PGMPool.cpp@ 33192

Last change on this file since 33192 was 33192, checked in by vboxsync, 14 years ago
Need more space for the hypervisor heap for large memory guests
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 51.0 KB

Line
1	/* $Id: PGMPool.cpp 33192 2010-10-18 11:54:33Z vboxsync $ */
2	/** @file
3	* PGM Shadow Page Pool.
4	*/
5
6	/*
7	* Copyright (C) 2006-2007 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18	/** @page pg_pgm_pool PGM Shadow Page Pool
19	*
20	* Motivations:
21	* -# Relationship between shadow page tables and physical guest pages. This
22	* should allow us to skip most of the global flushes now following access
23	* handler changes. The main expense is flushing shadow pages.
24	* -# Limit the pool size if necessary (default is kind of limitless).
25	* -# Allocate shadow pages from RC. We use to only do this in SyncCR3.
26	* -# Required for 64-bit guests.
27	* -# Combining the PD cache and page pool in order to simplify caching.
28	*
29	*
30	* @section sec_pgm_pool_outline Design Outline
31	*
32	* The shadow page pool tracks pages used for shadowing paging structures (i.e.
33	* page tables, page directory, page directory pointer table and page map
34	* level-4). Each page in the pool has an unique identifier. This identifier is
35	* used to link a guest physical page to a shadow PT. The identifier is a
36	* non-zero value and has a relativly low max value - say 14 bits. This makes it
37	* possible to fit it into the upper bits of the of the aHCPhys entries in the
38	* ram range.
39	*
40	* By restricting host physical memory to the first 48 bits (which is the
41	* announced physical memory range of the K8L chip (scheduled for 2008)), we
42	* can safely use the upper 16 bits for shadow page ID and reference counting.
43	*
44	* Update: The 48 bit assumption will be lifted with the new physical memory
45	* management (PGMPAGE), so we won't have any trouble when someone stuffs 2TB
46	* into a box in some years.
47	*
48	* Now, it's possible for a page to be aliased, i.e. mapped by more than one PT
49	* or PD. This is solved by creating a list of physical cross reference extents
50	* when ever this happens. Each node in the list (extent) is can contain 3 page
51	* pool indexes. The list it self is chained using indexes into the paPhysExt
52	* array.
53	*
54	*
55	* @section sec_pgm_pool_life Life Cycle of a Shadow Page
56	*
57	* -# The SyncPT function requests a page from the pool.
58	* The request includes the kind of page it is (PT/PD, PAE/legacy), the
59	* address of the page it's shadowing, and more.
60	* -# The pool responds to the request by allocating a new page.
61	* When the cache is enabled, it will first check if it's in the cache.
62	* Should the pool be exhausted, one of two things can be done:
63	* -# Flush the whole pool and current CR3.
64	* -# Use the cache to find a page which can be flushed (~age).
65	* -# The SyncPT function will sync one or more pages and insert it into the
66	* shadow PD.
67	* -# The SyncPage function may sync more pages on a later \#PFs.
68	* -# The page is freed / flushed in SyncCR3 (perhaps) and some other cases.
69	* When caching is enabled, the page isn't flush but remains in the cache.
70	*
71	*
72	* @section sec_pgm_pool_impl Monitoring
73	*
74	* We always monitor PAGE_SIZE chunks of memory. When we've got multiple shadow
75	* pages for the same PAGE_SIZE of guest memory (PAE and mixed PD/PT) the pages
76	* sharing the monitor get linked using the iMonitoredNext/Prev. The head page
77	* is the pvUser to the access handlers.
78	*
79	*
80	* @section sec_pgm_pool_impl Implementation
81	*
82	* The pool will take pages from the MM page pool. The tracking data
83	* (attributes, bitmaps and so on) are allocated from the hypervisor heap. The
84	* pool content can be accessed both by using the page id and the physical
85	* address (HC). The former is managed by means of an array, the latter by an
86	* offset based AVL tree.
87	*
88	* Flushing of a pool page means that we iterate the content (we know what kind
89	* it is) and updates the link information in the ram range.
90	*
91	* ...
92	*/
93
94
95	/*******************************************************************************
96	* Header Files *
97	*******************************************************************************/
98	#define LOG_GROUP LOG_GROUP_PGM_POOL
99	#include <VBox/pgm.h>
100	#include <VBox/mm.h>
101	#include "PGMInternal.h"
102	#include <VBox/vm.h>
103	#include "PGMInline.h"
104
105	#include <VBox/log.h>
106	#include <VBox/err.h>
107	#include <iprt/asm.h>
108	#include <iprt/string.h>
109	#include <VBox/dbg.h>
110
111
112	/*******************************************************************************
113	* Internal Functions *
114	*******************************************************************************/
115	static DECLCALLBACK(int) pgmR3PoolAccessHandler(PVM pVM, RTGCPHYS GCPhys, void pvPhys, void pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType, void *pvUser);
116	#ifdef VBOX_WITH_DEBUGGER
117	static DECLCALLBACK(int) pgmR3PoolCmdCheck(PCDBGCCMD pCmd, PDBGCCMDHLP pCmdHlp, PVM pVM, PCDBGCVAR paArgs, unsigned cArgs, PDBGCVAR pResult);
118	#endif
119
120	#ifdef VBOX_WITH_DEBUGGER
121	/** Command descriptors. */
122	static const DBGCCMD g_aCmds[] =
123	{
124	/* pszCmd, cArgsMin, cArgsMax, paArgDesc, cArgDescs, pResultDesc, fFlags, pfnHandler pszSyntax, ....pszDescription */
125	{ "pgmpoolcheck", 0, 0, NULL, 0, NULL, 0, pgmR3PoolCmdCheck, "", "Check the pgm pool pages." },
126	};
127	#endif
128
129	/**
130	* Initalizes the pool
131	*
132	* @returns VBox status code.
133	* @param pVM The VM handle.
134	*/
135	int pgmR3PoolInit(PVM pVM)
136	{
137	AssertCompile(NIL_PGMPOOL_IDX == 0);
138	/* pPage->cLocked is an unsigned byte. */
139	AssertCompile(VMM_MAX_CPU_COUNT <= 255);
140
141	/*
142	* Query Pool config.
143	*/
144	PCFGMNODE pCfg = CFGMR3GetChild(CFGMR3GetRoot(pVM), "/PGM/Pool");
145
146	/* Default pgm pool size equals 1024 pages. */
147	uint16_t cMaxPages = 4*_1M >> PAGE_SHIFT;
148
149	#if HC_ARCH_BITS == 64
150	uint64_t cbRam = 0;
151	CFGMR3QueryU64Def(CFGMR3GetRoot(pVM), "RamSize", &cbRam, 0);
152
153	/* We should increase the pgm pool size for guests with more than 2 GB of ram */
154	if (cbRam >= UINT64_C(2) * _1G)
155	{
156	/* In the nested paging case we require 2 + 513 * (cbRam/1GB) pages to
157	* store the entire page table descriptors.
158	*/
159	uint64_t u64MaxPages = cbRam / (_1G / UINT64_C(512));
160	if (u64MaxPages > PGMPOOL_IDX_LAST)
161	cMaxPages = PGMPOOL_IDX_LAST;
162	else
163	cMaxPages = (uint16_t)u64MaxPages;
164	}
165	#endif
166
167	/** @cfgm{/PGM/Pool/MaxPages, uint16_t, #pages, 16, 0x3fff, 1024}
168	* The max size of the shadow page pool in pages. The pool will grow dynamically
169	* up to this limit.
170	*/
171	int rc = CFGMR3QueryU16Def(pCfg, "MaxPages", &cMaxPages, cMaxPages);
172	AssertLogRelRCReturn(rc, rc);
173	AssertLogRelMsgReturn(cMaxPages <= PGMPOOL_IDX_LAST && cMaxPages >= RT_ALIGN(PGMPOOL_IDX_FIRST, 16),
174	("cMaxPages=%u (%#x)\n", cMaxPages, cMaxPages), VERR_INVALID_PARAMETER);
175	cMaxPages = RT_ALIGN(cMaxPages, 16);
176
177	/** todo:
178	* We need to be much more careful with our allocation strategy here.
179	* For nested paging we don't need pool user info nor extents at all, but we can't check for nested paging here (too early during init to get a confirmation it can be used)
180	* The default for large memory configs is a bit large for shadow paging, so I've restricted the extent maximum to 2k (2k * 16 = 32k of hyper heap)
181	*/
182
183	/** @cfgm{/PGM/Pool/MaxUsers, uint16_t, #users, MaxUsers, 32K, MaxPages*2}
184	* The max number of shadow page user tracking records. Each shadow page has
185	* zero of other shadow pages (or CR3s) that references it, or uses it if you
186	* like. The structures describing these relationships are allocated from a
187	* fixed sized pool. This configuration variable defines the pool size.
188	*/
189	uint16_t cMaxUsers;
190	rc = CFGMR3QueryU16Def(pCfg, "MaxUsers", &cMaxUsers, cMaxPages * 2);
191	AssertLogRelRCReturn(rc, rc);
192	AssertLogRelMsgReturn(cMaxUsers >= cMaxPages && cMaxPages <= _32K,
193	("cMaxUsers=%u (%#x)\n", cMaxUsers, cMaxUsers), VERR_INVALID_PARAMETER);
194
195	/** @cfgm{/PGM/Pool/MaxPhysExts, uint16_t, #extents, 16, MaxPages * 2, MAX(MaxPages*2,0x3fff)}
196	* The max number of extents for tracking aliased guest pages.
197	*/
198	uint16_t cMaxPhysExts;
199	rc = CFGMR3QueryU16Def(pCfg, "MaxPhysExts", &cMaxPhysExts, RT_MAX(cMaxPages * 2, 2048 /* 2k max as this eat too much hyper heap */));
200	AssertLogRelRCReturn(rc, rc);
201	AssertLogRelMsgReturn(cMaxPhysExts >= 16 && cMaxPages <= PGMPOOL_IDX_LAST,
202	("cMaxPhysExts=%u (%#x)\n", cMaxPhysExts, cMaxPhysExts), VERR_INVALID_PARAMETER);
203
204	/** @cfgm{/PGM/Pool/ChacheEnabled, bool, true}
205	* Enables or disabling caching of shadow pages. Caching means that we will try
206	* reuse shadow pages instead of recreating them everything SyncCR3, SyncPT or
207	* SyncPage requests one. When reusing a shadow page, we can save time
208	* reconstructing it and it's children.
209	*/
210	bool fCacheEnabled;
211	rc = CFGMR3QueryBoolDef(pCfg, "CacheEnabled", &fCacheEnabled, true);
212	AssertLogRelRCReturn(rc, rc);
213
214	LogRel(("pgmR3PoolInit: cMaxPages=%#RX16 cMaxUsers=%#RX16 cMaxPhysExts=%#RX16 fCacheEnable=%RTbool\n",
215	cMaxPages, cMaxUsers, cMaxPhysExts, fCacheEnabled));
216
217	/*
218	* Allocate the data structures.
219	*/
220	uint32_t cb = RT_OFFSETOF(PGMPOOL, aPages[cMaxPages]);
221	cb += cMaxUsers * sizeof(PGMPOOLUSER);
222	cb += cMaxPhysExts * sizeof(PGMPOOLPHYSEXT);
223	PPGMPOOL pPool;
224	rc = MMR3HyperAllocOnceNoRel(pVM, cb, 0, MM_TAG_PGM_POOL, (void **)&pPool);
225	if (RT_FAILURE(rc))
226	return rc;
227	pVM->pgm.s.pPoolR3 = pPool;
228	pVM->pgm.s.pPoolR0 = MMHyperR3ToR0(pVM, pPool);
229	pVM->pgm.s.pPoolRC = MMHyperR3ToRC(pVM, pPool);
230
231	/*
232	* Initialize it.
233	*/
234	pPool->pVMR3 = pVM;
235	pPool->pVMR0 = pVM->pVMR0;
236	pPool->pVMRC = pVM->pVMRC;
237	pPool->cMaxPages = cMaxPages;
238	pPool->cCurPages = PGMPOOL_IDX_FIRST;
239	pPool->iUserFreeHead = 0;
240	pPool->cMaxUsers = cMaxUsers;
241	PPGMPOOLUSER paUsers = (PPGMPOOLUSER)&pPool->aPages[pPool->cMaxPages];
242	pPool->paUsersR3 = paUsers;
243	pPool->paUsersR0 = MMHyperR3ToR0(pVM, paUsers);
244	pPool->paUsersRC = MMHyperR3ToRC(pVM, paUsers);
245	for (unsigned i = 0; i < cMaxUsers; i++)
246	{
247	paUsers[i].iNext = i + 1;
248	paUsers[i].iUser = NIL_PGMPOOL_IDX;
249	paUsers[i].iUserTable = 0xfffffffe;
250	}
251	paUsers[cMaxUsers - 1].iNext = NIL_PGMPOOL_USER_INDEX;
252	pPool->iPhysExtFreeHead = 0;
253	pPool->cMaxPhysExts = cMaxPhysExts;
254	PPGMPOOLPHYSEXT paPhysExts = (PPGMPOOLPHYSEXT)&paUsers[cMaxUsers];
255	pPool->paPhysExtsR3 = paPhysExts;
256	pPool->paPhysExtsR0 = MMHyperR3ToR0(pVM, paPhysExts);
257	pPool->paPhysExtsRC = MMHyperR3ToRC(pVM, paPhysExts);
258	for (unsigned i = 0; i < cMaxPhysExts; i++)
259	{
260	paPhysExts[i].iNext = i + 1;
261	paPhysExts[i].aidx[0] = NIL_PGMPOOL_IDX;
262	paPhysExts[i].apte[0] = NIL_PGMPOOL_PHYSEXT_IDX_PTE;
263	paPhysExts[i].aidx[1] = NIL_PGMPOOL_IDX;
264	paPhysExts[i].apte[1] = NIL_PGMPOOL_PHYSEXT_IDX_PTE;
265	paPhysExts[i].aidx[2] = NIL_PGMPOOL_IDX;
266	paPhysExts[i].apte[2] = NIL_PGMPOOL_PHYSEXT_IDX_PTE;
267	}
268	paPhysExts[cMaxPhysExts - 1].iNext = NIL_PGMPOOL_PHYSEXT_INDEX;
269	for (unsigned i = 0; i < RT_ELEMENTS(pPool->aiHash); i++)
270	pPool->aiHash[i] = NIL_PGMPOOL_IDX;
271	pPool->iAgeHead = NIL_PGMPOOL_IDX;
272	pPool->iAgeTail = NIL_PGMPOOL_IDX;
273	pPool->fCacheEnabled = fCacheEnabled;
274	pPool->pfnAccessHandlerR3 = pgmR3PoolAccessHandler;
275	pPool->pszAccessHandler = "Guest Paging Access Handler";
276	pPool->HCPhysTree = 0;
277
278	/* The NIL entry. */
279	Assert(NIL_PGMPOOL_IDX == 0);
280	pPool->aPages[NIL_PGMPOOL_IDX].enmKind = PGMPOOLKIND_INVALID;
281
282	/* The Shadow 32-bit PD. (32 bits guest paging) */
283	pPool->aPages[PGMPOOL_IDX_PD].Core.Key = NIL_RTHCPHYS;
284	pPool->aPages[PGMPOOL_IDX_PD].GCPhys = NIL_RTGCPHYS;
285	pPool->aPages[PGMPOOL_IDX_PD].pvPageR3 = 0;
286	pPool->aPages[PGMPOOL_IDX_PD].enmKind = PGMPOOLKIND_32BIT_PD;
287	pPool->aPages[PGMPOOL_IDX_PD].idx = PGMPOOL_IDX_PD;
288
289	/* The Shadow PDPT. */
290	pPool->aPages[PGMPOOL_IDX_PDPT].Core.Key = NIL_RTHCPHYS;
291	pPool->aPages[PGMPOOL_IDX_PDPT].GCPhys = NIL_RTGCPHYS;
292	pPool->aPages[PGMPOOL_IDX_PDPT].pvPageR3 = 0;
293	pPool->aPages[PGMPOOL_IDX_PDPT].enmKind = PGMPOOLKIND_PAE_PDPT;
294	pPool->aPages[PGMPOOL_IDX_PDPT].idx = PGMPOOL_IDX_PDPT;
295
296	/* The Shadow AMD64 CR3. */
297	pPool->aPages[PGMPOOL_IDX_AMD64_CR3].Core.Key = NIL_RTHCPHYS;
298	pPool->aPages[PGMPOOL_IDX_AMD64_CR3].GCPhys = NIL_RTGCPHYS;
299	pPool->aPages[PGMPOOL_IDX_AMD64_CR3].pvPageR3 = 0;
300	pPool->aPages[PGMPOOL_IDX_AMD64_CR3].enmKind = PGMPOOLKIND_64BIT_PML4;
301	pPool->aPages[PGMPOOL_IDX_AMD64_CR3].idx = PGMPOOL_IDX_AMD64_CR3;
302
303	/* The Nested Paging CR3. */
304	pPool->aPages[PGMPOOL_IDX_NESTED_ROOT].Core.Key = NIL_RTHCPHYS;
305	pPool->aPages[PGMPOOL_IDX_NESTED_ROOT].GCPhys = NIL_RTGCPHYS;
306	pPool->aPages[PGMPOOL_IDX_NESTED_ROOT].pvPageR3 = 0;
307	pPool->aPages[PGMPOOL_IDX_NESTED_ROOT].enmKind = PGMPOOLKIND_ROOT_NESTED;
308	pPool->aPages[PGMPOOL_IDX_NESTED_ROOT].idx = PGMPOOL_IDX_NESTED_ROOT;
309
310	/*
311	* Set common stuff.
312	*/
313	for (unsigned iPage = 1; iPage < PGMPOOL_IDX_FIRST; iPage++)
314	{
315	pPool->aPages[iPage].iNext = NIL_PGMPOOL_IDX;
316	pPool->aPages[iPage].iUserHead = NIL_PGMPOOL_USER_INDEX;
317	pPool->aPages[iPage].iModifiedNext = NIL_PGMPOOL_IDX;
318	pPool->aPages[iPage].iModifiedPrev = NIL_PGMPOOL_IDX;
319	pPool->aPages[iPage].iMonitoredNext = NIL_PGMPOOL_IDX;
320	pPool->aPages[iPage].iMonitoredNext = NIL_PGMPOOL_IDX;
321	pPool->aPages[iPage].iAgeNext = NIL_PGMPOOL_IDX;
322	pPool->aPages[iPage].iAgePrev = NIL_PGMPOOL_IDX;
323	Assert(pPool->aPages[iPage].idx == iPage);
324	Assert(pPool->aPages[iPage].GCPhys == NIL_RTGCPHYS);
325	Assert(!pPool->aPages[iPage].fSeenNonGlobal);
326	Assert(!pPool->aPages[iPage].fMonitored);
327	Assert(!pPool->aPages[iPage].fCached);
328	Assert(!pPool->aPages[iPage].fZeroed);
329	Assert(!pPool->aPages[iPage].fReusedFlushPending);
330	}
331
332	#ifdef VBOX_WITH_STATISTICS
333	/*
334	* Register statistics.
335	*/
336	STAM_REG(pVM, &pPool->cCurPages, STAMTYPE_U16, "/PGM/Pool/cCurPages", STAMUNIT_PAGES, "Current pool size.");
337	STAM_REG(pVM, &pPool->cMaxPages, STAMTYPE_U16, "/PGM/Pool/cMaxPages", STAMUNIT_PAGES, "Max pool size.");
338	STAM_REG(pVM, &pPool->cUsedPages, STAMTYPE_U16, "/PGM/Pool/cUsedPages", STAMUNIT_PAGES, "The number of pages currently in use.");
339	STAM_REG(pVM, &pPool->cUsedPagesHigh, STAMTYPE_U16_RESET, "/PGM/Pool/cUsedPagesHigh", STAMUNIT_PAGES, "The high watermark for cUsedPages.");
340	STAM_REG(pVM, &pPool->StatAlloc, STAMTYPE_PROFILE_ADV, "/PGM/Pool/Alloc", STAMUNIT_TICKS_PER_CALL, "Profiling of pgmPoolAlloc.");
341	STAM_REG(pVM, &pPool->StatClearAll, STAMTYPE_PROFILE, "/PGM/Pool/ClearAll", STAMUNIT_TICKS_PER_CALL, "Profiling of pgmR3PoolClearAll.");
342	STAM_REG(pVM, &pPool->StatR3Reset, STAMTYPE_PROFILE, "/PGM/Pool/R3Reset", STAMUNIT_TICKS_PER_CALL, "Profiling of pgmR3PoolReset.");
343	STAM_REG(pVM, &pPool->StatFlushPage, STAMTYPE_PROFILE, "/PGM/Pool/FlushPage", STAMUNIT_TICKS_PER_CALL, "Profiling of pgmPoolFlushPage.");
344	STAM_REG(pVM, &pPool->StatFree, STAMTYPE_PROFILE, "/PGM/Pool/Free", STAMUNIT_TICKS_PER_CALL, "Profiling of pgmPoolFree.");
345	STAM_REG(pVM, &pPool->StatForceFlushPage, STAMTYPE_COUNTER, "/PGM/Pool/FlushForce", STAMUNIT_OCCURENCES, "Counting explicit flushes by PGMPoolFlushPage().");
346	STAM_REG(pVM, &pPool->StatForceFlushDirtyPage, STAMTYPE_COUNTER, "/PGM/Pool/FlushForceDirty", STAMUNIT_OCCURENCES, "Counting explicit flushes of dirty pages by PGMPoolFlushPage().");
347	STAM_REG(pVM, &pPool->StatForceFlushReused, STAMTYPE_COUNTER, "/PGM/Pool/FlushReused", STAMUNIT_OCCURENCES, "Counting flushes for reused pages.");
348	STAM_REG(pVM, &pPool->StatZeroPage, STAMTYPE_PROFILE, "/PGM/Pool/ZeroPage", STAMUNIT_TICKS_PER_CALL, "Profiling time spent zeroing pages. Overlaps with Alloc.");
349	STAM_REG(pVM, &pPool->cMaxUsers, STAMTYPE_U16, "/PGM/Pool/Track/cMaxUsers", STAMUNIT_COUNT, "Max user tracking records.");
350	STAM_REG(pVM, &pPool->cPresent, STAMTYPE_U32, "/PGM/Pool/Track/cPresent", STAMUNIT_COUNT, "Number of present page table entries.");
351	STAM_REG(pVM, &pPool->StatTrackDeref, STAMTYPE_PROFILE, "/PGM/Pool/Track/Deref", STAMUNIT_TICKS_PER_CALL, "Profiling of pgmPoolTrackDeref.");
352	STAM_REG(pVM, &pPool->StatTrackFlushGCPhysPT, STAMTYPE_PROFILE, "/PGM/Pool/Track/FlushGCPhysPT", STAMUNIT_TICKS_PER_CALL, "Profiling of pgmPoolTrackFlushGCPhysPT.");
353	STAM_REG(pVM, &pPool->StatTrackFlushGCPhysPTs, STAMTYPE_PROFILE, "/PGM/Pool/Track/FlushGCPhysPTs", STAMUNIT_TICKS_PER_CALL, "Profiling of pgmPoolTrackFlushGCPhysPTs.");
354	STAM_REG(pVM, &pPool->StatTrackFlushGCPhysPTsSlow, STAMTYPE_PROFILE, "/PGM/Pool/Track/FlushGCPhysPTsSlow", STAMUNIT_TICKS_PER_CALL, "Profiling of pgmPoolTrackFlushGCPhysPTsSlow.");
355	STAM_REG(pVM, &pPool->StatTrackFlushEntry, STAMTYPE_COUNTER, "/PGM/Pool/Track/Entry/Flush", STAMUNIT_COUNT, "Nr of flushed entries.");
356	STAM_REG(pVM, &pPool->StatTrackFlushEntryKeep, STAMTYPE_COUNTER, "/PGM/Pool/Track/Entry/Update", STAMUNIT_COUNT, "Nr of updated entries.");
357	STAM_REG(pVM, &pPool->StatTrackFreeUpOneUser, STAMTYPE_COUNTER, "/PGM/Pool/Track/FreeUpOneUser", STAMUNIT_TICKS_PER_CALL, "The number of times we were out of user tracking records.");
358	STAM_REG(pVM, &pPool->StatTrackDerefGCPhys, STAMTYPE_PROFILE, "/PGM/Pool/Track/DrefGCPhys", STAMUNIT_TICKS_PER_CALL, "Profiling deref activity related tracking GC physical pages.");
359	STAM_REG(pVM, &pPool->StatTrackLinearRamSearches, STAMTYPE_COUNTER, "/PGM/Pool/Track/LinearRamSearches", STAMUNIT_OCCURENCES, "The number of times we had to do linear ram searches.");
360	STAM_REG(pVM, &pPool->StamTrackPhysExtAllocFailures,STAMTYPE_COUNTER, "/PGM/Pool/Track/PhysExtAllocFailures", STAMUNIT_OCCURENCES, "The number of failing pgmPoolTrackPhysExtAlloc calls.");
361	STAM_REG(pVM, &pPool->StatMonitorRZ, STAMTYPE_PROFILE, "/PGM/Pool/Monitor/RZ", STAMUNIT_TICKS_PER_CALL, "Profiling the RC/R0 access handler.");
362	STAM_REG(pVM, &pPool->StatMonitorRZEmulateInstr, STAMTYPE_COUNTER, "/PGM/Pool/Monitor/RZ/EmulateInstr", STAMUNIT_OCCURENCES, "Times we've failed interpreting the instruction.");
363	STAM_REG(pVM, &pPool->StatMonitorRZFlushPage, STAMTYPE_PROFILE, "/PGM/Pool/Monitor/RZ/FlushPage", STAMUNIT_TICKS_PER_CALL, "Profiling the pgmPoolFlushPage calls made from the RC/R0 access handler.");
364	STAM_REG(pVM, &pPool->StatMonitorRZFlushReinit, STAMTYPE_COUNTER, "/PGM/Pool/Monitor/RZ/FlushReinit", STAMUNIT_OCCURENCES, "Times we've detected a page table reinit.");
365	STAM_REG(pVM, &pPool->StatMonitorRZFlushModOverflow,STAMTYPE_COUNTER, "/PGM/Pool/Monitor/RZ/FlushOverflow", STAMUNIT_OCCURENCES, "Counting flushes for pages that are modified too often.");
366	STAM_REG(pVM, &pPool->StatMonitorRZFork, STAMTYPE_COUNTER, "/PGM/Pool/Monitor/RZ/Fork", STAMUNIT_OCCURENCES, "Times we've detected fork().");
367	STAM_REG(pVM, &pPool->StatMonitorRZHandled, STAMTYPE_PROFILE, "/PGM/Pool/Monitor/RZ/Handled", STAMUNIT_TICKS_PER_CALL, "Profiling the RC/R0 access we've handled (except REP STOSD).");
368	STAM_REG(pVM, &pPool->StatMonitorRZIntrFailPatch1, STAMTYPE_COUNTER, "/PGM/Pool/Monitor/RZ/IntrFailPatch1", STAMUNIT_OCCURENCES, "Times we've failed interpreting a patch code instruction.");
369	STAM_REG(pVM, &pPool->StatMonitorRZIntrFailPatch2, STAMTYPE_COUNTER, "/PGM/Pool/Monitor/RZ/IntrFailPatch2", STAMUNIT_OCCURENCES, "Times we've failed interpreting a patch code instruction during flushing.");
370	STAM_REG(pVM, &pPool->StatMonitorRZRepPrefix, STAMTYPE_COUNTER, "/PGM/Pool/Monitor/RZ/RepPrefix", STAMUNIT_OCCURENCES, "The number of times we've seen rep prefixes we can't handle.");
371	STAM_REG(pVM, &pPool->StatMonitorRZRepStosd, STAMTYPE_PROFILE, "/PGM/Pool/Monitor/RZ/RepStosd", STAMUNIT_TICKS_PER_CALL, "Profiling the REP STOSD cases we've handled.");
372	STAM_REG(pVM, &pPool->StatMonitorRZFaultPT, STAMTYPE_COUNTER, "/PGM/Pool/Monitor/RZ/Fault/PT", STAMUNIT_OCCURENCES, "Nr of handled PT faults.");
373	STAM_REG(pVM, &pPool->StatMonitorRZFaultPD, STAMTYPE_COUNTER, "/PGM/Pool/Monitor/RZ/Fault/PD", STAMUNIT_OCCURENCES, "Nr of handled PD faults.");
374	STAM_REG(pVM, &pPool->StatMonitorRZFaultPDPT, STAMTYPE_COUNTER, "/PGM/Pool/Monitor/RZ/Fault/PDPT", STAMUNIT_OCCURENCES, "Nr of handled PDPT faults.");
375	STAM_REG(pVM, &pPool->StatMonitorRZFaultPML4, STAMTYPE_COUNTER, "/PGM/Pool/Monitor/RZ/Fault/PML4", STAMUNIT_OCCURENCES, "Nr of handled PML4 faults.");
376	STAM_REG(pVM, &pPool->StatMonitorR3, STAMTYPE_PROFILE, "/PGM/Pool/Monitor/R3", STAMUNIT_TICKS_PER_CALL, "Profiling the R3 access handler.");
377	STAM_REG(pVM, &pPool->StatMonitorR3EmulateInstr, STAMTYPE_COUNTER, "/PGM/Pool/Monitor/R3/EmulateInstr", STAMUNIT_OCCURENCES, "Times we've failed interpreting the instruction.");
378	STAM_REG(pVM, &pPool->StatMonitorR3FlushPage, STAMTYPE_PROFILE, "/PGM/Pool/Monitor/R3/FlushPage", STAMUNIT_TICKS_PER_CALL, "Profiling the pgmPoolFlushPage calls made from the R3 access handler.");
379	STAM_REG(pVM, &pPool->StatMonitorR3FlushReinit, STAMTYPE_COUNTER, "/PGM/Pool/Monitor/R3/FlushReinit", STAMUNIT_OCCURENCES, "Times we've detected a page table reinit.");
380	STAM_REG(pVM, &pPool->StatMonitorR3FlushModOverflow,STAMTYPE_COUNTER, "/PGM/Pool/Monitor/R3/FlushOverflow", STAMUNIT_OCCURENCES, "Counting flushes for pages that are modified too often.");
381	STAM_REG(pVM, &pPool->StatMonitorR3Fork, STAMTYPE_COUNTER, "/PGM/Pool/Monitor/R3/Fork", STAMUNIT_OCCURENCES, "Times we've detected fork().");
382	STAM_REG(pVM, &pPool->StatMonitorR3Handled, STAMTYPE_PROFILE, "/PGM/Pool/Monitor/R3/Handled", STAMUNIT_TICKS_PER_CALL, "Profiling the R3 access we've handled (except REP STOSD).");
383	STAM_REG(pVM, &pPool->StatMonitorR3RepPrefix, STAMTYPE_COUNTER, "/PGM/Pool/Monitor/R3/RepPrefix", STAMUNIT_OCCURENCES, "The number of times we've seen rep prefixes we can't handle.");
384	STAM_REG(pVM, &pPool->StatMonitorR3RepStosd, STAMTYPE_PROFILE, "/PGM/Pool/Monitor/R3/RepStosd", STAMUNIT_TICKS_PER_CALL, "Profiling the REP STOSD cases we've handled.");
385	STAM_REG(pVM, &pPool->StatMonitorR3FaultPT, STAMTYPE_COUNTER, "/PGM/Pool/Monitor/R3/Fault/PT", STAMUNIT_OCCURENCES, "Nr of handled PT faults.");
386	STAM_REG(pVM, &pPool->StatMonitorR3FaultPD, STAMTYPE_COUNTER, "/PGM/Pool/Monitor/R3/Fault/PD", STAMUNIT_OCCURENCES, "Nr of handled PD faults.");
387	STAM_REG(pVM, &pPool->StatMonitorR3FaultPDPT, STAMTYPE_COUNTER, "/PGM/Pool/Monitor/R3/Fault/PDPT", STAMUNIT_OCCURENCES, "Nr of handled PDPT faults.");
388	STAM_REG(pVM, &pPool->StatMonitorR3FaultPML4, STAMTYPE_COUNTER, "/PGM/Pool/Monitor/R3/Fault/PML4", STAMUNIT_OCCURENCES, "Nr of handled PML4 faults.");
389	STAM_REG(pVM, &pPool->StatMonitorR3Async, STAMTYPE_COUNTER, "/PGM/Pool/Monitor/R3/Async", STAMUNIT_OCCURENCES, "Times we're called in an async thread and need to flush.");
390	STAM_REG(pVM, &pPool->cModifiedPages, STAMTYPE_U16, "/PGM/Pool/Monitor/cModifiedPages", STAMUNIT_PAGES, "The current cModifiedPages value.");
391	STAM_REG(pVM, &pPool->cModifiedPagesHigh, STAMTYPE_U16_RESET, "/PGM/Pool/Monitor/cModifiedPagesHigh", STAMUNIT_PAGES, "The high watermark for cModifiedPages.");
392	STAM_REG(pVM, &pPool->StatResetDirtyPages, STAMTYPE_COUNTER, "/PGM/Pool/Monitor/Dirty/Resets", STAMUNIT_OCCURENCES, "Times we've called pgmPoolResetDirtyPages (and there were dirty page).");
393	STAM_REG(pVM, &pPool->StatDirtyPage, STAMTYPE_COUNTER, "/PGM/Pool/Monitor/Dirty/Pages", STAMUNIT_OCCURENCES, "Times we've called pgmPoolAddDirtyPage.");
394	STAM_REG(pVM, &pPool->StatDirtyPageDupFlush, STAMTYPE_COUNTER, "/PGM/Pool/Monitor/Dirty/FlushDup", STAMUNIT_OCCURENCES, "Times we've had to flush duplicates for dirty page management.");
395	STAM_REG(pVM, &pPool->StatDirtyPageOverFlowFlush, STAMTYPE_COUNTER, "/PGM/Pool/Monitor/Dirty/FlushOverflow",STAMUNIT_OCCURENCES, "Times we've had to flush because of overflow.");
396	STAM_REG(pVM, &pPool->StatCacheHits, STAMTYPE_COUNTER, "/PGM/Pool/Cache/Hits", STAMUNIT_OCCURENCES, "The number of pgmPoolAlloc calls satisfied by the cache.");
397	STAM_REG(pVM, &pPool->StatCacheMisses, STAMTYPE_COUNTER, "/PGM/Pool/Cache/Misses", STAMUNIT_OCCURENCES, "The number of pgmPoolAlloc calls not statisfied by the cache.");
398	STAM_REG(pVM, &pPool->StatCacheKindMismatches, STAMTYPE_COUNTER, "/PGM/Pool/Cache/KindMismatches", STAMUNIT_OCCURENCES, "The number of shadow page kind mismatches. (Better be low, preferably 0!)");
399	STAM_REG(pVM, &pPool->StatCacheFreeUpOne, STAMTYPE_COUNTER, "/PGM/Pool/Cache/FreeUpOne", STAMUNIT_OCCURENCES, "The number of times the cache was asked to free up a page.");
400	STAM_REG(pVM, &pPool->StatCacheCacheable, STAMTYPE_COUNTER, "/PGM/Pool/Cache/Cacheable", STAMUNIT_OCCURENCES, "The number of cacheable allocations.");
401	STAM_REG(pVM, &pPool->StatCacheUncacheable, STAMTYPE_COUNTER, "/PGM/Pool/Cache/Uncacheable", STAMUNIT_OCCURENCES, "The number of uncacheable allocations.");
402	#endif /* VBOX_WITH_STATISTICS */
403
404	#ifdef VBOX_WITH_DEBUGGER
405	/*
406	* Debugger commands.
407	*/
408	static bool s_fRegisteredCmds = false;
409	if (!s_fRegisteredCmds)
410	{
411	rc = DBGCRegisterCommands(&g_aCmds[0], RT_ELEMENTS(g_aCmds));
412	if (RT_SUCCESS(rc))
413	s_fRegisteredCmds = true;
414	}
415	#endif
416
417	return VINF_SUCCESS;
418	}
419
420
421	/**
422	* Relocate the page pool data.
423	*
424	* @param pVM The VM handle.
425	*/
426	void pgmR3PoolRelocate(PVM pVM)
427	{
428	pVM->pgm.s.pPoolRC = MMHyperR3ToRC(pVM, pVM->pgm.s.pPoolR3);
429	pVM->pgm.s.pPoolR3->pVMRC = pVM->pVMRC;
430	pVM->pgm.s.pPoolR3->paUsersRC = MMHyperR3ToRC(pVM, pVM->pgm.s.pPoolR3->paUsersR3);
431	pVM->pgm.s.pPoolR3->paPhysExtsRC = MMHyperR3ToRC(pVM, pVM->pgm.s.pPoolR3->paPhysExtsR3);
432	int rc = PDMR3LdrGetSymbolRC(pVM, NULL, "pgmPoolAccessHandler", &pVM->pgm.s.pPoolR3->pfnAccessHandlerRC);
433	AssertReleaseRC(rc);
434	/* init order hack. */
435	if (!pVM->pgm.s.pPoolR3->pfnAccessHandlerR0)
436	{
437	rc = PDMR3LdrGetSymbolR0(pVM, NULL, "pgmPoolAccessHandler", &pVM->pgm.s.pPoolR3->pfnAccessHandlerR0);
438	AssertReleaseRC(rc);
439	}
440	}
441
442
443	/**
444	* Grows the shadow page pool.
445	*
446	* I.e. adds more pages to it, assuming that hasn't reached cMaxPages yet.
447	*
448	* @returns VBox status code.
449	* @param pVM The VM handle.
450	*/
451	VMMR3DECL(int) PGMR3PoolGrow(PVM pVM)
452	{
453	PPGMPOOL pPool = pVM->pgm.s.pPoolR3;
454	AssertReturn(pPool->cCurPages < pPool->cMaxPages, VERR_INTERNAL_ERROR);
455
456	pgmLock(pVM);
457
458	/*
459	* How much to grow it by?
460	*/
461	uint32_t cPages = pPool->cMaxPages - pPool->cCurPages;
462	cPages = RT_MIN(PGMPOOL_CFG_MAX_GROW, cPages);
463	LogFlow(("PGMR3PoolGrow: Growing the pool by %d (%#x) pages.\n", cPages, cPages));
464
465	for (unsigned i = pPool->cCurPages; cPages-- > 0; i++)
466	{
467	PPGMPOOLPAGE pPage = &pPool->aPages[i];
468
469	/* Allocate all pages in low (below 4 GB) memory as 32 bits guests need a page table root in low memory. */
470	pPage->pvPageR3 = MMR3PageAllocLow(pVM);
471	if (!pPage->pvPageR3)
472	{
473	Log(("We're out of memory!! i=%d\n", i));
474	pgmUnlock(pVM);
475	return i ? VINF_SUCCESS : VERR_NO_PAGE_MEMORY;
476	}
477	pPage->Core.Key = MMPage2Phys(pVM, pPage->pvPageR3);
478	AssertFatal(pPage->Core.Key < _4G);
479	pPage->GCPhys = NIL_RTGCPHYS;
480	pPage->enmKind = PGMPOOLKIND_FREE;
481	pPage->idx = pPage - &pPool->aPages[0];
482	LogFlow(("PGMR3PoolGrow: insert page #%#x - %RHp\n", pPage->idx, pPage->Core.Key));
483	pPage->iNext = pPool->iFreeHead;
484	pPage->iUserHead = NIL_PGMPOOL_USER_INDEX;
485	pPage->iModifiedNext = NIL_PGMPOOL_IDX;
486	pPage->iModifiedPrev = NIL_PGMPOOL_IDX;
487	pPage->iMonitoredNext = NIL_PGMPOOL_IDX;
488	pPage->iMonitoredNext = NIL_PGMPOOL_IDX;
489	pPage->iAgeNext = NIL_PGMPOOL_IDX;
490	pPage->iAgePrev = NIL_PGMPOOL_IDX;
491	/* commit it */
492	bool fRc = RTAvloHCPhysInsert(&pPool->HCPhysTree, &pPage->Core); Assert(fRc); NOREF(fRc);
493	pPool->iFreeHead = i;
494	pPool->cCurPages = i + 1;
495	}
496
497	pgmUnlock(pVM);
498	Assert(pPool->cCurPages <= pPool->cMaxPages);
499	return VINF_SUCCESS;
500	}
501
502
503
504	/**
505	* Worker used by pgmR3PoolAccessHandler when it's invoked by an async thread.
506	*
507	* @param pPool The pool.
508	* @param pPage The page.
509	*/
510	static DECLCALLBACK(void) pgmR3PoolFlushReusedPage(PPGMPOOL pPool, PPGMPOOLPAGE pPage)
511	{
512	/* for the present this should be safe enough I think... */
513	pgmLock(pPool->pVMR3);
514	if ( pPage->fReusedFlushPending
515	&& pPage->enmKind != PGMPOOLKIND_FREE)
516	pgmPoolFlushPage(pPool, pPage);
517	pgmUnlock(pPool->pVMR3);
518	}
519
520
521	/**
522	* \#PF Handler callback for PT write accesses.
523	*
524	* The handler can not raise any faults, it's mainly for monitoring write access
525	* to certain pages.
526	*
527	* @returns VINF_SUCCESS if the handler has carried out the operation.
528	* @returns VINF_PGM_HANDLER_DO_DEFAULT if the caller should carry out the access operation.
529	* @param pVM VM Handle.
530	* @param GCPhys The physical address the guest is writing to.
531	* @param pvPhys The HC mapping of that address.
532	* @param pvBuf What the guest is reading/writing.
533	* @param cbBuf How much it's reading/writing.
534	* @param enmAccessType The access type.
535	* @param pvUser User argument.
536	*/
537	static DECLCALLBACK(int) pgmR3PoolAccessHandler(PVM pVM, RTGCPHYS GCPhys, void pvPhys, void pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType, void *pvUser)
538	{
539	STAM_PROFILE_START(&pVM->pgm.s.pPoolR3->StatMonitorR3, a);
540	PPGMPOOL pPool = pVM->pgm.s.pPoolR3;
541	PPGMPOOLPAGE pPage = (PPGMPOOLPAGE)pvUser;
542	LogFlow(("pgmR3PoolAccessHandler: GCPhys=%RGp %p:{.Core=%RHp, .idx=%d, .GCPhys=%RGp, .enmType=%d}\n",
543	GCPhys, pPage, pPage->Core.Key, pPage->idx, pPage->GCPhys, pPage->enmKind));
544
545	PVMCPU pVCpu = VMMGetCpu(pVM);
546
547	/*
548	* We don't have to be very sophisticated about this since there are relativly few calls here.
549	* However, we must try our best to detect any non-cpu accesses (disk / networking).
550	*
551	* Just to make life more interesting, we'll have to deal with the async threads too.
552	* We cannot flush a page if we're in an async thread because of REM notifications.
553	*/
554	pgmLock(pVM);
555	if (PHYS_PAGE_ADDRESS(GCPhys) != PHYS_PAGE_ADDRESS(pPage->GCPhys))
556	{
557	/* Pool page changed while we were waiting for the lock; ignore. */
558	Log(("CPU%d: pgmR3PoolAccessHandler pgm pool page for %RGp changed (to %RGp) while waiting!\n", pVCpu->idCpu, PHYS_PAGE_ADDRESS(GCPhys), PHYS_PAGE_ADDRESS(pPage->GCPhys)));
559	pgmUnlock(pVM);
560	return VINF_PGM_HANDLER_DO_DEFAULT;
561	}
562
563	Assert(pPage->enmKind != PGMPOOLKIND_FREE);
564
565	/* @todo this code doesn't make any sense. remove the if (!pVCpu) block */
566	if (!pVCpu) /** @todo This shouldn't happen any longer, all access handlers will be called on an EMT. All ring-3 handlers, except MMIO, already own the PGM lock. @bugref{3170} */
567	{
568	Log(("pgmR3PoolAccessHandler: async thread, requesting EMT to flush the page: %p:{.Core=%RHp, .idx=%d, .GCPhys=%RGp, .enmType=%d}\n",
569	pPage, pPage->Core.Key, pPage->idx, pPage->GCPhys, pPage->enmKind));
570	STAM_COUNTER_INC(&pPool->StatMonitorR3Async);
571	if (!pPage->fReusedFlushPending)
572	{
573	pgmUnlock(pVM);
574	int rc = VMR3ReqCallVoidNoWait(pPool->pVMR3, VMCPUID_ANY, (PFNRT)pgmR3PoolFlushReusedPage, 2, pPool, pPage);
575	AssertRCReturn(rc, rc);
576	pgmLock(pVM);
577	pPage->fReusedFlushPending = true;
578	pPage->cModifications += 0x1000;
579	}
580
581	pgmPoolMonitorChainChanging(pVCpu, pPool, pPage, GCPhys, pvPhys, 0 /* unknown write size */);
582	/** @todo r=bird: making unsafe assumption about not crossing entries here! */
583	while (cbBuf > 4)
584	{
585	cbBuf -= 4;
586	pvPhys = (uint8_t *)pvPhys + 4;
587	GCPhys += 4;
588	pgmPoolMonitorChainChanging(pVCpu, pPool, pPage, GCPhys, pvPhys, 0 /* unknown write size */);
589	}
590	STAM_PROFILE_STOP(&pPool->StatMonitorR3, a);
591	}
592	else if ( ( pPage->cModifications < 96 /* it's cheaper here. */
593	\|\| pgmPoolIsPageLocked(&pVM->pgm.s, pPage)
594	)
595	&& cbBuf <= 4)
596	{
597	/* Clear the shadow entry. */
598	if (!pPage->cModifications++)
599	pgmPoolMonitorModifiedInsert(pPool, pPage);
600	/** @todo r=bird: making unsafe assumption about not crossing entries here! */
601	pgmPoolMonitorChainChanging(pVCpu, pPool, pPage, GCPhys, pvPhys, 0 /* unknown write size */);
602	STAM_PROFILE_STOP(&pPool->StatMonitorR3, a);
603	}
604	else
605	{
606	pgmPoolMonitorChainFlush(pPool, pPage); /* ASSUME that VERR_PGM_POOL_CLEARED can be ignored here and that FFs will deal with it in due time. */
607	STAM_PROFILE_STOP_EX(&pPool->StatMonitorR3, &pPool->StatMonitorR3FlushPage, a);
608	}
609	pgmUnlock(pVM);
610	return VINF_PGM_HANDLER_DO_DEFAULT;
611	}
612
613
614	/**
615	* Rendezvous callback used by pgmR3PoolClearAll that clears all shadow pages
616	* and all modification counters.
617	*
618	* This is only called on one of the EMTs while the other ones are waiting for
619	* it to complete this function.
620	*
621	* @returns VINF_SUCCESS (VBox strict status code).
622	* @param pVM The VM handle.
623	* @param pVCpu The VMCPU for the EMT we're being called on. Unused.
624	* @param fpvFlushRemTlb When not NULL, we'll flush the REM TLB as well.
625	* (This is the pvUser, so it has to be void *.)
626	*
627	*/
628	DECLCALLBACK(VBOXSTRICTRC) pgmR3PoolClearAllRendezvous(PVM pVM, PVMCPU pVCpu, void *fpvFlushRemTbl)
629	{
630	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
631	STAM_PROFILE_START(&pPool->StatClearAll, c);
632
633	pgmLock(pVM);
634	Log(("pgmR3PoolClearAllRendezvous: cUsedPages=%d fpvFlushRemTbl=%RTbool\n", pPool->cUsedPages, !!fpvFlushRemTbl));
635
636	/*
637	* Iterate all the pages until we've encountered all that are in use.
638	* This is a simple but not quite optimal solution.
639	*/
640	unsigned cModifiedPages = 0; NOREF(cModifiedPages);
641	unsigned cLeft = pPool->cUsedPages;
642	unsigned iPage = pPool->cCurPages;
643	while (--iPage >= PGMPOOL_IDX_FIRST)
644	{
645	PPGMPOOLPAGE pPage = &pPool->aPages[iPage];
646	if (pPage->GCPhys != NIL_RTGCPHYS)
647	{
648	switch (pPage->enmKind)
649	{
650	/*
651	* We only care about shadow page tables.
652	*/
653	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_PT:
654	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_4MB:
655	case PGMPOOLKIND_PAE_PT_FOR_32BIT_PT:
656	case PGMPOOLKIND_PAE_PT_FOR_32BIT_4MB:
657	case PGMPOOLKIND_PAE_PT_FOR_PAE_PT:
658	case PGMPOOLKIND_PAE_PT_FOR_PAE_2MB:
659	case PGMPOOLKIND_32BIT_PT_FOR_PHYS:
660	case PGMPOOLKIND_PAE_PT_FOR_PHYS:
661	case PGMPOOLKIND_EPT_PT_FOR_PHYS:
662	{
663	if (pPage->cPresent)
664	{
665	void *pvShw = PGMPOOL_PAGE_2_PTR_V2(pPool->CTX_SUFF(pVM), pVCpu, pPage);
666	STAM_PROFILE_START(&pPool->StatZeroPage, z);
667	#if 0
668	/* Useful check for leaking references; very expensive though. */
669	switch (pPage->enmKind)
670	{
671	case PGMPOOLKIND_PAE_PT_FOR_32BIT_PT:
672	case PGMPOOLKIND_PAE_PT_FOR_32BIT_4MB:
673	case PGMPOOLKIND_PAE_PT_FOR_PAE_PT:
674	case PGMPOOLKIND_PAE_PT_FOR_PAE_2MB:
675	case PGMPOOLKIND_PAE_PT_FOR_PHYS:
676	{
677	bool fFoundFirst = false;
678	PPGMSHWPTPAE pPT = (PPGMSHWPTPAE)pvShw;
679	for (unsigned ptIndex = 0; ptIndex < RT_ELEMENTS(pPT->a); ptIndex++)
680	{
681	if (pPT->a[ptIndex].u)
682	{
683	if (!fFoundFirst)
684	{
685	AssertFatalMsg(pPage->iFirstPresent <= ptIndex, ("ptIndex = %d first present = %d\n", ptIndex, pPage->iFirstPresent));
686	if (pPage->iFirstPresent != ptIndex)
687	Log(("ptIndex = %d first present = %d\n", ptIndex, pPage->iFirstPresent));
688	fFoundFirst = true;
689	}
690	if (PGMSHWPTEPAE_IS_P(pPT->a[ptIndex]))
691	{
692	pgmPoolTracDerefGCPhysHint(pPool, pPage, PGMSHWPTEPAE_GET_HCPHYS(pPT->a[ptIndex]), NIL_RTGCPHYS);
693	if (pPage->iFirstPresent == ptIndex)
694	pPage->iFirstPresent = NIL_PGMPOOL_PRESENT_INDEX;
695	}
696	}
697	}
698	AssertFatalMsg(pPage->cPresent == 0, ("cPresent = %d pPage = %RGv\n", pPage->cPresent, pPage->GCPhys));
699	break;
700	}
701	default:
702	break;
703	}
704	#endif
705	ASMMemZeroPage(pvShw);
706	STAM_PROFILE_STOP(&pPool->StatZeroPage, z);
707	pPage->cPresent = 0;
708	pPage->iFirstPresent = NIL_PGMPOOL_PRESENT_INDEX;
709	}
710	}
711	/* fall thru */
712
713	default:
714	Assert(!pPage->cModifications \|\| ++cModifiedPages);
715	Assert(pPage->iModifiedNext == NIL_PGMPOOL_IDX \|\| pPage->cModifications);
716	Assert(pPage->iModifiedPrev == NIL_PGMPOOL_IDX \|\| pPage->cModifications);
717	pPage->iModifiedNext = NIL_PGMPOOL_IDX;
718	pPage->iModifiedPrev = NIL_PGMPOOL_IDX;
719	pPage->cModifications = 0;
720	break;
721
722	}
723	if (!--cLeft)
724	break;
725	}
726	}
727
728	/* swipe the special pages too. */
729	for (iPage = PGMPOOL_IDX_FIRST_SPECIAL; iPage < PGMPOOL_IDX_FIRST; iPage++)
730	{
731	PPGMPOOLPAGE pPage = &pPool->aPages[iPage];
732	if (pPage->GCPhys != NIL_RTGCPHYS)
733	{
734	Assert(!pPage->cModifications \|\| ++cModifiedPages);
735	Assert(pPage->iModifiedNext == NIL_PGMPOOL_IDX \|\| pPage->cModifications);
736	Assert(pPage->iModifiedPrev == NIL_PGMPOOL_IDX \|\| pPage->cModifications);
737	pPage->iModifiedNext = NIL_PGMPOOL_IDX;
738	pPage->iModifiedPrev = NIL_PGMPOOL_IDX;
739	pPage->cModifications = 0;
740	}
741	}
742
743	#ifndef DEBUG_michael
744	AssertMsg(cModifiedPages == pPool->cModifiedPages, ("%d != %d\n", cModifiedPages, pPool->cModifiedPages));
745	#endif
746	pPool->iModifiedHead = NIL_PGMPOOL_IDX;
747	pPool->cModifiedPages = 0;
748
749	/*
750	* Clear all the GCPhys links and rebuild the phys ext free list.
751	*/
752	for (PPGMRAMRANGE pRam = pPool->CTX_SUFF(pVM)->pgm.s.CTX_SUFF(pRamRanges);
753	pRam;
754	pRam = pRam->CTX_SUFF(pNext))
755	{
756	iPage = pRam->cb >> PAGE_SHIFT;
757	while (iPage-- > 0)
758	PGM_PAGE_SET_TRACKING(&pRam->aPages[iPage], 0);
759	}
760
761	pPool->iPhysExtFreeHead = 0;
762	PPGMPOOLPHYSEXT paPhysExts = pPool->CTX_SUFF(paPhysExts);
763	const unsigned cMaxPhysExts = pPool->cMaxPhysExts;
764	for (unsigned i = 0; i < cMaxPhysExts; i++)
765	{
766	paPhysExts[i].iNext = i + 1;
767	paPhysExts[i].aidx[0] = NIL_PGMPOOL_IDX;
768	paPhysExts[i].apte[0] = NIL_PGMPOOL_PHYSEXT_IDX_PTE;
769	paPhysExts[i].aidx[1] = NIL_PGMPOOL_IDX;
770	paPhysExts[i].apte[1] = NIL_PGMPOOL_PHYSEXT_IDX_PTE;
771	paPhysExts[i].aidx[2] = NIL_PGMPOOL_IDX;
772	paPhysExts[i].apte[2] = NIL_PGMPOOL_PHYSEXT_IDX_PTE;
773	}
774	paPhysExts[cMaxPhysExts - 1].iNext = NIL_PGMPOOL_PHYSEXT_INDEX;
775
776
777	#ifdef PGMPOOL_WITH_OPTIMIZED_DIRTY_PT
778	/* Reset all dirty pages to reactivate the page monitoring. */
779	/* Note: we must do this after clearing all page references and shadow page tables as there might be stale references to
780	* recently removed MMIO ranges around that might otherwise end up asserting in pgmPoolTracDerefGCPhysHint
781	*/
782	for (unsigned i = 0; i < RT_ELEMENTS(pPool->aDirtyPages); i++)
783	{
784	PPGMPOOLPAGE pPage;
785	unsigned idxPage;
786
787	if (pPool->aDirtyPages[i].uIdx == NIL_PGMPOOL_IDX)
788	continue;
789
790	idxPage = pPool->aDirtyPages[i].uIdx;
791	AssertRelease(idxPage != NIL_PGMPOOL_IDX);
792	pPage = &pPool->aPages[idxPage];
793	Assert(pPage->idx == idxPage);
794	Assert(pPage->iMonitoredNext == NIL_PGMPOOL_IDX && pPage->iMonitoredPrev == NIL_PGMPOOL_IDX);
795
796	AssertMsg(pPage->fDirty, ("Page %RGp (slot=%d) not marked dirty!", pPage->GCPhys, i));
797
798	Log(("Reactivate dirty page %RGp\n", pPage->GCPhys));
799
800	/* First write protect the page again to catch all write accesses. (before checking for changes -> SMP) */
801	int rc = PGMHandlerPhysicalReset(pVM, pPage->GCPhys & PAGE_BASE_GC_MASK);
802	Assert(rc == VINF_SUCCESS);
803	pPage->fDirty = false;
804
805	pPool->aDirtyPages[i].uIdx = NIL_PGMPOOL_IDX;
806	}
807
808	/* Clear all dirty pages. */
809	pPool->idxFreeDirtyPage = 0;
810	pPool->cDirtyPages = 0;
811	#endif
812
813	/* Clear the PGM_SYNC_CLEAR_PGM_POOL flag on all VCPUs to prevent redundant flushes. */
814	for (VMCPUID idCpu = 0; idCpu < pVM->cCpus; idCpu++)
815	pVM->aCpus[idCpu].pgm.s.fSyncFlags &= ~PGM_SYNC_CLEAR_PGM_POOL;
816
817	/* Flush job finished. */
818	VM_FF_CLEAR(pVM, VM_FF_PGM_POOL_FLUSH_PENDING);
819	pPool->cPresent = 0;
820	pgmUnlock(pVM);
821
822	PGM_INVL_ALL_VCPU_TLBS(pVM);
823
824	if (fpvFlushRemTbl)
825	for (VMCPUID idCpu = 0; idCpu < pVM->cCpus; idCpu++)
826	CPUMSetChangedFlags(&pVM->aCpus[idCpu], CPUM_CHANGED_GLOBAL_TLB_FLUSH);
827
828	STAM_PROFILE_STOP(&pPool->StatClearAll, c);
829	return VINF_SUCCESS;
830	}
831
832
833	/**
834	* Clears the shadow page pool.
835	*
836	* @param pVM The VM handle.
837	* @param fFlushRemTlb When set, the REM TLB is scheduled for flushing as
838	* well.
839	*/
840	void pgmR3PoolClearAll(PVM pVM, bool fFlushRemTlb)
841	{
842	int rc = VMMR3EmtRendezvous(pVM, VMMEMTRENDEZVOUS_FLAGS_TYPE_ONCE, pgmR3PoolClearAllRendezvous, &fFlushRemTlb);
843	AssertRC(rc);
844	}
845
846	/**
847	* Protect all pgm pool page table entries to monitor writes
848	*
849	* @param pVM The VM handle.
850	*
851	* Remark: assumes the caller will flush all TLBs (!!)
852	*/
853	void pgmR3PoolWriteProtectPages(PVM pVM)
854	{
855	Assert(PGMIsLockOwner(pVM));
856	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
857	unsigned cLeft = pPool->cUsedPages;
858	unsigned iPage = pPool->cCurPages;
859	while (--iPage >= PGMPOOL_IDX_FIRST)
860	{
861	PPGMPOOLPAGE pPage = &pPool->aPages[iPage];
862	if ( pPage->GCPhys != NIL_RTGCPHYS
863	&& pPage->cPresent)
864	{
865	union
866	{
867	void *pv;
868	PX86PT pPT;
869	PPGMSHWPTPAE pPTPae;
870	PEPTPT pPTEpt;
871	} uShw;
872	uShw.pv = PGMPOOL_PAGE_2_PTR(pVM, pPage);
873
874	switch (pPage->enmKind)
875	{
876	/*
877	* We only care about shadow page tables.
878	*/
879	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_PT:
880	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_4MB:
881	case PGMPOOLKIND_32BIT_PT_FOR_PHYS:
882	for (unsigned iShw = 0; iShw < RT_ELEMENTS(uShw.pPT->a); iShw++)
883	{
884	if (uShw.pPT->a[iShw].n.u1Present)
885	uShw.pPT->a[iShw].n.u1Write = 0;
886	}
887	break;
888
889	case PGMPOOLKIND_PAE_PT_FOR_32BIT_PT:
890	case PGMPOOLKIND_PAE_PT_FOR_32BIT_4MB:
891	case PGMPOOLKIND_PAE_PT_FOR_PAE_PT:
892	case PGMPOOLKIND_PAE_PT_FOR_PAE_2MB:
893	case PGMPOOLKIND_PAE_PT_FOR_PHYS:
894	for (unsigned iShw = 0; iShw < RT_ELEMENTS(uShw.pPTPae->a); iShw++)
895	{
896	if (PGMSHWPTEPAE_IS_P(uShw.pPTPae->a[iShw]))
897	PGMSHWPTEPAE_SET_RO(uShw.pPTPae->a[iShw]);
898	}
899	break;
900
901	case PGMPOOLKIND_EPT_PT_FOR_PHYS:
902	for (unsigned iShw = 0; iShw < RT_ELEMENTS(uShw.pPTEpt->a); iShw++)
903	{
904	if (uShw.pPTEpt->a[iShw].n.u1Present)
905	uShw.pPTEpt->a[iShw].n.u1Write = 0;
906	}
907	break;
908
909	default:
910	break;
911	}
912	if (!--cLeft)
913	break;
914	}
915	}
916	}
917
918	#ifdef VBOX_WITH_DEBUGGER
919	/**
920	* The '.pgmpoolcheck' command.
921	*
922	* @returns VBox status.
923	* @param pCmd Pointer to the command descriptor (as registered).
924	* @param pCmdHlp Pointer to command helper functions.
925	* @param pVM Pointer to the current VM (if any).
926	* @param paArgs Pointer to (readonly) array of arguments.
927	* @param cArgs Number of arguments in the array.
928	*/
929	static DECLCALLBACK(int) pgmR3PoolCmdCheck(PCDBGCCMD pCmd, PDBGCCMDHLP pCmdHlp, PVM pVM, PCDBGCVAR paArgs, unsigned cArgs, PDBGCVAR pResult)
930	{
931	/*
932	* Validate input.
933	*/
934	if (!pVM)
935	return pCmdHlp->pfnPrintf(pCmdHlp, NULL, "error: The command requires a VM to be selected.\n");
936
937	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
938
939	for (unsigned i = 0; i < pPool->cCurPages; i++)
940	{
941	PPGMPOOLPAGE pPage = &pPool->aPages[i];
942	bool fFirstMsg = true;
943
944	/* Todo: cover other paging modes too. */
945	if (pPage->enmKind == PGMPOOLKIND_PAE_PT_FOR_PAE_PT)
946	{
947	PPGMSHWPTPAE pShwPT = (PPGMSHWPTPAE)PGMPOOL_PAGE_2_PTR(pPool->CTX_SUFF(pVM), pPage);
948	{
949	PX86PTPAE pGstPT;
950	PGMPAGEMAPLOCK LockPage;
951	int rc = PGMPhysGCPhys2CCPtrReadOnly(pVM, pPage->GCPhys, (const void **)&pGstPT, &LockPage); AssertReleaseRC(rc);
952
953	/* Check if any PTEs are out of sync. */
954	for (unsigned j = 0; j < RT_ELEMENTS(pShwPT->a); j++)
955	{
956	if (PGMSHWPTEPAE_IS_P(pShwPT->a[j]))
957	{
958	RTHCPHYS HCPhys = NIL_RTHCPHYS;
959	rc = PGMPhysGCPhys2HCPhys(pPool->CTX_SUFF(pVM), pGstPT->a[j].u & X86_PTE_PAE_PG_MASK, &HCPhys);
960	if ( rc != VINF_SUCCESS
961	\|\| PGMSHWPTEPAE_GET_HCPHYS(pShwPT->a[j]) != HCPhys)
962	{
963	if (fFirstMsg)
964	{
965	pCmdHlp->pfnPrintf(pCmdHlp, NULL, "Check pool page %RGp\n", pPage->GCPhys);
966	fFirstMsg = false;
967	}
968	pCmdHlp->pfnPrintf(pCmdHlp, NULL, "Mismatch HCPhys: rc=%Rrc idx=%d guest %RX64 shw=%RX64 vs %RHp\n", rc, j, pGstPT->a[j].u, PGMSHWPTEPAE_GET_LOG(pShwPT->a[j]), HCPhys);
969	}
970	else if ( PGMSHWPTEPAE_IS_RW(pShwPT->a[j])
971	&& !pGstPT->a[j].n.u1Write)
972	{
973	if (fFirstMsg)
974	{
975	pCmdHlp->pfnPrintf(pCmdHlp, NULL, "Check pool page %RGp\n", pPage->GCPhys);
976	fFirstMsg = false;
977	}
978	pCmdHlp->pfnPrintf(pCmdHlp, NULL, "Mismatch r/w gst/shw: idx=%d guest %RX64 shw=%RX64 vs %RHp\n", j, pGstPT->a[j].u, PGMSHWPTEPAE_GET_LOG(pShwPT->a[j]), HCPhys);
979	}
980	}
981	}
982	PGMPhysReleasePageMappingLock(pVM, &LockPage);
983	}
984
985	/* Make sure this page table can't be written to from any shadow mapping. */
986	RTHCPHYS HCPhysPT = NIL_RTHCPHYS;
987	int rc = PGMPhysGCPhys2HCPhys(pPool->CTX_SUFF(pVM), pPage->GCPhys, &HCPhysPT);
988	AssertMsgRC(rc, ("PGMPhysGCPhys2HCPhys failed with rc=%d for %RGp\n", rc, pPage->GCPhys));
989	if (rc == VINF_SUCCESS)
990	{
991	for (unsigned j = 0; j < pPool->cCurPages; j++)
992	{
993	PPGMPOOLPAGE pTempPage = &pPool->aPages[j];
994
995	if (pTempPage->enmKind == PGMPOOLKIND_PAE_PT_FOR_PAE_PT)
996	{
997	PPGMSHWPTPAE pShwPT2 = (PPGMSHWPTPAE)PGMPOOL_PAGE_2_PTR(pPool->CTX_SUFF(pVM), pTempPage);
998
999	for (unsigned k = 0; k < RT_ELEMENTS(pShwPT->a); k++)
1000	{
1001	if ( PGMSHWPTEPAE_IS_P_RW(pShwPT2->a[k])
1002	# ifdef PGMPOOL_WITH_OPTIMIZED_DIRTY_PT
1003	&& !pPage->fDirty
1004	# endif
1005	&& PGMSHWPTEPAE_GET_HCPHYS(pShwPT2->a[k]) == HCPhysPT)
1006	{
1007	if (fFirstMsg)
1008	{
1009	pCmdHlp->pfnPrintf(pCmdHlp, NULL, "Check pool page %RGp\n", pPage->GCPhys);
1010	fFirstMsg = false;
1011	}
1012	pCmdHlp->pfnPrintf(pCmdHlp, NULL, "Mismatch: r/w: GCPhys=%RGp idx=%d shw %RX64 %RX64\n", pTempPage->GCPhys, k, PGMSHWPTEPAE_GET_LOG(pShwPT->a[k]), PGMSHWPTEPAE_GET_LOG(pShwPT2->a[k]));
1013	}
1014	}
1015	}
1016	}
1017	}
1018	}
1019	}
1020	return VINF_SUCCESS;
1021	}
1022	#endif /* VBOX_WITH_DEBUGGER */

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/PGMPool.cpp@ 33192

Download in other formats: