using btr to clear X86_PTE_RW.
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync * The functions involved are (2.6.16 source inspection):
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync * clear_bit
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync * ptep_set_wrprotect
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync * copy_one_pte
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync * copy_pte_range
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync * copy_pmd_range
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync * copy_pud_range
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync * copy_page_range
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync * copy_process
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync /** @todo Validate that the bit index is X86_PTE_RW. */
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,Fork));
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync return true;
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync return false;
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync * Determine whether the page is likely to have been reused.
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync * @returns true if we consider the page as being reused for a different purpose.
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync * @returns false if we consider it to still be a paging page.
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync * @param pVM VM Handle.
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync * @param pVCpu VMCPU Handle.
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync * @param pRegFrame Trap register frame.
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync * @param pDis The disassembly info for the faulting instruction.
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync * @param pvFault The fault address.
35e6d303696e46d969aaf9a59cc381333a483b0bvboxsync * @remark The REP prefix check is left to the caller because of STOSD/W.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncDECLINLINE(bool) pgmPoolMonitorIsReused(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pDis, RTGCPTR pvFault)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync /** @todo could make this general, faulting close to rsp should be a safe reuse heuristic. */
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync /* Fault caused by stack writes while trying to inject an interrupt event. */
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync Log(("pgmPoolMonitorIsReused: reused %RGv for interrupt stack (rsp=%RGv).\n", pvFault, pRegFrame->rsp));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync return true;
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync LogFlow(("Reused instr %RGv %d at %RGv param1.flags=%x param1.reg=%d\n", pRegFrame->rip, pDis->pCurInstr->opcode, pvFault, pDis->param1.flags, pDis->param1.base.reg_gen));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync /* Non-supervisor mode write means it's used for something else. */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync return true;
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync /* call implies the actual push of the return address faulted */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync return true;
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync return true;
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync return true;
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync return true;
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync return true;
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync return true;
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync case OP_MOVNTDQ: /* solaris - hwblkclr & hwblkpagecopy */
9523921c89c66f4bececdbd5ac95aed0039eda1bvboxsync return true;
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync return true;
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync return false;
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync return true;
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync return false;
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Flushes the page being accessed.
06ea6bcf23874b662d499b3f130024c98b2dd7a6vboxsync * @returns VBox status code suitable for scheduling.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pVM The VM handle.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pVCpu The VMCPU handle.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pPool The pool.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pPage The pool page (head).
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * @param pDis The disassembly of the write instruction.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * @param pRegFrame The trap register frame.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param GCPhysFault The fault address as guest physical address.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pvFault The fault address.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncstatic int pgmPoolAccessHandlerFlush(PVM pVM, PVMCPU pVCpu, PPGMPOOL pPool, PPGMPOOLPAGE pPage, PDISCPUSTATE pDis,
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, RTGCPTR pvFault)
06ea6bcf23874b662d499b3f130024c98b2dd7a6vboxsync * First, do the flushing.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * Emulate the instruction (xp/w2k problem, requires pc/cr2/sp detection). Must do this in raw mode (!); XP boot will fail otherwise
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync int rc2 = EMInterpretInstructionCPU(pVM, pVCpu, pDis, pRegFrame, pvFault, &cbWritten);
06ea6bcf23874b662d499b3f130024c98b2dd7a6vboxsync if (PATMIsPatchGCAddr(pVM, (RTRCPTR)pRegFrame->eip))
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync LogFlow(("pgmPoolAccessHandlerPTWorker: Interpretation failed for patch code %04x:%RGv, ignoring.\n",
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync STAM_COUNTER_INC(&pPool->StatMonitorRZIntrFailPatch2);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,EmulateInstr));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync LogFlow(("pgmPoolAccessHandlerPT: returns %Rrc (flushed)\n", rc));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Handles the STOSD write accesses.
7862f4bd000f1eb6c86289f5ac2849e9cf943ca9vboxsync * @returns VBox status code suitable for scheduling.
7862f4bd000f1eb6c86289f5ac2849e9cf943ca9vboxsync * @param pVM The VM handle.
7862f4bd000f1eb6c86289f5ac2849e9cf943ca9vboxsync * @param pPool The pool.
7862f4bd000f1eb6c86289f5ac2849e9cf943ca9vboxsync * @param pPage The pool page (head).
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * @param pDis The disassembly of the write instruction.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * @param pRegFrame The trap register frame.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * @param GCPhysFault The fault address as guest physical address.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * @param pvFault The fault address.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsyncDECLINLINE(int) pgmPoolAccessHandlerSTOSD(PVM pVM, PPGMPOOL pPool, PPGMPOOLPAGE pPage, PDISCPUSTATE pDis,
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, RTGCPTR pvFault)
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync Assert(pDis->mode == CPUMODE_32BIT || pDis->mode == CPUMODE_64BIT);
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * Increment the modification counter and insert it into the list
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * of modified pages the first time.
06ea6bcf23874b662d499b3f130024c98b2dd7a6vboxsync * Execute REP STOSD.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * This ASSUMES that we're not invoked by Trap0e on in a out-of-sync
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * write situation, meaning that it's safe to write here.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync uint32_t iPrevSubset = PGMDynMapPushAutoSubset(pVCpu);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync pgmPoolMonitorChainChanging(pVCpu, pPool, pPage, GCPhysFault, (RTGCPTR)pu32, uIncrement);
7862f4bd000f1eb6c86289f5ac2849e9cf943ca9vboxsync pgmPoolMonitorChainChanging(pVCpu, pPool, pPage, GCPhysFault, (RTGCPTR)pu32, uIncrement);
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync PGMPhysSimpleWriteGCPhys(pVM, GCPhysFault, &pRegFrame->rax, uIncrement);
7862f4bd000f1eb6c86289f5ac2849e9cf943ca9vboxsync * Handles the simple write accesses.
7862f4bd000f1eb6c86289f5ac2849e9cf943ca9vboxsync * @returns VBox status code suitable for scheduling.
7862f4bd000f1eb6c86289f5ac2849e9cf943ca9vboxsync * @param pVM The VM handle.
7862f4bd000f1eb6c86289f5ac2849e9cf943ca9vboxsync * @param pVCpu The VMCPU handle.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * @param pPool The pool.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * @param pPage The pool page (head).
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * @param pDis The disassembly of the write instruction.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * @param pRegFrame The trap register frame.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * @param GCPhysFault The fault address as guest physical address.
7862f4bd000f1eb6c86289f5ac2849e9cf943ca9vboxsync * @param pvFault The fault address.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync * @param pfReused Reused state (out)
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsyncDECLINLINE(int) pgmPoolAccessHandlerSimple(PVM pVM, PVMCPU pVCpu, PPGMPOOL pPool, PPGMPOOLPAGE pPage, PDISCPUSTATE pDis,
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, RTGCPTR pvFault, bool *pfReused)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Increment the modification counter and insert it into the list
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * of modified pages the first time.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Clear all the pages. ASSUMES that pvFault is readable.
7862f4bd000f1eb6c86289f5ac2849e9cf943ca9vboxsync uint32_t iPrevSubset = PGMDynMapPushAutoSubset(pVCpu);
7862f4bd000f1eb6c86289f5ac2849e9cf943ca9vboxsync pgmPoolMonitorChainChanging(pVCpu, pPool, pPage, GCPhysFault, pvFault, DISGetParamSize(pDis, &pDis->param1));
7862f4bd000f1eb6c86289f5ac2849e9cf943ca9vboxsync pgmPoolMonitorChainChanging(pVCpu, pPool, pPage, GCPhysFault, pvFault, DISGetParamSize(pDis, &pDis->param1));
06ea6bcf23874b662d499b3f130024c98b2dd7a6vboxsync * Interpret the instruction.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync int rc = EMInterpretInstructionCPU(pVM, pVCpu, pDis, pRegFrame, pvFault, &cb);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync LogFlow(("pgmPoolAccessHandlerPTWorker: Interpretation failed for %04x:%RGv - opcode=%d\n",
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync pRegFrame->cs, (RTGCPTR)pRegFrame->rip, pDis->pCurInstr->opcode));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,EmulateInstr));
9523921c89c66f4bececdbd5ac95aed0039eda1bvboxsync#if 0 /* experimental code */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync int rc = pgmPoolPhysSimpleReadGCPhys(pVM, &GstPte, pvFault, GCPhysFault, sizeof(GstPte));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync /* Check the new value written by the guest. If present and with a bogus physical address, then
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * it's fairly safe to assume the guest is reusing the PT.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync int rc = PGMPhysGCPhys2HCPhys(pVM, GstPte.u & X86_PTE_PAE_PG_MASK, &HCPhys);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync LogFlow(("pgmPoolAccessHandlerSimple: returns %Rrc cb=%d\n", rc, cb));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * \#PF Handler callback for PT write accesses.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @returns VBox status code (appropriate for GC return).
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pVM VM Handle.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param uErrorCode CPU Error code.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pRegFrame Trap register frame.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * NULL on DMA and other non CPU access.
9523921c89c66f4bececdbd5ac95aed0039eda1bvboxsync * @param pvFault The fault address (cr2).
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param GCPhysFault The GC physical address corresponding to pvFault.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pvUser User argument.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsyncDECLEXPORT(int) pgmPoolAccessHandler(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, RTGCPHYS GCPhysFault, void *pvUser)
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync STAM_PROFILE_START(&pVM->pgm.s.CTX_SUFF(pPool)->CTX_SUFF_Z(StatMonitor), a);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync bool fForcedFlush = false;
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync LogFlow(("pgmPoolAccessHandler: pvFault=%RGv pPage=%p:{.idx=%d} GCPhysFault=%RGp\n", pvFault, pPage, pPage->idx, GCPhysFault));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync if (PHYS_PAGE_ADDRESS(GCPhysFault) != PHYS_PAGE_ADDRESS(pPage->GCPhys))
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync /* Pool page changed while we were waiting for the lock; ignore. */
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync Log(("CPU%d: pgmPoolAccessHandler pgm pool page for %RGp changed (to %RGp) while waiting!\n", pVCpu->idCpu, PHYS_PAGE_ADDRESS(GCPhysFault), PHYS_PAGE_ADDRESS(pPage->GCPhys)));
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync STAM_PROFILE_STOP_EX(&pVM->pgm.s.CTX_SUFF(pPool)->CTX_SUFF_Z(StatMonitor), &pPool->CTX_MID_Z(StatMonitor,Handled), a);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync return VINF_SUCCESS; /* SMP guest case where we were blocking on the pgm lock while the same page was being marked dirty. */
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync#if 0 /* test code defined(VBOX_STRICT) && defined(PGMPOOL_WITH_OPTIMIZED_DIRTY_PT) */
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync if (pPage->enmKind == PGMPOOLKIND_PAE_PT_FOR_PAE_PT)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync void *pvShw = PGMPOOL_PAGE_2_LOCKED_PTR(pPool->CTX_SUFF(pVM), pPage);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync int rc = PGM_GCPHYS_2_PTR(pPool->CTX_SUFF(pVM), pPage->GCPhys, &pvGst); AssertReleaseRC(rc);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync pgmPoolTrackCheckPTPaePae(pPool, pPage, (PX86PTPAE)pvShw, (PCX86PTPAE)pvGst);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Disassemble the faulting instruction.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync int rc = EMInterpretDisasOne(pVM, pVCpu, pRegFrame, pDis, NULL);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync AssertMsg(rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT, ("Unexpected rc %d\n", rc));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * We should ALWAYS have the list head as user parameter. This
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * is because we use that page to record the changes.
5f2b03bf7695dabd71222dba123532a3f76828c1vboxsync /* Maximum nr of modifications depends on the page type. */
45655563f818c5d5bbf4b3d14aa48cbd92a871f1vboxsync if (pPage->enmKind == PGMPOOLKIND_PAE_PT_FOR_PAE_PT)
06ea6bcf23874b662d499b3f130024c98b2dd7a6vboxsync * Incremental page table updates should weight more than random ones.
06ea6bcf23874b662d499b3f130024c98b2dd7a6vboxsync * (Only applies when started from offset 0)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync if ( pPage->pvLastAccessHandlerRip >= pRegFrame->rip - 0x40 /* observed loops in Windows 7 x64 */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync && pPage->pvLastAccessHandlerRip < pRegFrame->rip + 0x40
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync && pvFault == (pPage->pvLastAccessHandlerFault + pDis->param1.size)
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync && pVCpu->pgm.s.cPoolAccessHandler == (pPage->cLastAccessHandlerCount + 1))
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync Log(("Possible page reuse cMods=%d -> %d (locked=%d type=%s)\n", pPage->cModifications, pPage->cModifications * 2, pgmPoolIsPageLocked(&pVM->pgm.s, pPage), pgmPoolPoolKindToStr(pPage->enmKind)));
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync pPage->cLastAccessHandlerCount = pVCpu->pgm.s.cPoolAccessHandler;
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FlushReinit));
907b6adfa052386a0666d5557bee9bdbc100c2e5vboxsync Log(("Mod overflow %VGv cMods=%d (locked=%d type=%s)\n", pvFault, pPage->cModifications, pgmPoolIsPageLocked(&pVM->pgm.s, pPage), pgmPoolPoolKindToStr(pPage->enmKind)));
907b6adfa052386a0666d5557bee9bdbc100c2e5vboxsync * Check if it's worth dealing with.
907b6adfa052386a0666d5557bee9bdbc100c2e5vboxsync bool fReused = false;
7862f4bd000f1eb6c86289f5ac2849e9cf943ca9vboxsync if ( ( pPage->cModifications < cMaxModifications /** @todo #define */ /** @todo need to check that it's not mapping EIP. */ /** @todo adjust this! */
907b6adfa052386a0666d5557bee9bdbc100c2e5vboxsync && !(fReused = pgmPoolMonitorIsReused(pVM, pVCpu, pRegFrame, pDis, pvFault))
7862f4bd000f1eb6c86289f5ac2849e9cf943ca9vboxsync && !pgmPoolMonitorIsForking(pPool, pDis, GCPhysFault & PAGE_OFFSET_MASK))
7862f4bd000f1eb6c86289f5ac2849e9cf943ca9vboxsync * Simple instructions, no REP prefix.
907b6adfa052386a0666d5557bee9bdbc100c2e5vboxsync rc = pgmPoolAccessHandlerSimple(pVM, pVCpu, pPool, pPage, pDis, pRegFrame, GCPhysFault, pvFault, &fReused);
907b6adfa052386a0666d5557bee9bdbc100c2e5vboxsync /* A mov instruction to change the first page table entry will be remembered so we can detect
7862f4bd000f1eb6c86289f5ac2849e9cf943ca9vboxsync * full page table changes early on. This will reduce the amount of unnecessary traps we'll take.
907b6adfa052386a0666d5557bee9bdbc100c2e5vboxsync pPage->cLastAccessHandlerCount = pVCpu->pgm.s.cPoolAccessHandler;
907b6adfa052386a0666d5557bee9bdbc100c2e5vboxsync /* Make sure we don't kick out a page too quickly. */
907b6adfa052386a0666d5557bee9bdbc100c2e5vboxsync /* ignore the 2nd write to this page table entry. */
907b6adfa052386a0666d5557bee9bdbc100c2e5vboxsync pPage->cLastAccessHandlerCount = pVCpu->pgm.s.cPoolAccessHandler;
ed9d3db07648c7e3a979105c15ad752ee9ea18devboxsync STAM_PROFILE_STOP_EX(&pVM->pgm.s.CTX_SUFF(pPool)->CTX_SUFF_Z(StatMonitor), &pPool->CTX_MID_Z(StatMonitor,Handled), a);
ed9d3db07648c7e3a979105c15ad752ee9ea18devboxsync * Windows is frequently doing small memset() operations (netio test 4k+).
ed9d3db07648c7e3a979105c15ad752ee9ea18devboxsync * We have to deal with these or we'll kill the cache and performance.
ed9d3db07648c7e3a979105c15ad752ee9ea18devboxsync bool fValidStosd = false;
ed9d3db07648c7e3a979105c15ad752ee9ea18devboxsync && pRegFrame->ecx * 4 <= PAGE_SIZE - ((uintptr_t)pvFault & PAGE_OFFSET_MASK)
ed9d3db07648c7e3a979105c15ad752ee9ea18devboxsync && (pRegFrame->eax == 0 || pRegFrame->eax == 0x80) /* the two values observed. */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync && pRegFrame->rcx * 8 <= PAGE_SIZE - ((uintptr_t)pvFault & PAGE_OFFSET_MASK)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync && (pRegFrame->rax == 0 || pRegFrame->rax == 0x80) /* the two values observed. */
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync rc = pgmPoolAccessHandlerSTOSD(pVM, pPool, pPage, pDis, pRegFrame, GCPhysFault, pvFault);
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync STAM_PROFILE_STOP_EX(&pVM->pgm.s.CTX_SUFF(pPool)->CTX_SUFF_Z(StatMonitor), &pPool->CTX_MID_Z(StatMonitor,RepStosd), a);
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync /* REP prefix, don't bother. */
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,RepPrefix));
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync Log4(("pgmPoolAccessHandler: eax=%#x ecx=%#x edi=%#x esi=%#x rip=%RGv opcode=%d prefix=%#x\n",
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync pRegFrame->eax, pRegFrame->ecx, pRegFrame->edi, pRegFrame->esi, (RTGCPTR)pRegFrame->rip, pDis->pCurInstr->opcode, pDis->prefix));
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync#if defined(PGMPOOL_WITH_OPTIMIZED_DIRTY_PT) && defined(IN_RING0)
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync /* E.g. Windows 7 x64 initializes page tables and touches some pages in the table during the process. This
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync * leads to pgm pool trashing and an excessive amount of write faults due to page monitoring.
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync || ( !pgmPoolMonitorIsReused(pVM, pVCpu, pRegFrame, pDis, pvFault)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync && !pgmPoolMonitorIsForking(pPool, pDis, GCPhysFault & PAGE_OFFSET_MASK))
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync /* Flush any monitored duplicates as we will disable write protection. */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync /* Find the monitor head. */
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync while (pPageHead->iMonitoredPrev != NIL_PGMPOOL_IDX)
687794577e2e35c3cae67e692a7f2130d1262a82vboxsync pPageHead = &pPool->aPages[pPageHead->iMonitoredPrev];
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync Log(("Flush duplicate page idx=%d GCPhys=%RGp type=%s\n", pPageHead->idx, pPageHead->GCPhys, pgmPoolPoolKindToStr(pPageHead->enmKind)));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync /* The flushing above might fail for locked pages, so double check. */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync /* Temporarily allow write access to the page table again. */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync rc = PGMHandlerPhysicalPageTempOff(pVM, pPage->GCPhys, pPage->GCPhys);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync rc = PGMShwModifyPage(pVCpu, pvFault, 1, X86_PTE_RW, ~(uint64_t)X86_PTE_RW);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync /* In the SMP case the page table might be removed while we wait for the PGM lock in the trap handler. */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync ("PGMShwModifyPage -> GCPtr=%RGv rc=%d\n", pvFault, rc));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync STAM_PROFILE_STOP(&pVM->pgm.s.CTX_SUFF(pPool)->CTX_SUFF_Z(StatMonitor), a);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync#endif /* PGMPOOL_WITH_OPTIMIZED_DIRTY_PT */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FlushModOverflow));
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Not worth it, so flush it.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * If we considered it to be reused, don't go back to ring-3
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * to emulate failed instructions since we usually cannot
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * interpret then. This may be a bit risky, in which case
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * the reuse detection must be fixed.
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync rc = pgmPoolAccessHandlerFlush(pVM, pVCpu, pPool, pPage, pDis, pRegFrame, GCPhysFault, pvFault);
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync /* Make sure that the current instruction still has shadow page backing, otherwise we'll end up in a loop. */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync if (PGMShwGetPage(pVCpu, pRegFrame->rip, NULL, NULL) == VINF_SUCCESS)
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync rc = VINF_SUCCESS; /* safe to restart the instruction. */
9523921c89c66f4bececdbd5ac95aed0039eda1bvboxsync STAM_PROFILE_STOP_EX(&pVM->pgm.s.CTX_SUFF(pPool)->CTX_SUFF_Z(StatMonitor), &pPool->CTX_MID_Z(StatMonitor,FlushPage), a);
702a8ee2dc1de96f2f77e97135015d3e243186fdvboxsync# endif /* !IN_RING3 */
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * Check references to guest physical memory in a PAE / PAE page table.
2f3883b126a405f92b19e829472f614c7352b4f9vboxsync * @param pPool The pool.
static void pgmPoolTrackCheckPTPaePae(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PX86PTPAE pShwPT, PCX86PTPAE pGstPT)
unsigned cErrors = 0;
#ifdef VBOX_STRICT
AssertMsg(!pShwPT->a[i].n.u1Present, ("Unexpected PTE: idx=%d %RX64 (first=%d)\n", i, pShwPT->a[i].u, pPage->iFirstPresent));
Log(("rc=%d idx=%d guest %RX64 shw=%RX64 vs %RHp\n", rc, i, pGstPT->a[i].u, pShwPT->a[i].u, HCPhys));
LastPTE = i;
cErrors++;
Log(("GCPhys=%RGp idx=%d %RX64 vs %RX64\n", pTempPage->GCPhys, j, pShwPT->a[j].u, pShwPT2->a[j].u));
AssertMsg(!cErrors, ("cErrors=%d: last rc=%d idx=%d guest %RX64 shw=%RX64 vs %RHp\n", cErrors, LastRc, LastPTE, pGstPT->a[LastPTE].u, pShwPT->a[LastPTE].u, LastHCPhys));
DECLINLINE(unsigned) pgmPoolTrackFlushPTPaePae(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PX86PTPAE pShwPT, PCX86PTPAE pGstPT, PCX86PTPAE pOldGstPT, bool fAllowRemoval, bool *pfFlush)
unsigned cChanged = 0;
#ifdef VBOX_STRICT
AssertMsg(!pShwPT->a[i].n.u1Present, ("Unexpected PTE: idx=%d %RX64 (first=%d)\n", i, pShwPT->a[i].u, pPage->iFirstPresent));
*pfFlush = false;
if ( fAllowRemoval
*pfFlush = true;
return ++cChanged;
#ifdef VBOX_STRICT
AssertMsg(rc == VINF_SUCCESS && (pShwPT->a[i].u & X86_PTE_PAE_PG_MASK) == HCPhys, ("rc=%d guest %RX64 old %RX64 shw=%RX64 vs %RHp\n", rc, pGstPT->a[i].u, pOldGstPT->a[i].u, pShwPT->a[i].u, HCPhys));
uint64_t uHostAttr = pShwPT->a[i].u & (X86_PTE_P | X86_PTE_US | X86_PTE_A | X86_PTE_D | X86_PTE_G | X86_PTE_PAE_NX);
uint64_t uGuestAttr = pGstPT->a[i].u & (X86_PTE_P | X86_PTE_US | X86_PTE_A | X86_PTE_D | X86_PTE_G | X86_PTE_PAE_NX);
cChanged++;
pgmPoolTracDerefGCPhysHint(pPool, pPage, pShwPT->a[i].u & X86_PTE_PAE_PG_MASK, pOldGstPT->a[i].u & X86_PTE_PAE_PG_MASK);
return cChanged;
static void pgmPoolFlushDirtyPage(PVM pVM, PPGMPOOL pPool, unsigned idxSlot, bool fAllowRemoval = false)
unsigned idxPage;
/* First write protect the page again to catch all write accesses. (before checking for changes -> SMP) */
#ifdef VBOX_STRICT
/* In the SMP case the page table might be removed while we wait for the PGM lock in the trap handler. */
void *pvGst;
bool fFlush;
unsigned cChanges = pgmPoolTrackFlushPTPaePae(pPool, pPage, (PX86PTPAE)pvShw, (PCX86PTPAE)pvGst, (PCX86PTPAE)&pPool->aDirtyPages[idxSlot][0], fAllowRemoval, &fFlush);
/** Note: we might want to consider keeping the dirty page active in case there were many changes. */
if (fFlush)
Log(("Removed dirty page %RGp cMods=%d cChanges=%d\n", pPage->GCPhys, pPage->cModifications, cChanges));
# ifndef IN_RING3
unsigned idxFree;
AssertMsg(pPool->aIdxDirtyPages[idxFree] == NIL_PGMPOOL_IDX, ("idxFree=%d cDirtyPages=%d\n", idxFree, pPool->cDirtyPages));
void *pvGst;
#ifdef VBOX_STRICT
Assert(pPool->cDirtyPages == RT_ELEMENTS(pPool->aIdxDirtyPages) || pPool->aIdxDirtyPages[pPool->idxFreeDirtyPage] == NIL_PGMPOOL_IDX);
Assert(pPool->aIdxDirtyPages[pPool->idxFreeDirtyPage] == NIL_PGMPOOL_IDX || pPool->cDirtyPages == RT_ELEMENTS(pPool->aIdxDirtyPages));
idxDirtyPage = i;
if (i == NIL_PGMPOOL_IDX)
iPrev = i;
#ifndef IN_RC
/* todo: find out why this is necessary; pgmPoolFlushPage should trigger a flush if one is really needed. */
return rc;
switch (enmKind1)
case PGMPOOLKIND_PAE_PD_PHYS:
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PDPT:
switch (enmKind2)
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_64BIT_PML4:
switch (enmKind2)
case PGMPOOLKIND_ROOT_NESTED:
static int pgmPoolCacheAlloc(PPGMPOOL pPool, RTGCPHYS GCPhys, PGMPOOLKIND enmKind, PGMPOOLACCESS enmAccess, uint16_t iUser, uint32_t iUserTable, PPPGMPOOLPAGE ppPage)
#ifndef IN_RC
Log3(("pgmPoolCacheAlloc: %RGp kind %s iUser=%x iUserTable=%x SLOT=%d\n", GCPhys, pgmPoolPoolKindToStr(enmKind), iUser, iUserTable, i));
if (i != NIL_PGMPOOL_IDX)
pPage->cModifications = 1; /* reset counter (can't use 0, or else it will be reinserted in the modified list) */
return VINF_PGM_CACHED_PAGE;
return rc;
} while (i != NIL_PGMPOOL_IDX);
Log3(("pgmPoolCacheAlloc: Missed GCPhys=%RGp enmKind=%s\n", GCPhys, pgmPoolPoolKindToStr(enmKind)));
return VERR_FILE_NOT_FOUND;
if (fCanBeCached)
if (i == NIL_PGMPOOL_IDX)
return NULL;
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PDPT:
return pPage;
case PGMPOOLKIND_ROOT_NESTED:
case PGMPOOLKIND_PAE_PD_PHYS:
} while (i != NIL_PGMPOOL_IDX);
return NULL;
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_ROOT_NESTED:
return VINF_SUCCESS;
case PGMPOOLKIND_PAE_PD_PHYS:
return VINF_SUCCESS;
int rc;
if (pPageHead)
Assert(!(VMMGetCpu(pVM)->pgm.s.fSyncFlags & PGM_SYNC_CLEAR_PGM_POOL) || VMCPU_FF_ISSET(VMMGetCpu(pVM), VMCPU_FF_PGM_SYNC_CR3));
return rc;
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_ROOT_NESTED:
case PGMPOOLKIND_PAE_PD_PHYS:
return VINF_SUCCESS;
int rc;
#ifdef VBOX_STRICT
AssertMsg(!(pVCpu->pgm.s.fSyncFlags & PGM_SYNC_CLEAR_PGM_POOL) || VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3),
return rc;
#ifdef VBOX_WITH_STATISTICS
Log3(("pgmPoolMonitorModifiedRemove: idx=%d cModifications=%d\n", pPage->idx, pPage->cModifications));
return VINF_PGM_SYNC_CR3;
return VINF_SUCCESS;
return rc;
DECLINLINE(int) pgmPoolTrackInsert(PPGMPOOL pPool, PPGMPOOLPAGE pPage, RTGCPHYS GCPhys, uint16_t iUser, uint32_t iUserTable)
#ifdef VBOX_STRICT
AssertMsg(paUsers[i].iUser != iUser || paUsers[i].iUserTable != iUserTable, ("%x %x vs new %x %x\n", paUsers[i].iUser, paUsers[i].iUserTable, iUser, iUserTable));
} while (i != NIL_PGMPOOL_USER_INDEX);
if (i == NIL_PGMPOOL_USER_INDEX)
return rc;
const bool fCanBeMonitored = true;
if (fCanBeMonitored)
return rc;
static int pgmPoolTrackAddUser(PPGMPOOL pPool, PPGMPOOLPAGE pPage, uint16_t iUser, uint32_t iUserTable)
Log3(("pgmPoolTrackAddUser GCPhys = %RGp iUser %x iUserTable %x\n", pPage->GCPhys, iUser, iUserTable));
# ifdef VBOX_STRICT
* Check that the entry doesn't already exists. We only allow multiple users of top-level paging structures (SHW_POOL_ROOT_IDX).
AssertMsg(iUser != PGMPOOL_IDX_PD || iUser != PGMPOOL_IDX_PDPT || iUser != PGMPOOL_IDX_NESTED_ROOT || iUser != PGMPOOL_IDX_AMD64_CR3 ||
paUsers[i].iUser != iUser || paUsers[i].iUserTable != iUserTable, ("%x %x vs new %x %x\n", paUsers[i].iUser, paUsers[i].iUserTable, iUser, iUserTable));
} while (i != NIL_PGMPOOL_USER_INDEX);
if (i == NIL_PGMPOOL_USER_INDEX)
return rc;
# ifdef PGMPOOL_WITH_OPTIMIZED_DIRTY_PT
return VINF_SUCCESS;
static void pgmPoolTrackFreeUser(PPGMPOOL pPool, PPGMPOOLPAGE pPage, uint16_t iUser, uint32_t iUserTable)
if ( i != NIL_PGMPOOL_USER_INDEX
while (i != NIL_PGMPOOL_USER_INDEX)
iPrev = i;
switch (enmKind)
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_ROOT_NESTED:
case PGMPOOLKIND_PAE_PD_PHYS:
switch (enmKind)
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_ROOT_NESTED:
case PGMPOOLKIND_PAE_PD_PHYS:
AssertFailed();
static bool pgmPoolTrackFlushGCPhysPTInt(PVM pVM, PCPGMPAGE pPhysPage, bool fFlushPTEs, uint16_t iShw, uint16_t cRefs)
LogFlow(("pgmPoolTrackFlushGCPhysPT: pPhysPage=%RHp iShw=%d cRefs=%d\n", PGM_PAGE_GET_HCPHYS(pPhysPage), iShw, cRefs));
bool bRet = false;
u32AndMask = 0;
u32OrMask = 0;
if (!fFlushPTEs)
bRet = true;
u32OrMask = 0;
bRet = true;
cRefs--;
if (!cRefs)
return bRet;
#ifdef LOG_ENABLED
AssertFatalMsgFailed(("cRefs=%d iFirstPresent=%d cPresent=%d\n", cRefs, pPage->iFirstPresent, pPage->cPresent));
u64OrMask = 0;
u64AndMask = 0;
if (!fFlushPTEs)
bRet = true;
u64OrMask = 0;
bRet = true;
cRefs--;
if (!cRefs)
return bRet;
#ifdef LOG_ENABLED
AssertFatalMsgFailed(("cRefs=%d iFirstPresent=%d cPresent=%d u64=%RX64\n", cRefs, pPage->iFirstPresent, pPage->cPresent, u64));
pPT->a[i].u = 0;
cRefs--;
if (!cRefs)
return bRet;
#ifdef LOG_ENABLED
AssertFatalMsgFailed(("cRefs=%d iFirstPresent=%d cPresent=%d\n", cRefs, pPage->iFirstPresent, pPage->cPresent));
return bRet;
static void pgmPoolTrackFlushGCPhysPT(PVM pVM, PPGMPAGE pPhysPage, bool fFlushPTEs, uint16_t iShw, uint16_t cRefs)
Log2(("pgmPoolTrackFlushGCPhysPT: pPhysPage=%RHp iShw=%d cRefs=%d\n", PGM_PAGE_GET_HCPHYS(pPhysPage), iShw, cRefs));
if (!fKeptPTEs)
static void pgmPoolTrackFlushGCPhysPTs(PVM pVM, PPGMPAGE pPhysPage, bool fFlushPTEs, uint16_t iPhysExt)
bool fKeepList = false;
Log2(("pgmPoolTrackFlushGCPhysPTs: pPhysPage=%RHp iPhysExt\n", PGM_PAGE_GET_HCPHYS(pPhysPage), iPhysExt));
if (!fKeptPTEs)
fKeepList = true;
if (!fKeepList)
if (u16)
*pfFlushTLBs = true;
return rc;
return VINF_PGM_GCPHYS_ALIASED;
pPT->a[i].u = 0;
if (!--cPresent)
pPT->a[i].u = 0;
if (!--cPresent)
if (!--cLeft)
return VINF_SUCCESS;
LogFlow(("pgmPoolTrackClearPageUser: clear %x in %s (%RGp) (flushing %s)\n", iUserTable, pgmPoolPoolKindToStr(pUserPage->enmKind), pUserPage->Core.Key, pgmPoolPoolKindToStr(pPage->enmKind)));
#ifdef VBOX_STRICT
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_PAE_PD_PHYS:
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_ROOT_NESTED:
case PGMPOOLKIND_32BIT_PD:
#if defined(IN_RC)
/* In 32 bits PAE mode we *must* invalidate the TLB when changing a PDPT entry; the CPU fetches them only during cr3 load, so any
ASMReloadCR3();
case PGMPOOLKIND_PAE_PD_PHYS:
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_ROOT_NESTED:
AssertFatalMsgFailed(("enmKind=%d iUser=%#x iUserTable=%#x\n", pUserPage->enmKind, pUser->iUser, pUser->iUserTable));
while (i != NIL_PGMPOOL_USER_INDEX)
i = iNext;
return NULL;
return pPhysExt;
if (!--cMax)
if (!pNew)
LogFlow(("pgmPoolTrackPhysExtInsert: added new extent %d:{%d}->%d\n", iPhysExt, iShwPT, iPhysExtStart));
if (pPhysExt)
LogFlow(("pgmPoolTrackPhysExtAddref: new extent: %d:{%d, %d}\n", iPhysExt, PGMPOOL_TD_GET_IDX(u16), iShwPT));
return u16;
AssertFatalMsg(cRefs == PGMPOOL_TD_CREFS_PHYSEXT, ("cRefs=%d pPhysPage=%R[pgmpage] pPage=%p:{.idx=%d}\n", cRefs, pPhysPage, pPage, pPage->idx));
Log2(("pgmPoolTrackPhysExtDerefGCPhys: pPhysPage=%R[pgmpage] idx=%d lonely\n", pPhysPage, pPage->idx));
Log2(("pgmPoolTrackPhysExtDerefGCPhys: pPhysPage=%R[pgmpage] idx=%d head\n", pPhysPage, pPage->idx));
AssertFatalMsgFailed(("not-found! cRefs=%d pPhysPage=%R[pgmpage] pPage=%p:{.idx=%d}\n", cRefs, pPhysPage, pPage, pPage->idx));
static void pgmPoolTracDerefGCPhys(PPGMPOOL pPool, PPGMPOOLPAGE pPage, RTHCPHYS HCPhys, RTGCPHYS GCPhys)
while (pRam)
#ifdef LOG_ENABLED
void pgmPoolTracDerefGCPhysHint(PPGMPOOL pPool, PPGMPOOLPAGE pPage, RTHCPHYS HCPhys, RTGCPHYS GCPhysHint)
while (pRam)
while (pRam)
while (iPage-- > 0)
DECLINLINE(void) pgmPoolTrackDerefPT32Bit32Bit(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PX86PT pShwPT, PCX86PT pGstPT)
pgmPoolTracDerefGCPhysHint(pPool, pPage, pShwPT->a[i].u & X86_PTE_PG_MASK, pGstPT->a[i].u & X86_PTE_PG_MASK);
DECLINLINE(void) pgmPoolTrackDerefPTPae32Bit(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PX86PTPAE pShwPT, PCX86PT pGstPT)
pgmPoolTracDerefGCPhysHint(pPool, pPage, pShwPT->a[i].u & X86_PTE_PAE_PG_MASK, pGstPT->a[i].u & X86_PTE_PG_MASK);
DECLINLINE(void) pgmPoolTrackDerefPTPaePae(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PX86PTPAE pShwPT, PCX86PTPAE pGstPT)
pgmPoolTracDerefGCPhysHint(pPool, pPage, pShwPT->a[i].u & X86_PTE_PAE_PG_MASK, pGstPT->a[i].u & X86_PTE_PAE_PG_MASK);
PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPD->a[i].u & X86_PDE_PG_MASK);
if (pSubPage)
PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPD->a[i].u & X86_PDE_PAE_PG_MASK);
if (pSubPage)
for (unsigned i = 0; i < X86_PG_PAE_PDPE_ENTRIES; i++)
PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPDPT->a[i].u & X86_PDPE_PG_MASK);
if (pSubPage)
PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPDPT->a[i].u & X86_PDPE_PG_MASK);
if (pSubPage)
PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPML4->a[i].u & X86_PDPE_PG_MASK);
if (pSubPage)
PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPD->a[i].u & EPT_PDE_PG_MASK);
if (pSubPage)
PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPDPT->a[i].u & EPT_PDPTE_PG_MASK);
if (pSubPage)
void *pvGst;
void *pvGst;
void *pvGst;
case PGMPOOLKIND_PAE_PD_PHYS:
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_64BIT_PML4:
bool fFlushRequired = false;
Log(("pgmPoolFlushPage: special root page, rejected. enmKind=%s idx=%d\n", pgmPoolPoolKindToStr(pPage->enmKind), pPage->idx));
return VINF_SUCCESS;
("Can't free the shadow CR3! (%RHp vs %RHp kind=%d\n", PGMGetHyperCR3(VMMGetCpu(pVM)), pPage->Core.Key, pPage->enmKind));
Log(("pgmPoolFlushPage: current active shadow CR3, rejected. enmKind=%s idx=%d\n", pgmPoolPoolKindToStr(pPage->enmKind), pPage->idx));
return VINF_SUCCESS;
fFlushRequired = true;
if ( fFlushRequired
&& fFlush)
return rc;
#if defined(IN_RC)
/* Hack alert: we can't deal with jumps to ring 3 when called from MapCR3 and allocating pages for PAE PDs. */
#ifdef IN_RING3
return rc;
return VINF_SUCCESS;
int pgmPoolAllocEx(PVM pVM, RTGCPHYS GCPhys, PGMPOOLKIND enmKind, PGMPOOLACCESS enmAccess, uint16_t iUser, uint32_t iUserTable, PPPGMPOOLPAGE ppPage, bool fLockPage)
LogFlow(("pgmPoolAlloc: GCPhys=%RGp enmKind=%s iUser=%#x iUserTable=%#x\n", GCPhys, pgmPoolPoolKindToStr(enmKind), iUser, iUserTable));
/** @todo CSAM/PGMPrefetchPage messes up here during CSAMR3CheckGates
* Assert(!(pVM->pgm.s.fGlobalSyncFlags & PGM_SYNC_CLEAR_PGM_POOL)); */
if (fLockPage)
LogFlow(("pgmPoolAlloc: cached returns %Rrc *ppPage=%p:{.Key=%RHp, .idx=%d}\n", rc2, *ppPage, (*ppPage)->Core.Key, (*ppPage)->idx));
return rc2;
return rc;
pPool->cUsedPages++; /* physical handler registration / pgmPoolTrackFlushGCPhysPTsSlow requirement. */
return rc3;
#ifdef VBOX_WITH_STATISTICS
if (fLockPage)
LogFlow(("pgmPoolAlloc: returns %Rrc *ppPage=%p:{.Key=%RHp, .idx=%d, .fCached=%RTbool, .fMonitored=%RTbool}\n",
return rc;
PPGMPOOLPAGE pPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, HCPhys & X86_PTE_PAE_PG_MASK);
AssertFatalMsg(pPage && pPage->enmKind != PGMPOOLKIND_FREE, ("HCPhys=%RHp pPage=%p idx=%d\n", HCPhys, pPage, (pPage) ? pPage->idx : 0));
return pPage;
#ifdef IN_RING3 /* currently only used in ring 3; save some space in the R0 & GC modules (left it here as we might need it elsewhere later on) */
if (i == NIL_PGMPOOL_IDX)
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_ROOT_NESTED:
case PGMPOOLKIND_PAE_PD_PHYS:
} while (i != NIL_PGMPOOL_IDX);
#ifdef IN_RING3
for (unsigned i = 0; i < cMaxUsers; i++)
pRam;
while (iPage-- > 0)
for (unsigned i = 0; i < cMaxPhysExts; i++)
#ifdef LOG_ENABLED
switch(enmKind)
case PGMPOOLKIND_INVALID:
case PGMPOOLKIND_FREE:
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PD_PHYS:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_ROOT_NESTED: