PGMAllPool.cpp revision ef4275be1971a6d17d45121d075a4f41659fa6c9
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * PGM Shadow Page Pool.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * Copyright (C) 2006-2007 Sun Microsystems, Inc.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * This file is part of VirtualBox Open Source Edition (OSE), as
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * available from http://www.virtualbox.org. This file is free software;
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * you can redistribute it and/or modify it under the terms of the GNU
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * General Public License (GPL) as published by the Free Software
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * Foundation, in version 2 as it comes in the "COPYING" file of the
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * Clara, CA 95054 USA or visit http://www.sun.com if you need
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * additional information or have any questions.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync/*******************************************************************************
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync* Header Files *
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync*******************************************************************************/
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync/*******************************************************************************
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync* Internal Functions *
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync*******************************************************************************/
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsyncDECLINLINE(unsigned) pgmPoolTrackGetShadowEntrySize(PGMPOOLKIND enmKind);
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsyncDECLINLINE(unsigned) pgmPoolTrackGetGuestEntrySize(PGMPOOLKIND enmKind);
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsyncstatic void pgmPoolTrackDeref(PPGMPOOL pPool, PPGMPOOLPAGE pPage);
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsyncstatic void pgmPoolTracDerefGCPhysHint(PPGMPOOL pPool, PPGMPOOLPAGE pPage, RTHCPHYS HCPhys, RTGCPHYS GCPhysHint);
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsyncstatic int pgmPoolTrackAddUser(PPGMPOOL pPool, PPGMPOOLPAGE pPage, uint16_t iUser, uint32_t iUserTable);
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsyncstatic void pgmPoolMonitorModifiedRemove(PPGMPOOL pPool, PPGMPOOLPAGE pPage);
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsyncDECLEXPORT(int) pgmPoolAccessHandler(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, RTGCPHYS GCPhysFault, void *pvUser);
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsyncstatic const char *pgmPoolPoolKindToStr(uint8_t enmKind);
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * Checks if the specified page pool kind is for a 4MB or 2MB guest page.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @returns true if it's the shadow of a 4MB or 2MB guest page, otherwise false.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @param enmKind The page kind.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsyncDECLINLINE(bool) pgmPoolIsBigPage(PGMPOOLKIND enmKind)
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync return true;
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync return false;
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync/** @def PGMPOOL_PAGE_2_LOCKED_PTR
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * Maps a pool page pool into the current context and lock it (RC only).
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @returns VBox status code.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @param pVM The VM handle.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @param pPage The pool page.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @remark In RC this uses PGMGCDynMapHCPage(), so it will consume of the
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * small page window employeed by that function. Be careful.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @remark There is no need to assert on the result.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsyncDECLINLINE(void *) PGMPOOL_PAGE_2_LOCKED_PTR(PVM pVM, PPGMPOOLPAGE pPage)
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync void *pv = pgmPoolMapPageInlined(&pVM->pgm.s, pPage);
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync /* Make sure the dynamic mapping will not be reused. */
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync# define PGMPOOL_PAGE_2_LOCKED_PTR(pVM, pPage) PGMPOOL_PAGE_2_PTR(pVM, pPage)
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync/** @def PGMPOOL_UNLOCK_PTR
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * Unlock a previously locked dynamic caching (RC only).
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @returns VBox status code.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @param pVM The VM handle.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @param pPage The pool page.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @remark In RC this uses PGMGCDynMapHCPage(), so it will consume of the
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * small page window employeed by that function. Be careful.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @remark There is no need to assert on the result.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsyncDECLINLINE(void) PGMPOOL_UNLOCK_PTR(PVM pVM, void *pvPage)
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync# define PGMPOOL_UNLOCK_PTR(pVM, pPage) do {} while (0)
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * Determin the size of a write instruction.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @returns number of bytes written.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @param pDis The disassembler state.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsyncstatic unsigned pgmPoolDisasWriteSize(PDISCPUSTATE pDis)
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * This is very crude and possibly wrong for some opcodes,
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * but since it's not really supposed to be called we can
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * probably live with that.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * Flushes a chain of pages sharing the same access monitor.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @returns VBox status code suitable for scheduling.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @param pPool The pool.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @param pPage A page in the chain.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsyncint pgmPoolMonitorChainFlush(PPGMPOOL pPool, PPGMPOOLPAGE pPage)
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync LogFlow(("pgmPoolMonitorChainFlush: Flush page %RGp type=%d\n", pPage->GCPhys, pPage->enmKind));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * Find the list head.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * Iterate the list flushing each shadow page.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync if (rc2 == VERR_PGM_POOL_CLEARED && rc == VINF_SUCCESS)
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * Wrapper for getting the current context pointer to the entry being modified.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @returns VBox status code suitable for scheduling.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @param pVM VM Handle.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @param pvDst Destination address
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @param pvSrc Source guest virtual address.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @param GCPhysSrc The source guest physical address.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @param cb Size of data to read
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsyncDECLINLINE(int) pgmPoolPhysSimpleReadGCPhys(PVM pVM, void *pvDst, CTXTYPE(RTGCPTR, RTHCPTR, RTGCPTR) pvSrc, RTGCPHYS GCPhysSrc, size_t cb)
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync memcpy(pvDst, (RTHCPTR)((uintptr_t)pvSrc & ~(RTHCUINTPTR)(cb - 1)), cb);
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync /* @todo in RC we could attempt to use the virtual address, although this can cause many faults (PAE Windows XP guest). */
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync return PGMPhysSimpleReadGCPhys(pVM, pvDst, GCPhysSrc & ~(RTGCPHYS)(cb - 1), cb);
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * Process shadow entries before they are changed by the guest.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * For PT entries we will clear them. For PD entries, we'll simply check
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * for mapping conflicts and set the SyncCR3 FF if found.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @param pPool The pool.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @param pPage The head page.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @param GCPhysFault The guest physical fault address.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @param uAddress In R0 and GC this is the guest context fault address (flat).
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * In R3 this is the host context 'fault' address.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @param pCpu The disassembler state for figuring out the write size.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * This need not be specified if the caller knows we won't do cross entry accesses.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsyncvoid pgmPoolMonitorChainChanging(PPGMPOOL pPool, PPGMPOOLPAGE pPage, RTGCPHYS GCPhysFault, CTXTYPE(RTGCPTR, RTHCPTR, RTGCPTR) pvAddress, PDISCPUSTATE pCpu)
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync const unsigned off = GCPhysFault & PAGE_OFFSET_MASK;
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync const unsigned cbWrite = (pCpu) ? pgmPoolDisasWriteSize(pCpu) : 0;
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync LogFlow(("pgmPoolMonitorChainChanging: %RGv phys=%RGp kind=%s cbWrite=%d\n", (RTGCPTR)pvAddress, GCPhysFault, pgmPoolPoolKindToStr(pPage->enmKind), cbWrite));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync LogFlow(("PGMPOOLKIND_32BIT_PT_FOR_32BIT_PT iShw=%x\n", iShw));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync int rc = pgmPoolPhysSimpleReadGCPhys(pVM, &GstPte, pvAddress, GCPhysFault, sizeof(GstPte));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync Log4(("pgmPoolMonitorChainChanging 32_32: deref %016RX64 GCPhys %08RX32\n", uShw.pPT->a[iShw].u & X86_PTE_PAE_PG_MASK, GstPte.u & X86_PTE_PG_MASK));
4d4f336b656d46f8d301603114bb99ce635aafc0vboxsync /* page/2 sized */
4d4f336b656d46f8d301603114bb99ce635aafc0vboxsync const unsigned iShw = (off / sizeof(X86PTE)) & (X86_PG_PAE_ENTRIES - 1);
4d4f336b656d46f8d301603114bb99ce635aafc0vboxsync LogFlow(("PGMPOOLKIND_PAE_PT_FOR_32BIT_PT iShw=%x\n", iShw));
4d4f336b656d46f8d301603114bb99ce635aafc0vboxsync int rc = pgmPoolPhysSimpleReadGCPhys(pVM, &GstPte, pvAddress, GCPhysFault, sizeof(GstPte));
4d4f336b656d46f8d301603114bb99ce635aafc0vboxsync Log4(("pgmPoolMonitorChainChanging pae_32: deref %016RX64 GCPhys %08RX32\n", uShw.pPT->a[iShw].u & X86_PTE_PAE_PG_MASK, GstPte.u & X86_PTE_PG_MASK));
4d4f336b656d46f8d301603114bb99ce635aafc0vboxsync LogFlow(("pgmPoolMonitorChainChanging PAE for 32 bits: iGst=%x iShw=%x idx = %d page idx=%d\n", iGst, iShw, iShwPdpt, pPage->enmKind - PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD));
4d4f336b656d46f8d301603114bb99ce635aafc0vboxsync if (iShwPdpt == pPage->enmKind - (unsigned)PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD)
4d4f336b656d46f8d301603114bb99ce635aafc0vboxsync for (unsigned i = 0; i < 2; i++)
4d4f336b656d46f8d301603114bb99ce635aafc0vboxsync if ((uShw.pPDPae->a[iShw + i].u & (PGM_PDFLAGS_MAPPING | X86_PDE_P)) == (PGM_PDFLAGS_MAPPING | X86_PDE_P))
4d4f336b656d46f8d301603114bb99ce635aafc0vboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShwPdpt=%#x iShw=%#x!\n", iShwPdpt, iShw+i));
4d4f336b656d46f8d301603114bb99ce635aafc0vboxsync# endif /* !IN_RING0 */
4d4f336b656d46f8d301603114bb99ce635aafc0vboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw=%#x: %RX64 -> freeing it!\n", iShw+i, uShw.pPDPae->a[iShw+i].u));
530c5ad6ea29dc5dc7a512482d3257faafdb2812vboxsync /* paranoia / a bit assumptive. */
4d4f336b656d46f8d301603114bb99ce635aafc0vboxsync if ((uShw.pPDPae->a[iShw2].u & (PGM_PDFLAGS_MAPPING | X86_PDE_P)) == (PGM_PDFLAGS_MAPPING | X86_PDE_P))
4d4f336b656d46f8d301603114bb99ce635aafc0vboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShwPdpt=%#x iShw2=%#x!\n", iShwPdpt, iShw2));
4d4f336b656d46f8d301603114bb99ce635aafc0vboxsync# endif /* !IN_RING0 */
4d4f336b656d46f8d301603114bb99ce635aafc0vboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPDPae->a[iShw2].u));
4d4f336b656d46f8d301603114bb99ce635aafc0vboxsync int rc = pgmPoolPhysSimpleReadGCPhys(pVM, &GstPte, pvAddress, GCPhysFault, sizeof(GstPte));
4d4f336b656d46f8d301603114bb99ce635aafc0vboxsync Log4(("pgmPoolMonitorChainChanging pae: deref %016RX64 GCPhys %016RX64\n", uShw.pPTPae->a[iShw].u & X86_PTE_PAE_PG_MASK, GstPte.u & X86_PTE_PAE_PG_MASK));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync /* paranoia / a bit assumptive. */
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PTEPAE);
530c5ad6ea29dc5dc7a512482d3257faafdb2812vboxsync int rc = pgmPoolPhysSimpleReadGCPhys(pVM, &GstPte, (RTHCPTR)((RTHCUINTPTR)pvAddress + sizeof(GstPte)), GCPhysFault + sizeof(GstPte), sizeof(GstPte));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync int rc = pgmPoolPhysSimpleReadGCPhys(pVM, &GstPte, pvAddress + sizeof(GstPte), GCPhysFault + sizeof(GstPte), sizeof(GstPte));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync Log4(("pgmPoolMonitorChainChanging pae: deref %016RX64 GCPhys %016RX64\n", uShw.pPTPae->a[iShw2].u & X86_PTE_PAE_PG_MASK, GstPte.u & X86_PTE_PAE_PG_MASK));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync const unsigned iShw = off / sizeof(X86PTE); // ASSUMING 32-bit guest paging!
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync LogFlow(("pgmPoolMonitorChainChanging: PGMPOOLKIND_32BIT_PD %x\n", iShw));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync STAM_COUNTER_INC(&(pVM->pgm.s.StatRZGuestCR3WriteConflict));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShw=%#x!\n", iShw));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync# endif /* !IN_RING0 */
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync# endif /* !IN_RING0 */
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync LogFlow(("pgmPoolMonitorChainChanging: 32 bit pd iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPD->a[iShw].u));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync /* paranoia / a bit assumptive. */
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PTE);
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync STAM_COUNTER_INC(&(pVM->pgm.s.StatRZGuestCR3WriteConflict));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShw2=%#x!\n", iShw2));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync# endif /* !IN_RING0 */
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync# endif /* !IN_RING0 */
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync LogFlow(("pgmPoolMonitorChainChanging: 32 bit pd iShw=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPD->a[iShw2].u));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync#if 0 /* useful when running PGMAssertCR3(), a bit too troublesome for general use (TLBs). */
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync LogFlow(("pgmPoolMonitorChainChanging: iShw=%#x: %RX32 -> freeing it!\n", iShw, uShw.pPD->a[iShw].u));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync# ifdef IN_RC /* TLB load - we're pushing things a bit... */
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync pgmPoolFree(pVM, uShw.pPD->a[iShw].u & X86_PDE_PG_MASK, pPage->idx, iShw);
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync STAM_COUNTER_INC(&(pVM->pgm.s.StatRZGuestCR3WriteConflict));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShw=%#x!\n", iShw));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync#endif /* !IN_RING0 */
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * Causes trouble when the guest uses a PDE to refer to the whole page table level
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * structure. (Invalidate here; faults later on when it tries to change the page
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * table entries -> recheck; probably only applies to the RC case.)
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync# endif /* !IN_RING0 */
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPDPae->a[iShw].u));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync /* paranoia / a bit assumptive. */
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PDEPAE);
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync STAM_COUNTER_INC(&(pVM->pgm.s.StatRZGuestCR3WriteConflict));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShw2=%#x!\n", iShw2));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync#endif /* !IN_RING0 */
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync# endif /* !IN_RING0 */
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw2=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPDPae->a[iShw2].u));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * Hopefully this doesn't happen very often:
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * - touching unused parts of the page
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * - messing with the bits of pd pointers without changing the physical address
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync /* PDPT roots are not page aligned; 32 byte only! */
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync const unsigned offPdpt = GCPhysFault - pPage->GCPhys;
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync if (iShw < X86_PG_PAE_PDPE_ENTRIES) /* don't use RT_ELEMENTS(uShw.pPDPT->a), because that's for long mode only */
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync STAM_COUNTER_INC(&(pVM->pgm.s.StatRZGuestCR3WriteConflict));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected pdpt conflict at iShw=%#x!\n", iShw));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync# endif /* !IN_RING0 */
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync# endif /* !IN_RING0 */
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pdpt iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPDPT->a[iShw].u));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync /* paranoia / a bit assumptive. */
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync const unsigned iShw2 = (offPdpt + cbWrite - 1) / sizeof(X86PDPE);
61ec6a59a936b2f248a67be4c4f8f9325f85b702vboxsync STAM_COUNTER_INC(&(pVM->pgm.s.StatRZGuestCR3WriteConflict));
61ec6a59a936b2f248a67be4c4f8f9325f85b702vboxsync LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShw2=%#x!\n", iShw2));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync# endif /* !IN_RING0 */
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync# endif /* !IN_RING0 */
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pdpt iShw=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPDPT->a[iShw2].u));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync Assert(!(uShw.pPDPae->a[iShw].u & PGM_PDFLAGS_MAPPING));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPDPae->a[iShw].u));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync /* paranoia / a bit assumptive. */
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PDEPAE);
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync Assert(!(uShw.pPDPae->a[iShw2].u & PGM_PDFLAGS_MAPPING));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw2=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPDPae->a[iShw2].u));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * Hopefully this doesn't happen very often:
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * - messing with the bits of pd pointers without changing the physical address
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync LogFlow(("pgmPoolMonitorChainChanging: pdpt iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPDPT->a[iShw].u));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync pgmPoolFree(pVM, uShw.pPDPT->a[iShw].u & X86_PDPE_PG_MASK, pPage->idx, iShw);
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync /* paranoia / a bit assumptive. */
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PDPE);
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync LogFlow(("pgmPoolMonitorChainChanging: pdpt iShw2=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPDPT->a[iShw2].u));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync pgmPoolFree(pVM, uShw.pPDPT->a[iShw2].u & X86_PDPE_PG_MASK, pPage->idx, iShw2);
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * Hopefully this doesn't happen very often:
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * - messing with the bits of pd pointers without changing the physical address
4d4f336b656d46f8d301603114bb99ce635aafc0vboxsync LogFlow(("pgmPoolMonitorChainChanging: pml4 iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPML4->a[iShw].u));
4d4f336b656d46f8d301603114bb99ce635aafc0vboxsync pgmPoolFree(pVM, uShw.pPML4->a[iShw].u & X86_PML4E_PG_MASK, pPage->idx, iShw);
4d4f336b656d46f8d301603114bb99ce635aafc0vboxsync /* paranoia / a bit assumptive. */
4d4f336b656d46f8d301603114bb99ce635aafc0vboxsync const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PML4E);
4d4f336b656d46f8d301603114bb99ce635aafc0vboxsync LogFlow(("pgmPoolMonitorChainChanging: pml4 iShw2=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPML4->a[iShw2].u));
4d4f336b656d46f8d301603114bb99ce635aafc0vboxsync pgmPoolFree(pVM, uShw.pPML4->a[iShw2].u & X86_PML4E_PG_MASK, pPage->idx, iShw2);
4d4f336b656d46f8d301603114bb99ce635aafc0vboxsync#endif /* IN_RING0 */
4d4f336b656d46f8d301603114bb99ce635aafc0vboxsync AssertFatalMsgFailed(("enmKind=%d\n", pPage->enmKind));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * Checks if a access could be a fork operation in progress.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * Meaning, that the guest is setuping up the parent process for Copy-On-Write.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @returns true if it's likly that we're forking, otherwise false.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @param pPool The pool.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @param pCpu The disassembled instruction.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * @param offFault The access offset.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsyncDECLINLINE(bool) pgmPoolMonitorIsForking(PPGMPOOL pPool, PDISCPUSTATE pCpu, unsigned offFault)
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * i386 linux is using btr to clear X86_PTE_RW.
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * The functions involved are (2.6.16 source inspection):
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * clear_bit
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * ptep_set_wrprotect
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * copy_one_pte
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * copy_pte_range
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * copy_pmd_range
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * copy_pud_range
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * copy_page_range
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * copy_process
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync /** @todo Validate that the bit index is X86_PTE_RW. */
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,Fork));
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync return true;
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync return false;
0b74a2f80aba476dc8be8bc1c63891fc53945986vboxsync * Determine whether the page is likely to have been reused.
DECLINLINE(bool) pgmPoolMonitorIsReused(PVM pVM, PPGMPOOLPAGE pPage, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, RTGCPTR pvFault)
#ifndef IN_RC
Log(("pgmPoolMonitorIsReused: reused %RGv for interrupt stack (rsp=%RGv).\n", pvFault, pRegFrame->rsp));
case OP_CALL:
case OP_PUSH:
case OP_PUSHF:
case OP_PUSHA:
case OP_FXSAVE:
case OP_MOVSWD:
case OP_STOSWD:
static int pgmPoolAccessHandlerFlush(PVM pVM, PPGMPOOL pPool, PPGMPOOLPAGE pPage, PDISCPUSTATE pCpu,
#ifdef IN_RC
LogFlow(("pgmPoolAccessHandlerPTWorker: Interpretation failed for patch code %04x:%RGv, ignoring.\n",
return rc;
DECLINLINE(int) pgmPoolAccessHandlerSTOSD(PVM pVM, PPGMPOOL pPool, PPGMPOOLPAGE pPage, PDISCPUSTATE pCpu,
#ifdef IN_RC
#ifdef IN_RC
return VINF_SUCCESS;
DECLINLINE(int) pgmPoolAccessHandlerSimple(PVM pVM, PPGMPOOL pPool, PPGMPOOLPAGE pPage, PDISCPUSTATE pCpu,
#ifdef IN_RC
return rc;
DECLEXPORT(int) pgmPoolAccessHandler(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, RTGCPHYS GCPhysFault, void *pvUser)
LogFlow(("pgmPoolAccessHandler: pvFault=%RGv pPage=%p:{.idx=%d} GCPhysFault=%RGp\n", pvFault, pPage, pPage->idx, GCPhysFault));
bool fReused = false;
if ( ( pPage->cModifications < 48 /** @todo #define */ /** @todo need to check that it's not mapping EIP. */ /** @todo adjust this! */
STAM_PROFILE_STOP_EX(&pVM->pgm.s.CTX_SUFF(pPool)->CTX_SUFF_Z(StatMonitor), &pPool->CTX_MID_Z(StatMonitor,Handled), a);
return rc;
STAM_PROFILE_STOP_EX(&pVM->pgm.s.CTX_SUFF(pPool)->CTX_SUFF_Z(StatMonitor), &pPool->CTX_MID_Z(StatMonitor,RepStosd), a);
return rc;
pRegFrame->eax, pRegFrame->ecx, pRegFrame->edi, pRegFrame->esi, (RTGCPTR)pRegFrame->rip, Cpu.pCurInstr->opcode, Cpu.prefix));
STAM_PROFILE_STOP_EX(&pVM->pgm.s.CTX_SUFF(pPool)->CTX_SUFF_Z(StatMonitor), &pPool->CTX_MID_Z(StatMonitor,FlushPage), a);
return rc;
#ifdef PGMPOOL_WITH_CACHE
if (i == NIL_PGMPOOL_IDX)
iPrev = i;
* @retval VERR_PGM_POOL_CLEARED if the deregistration of a physical handler will cause a light weight pool flush.
#ifndef IN_RC
return rc;
switch (enmKind1)
case PGMPOOLKIND_PAE_PD_PHYS:
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PDPT:
switch (enmKind2)
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_64BIT_PML4:
switch (enmKind2)
case PGMPOOLKIND_ROOT_NESTED:
static int pgmPoolCacheAlloc(PPGMPOOL pPool, RTGCPHYS GCPhys, PGMPOOLKIND enmKind, uint16_t iUser, uint32_t iUserTable, PPPGMPOOLPAGE ppPage)
#ifndef IN_RC
Log3(("pgmPoolCacheAlloc: %RGp kind %s iUser=%x iUserTable=%x SLOT=%d\n", GCPhys, pgmPoolPoolKindToStr(enmKind), iUser, iUserTable, i));
if (i != NIL_PGMPOOL_IDX)
return VINF_PGM_CACHED_PAGE;
return rc;
pgmPoolFlushPage(pPool, pPage); /* ASSUMES that VERR_PGM_POOL_CLEARED will be returned by pgmPoolTracInsert. */
} while (i != NIL_PGMPOOL_IDX);
Log3(("pgmPoolCacheAlloc: Missed GCPhys=%RGp enmKind=%s\n", GCPhys, pgmPoolPoolKindToStr(enmKind)));
return VERR_FILE_NOT_FOUND;
if (fCanBeCached)
#ifdef PGMPOOL_WITH_MONITORING
#ifdef PGMPOOL_WITH_CACHE
if (i == NIL_PGMPOOL_IDX)
return NULL;
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PDPT:
return pPage;
case PGMPOOLKIND_ROOT_NESTED:
case PGMPOOLKIND_PAE_PD_PHYS:
} while (i != NIL_PGMPOOL_IDX);
return NULL;
* @retval VERR_PGM_POOL_CLEARED if the registration of the physical handler will cause a light weight pool flush.
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_ROOT_NESTED:
return VINF_SUCCESS;
case PGMPOOLKIND_PAE_PD_PHYS:
return VINF_SUCCESS;
#ifdef PGMPOOL_WITH_MIXED_PT_CR3
int rc;
if (pPageHead)
return rc;
* @retval VERR_PGM_POOL_CLEARED if the deregistration of the physical handler will cause a light weight pool flush.
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_ROOT_NESTED:
case PGMPOOLKIND_PAE_PD_PHYS:
return VINF_SUCCESS;
#ifdef PGMPOOL_WITH_MIXED_PT_CR3
int rc;
return rc;
#ifdef VBOX_WITH_STATISTICS
Log3(("pgmPoolMonitorModifiedRemove: idx=%d cModifications=%d\n", pPage->idx, pPage->cModifications));
#ifdef IN_RING3
#ifdef PGMPOOL_WITH_USER_TRACKING
#ifdef PGMPOOL_WITH_USER_TRACKING
if (!--cLeft)
#ifndef DEBUG_michael
AssertMsg(cModifiedPages == pPool->cModifiedPages, ("%d != %d\n", cModifiedPages, pPool->cModifiedPages));
#ifdef PGMPOOL_WITH_GCPHYS_TRACKING
pRam;
while (iPage-- > 0)
for (unsigned i = 0; i < cMaxPhysExts; i++)
return VINF_PGM_SYNC_CR3;
return VINF_SUCCESS;
#ifdef PGMPOOL_WITH_USER_TRACKING
#ifdef PGMPOOL_WITH_CACHE
return rc;
return VERR_PGM_POOL_FLUSHED;
* @retval VERR_PGM_POOL_CLEARED if the deregistration of the physical handler will cause a light weight pool flush.
DECLINLINE(int) pgmPoolTrackInsert(PPGMPOOL pPool, PPGMPOOLPAGE pPage, RTGCPHYS GCPhys, uint16_t iUser, uint32_t iUserTable)
#ifdef VBOX_STRICT
AssertMsg(paUsers[i].iUser != iUser || paUsers[i].iUserTable != iUserTable, ("%x %x vs new %x %x\n", paUsers[i].iUser, paUsers[i].iUserTable, iUser, iUserTable));
} while (i != NIL_PGMPOOL_USER_INDEX);
if (i == NIL_PGMPOOL_USER_INDEX)
return rc;
# ifdef PGMPOOL_WITH_MIXED_PT_CR3
const bool fCanBeMonitored = true;
|| (GCPhys & X86_PTE_PAE_PG_MASK) != (pPool->CTX_SUFF(pVM)->pgm.s.GCPhysGstCR3Monitored & X86_PTE_PAE_PG_MASK)
# ifdef PGMPOOL_WITH_CACHE
if (fCanBeMonitored)
# ifdef PGMPOOL_WITH_MONITORING
# ifndef PGMPOOL_WITH_CACHE
return rc;
static int pgmPoolTrackAddUser(PPGMPOOL pPool, PPGMPOOLPAGE pPage, uint16_t iUser, uint32_t iUserTable)
Log3(("pgmPoolTrackAddUser GCPhys = %RGp iUser %x iUserTable %x\n", pPage->GCPhys, iUser, iUserTable));
# ifdef VBOX_STRICT
AssertMsg(paUsers[i].iUser != iUser || paUsers[i].iUserTable != iUserTable, ("%x %x vs new %x %x\n", paUsers[i].iUser, paUsers[i].iUserTable, iUser, iUserTable));
} while (i != NIL_PGMPOOL_USER_INDEX);
if (i == NIL_PGMPOOL_USER_INDEX)
return rc;
# ifdef PGMPOOL_WITH_CACHE
return VINF_SUCCESS;
static void pgmPoolTrackFreeUser(PPGMPOOL pPool, PPGMPOOLPAGE pPage, uint16_t iUser, uint32_t iUserTable)
if ( i != NIL_PGMPOOL_USER_INDEX
while (i != NIL_PGMPOOL_USER_INDEX)
iPrev = i;
switch (enmKind)
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_ROOT_NESTED:
case PGMPOOLKIND_PAE_PD_PHYS:
switch (enmKind)
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_ROOT_NESTED:
case PGMPOOLKIND_PAE_PD_PHYS:
AssertFailed();
#ifdef PGMPOOL_WITH_GCPHYS_TRACKING
static void pgmPoolTrackFlushGCPhysPTInt(PVM pVM, PCPGMPAGE pPhysPage, uint16_t iShw, uint16_t cRefs)
LogFlow(("pgmPoolTrackFlushGCPhysPT: pPhysPage=%R[pgmpage] iShw=%d cRefs=%d\n", pPhysPage, iShw, cRefs));
pPT->a[i].u = 0;
cRefs--;
if (!cRefs)
#ifdef LOG_ENABLED
RTLogPrintf("cRefs=%d iFirstPresent=%d cPresent=%d\n", cRefs, pPage->iFirstPresent, pPage->cPresent);
pPT->a[i].u = 0;
AssertFatalMsgFailed(("cRefs=%d iFirstPresent=%d cPresent=%d\n", cRefs, pPage->iFirstPresent, pPage->cPresent));
pPT->a[i].u = 0;
cRefs--;
if (!cRefs)
#ifdef LOG_ENABLED
RTLogPrintf("cRefs=%d iFirstPresent=%d cPresent=%d\n", cRefs, pPage->iFirstPresent, pPage->cPresent);
pPT->a[i].u = 0;
AssertFatalMsgFailed(("cRefs=%d iFirstPresent=%d cPresent=%d u64=%RX64\n", cRefs, pPage->iFirstPresent, pPage->cPresent, u64));
pPT->a[i].u = 0;
cRefs--;
if (!cRefs)
#ifdef LOG_ENABLED
RTLogPrintf("cRefs=%d iFirstPresent=%d cPresent=%d\n", cRefs, pPage->iFirstPresent, pPage->cPresent);
pPT->a[i].u = 0;
AssertFatalMsgFailed(("cRefs=%d iFirstPresent=%d cPresent=%d\n", cRefs, pPage->iFirstPresent, pPage->cPresent));
LogFlow(("pgmPoolTrackFlushGCPhysPT: pPhysPage=%R[pgmpage] iShw=%d cRefs=%d\n", pPhysPage, iShw, cRefs));
#ifdef PGMPOOL_WITH_GCPHYS_TRACKING
if (u16)
# ifdef VBOX_WITH_NEW_PHYS_CODE
*pfFlushTLBs = true;
# ifdef VBOX_WITH_NEW_PHYS_CODE
*pfFlushTLBs = true;
return rc;
return VINF_PGM_GCPHYS_ALIASED;
pPT->a[i].u = 0;
if (!--cPresent)
pPT->a[i].u = 0;
if (!--cPresent)
if (!--cLeft)
return VINF_SUCCESS;
LogFlow(("pgmPoolTrackClearPageUser: clear %x in %s (%RGp) (flushing %s)\n", iUserTable, pgmPoolPoolKindToStr(pUserPage->enmKind), pUserPage->Core.Key, pgmPoolPoolKindToStr(pPage->enmKind)));
#ifdef VBOX_STRICT
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_PAE_PD_PHYS:
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_ROOT_NESTED:
case PGMPOOLKIND_32BIT_PD:
#if defined(IN_RC)
/* In 32 bits PAE mode we *must* invalidate the TLB when changing a PDPT entry; the CPU fetches them only during cr3 load, so any
ASMReloadCR3();
case PGMPOOLKIND_PAE_PD_PHYS:
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_ROOT_NESTED:
AssertFatalMsgFailed(("enmKind=%d iUser=%#x iUserTable=%#x\n", pUserPage->enmKind, pUser->iUser, pUser->iUserTable));
while (i != NIL_PGMPOOL_USER_INDEX)
i = iNext;
#ifdef PGMPOOL_WITH_GCPHYS_TRACKING
return NULL;
return pPhysExt;
if (!--cMax)
if (!pNew)
LogFlow(("pgmPoolTrackPhysExtAddref: added new extent %d:{%d}->%d\n", iPhysExt, iShwPT, iPhysExtStart));
if (pPhysExt)
LogFlow(("pgmPoolTrackPhysExtAddref: new extent: %d:{%d, %d}\n", iPhysExt, PGMPOOL_TD_GET_IDX(u16), iShwPT));
return u16;
AssertFatalMsg(cRefs == PGMPOOL_TD_CREFS_PHYSEXT, ("cRefs=%d pPhysPage=%R[pgmpage] pPage=%p:{.idx=%d}\n", cRefs, pPhysPage, pPage, pPage->idx));
Log2(("pgmPoolTrackPhysExtDerefGCPhys: pPhysPage=%R[pgmpage] idx=%d lonely\n", pPhysPage, pPage->idx));
Log2(("pgmPoolTrackPhysExtDerefGCPhys: pPhysPage=%R[pgmpage] idx=%d head\n", pPhysPage, pPage->idx));
AssertFatalMsgFailed(("not-found! cRefs=%d pPhysPage=%R[pgmpage] pPage=%p:{.idx=%d}\n", cRefs, pPhysPage, pPage, pPage->idx));
static void pgmPoolTracDerefGCPhys(PPGMPOOL pPool, PPGMPOOLPAGE pPage, RTHCPHYS HCPhys, RTGCPHYS GCPhys)
while (pRam)
#ifdef LOG_ENABLED
static void pgmPoolTracDerefGCPhysHint(PPGMPOOL pPool, PPGMPOOLPAGE pPage, RTHCPHYS HCPhys, RTGCPHYS GCPhysHint)
while (pRam)
while (pRam)
while (iPage-- > 0)
DECLINLINE(void) pgmPoolTrackDerefPT32Bit32Bit(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PX86PT pShwPT, PCX86PT pGstPT)
pgmPoolTracDerefGCPhysHint(pPool, pPage, pShwPT->a[i].u & X86_PTE_PG_MASK, pGstPT->a[i].u & X86_PTE_PG_MASK);
DECLINLINE(void) pgmPoolTrackDerefPTPae32Bit(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PX86PTPAE pShwPT, PCX86PT pGstPT)
pgmPoolTracDerefGCPhysHint(pPool, pPage, pShwPT->a[i].u & X86_PTE_PAE_PG_MASK, pGstPT->a[i].u & X86_PTE_PG_MASK);
DECLINLINE(void) pgmPoolTrackDerefPTPaePae(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PX86PTPAE pShwPT, PCX86PTPAE pGstPT)
pgmPoolTracDerefGCPhysHint(pPool, pPage, pShwPT->a[i].u & X86_PTE_PAE_PG_MASK, pGstPT->a[i].u & X86_PTE_PAE_PG_MASK);
PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPD->a[i].u & X86_PDE_PG_MASK);
if (pSubPage)
PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPD->a[i].u & X86_PDE_PAE_PG_MASK);
if (pSubPage)
for (unsigned i = 0; i < X86_PG_PAE_PDPE_ENTRIES; i++)
PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPDPT->a[i].u & X86_PDPE_PG_MASK);
if (pSubPage)
PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPDPT->a[i].u & X86_PDPE_PG_MASK);
if (pSubPage)
PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPML4->a[i].u & X86_PDPE_PG_MASK);
if (pSubPage)
PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPD->a[i].u & EPT_PDE_PG_MASK);
if (pSubPage)
PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPDPT->a[i].u & EPT_PDPTE_PG_MASK);
if (pSubPage)
#ifdef PGMPOOL_WITH_GCPHYS_TRACKING
void *pvGst;
void *pvGst;
void *pvGst;
case PGMPOOLKIND_PAE_PD_PHYS:
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_64BIT_PML4:
#ifdef IN_RING3
/* Exit the current shadow paging mode as well; nested paging and EPT use a root CR3 which will get flushed here. */
#ifdef IN_RING3
#ifdef PGMPOOL_WITH_MONITORING
#ifdef PGMPOOL_WITH_USER_TRACKING
#ifdef PGMPOOL_WITH_CACHE
#ifdef PGMPOOL_WITH_USER_TRACKING
for (unsigned i = 0; i < cMaxUsers; i++)
#ifdef PGMPOOL_WITH_GCPHYS_TRACKING
pRam;
while (iPage-- > 0)
for (unsigned i = 0; i < cMaxPhysExts; i++)
#ifdef PGMPOOL_WITH_MONITORING
#ifdef PGMPOOL_WITH_CACHE
#ifdef PGMPOOL_WITH_MONITORING
# ifdef PGMPOOL_WITH_CACHE
#ifdef PGMPOOL_WITH_USER_TRACKING
#ifdef PGMPOOL_WITH_CACHE
/* Reinit the current shadow paging mode as well; nested paging and EPT use a root CR3 which will get flushed here. */
* @retval VERR_PGM_POOL_CLEARED if the deregistration of the physical handler will cause a light weight pool flush.
Log(("pgmPoolFlushPage: special root page, rejected. enmKind=%s idx=%d\n", pgmPoolPoolKindToStr(pPage->enmKind), pPage->idx));
return VINF_SUCCESS;
("Can't free the shadow CR3! (%RHp vs %RHp kind=%d\n", PGMGetHyperCR3(pPool->CTX_SUFF(pVM)), pPage->Core.Key, pPage->enmKind));
Log(("pgmPoolFlushPage: current active shadow CR3, rejected. enmKind=%s idx=%d\n", pgmPoolPoolKindToStr(pPage->enmKind), pPage->idx));
return VINF_SUCCESS;
#ifdef PGMPOOL_WITH_USER_TRACKING
#ifdef PGMPOOL_WITH_CACHE
#ifdef PGMPOOL_WITH_MONITORING
return rc;
#ifdef PGMPOOL_WITH_USER_TRACKING
#ifdef PGMPOOL_WITH_CACHE
#if defined(IN_RC)
/* Hack alert: we can't deal with jumps to ring 3 when called from MapCR3 and allocating pages for PAE PDs. */
#ifdef IN_RING3
return rc;
return VINF_SUCCESS;
#ifdef PGMPOOL_WITH_CACHE
return VERR_PGM_POOL_FLUSHED;
int pgmPoolAlloc(PVM pVM, RTGCPHYS GCPhys, PGMPOOLKIND enmKind, uint16_t iUser, uint32_t iUserTable, PPPGMPOOLPAGE ppPage)
LogFlow(("pgmPoolAlloc: GCPhys=%RGp enmKind=%s iUser=%#x iUserTable=%#x\n", GCPhys, pgmPoolPoolKindToStr(enmKind), iUser, iUserTable));
/** @todo CSAM/PGMPrefetchPage messes up here during CSAMR3CheckGates
* Assert(!(pVM->pgm.s.fSyncFlags & PGM_SYNC_CLEAR_PGM_POOL)); */
#ifdef PGMPOOL_WITH_CACHE
LogFlow(("pgmPoolAlloc: cached returns %Rrc *ppPage=%p:{.Key=%RHp, .idx=%d}\n", rc2, *ppPage, (*ppPage)->Core.Key, (*ppPage)->idx));
return rc2;
return rc;
pPool->cUsedPages++; /* physical handler registration / pgmPoolTrackFlushGCPhysPTsSlow requirement. */
#ifdef PGMPOOL_WITH_MONITORING
#ifdef PGMPOOL_WITH_USER_TRACKING
return rc3;
#ifdef VBOX_WITH_STATISTICS
LogFlow(("pgmPoolAlloc: returns %Rrc *ppPage=%p:{.Key=%RHp, .idx=%d, .fCached=%RTbool, .fMonitored=%RTbool}\n",
return rc;
return pPage;
#ifdef IN_RING3
#ifdef LOG_ENABLED
switch(enmKind)
case PGMPOOLKIND_INVALID:
case PGMPOOLKIND_FREE:
case PGMPOOLKIND_32BIT_PD:
case PGMPOOLKIND_PAE_PD_PHYS:
case PGMPOOLKIND_PAE_PDPT:
case PGMPOOLKIND_64BIT_PML4:
case PGMPOOLKIND_ROOT_NESTED: