PGMAllBth.h@ 7747

Last change on this file since 7747 was 7747, checked in by vboxsync, 17 years ago
PAE correction
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 152.7 KB

Line
1	/* $Id: PGMAllBth.h 7747 2008-04-04 15:23:58Z vboxsync $ */
2	/** @file
3	* VBox - Page Manager, Shadow+Guest Paging Template - All context code.
4	*
5	* This file is a big challenge!
6	*/
7
8	/*
9	* Copyright (C) 2006-2007 innotek GmbH
10	*
11	* This file is part of VirtualBox Open Source Edition (OSE), as
12	* available from http://www.virtualbox.org. This file is free software;
13	* you can redistribute it and/or modify it under the terms of the GNU
14	* General Public License (GPL) as published by the Free Software
15	* Foundation, in version 2 as it comes in the "COPYING" file of the
16	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
17	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
18	*/
19
20	/*******************************************************************************
21	* Internal Functions *
22	*******************************************************************************/
23	__BEGIN_DECLS
24	PGM_BTH_DECL(int, Trap0eHandler)(PVM pVM, RTGCUINT uErr, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault);
25	PGM_BTH_DECL(int, InvalidatePage)(PVM pVM, RTGCUINTPTR GCPtrPage);
26	PGM_BTH_DECL(int, SyncPage)(PVM pVM, GSTPDE PdeSrc, RTGCUINTPTR GCPtrPage, unsigned cPages, unsigned uErr);
27	PGM_BTH_DECL(int, CheckPageFault)(PVM pVM, uint32_t uErr, PSHWPDE pPdeDst, PGSTPDE pPdeSrc, RTGCUINTPTR GCPtrPage);
28	PGM_BTH_DECL(int, SyncPT)(PVM pVM, unsigned iPD, PGSTPD pPDSrc, RTGCUINTPTR GCPtrPage);
29	PGM_BTH_DECL(int, VerifyAccessSyncPage)(PVM pVM, RTGCUINTPTR Addr, unsigned fPage, unsigned uErr);
30	PGM_BTH_DECL(int, PrefetchPage)(PVM pVM, RTGCUINTPTR GCPtrPage);
31	PGM_BTH_DECL(int, SyncCR3)(PVM pVM, uint32_t cr0, uint32_t cr3, uint32_t cr4, bool fGlobal);
32	#ifdef VBOX_STRICT
33	PGM_BTH_DECL(unsigned, AssertCR3)(PVM pVM, uint32_t cr3, uint32_t cr4, RTGCUINTPTR GCPtr = 0, RTGCUINTPTR cb = ~(RTGCUINTPTR)0);
34	#endif
35	#ifdef PGMPOOL_WITH_USER_TRACKING
36	DECLINLINE(void) PGM_BTH_NAME(SyncPageWorkerTrackDeref)(PVM pVM, PPGMPOOLPAGE pShwPage, RTHCPHYS HCPhys);
37	#endif
38	__END_DECLS
39
40
41	/* Filter out some illegal combinations of guest and shadow paging, so we can remove redundant checks inside functions. */
42	#if PGM_GST_TYPE == PGM_TYPE_PAE && PGM_SHW_TYPE != PGM_TYPE_PAE
43	#error "Invalid combination; PAE guest implies PAE shadow"
44	#endif
45
46	#if (PGM_GST_TYPE == PGM_TYPE_REAL \|\| PGM_GST_TYPE == PGM_TYPE_PROT) \
47	&& !(PGM_SHW_TYPE == PGM_TYPE_32BIT \|\| PGM_SHW_TYPE == PGM_TYPE_PAE)
48	#error "Invalid combination; real or protected mode without paging implies 32 bits or PAE shadow paging."
49	#endif
50
51	#if (PGM_GST_TYPE == PGM_TYPE_32BIT \|\| PGM_GST_TYPE == PGM_TYPE_PAE) \
52	&& !(PGM_SHW_TYPE == PGM_TYPE_32BIT \|\| PGM_SHW_TYPE == PGM_TYPE_PAE)
53	#error "Invalid combination; 32 bits guest paging or PAE implies 32 bits or PAE shadow paging."
54	#endif
55
56	#if (PGM_GST_TYPE == PGM_TYPE_AMD64 && PGM_SHW_TYPE != PGM_TYPE_AMD64)
57	\|\| (PGM_SHW_TYPE == PGM_TYPE_AMD64 && PGM_GST_TYPE != PGM_TYPE_AMD64)
58	#error "Invalid combination; AMD64 guest implies AMD64 shadow and vice versa"
59	#endif
60
61	/**
62	* #PF Handler for raw-mode guest execution.
63	*
64	* @returns VBox status code (appropriate for trap handling and GC return).
65	* @param pVM VM Handle.
66	* @param uErr The trap error code.
67	* @param pRegFrame Trap register frame.
68	* @param pvFault The fault address.
69	*/
70	PGM_BTH_DECL(int, Trap0eHandler)(PVM pVM, RTGCUINT uErr, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault)
71	{
72	#if (PGM_GST_TYPE == PGM_TYPE_32BIT \|\| PGM_GST_TYPE == PGM_TYPE_REAL \|\| PGM_GST_TYPE == PGM_TYPE_PROT \|\| PGM_GST_TYPE == PGM_TYPE_PAE) && PGM_SHW_TYPE != PGM_TYPE_AMD64
73
74	# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE != PGM_TYPE_PAE
75	/*
76	* Hide the instruction fetch trap indicator for now.
77	*/
78	/** @todo NXE will change this and we must fix NXE in the switcher too! */
79	if (uErr & X86_TRAP_PF_ID)
80	{
81	uErr &= ~X86_TRAP_PF_ID;
82	TRPMSetErrorCode(pVM, uErr);
83	}
84	# endif
85
86	/*
87	* Get PDs.
88	*/
89	int rc;
90	# if PGM_WITH_PAGING(PGM_GST_TYPE)
91	# if PGM_GST_TYPE == PGM_TYPE_32BIT
92	const unsigned iPDSrc = (RTGCUINTPTR)pvFault >> GST_PD_SHIFT;
93	PGSTPD pPDSrc = CTXSUFF(pVM->pgm.s.pGuestPD);
94	# else /* PAE */
95	unsigned iPDSrc;
96	PGSTPD pPDSrc = pgmGstGetPaePDPtr(&pVM->pgm.s, (RTGCUINTPTR)pvFault, &iPDSrc);
97	# endif
98	# else
99	PGSTPD pPDSrc = NULL;
100	const unsigned iPDSrc = 0;
101	# endif
102
103	const unsigned iPDDst = (RTGCUINTPTR)pvFault >> SHW_PD_SHIFT;
104	# if PGM_SHW_TYPE == PGM_TYPE_32BIT
105	PX86PD pPDDst = pVM->pgm.s.CTXMID(p,32BitPD);
106	# else /* PAE */
107	PX86PDPAE pPDDst = pVM->pgm.s.CTXMID(ap,PaePDs)[0]; /* We treat this as a PD with 2048 entries. */
108	# endif
109
110	# if PGM_WITH_PAGING(PGM_GST_TYPE)
111	# ifdef PGM_SYNC_DIRTY_BIT
112	/*
113	* If we successfully correct the write protection fault due to dirty bit
114	* tracking, or this page fault is a genuine one, then return immediately.
115	*/
116	STAM_PROFILE_START(&pVM->pgm.s.StatCheckPageFault, e);
117	rc = PGM_BTH_NAME(CheckPageFault)(pVM, uErr, &pPDDst->a[iPDDst], &pPDSrc->a[iPDSrc], (RTGCUINTPTR)pvFault);
118	STAM_PROFILE_STOP(&pVM->pgm.s.StatCheckPageFault, e);
119	if ( rc == VINF_PGM_HANDLED_DIRTY_BIT_FAULT
120	\|\| rc == VINF_EM_RAW_GUEST_TRAP)
121	{
122	STAM_STATS({ pVM->pgm.s.CTXSUFF(pStatTrap0eAttribution)
123	= rc == VINF_PGM_HANDLED_DIRTY_BIT_FAULT ? &pVM->pgm.s.StatTrap0eDirtyAndAccessedBits : &pVM->pgm.s.StatTrap0eGuestTrap; });
124	LogBird(("Trap0eHandler: returns %s\n", rc == VINF_PGM_HANDLED_DIRTY_BIT_FAULT ? "VINF_SUCCESS" : "VINF_EM_RAW_GUEST_TRAP"));
125	return rc == VINF_PGM_HANDLED_DIRTY_BIT_FAULT ? VINF_SUCCESS : rc;
126	}
127	# endif
128
129	STAM_COUNTER_INC(&pVM->pgm.s.StatGCTrap0ePD[iPDSrc]);
130	# endif /* PGM_WITH_PAGING(PGM_GST_TYPE) */
131
132	/*
133	* A common case is the not-present error caused by lazy page table syncing.
134	*
135	* It is IMPORTANT that we weed out any access to non-present shadow PDEs here
136	* so we can safely assume that the shadow PT is present when calling SyncPage later.
137	*
138	* On failure, we ASSUME that SyncPT is out of memory or detected some kind
139	* of mapping conflict and defer to SyncCR3 in R3.
140	* (Again, we do NOT support access handlers for non-present guest pages.)
141	*
142	*/
143	# if PGM_WITH_PAGING(PGM_GST_TYPE)
144	GSTPDE PdeSrc = pPDSrc->a[iPDSrc];
145	# else
146	GSTPDE PdeSrc;
147	PdeSrc.au32[0] = 0; /* faked so we don't have to #ifdef everything */
148	PdeSrc.n.u1Present = 1;
149	PdeSrc.n.u1Write = 1;
150	PdeSrc.n.u1Accessed = 1;
151	PdeSrc.n.u1User = 1;
152	# endif
153	if ( !(uErr & X86_TRAP_PF_P) /* not set means page not present instead of page protection violation */
154	&& !pPDDst->a[iPDDst].n.u1Present
155	&& PdeSrc.n.u1Present
156	)
157
158	{
159	STAM_STATS({ pVM->pgm.s.CTXSUFF(pStatTrap0eAttribution) = &pVM->pgm.s.StatTrap0eSyncPT; });
160	STAM_PROFILE_START(&pVM->pgm.s.StatLazySyncPT, f);
161	LogFlow(("=>SyncPT %04x = %08x\n", iPDSrc, PdeSrc.au32[0]));
162	rc = PGM_BTH_NAME(SyncPT)(pVM, iPDSrc, pPDSrc, (RTGCUINTPTR)pvFault);
163	if (VBOX_SUCCESS(rc))
164	{
165	STAM_PROFILE_STOP(&pVM->pgm.s.StatLazySyncPT, f);
166	return rc;
167	}
168	Log(("SyncPT: %d failed!! rc=%d\n", iPDSrc, rc));
169	VM_FF_SET(pVM, VM_FF_PGM_SYNC_CR3); /** @todo no need to do global sync, right? */
170	STAM_PROFILE_STOP(&pVM->pgm.s.StatLazySyncPT, f);
171	return VINF_PGM_SYNC_CR3;
172	}
173
174	# if PGM_WITH_PAGING(PGM_GST_TYPE)
175	/*
176	* Check if this address is within any of our mappings.
177	*
178	* This is very fast and it's gonna save us a bit of effort below and prevent
179	* us from screwing ourself with MMIO2 pages which have a GC Mapping (VRam).
180	* (BTW, it's impossible to have physical access handlers in a mapping.)
181	*/
182	if (pgmMapAreMappingsEnabled(&pVM->pgm.s))
183	{
184	STAM_PROFILE_START(&pVM->pgm.s.StatMapping, a);
185	PPGMMAPPING pMapping = CTXALLSUFF(pVM->pgm.s.pMappings);
186	for ( ; pMapping; pMapping = CTXALLSUFF(pMapping->pNext))
187	{
188	if ((RTGCUINTPTR)pvFault < (RTGCUINTPTR)pMapping->GCPtr)
189	break;
190	if ((RTGCUINTPTR)pvFault - (RTGCUINTPTR)pMapping->GCPtr < pMapping->cb)
191	{
192	/*
193	* The first thing we check is if we've got an undetected conflict.
194	*/
195	if (!pVM->pgm.s.fMappingsFixed)
196	{
197	unsigned iPT = pMapping->cPTs;
198	while (iPT-- > 0)
199	if (pPDSrc->a[iPDSrc + iPT].n.u1Present)
200	{
201	STAM_COUNTER_INC(&pVM->pgm.s.StatGCTrap0eConflicts);
202	Log(("Trap0e: Detected Conflict %VGv-%VGv\n", pMapping->GCPtr, pMapping->GCPtrLast));
203	VM_FF_SET(pVM, VM_FF_PGM_SYNC_CR3); /** @todo no need to do global sync,right? */
204	STAM_PROFILE_STOP(&pVM->pgm.s.StatMapping, a);
205	return VINF_PGM_SYNC_CR3;
206	}
207	}
208
209	/*
210	* Check if the fault address is in a virtual page access handler range.
211	*/
212	PPGMVIRTHANDLER pCur = (PPGMVIRTHANDLER)RTAvlroGCPtrRangeGet(&CTXSUFF(pVM->pgm.s.pTrees)->HyperVirtHandlers, pvFault);
213	if ( pCur
214	&& (RTGCUINTPTR)pvFault - (RTGCUINTPTR)pCur->GCPtr < pCur->cb
215	&& uErr & X86_TRAP_PF_RW)
216	{
217	# ifdef IN_GC
218	STAM_PROFILE_START(&pCur->Stat, h);
219	rc = CTXSUFF(pCur->pfnHandler)(pVM, uErr, pRegFrame, pvFault, pCur->GCPtr, (RTGCUINTPTR)pvFault - (RTGCUINTPTR)pCur->GCPtr);
220	STAM_PROFILE_STOP(&pCur->Stat, h);
221	# else
222	AssertFailed();
223	rc = VINF_EM_RAW_EMULATE_INSTR; /* can't happen with VMX */
224	# endif
225	STAM_COUNTER_INC(&pVM->pgm.s.StatTrap0eMapHandler);
226	STAM_PROFILE_STOP(&pVM->pgm.s.StatMapping, a);
227	return rc;
228	}
229
230	/*
231	* Pretend we're not here and let the guest handle the trap.
232	*/
233	TRPMSetErrorCode(pVM, uErr & ~X86_TRAP_PF_P);
234	STAM_COUNTER_INC(&pVM->pgm.s.StatGCTrap0eMap);
235	LogFlow(("PGM: Mapping access -> route trap to recompiler!\n"));
236	STAM_PROFILE_STOP(&pVM->pgm.s.StatMapping, a);
237	return VINF_EM_RAW_GUEST_TRAP;
238	}
239	}
240	STAM_PROFILE_STOP(&pVM->pgm.s.StatMapping, a);
241	} /* pgmAreMappingsEnabled(&pVM->pgm.s) */
242	# endif /* PGM_WITH_PAGING(PGM_GST_TYPE) */
243
244	/*
245	* Check if this fault address is flagged for special treatment,
246	* which means we'll have to figure out the physical address and
247	* check flags associated with it.
248	*
249	* ASSUME that we can limit any special access handling to pages
250	* in page tables which the guest believes to be present.
251	*/
252	if (PdeSrc.n.u1Present)
253	{
254	RTGCPHYS GCPhys = NIL_RTGCPHYS;
255
256	# if PGM_WITH_PAGING(PGM_GST_TYPE)
257	uint32_t cr4 = CPUMGetGuestCR4(pVM);
258	if ( PdeSrc.b.u1Size
259	&& (cr4 & X86_CR4_PSE))
260	GCPhys = (PdeSrc.u & GST_PDE_BIG_PG_MASK)
261	\| ((RTGCPHYS)pvFault & (GST_BIG_PAGE_OFFSET_MASK ^ PAGE_OFFSET_MASK));
262	else
263	{
264	PX86PT pPTSrc;
265	# ifdef IN_GC
266	rc = PGMGCDynMapGCPage(pVM, PdeSrc.u & GST_PDE_PG_MASK, (void **)&pPTSrc);
267	# else
268	pPTSrc = (PX86PT)MMPhysGCPhys2HCVirt(pVM, PdeSrc.u & GST_PDE_PG_MASK, sizeof(*pPTSrc));
269	if (pPTSrc == 0)
270	rc = VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS;
271	# endif
272	if (VBOX_SUCCESS(rc))
273	{
274	unsigned iPTESrc = ((RTGCUINTPTR)pvFault >> PAGE_SHIFT) & GST_PT_MASK;
275	if (pPTSrc->a[iPTESrc].n.u1Present)
276	GCPhys = pPTSrc->a[iPTESrc].u & GST_PTE_PG_MASK;
277	}
278	}
279	# else
280	/* No paging so the fault address is the physical address */
281	GCPhys = (RTGCPHYS)((RTGCUINTPTR)pvFault & ~PAGE_OFFSET_MASK);
282	# endif /* PGM_WITH_PAGING(PGM_GST_TYPE) */
283
284	/*
285	* If we have a GC address we'll check if it has any flags set.
286	*/
287	if (GCPhys != NIL_RTGCPHYS)
288	{
289	STAM_PROFILE_START(&pVM->pgm.s.StatHandlers, b);
290
291	PPGMPAGE pPage;
292	rc = pgmPhysGetPageEx(&pVM->pgm.s, GCPhys, &pPage);
293	if (VBOX_SUCCESS(rc))
294	{
295	if (PGM_PAGE_HAS_ANY_HANDLERS(pPage))
296	{
297	if (PGM_PAGE_HAS_ANY_PHYSICAL_HANDLERS(pPage))
298	{
299	/*
300	* Physical page access handler.
301	*/
302	const RTGCPHYS GCPhysFault = GCPhys \| ((RTGCUINTPTR)pvFault & PAGE_OFFSET_MASK);
303	PPGMPHYSHANDLER pCur = (PPGMPHYSHANDLER)RTAvlroGCPhysRangeGet(&CTXSUFF(pVM->pgm.s.pTrees)->PhysHandlers, GCPhysFault);
304	if (pCur)
305	{
306	# ifdef PGM_SYNC_N_PAGES
307	/*
308	* If the region is write protected and we got a page not present fault, then sync
309	* the pages. If the fault was caused by a read, then restart the instruction.
310	* In case of write access continue to the GC write handler.
311	*
312	* ASSUMES that there is only one handler per page or that they have similar write properties.
313	*/
314	if ( pCur->enmType == PGMPHYSHANDLERTYPE_PHYSICAL_WRITE
315	&& !(uErr & X86_TRAP_PF_P))
316	{
317	rc = PGM_BTH_NAME(SyncPage)(pVM, PdeSrc, (RTGCUINTPTR)pvFault, PGM_SYNC_NR_PAGES, uErr);
318	if ( VBOX_FAILURE(rc)
319	\|\| !(uErr & X86_TRAP_PF_RW)
320	\|\| rc == VINF_PGM_SYNCPAGE_MODIFIED_PDE)
321	{
322	AssertRC(rc);
323	STAM_COUNTER_INC(&pVM->pgm.s.StatHandlersOutOfSync);
324	STAM_PROFILE_STOP(&pVM->pgm.s.StatHandlers, b);
325	STAM_STATS({ pVM->pgm.s.CTXSUFF(pStatTrap0eAttribution) = &pVM->pgm.s.StatTrap0eOutOfSyncHndPhys; });
326	return rc;
327	}
328	}
329	# endif
330
331	AssertMsg( pCur->enmType != PGMPHYSHANDLERTYPE_PHYSICAL_WRITE
332	\|\| (pCur->enmType == PGMPHYSHANDLERTYPE_PHYSICAL_WRITE && (uErr & X86_TRAP_PF_RW)),
333	("Unexpected trap for physical handler: %08X (phys=%08x) HCPhys=%X uErr=%X, enum=%d\n", pvFault, GCPhys, pPage->HCPhys, uErr, pCur->enmType));
334
335	#if defined(IN_GC) \|\| defined(IN_RING0)
336	if (CTXALLSUFF(pCur->pfnHandler))
337	{
338	STAM_PROFILE_START(&pCur->Stat, h);
339	rc = pCur->CTXALLSUFF(pfnHandler)(pVM, uErr, pRegFrame, pvFault, GCPhysFault, CTXALLSUFF(pCur->pvUser));
340	STAM_PROFILE_STOP(&pCur->Stat, h);
341	}
342	else
343	#endif
344	rc = VINF_EM_RAW_EMULATE_INSTR;
345	STAM_COUNTER_INC(&pVM->pgm.s.StatHandlersPhysical);
346	STAM_PROFILE_STOP(&pVM->pgm.s.StatHandlers, b);
347	STAM_STATS({ pVM->pgm.s.CTXSUFF(pStatTrap0eAttribution) = &pVM->pgm.s.StatTrap0eHndPhys; });
348	return rc;
349	}
350	}
351	# if PGM_WITH_PAGING(PGM_GST_TYPE)
352	else
353	{
354	# ifdef PGM_SYNC_N_PAGES
355	/*
356	* If the region is write protected and we got a page not present fault, then sync
357	* the pages. If the fault was caused by a read, then restart the instruction.
358	* In case of write access continue to the GC write handler.
359	*/
360	if ( PGM_PAGE_GET_HNDL_VIRT_STATE(pPage) < PGM_PAGE_HNDL_PHYS_STATE_ALL
361	&& !(uErr & X86_TRAP_PF_P))
362	{
363	rc = PGM_BTH_NAME(SyncPage)(pVM, PdeSrc, (RTGCUINTPTR)pvFault, PGM_SYNC_NR_PAGES, uErr);
364	if ( VBOX_FAILURE(rc)
365	\|\| rc == VINF_PGM_SYNCPAGE_MODIFIED_PDE
366	\|\| !(uErr & X86_TRAP_PF_RW))
367	{
368	AssertRC(rc);
369	STAM_COUNTER_INC(&pVM->pgm.s.StatHandlersOutOfSync);
370	STAM_PROFILE_STOP(&pVM->pgm.s.StatHandlers, b);
371	STAM_STATS({ pVM->pgm.s.CTXSUFF(pStatTrap0eAttribution) = &pVM->pgm.s.StatTrap0eOutOfSyncHndVirt; });
372	return rc;
373	}
374	}
375	# endif
376	/*
377	* Ok, it's an virtual page access handler.
378	*
379	* Since it's faster to search by address, we'll do that first
380	* and then retry by GCPhys if that fails.
381	*/
382	/** @todo r=bird: perhaps we should consider looking up by physical address directly now? */
383	/** @note r=svl: true, but lookup on virtual address should remain as a fallback as phys & virt trees might be out of sync, because the
384	* page was changed without us noticing it (not-present -> present without invlpg or mov cr3, xxx)
385	*/
386	PPGMVIRTHANDLER pCur = (PPGMVIRTHANDLER)RTAvlroGCPtrRangeGet(&CTXSUFF(pVM->pgm.s.pTrees)->VirtHandlers, pvFault);
387	if (pCur)
388	{
389	AssertMsg(!((RTGCUINTPTR)pvFault - (RTGCUINTPTR)pCur->GCPtr < pCur->cb)
390	\|\| ( pCur->enmType != PGMVIRTHANDLERTYPE_WRITE
391	\|\| !(uErr & X86_TRAP_PF_P)
392	\|\| (pCur->enmType == PGMVIRTHANDLERTYPE_WRITE && (uErr & X86_TRAP_PF_RW))),
393	("Unexpected trap for virtual handler: %VGv (phys=%VGp) HCPhys=%HGp uErr=%X, enum=%d\n", pvFault, GCPhys, pPage->HCPhys, uErr, pCur->enmType));
394
395	if ( (RTGCUINTPTR)pvFault - (RTGCUINTPTR)pCur->GCPtr < pCur->cb
396	&& ( uErr & X86_TRAP_PF_RW
397	\|\| pCur->enmType != PGMVIRTHANDLERTYPE_WRITE ) )
398	{
399	# ifdef IN_GC
400	STAM_PROFILE_START(&pCur->Stat, h);
401	rc = CTXSUFF(pCur->pfnHandler)(pVM, uErr, pRegFrame, pvFault, pCur->GCPtr, (RTGCUINTPTR)pvFault - (RTGCUINTPTR)pCur->GCPtr);
402	STAM_PROFILE_STOP(&pCur->Stat, h);
403	# else
404	rc = VINF_EM_RAW_EMULATE_INSTR; /** @todo for VMX */
405	# endif
406	STAM_COUNTER_INC(&pVM->pgm.s.StatHandlersVirtual);
407	STAM_PROFILE_STOP(&pVM->pgm.s.StatHandlers, b);
408	STAM_STATS({ pVM->pgm.s.CTXSUFF(pStatTrap0eAttribution) = &pVM->pgm.s.StatTrap0eHndVirt; });
409	return rc;
410	}
411	/* Unhandled part of a monitored page */
412	}
413	else
414	{
415	/* Check by physical address. */
416	PPGMVIRTHANDLER pCur;
417	unsigned iPage;
418	rc = pgmHandlerVirtualFindByPhysAddr(pVM, GCPhys + ((RTGCUINTPTR)pvFault & PAGE_OFFSET_MASK),
419	&pCur, &iPage);
420	Assert(VBOX_SUCCESS(rc) \|\| !pCur);
421	if ( pCur
422	&& ( uErr & X86_TRAP_PF_RW
423	\|\| pCur->enmType != PGMVIRTHANDLERTYPE_WRITE ) )
424	{
425	Assert((pCur->aPhysToVirt[iPage].Core.Key & X86_PTE_PAE_PG_MASK) == GCPhys);
426	# ifdef IN_GC
427	RTGCUINTPTR off = (iPage << PAGE_SHIFT) + ((RTGCUINTPTR)pvFault & PAGE_OFFSET_MASK) - ((RTGCUINTPTR)pCur->GCPtr & PAGE_OFFSET_MASK);
428	Assert(off < pCur->cb);
429	STAM_PROFILE_START(&pCur->Stat, h);
430	rc = CTXSUFF(pCur->pfnHandler)(pVM, uErr, pRegFrame, pvFault, pCur->GCPtr, off);
431	STAM_PROFILE_STOP(&pCur->Stat, h);
432	# else
433	rc = VINF_EM_RAW_EMULATE_INSTR; /** @todo for VMX */
434	# endif
435	STAM_COUNTER_INC(&pVM->pgm.s.StatHandlersVirtualByPhys);
436	STAM_PROFILE_STOP(&pVM->pgm.s.StatHandlers, b);
437	STAM_STATS({ pVM->pgm.s.CTXSUFF(pStatTrap0eAttribution) = &pVM->pgm.s.StatTrap0eHndVirt; });
438	return rc;
439	}
440	}
441	}
442	# endif /* PGM_WITH_PAGING(PGM_GST_TYPE) */
443
444	/*
445	* There is a handled area of the page, but this fault doesn't belong to it.
446	* We must emulate the instruction.
447	*
448	* To avoid crashing (non-fatal) in the interpreter and go back to the recompiler
449	* we first check if this was a page-not-present fault for a page with only
450	* write access handlers. Restart the instruction if it wasn't a write access.
451	*/
452	STAM_COUNTER_INC(&pVM->pgm.s.StatHandlersUnhandled);
453
454	if ( !PGM_PAGE_HAS_ACTIVE_ALL_HANDLERS(pPage)
455	&& !(uErr & X86_TRAP_PF_P))
456	{
457	rc = PGM_BTH_NAME(SyncPage)(pVM, PdeSrc, (RTGCUINTPTR)pvFault, PGM_SYNC_NR_PAGES, uErr);
458	if ( VBOX_FAILURE(rc)
459	\|\| rc == VINF_PGM_SYNCPAGE_MODIFIED_PDE
460	\|\| !(uErr & X86_TRAP_PF_RW))
461	{
462	AssertRC(rc);
463	STAM_COUNTER_INC(&pVM->pgm.s.StatHandlersOutOfSync);
464	STAM_PROFILE_STOP(&pVM->pgm.s.StatHandlers, b);
465	STAM_STATS({ pVM->pgm.s.CTXSUFF(pStatTrap0eAttribution) = &pVM->pgm.s.StatTrap0eOutOfSyncHndPhys; });
466	return rc;
467	}
468	}
469
470	/** @todo This particular case can cause quite a lot of overhead. E.g. early stage of kernel booting in Ubuntu 6.06
471	* It's writing to an unhandled part of the LDT page several million times.
472	*/
473	rc = PGMInterpretInstruction(pVM, pRegFrame, pvFault);
474	LogFlow(("PGM: PGMInterpretInstruction -> rc=%d HCPhys=%RHp%s%s\n",
475	rc, pPage->HCPhys,
476	PGM_PAGE_HAS_ANY_PHYSICAL_HANDLERS(pPage) ? " phys" : "",
477	PGM_PAGE_HAS_ANY_VIRTUAL_HANDLERS(pPage) ? " virt" : ""));
478	STAM_PROFILE_STOP(&pVM->pgm.s.StatHandlers, b);
479	STAM_STATS({ pVM->pgm.s.CTXSUFF(pStatTrap0eAttribution) = &pVM->pgm.s.StatTrap0eHndUnhandled; });
480	return rc;
481	} /* if any kind of handler */
482
483	# if PGM_WITH_PAGING(PGM_GST_TYPE)
484	if (uErr & X86_TRAP_PF_P)
485	{
486	/*
487	* The page isn't marked, but it might still be monitored by a virtual page access handler.
488	* (ASSUMES no temporary disabling of virtual handlers.)
489	*/
490	/** @todo r=bird: Since the purpose is to catch out of sync pages with virtual handler(s) here,
491	* we should correct both the shadow page table and physical memory flags, and not only check for
492	* accesses within the handler region but for access to pages with virtual handlers. */
493	PPGMVIRTHANDLER pCur = (PPGMVIRTHANDLER)RTAvlroGCPtrRangeGet(&CTXSUFF(pVM->pgm.s.pTrees)->VirtHandlers, pvFault);
494	if (pCur)
495	{
496	AssertMsg( !((RTGCUINTPTR)pvFault - (RTGCUINTPTR)pCur->GCPtr < pCur->cb)
497	\|\| ( pCur->enmType != PGMVIRTHANDLERTYPE_WRITE
498	\|\| !(uErr & X86_TRAP_PF_P)
499	\|\| (pCur->enmType == PGMVIRTHANDLERTYPE_WRITE && (uErr & X86_TRAP_PF_RW))),
500	("Unexpected trap for virtual handler: %08X (phys=%08x) HCPhys=%X uErr=%X, enum=%d\n", pvFault, GCPhys, pPage->HCPhys, uErr, pCur->enmType));
501
502	if ( (RTGCUINTPTR)pvFault - (RTGCUINTPTR)pCur->GCPtr < pCur->cb
503	&& ( uErr & X86_TRAP_PF_RW
504	\|\| pCur->enmType != PGMVIRTHANDLERTYPE_WRITE ) )
505	{
506	# ifdef IN_GC
507	STAM_PROFILE_START(&pCur->Stat, h);
508	rc = CTXSUFF(pCur->pfnHandler)(pVM, uErr, pRegFrame, pvFault, pCur->GCPtr, (RTGCUINTPTR)pvFault - (RTGCUINTPTR)pCur->GCPtr);
509	STAM_PROFILE_STOP(&pCur->Stat, h);
510	# else
511	rc = VINF_EM_RAW_EMULATE_INSTR; /** @todo for VMX */
512	# endif
513	STAM_COUNTER_INC(&pVM->pgm.s.StatHandlersVirtualUnmarked);
514	STAM_PROFILE_STOP(&pVM->pgm.s.StatHandlers, b);
515	STAM_STATS({ pVM->pgm.s.CTXSUFF(pStatTrap0eAttribution) = &pVM->pgm.s.StatTrap0eHndVirt; });
516	return rc;
517	}
518	}
519	}
520	# endif /* PGM_WITH_PAGING(PGM_GST_TYPE) */
521	}
522	STAM_PROFILE_STOP(&pVM->pgm.s.StatHandlers, b);
523
524	# ifdef PGM_OUT_OF_SYNC_IN_GC
525	/*
526	* We are here only if page is present in Guest page tables and trap is not handled
527	* by our handlers.
528	* Check it for page out-of-sync situation.
529	*/
530	STAM_PROFILE_START(&pVM->pgm.s.StatOutOfSync, c);
531
532	if (!(uErr & X86_TRAP_PF_P))
533	{
534	/*
535	* Page is not present in our page tables.
536	* Try to sync it!
537	* BTW, fPageShw is invalid in this branch!
538	*/
539	if (uErr & X86_TRAP_PF_US)
540	STAM_COUNTER_INC(&pVM->pgm.s.StatGCPageOutOfSyncUser);
541	else /* supervisor */
542	STAM_COUNTER_INC(&pVM->pgm.s.StatGCPageOutOfSyncSupervisor);
543
544	# if defined(LOG_ENABLED) && !defined(IN_RING0)
545	RTGCPHYS GCPhys;
546	uint64_t fPageGst;
547	PGMGstGetPage(pVM, pvFault, &fPageGst, &GCPhys);
548	Log(("Page out of sync: %p eip=%08x PdeSrc.n.u1User=%d fPageGst=%08llx GCPhys=%VGp scan=%d\n",
549	pvFault, pRegFrame->eip, PdeSrc.n.u1User, fPageGst, GCPhys, CSAMDoesPageNeedScanning(pVM, (RTGCPTR)pRegFrame->eip)));
550	# endif /* LOG_ENABLED */
551
552	# if PGM_WITH_PAGING(PGM_GST_TYPE) && !defined(IN_RING0)
553	if (CPUMGetGuestCPL(pVM, pRegFrame) == 0)
554	{
555	uint64_t fPageGst;
556	rc = PGMGstGetPage(pVM, pvFault, &fPageGst, NULL);
557	if ( VBOX_SUCCESS(rc)
558	&& !(fPageGst & X86_PTE_US))
559	{
560	/* Note: can't check for X86_TRAP_ID bit, because that requires execute disable support on the CPU */
561	if ( pvFault == (RTGCPTR)pRegFrame->eip
562	\|\| (RTGCUINTPTR)pvFault - pRegFrame->eip < 8 /* instruction crossing a page boundary */
563	# ifdef CSAM_DETECT_NEW_CODE_PAGES
564	\|\| ( !PATMIsPatchGCAddr(pVM, (RTGCPTR)pRegFrame->eip)
565	&& CSAMDoesPageNeedScanning(pVM, (RTGCPTR)pRegFrame->eip)) /* any new code we encounter here */
566	# endif /* CSAM_DETECT_NEW_CODE_PAGES */
567	)
568	{
569	LogFlow(("CSAMExecFault %VGv\n", pRegFrame->eip));
570	rc = CSAMExecFault(pVM, (RTGCPTR)pRegFrame->eip);
571	if (rc != VINF_SUCCESS)
572	{
573	/*
574	* CSAM needs to perform a job in ring 3.
575	*
576	* Sync the page before going to the host context; otherwise we'll end up in a loop if
577	* CSAM fails (e.g. instruction crosses a page boundary and the next page is not present)
578	*/
579	LogFlow(("CSAM ring 3 job\n"));
580	int rc2 = PGM_BTH_NAME(SyncPage)(pVM, PdeSrc, (RTGCUINTPTR)pvFault, 1, uErr);
581	AssertRC(rc2);
582
583	STAM_PROFILE_STOP(&pVM->pgm.s.StatOutOfSync, c);
584	STAM_STATS({ pVM->pgm.s.CTXSUFF(pStatTrap0eAttribution) = &pVM->pgm.s.StatTrap0eCSAM; });
585	return rc;
586	}
587	}
588	# ifdef CSAM_DETECT_NEW_CODE_PAGES
589	else
590	if ( uErr == X86_TRAP_PF_RW
591	&& pRegFrame->ecx >= 0x100 /* early check for movswd count */
592	&& pRegFrame->ecx < 0x10000
593	)
594	{
595	/* In case of a write to a non-present supervisor shadow page, we'll take special precautions
596	* to detect loading of new code pages.
597	*/
598
599	/*
600	* Decode the instruction.
601	*/
602	RTGCPTR PC;
603	rc = SELMValidateAndConvertCSAddr(pVM, pRegFrame->eflags, pRegFrame->ss, pRegFrame->cs, &pRegFrame->csHid, (RTGCPTR)pRegFrame->eip, &PC);
604	if (rc == VINF_SUCCESS)
605	{
606	DISCPUSTATE Cpu;
607	uint32_t cbOp;
608	rc = EMInterpretDisasOneEx(pVM, (RTGCUINTPTR)PC, pRegFrame, &Cpu, &cbOp);
609
610	/* For now we'll restrict this to rep movsw/d instructions */
611	if ( rc == VINF_SUCCESS
612	&& Cpu.pCurInstr->opcode == OP_MOVSWD
613	&& (Cpu.prefix & PREFIX_REP))
614	{
615	CSAMMarkPossibleCodePage(pVM, pvFault);
616	}
617	}
618	}
619	# endif /* CSAM_DETECT_NEW_CODE_PAGES */
620
621	/*
622	* Mark this page as safe.
623	*/
624	/** @todo not correct for pages that contain both code and data!! */
625	Log2(("CSAMMarkPage %p; scanned=%d\n", pvFault, true));
626	CSAMMarkPage(pVM, pvFault, true);
627	}
628	}
629	# endif /* PGM_WITH_PAGING(PGM_GST_TYPE) && !defined(IN_RING0) */
630	rc = PGM_BTH_NAME(SyncPage)(pVM, PdeSrc, (RTGCUINTPTR)pvFault, PGM_SYNC_NR_PAGES, uErr);
631	if (VBOX_SUCCESS(rc))
632	{
633	/* The page was successfully synced, return to the guest. */
634	STAM_PROFILE_STOP(&pVM->pgm.s.StatOutOfSync, c);
635	STAM_STATS({ pVM->pgm.s.CTXSUFF(pStatTrap0eAttribution) = &pVM->pgm.s.StatTrap0eOutOfSync; });
636	return VINF_SUCCESS;
637	}
638	}
639	else
640	{
641	/*
642	* A side effect of not flushing global PDEs are out of sync pages due
643	* to physical monitored regions, that are no longer valid.
644	* Assume for now it only applies to the read/write flag
645	*/
646	if (VBOX_SUCCESS(rc) && (uErr & X86_TRAP_PF_RW))
647	{
648	if (uErr & X86_TRAP_PF_US)
649	STAM_COUNTER_INC(&pVM->pgm.s.StatGCPageOutOfSyncUser);
650	else /* supervisor */
651	STAM_COUNTER_INC(&pVM->pgm.s.StatGCPageOutOfSyncSupervisor);
652
653
654	/*
655	* Note: Do NOT use PGM_SYNC_NR_PAGES here. That only works if the page is not present, which is not true in this case.
656	*/
657	rc = PGM_BTH_NAME(SyncPage)(pVM, PdeSrc, (RTGCUINTPTR)pvFault, 1, uErr);
658	if (VBOX_SUCCESS(rc))
659	{
660	/*
661	* Page was successfully synced, return to guest.
662	*/
663	# ifdef VBOX_STRICT
664	RTGCPHYS GCPhys;
665	uint64_t fPageGst;
666	rc = PGMGstGetPage(pVM, pvFault, &fPageGst, &GCPhys);
667	Assert(VBOX_SUCCESS(rc) && fPageGst & X86_PTE_RW);
668	LogFlow(("Obsolete physical monitor page out of sync %VGv - phys %VGp flags=%08llx\n", pvFault, GCPhys, (uint64_t)fPageGst));
669
670	uint64_t fPageShw;
671	rc = PGMShwGetPage(pVM, pvFault, &fPageShw, NULL);
672	Assert(VBOX_SUCCESS(rc) && fPageShw & X86_PTE_RW);
673	# endif /* VBOX_STRICT */
674	STAM_PROFILE_STOP(&pVM->pgm.s.StatOutOfSync, c);
675	STAM_STATS({ pVM->pgm.s.CTXSUFF(pStatTrap0eAttribution) = &pVM->pgm.s.StatTrap0eOutOfSyncObsHnd; });
676	return VINF_SUCCESS;
677	}
678
679	/* Check to see if we need to emulate the instruction as X86_CR0_WP has been cleared. */
680	if ( CPUMGetGuestCPL(pVM, pRegFrame) == 0
681	&& ((CPUMGetGuestCR0(pVM) & (X86_CR0_WP\|X86_CR0_PG)) == X86_CR0_PG)
682	&& (uErr & (X86_TRAP_PF_RW \| X86_TRAP_PF_P)) == (X86_TRAP_PF_RW \| X86_TRAP_PF_P))
683	{
684	uint64_t fPageGst;
685	rc = PGMGstGetPage(pVM, pvFault, &fPageGst, NULL);
686	if ( VBOX_SUCCESS(rc)
687	&& !(fPageGst & X86_PTE_RW))
688	{
689	rc = PGMInterpretInstruction(pVM, pRegFrame, pvFault);
690	if (VBOX_SUCCESS(rc))
691	STAM_COUNTER_INC(&pVM->pgm.s.StatTrap0eWPEmulGC);
692	else
693	STAM_COUNTER_INC(&pVM->pgm.s.StatTrap0eWPEmulR3);
694	return rc;
695	}
696	else
697	AssertMsgFailed(("Unexpected r/w page %x flag=%x\n", pvFault, (uint32_t)fPageGst));
698	}
699
700	}
701
702	# if PGM_WITH_PAGING(PGM_GST_TYPE)
703	# ifdef VBOX_STRICT
704	/*
705	* Check for VMM page flags vs. Guest page flags consistency.
706	* Currently only for debug purposes.
707	*/
708	if (VBOX_SUCCESS(rc))
709	{
710	/* Get guest page flags. */
711	uint64_t fPageGst;
712	rc = PGMGstGetPage(pVM, pvFault, &fPageGst, NULL);
713	if (VBOX_SUCCESS(rc))
714	{
715	uint64_t fPageShw;
716	rc = PGMShwGetPage(pVM, pvFault, &fPageShw, NULL);
717
718	/*
719	* Compare page flags.
720	* Note: we have AVL, A, D bits desynched.
721	*/
722	AssertMsg((fPageShw & ~(X86_PTE_A \| X86_PTE_D \| X86_PTE_AVL_MASK)) == (fPageGst & ~(X86_PTE_A \| X86_PTE_D \| X86_PTE_AVL_MASK)),
723	("Page flags mismatch! pvFault=%p GCPhys=%VGp fPageShw=%08llx fPageGst=%08llx\n", pvFault, GCPhys, fPageShw, fPageGst));
724	}
725	else
726	AssertMsgFailed(("PGMGstGetPage rc=%Vrc\n", rc));
727	}
728	else
729	AssertMsgFailed(("PGMGCGetPage rc=%Vrc\n", rc));
730	# endif /* VBOX_STRICT */
731	# endif /* PGM_WITH_PAGING(PGM_GST_TYPE) */
732	}
733	STAM_PROFILE_STOP(&pVM->pgm.s.StatOutOfSync, c);
734	# endif /* PGM_OUT_OF_SYNC_IN_GC */
735	}
736	else
737	{
738	/*
739	* Page not present in Guest OS or invalid page table address.
740	* This is potential virtual page access handler food.
741	*
742	* For the present we'll say that our access handlers don't
743	* work for this case - we've already discarded the page table
744	* not present case which is identical to this.
745	*
746	* When we perchance find we need this, we will probably have AVL
747	* trees (offset based) to operate on and we can measure their speed
748	* agains mapping a page table and probably rearrange this handling
749	* a bit. (Like, searching virtual ranges before checking the
750	* physical address.)
751	*/
752	}
753	}
754
755
756	# if PGM_WITH_PAGING(PGM_GST_TYPE)
757	/*
758	* Conclusion, this is a guest trap.
759	*/
760	LogFlow(("PGM: Unhandled #PF -> route trap to recompiler!\n"));
761	STAM_COUNTER_INC(&pVM->pgm.s.StatGCTrap0eUnhandled);
762	return VINF_EM_RAW_GUEST_TRAP;
763	# else
764	/* present, but not a monitored page; perhaps the guest is probing physical memory */
765	return VINF_EM_RAW_EMULATE_INSTR;
766	# endif /* PGM_WITH_PAGING(PGM_GST_TYPE) */
767
768
769	#else /* PGM_GST_TYPE != PGM_TYPE_32BIT */
770
771	AssertReleaseMsgFailed(("Shw=%d Gst=%d is not implemented!\n", PGM_GST_TYPE, PGM_SHW_TYPE));
772	return VERR_INTERNAL_ERROR;
773	#endif /* PGM_GST_TYPE != PGM_TYPE_32BIT */
774	}
775
776
777	/**
778	* Emulation of the invlpg instruction.
779	*
780	*
781	* @returns VBox status code.
782	*
783	* @param pVM VM handle.
784	* @param GCPtrPage Page to invalidate.
785	*
786	* @remark ASSUMES that the guest is updating before invalidating. This order
787	* isn't required by the CPU, so this is speculative and could cause
788	* trouble.
789	*
790	* @todo Flush page or page directory only if necessary!
791	* @todo Add a #define for simply invalidating the page.
792	*/
793	PGM_BTH_DECL(int, InvalidatePage)(PVM pVM, RTGCUINTPTR GCPtrPage)
794	{
795	#if PGM_GST_TYPE == PGM_TYPE_32BIT \
796	\|\| PGM_GST_TYPE == PGM_TYPE_PAE
797
798	LogFlow(("InvalidatePage %x\n", GCPtrPage));
799	/*
800	* Get the shadow PD entry and skip out if this PD isn't present.
801	* (Guessing that it is frequent for a shadow PDE to not be present, do this first.)
802	*/
803	const unsigned iPDDst = GCPtrPage >> SHW_PD_SHIFT;
804	# if PGM_SHW_TYPE == PGM_TYPE_32BIT
805	PX86PDE pPdeDst = &pVM->pgm.s.CTXMID(p,32BitPD)->a[iPDDst];
806	# else
807	PX86PDEPAE pPdeDst = &pVM->pgm.s.CTXMID(ap,PaePDs[0])->a[iPDDst];
808	# endif
809	const SHWPDE PdeDst = *pPdeDst;
810	if (!PdeDst.n.u1Present)
811	{
812	STAM_COUNTER_INC(&pVM->pgm.s.CTXMID(Stat,InvalidatePageSkipped));
813	return VINF_SUCCESS;
814	}
815
816	/*
817	* Get the guest PD entry and calc big page.
818	*/
819	# if PGM_GST_TYPE == PGM_TYPE_32BIT
820	PX86PD pPDSrc = CTXSUFF(pVM->pgm.s.pGuestPD);
821	const unsigned iPDSrc = GCPtrPage >> GST_PD_SHIFT;
822	GSTPDE PdeSrc = pPDSrc->a[iPDSrc];
823	# else /* PAE */
824	unsigned iPDSrc;
825	PX86PDPAE pPDSrc = pgmGstGetPaePDPtr(&pVM->pgm.s, GCPtrPage, &iPDSrc);
826	GSTPDE PdeSrc = pPDSrc->a[iPDSrc];
827	# endif
828
829	const uint32_t cr4 = CPUMGetGuestCR4(pVM);
830	const bool fIsBigPage = PdeSrc.b.u1Size && (cr4 & X86_CR4_PSE);
831
832	# ifdef IN_RING3
833	/*
834	* If a CR3 Sync is pending we may ignore the invalidate page operation
835	* depending on the kind of sync and if it's a global page or not.
836	* This doesn't make sense in GC/R0 so we'll skip it entirely there.
837	*/
838	# ifdef PGM_SKIP_GLOBAL_PAGEDIRS_ON_NONGLOBAL_FLUSH
839	if ( VM_FF_ISSET(pVM, VM_FF_PGM_SYNC_CR3)
840	\|\| ( VM_FF_ISSET(pVM, VM_FF_PGM_SYNC_CR3_NON_GLOBAL)
841	&& fIsBigPage
842	&& PdeSrc.b.u1Global
843	&& (cr4 & X86_CR4_PGE)
844	)
845	)
846	# else
847	if (VM_FF_ISPENDING(pVM, VM_FF_PGM_SYNC_CR3 \| VM_FF_PGM_SYNC_CR3_NON_GLOBAL) )
848	# endif
849	{
850	STAM_COUNTER_INC(&pVM->pgm.s.StatHCInvalidatePageSkipped);
851	return VINF_SUCCESS;
852	}
853	# endif /* IN_RING3 */
854
855
856	/*
857	* Deal with the Guest PDE.
858	*/
859	int rc = VINF_SUCCESS;
860	if (PdeSrc.n.u1Present)
861	{
862	if (PdeDst.u & PGM_PDFLAGS_MAPPING)
863	{
864	/*
865	* Conflict - Let SyncPT deal with it to avoid duplicate code.
866	*/
867	Assert(pgmMapAreMappingsEnabled(&pVM->pgm.s));
868	Assert(PGMGetGuestMode(pVM) <= PGMMODE_32_BIT);
869	rc = PGM_BTH_NAME(SyncPT)(pVM, iPDSrc, pPDSrc, GCPtrPage);
870	}
871	else if ( PdeSrc.n.u1User != PdeDst.n.u1User
872	\|\| (!PdeSrc.n.u1Write && PdeDst.n.u1Write))
873	{
874	/*
875	* Mark not present so we can resync the PDE when it's used.
876	*/
877	LogFlow(("InvalidatePage: Out-of-sync at %VGp PdeSrc=%RX64 PdeDst=%RX64\n",
878	GCPtrPage, (uint64_t)PdeSrc.u, (uint64_t)PdeDst.u));
879	pgmPoolFree(pVM, PdeDst.u & SHW_PDE_PG_MASK, SHW_POOL_ROOT_IDX, iPDDst);
880	pPdeDst->u = 0;
881	STAM_COUNTER_INC(&pVM->pgm.s.CTXMID(Stat,InvalidatePagePDOutOfSync));
882	PGM_INVL_GUEST_TLBS();
883	}
884	# ifdef PGM_SYNC_ACCESSED_BIT
885	else if (!PdeSrc.n.u1Accessed)
886	{
887	/*
888	* Mark not present so we can set the accessed bit.
889	*/
890	pgmPoolFree(pVM, PdeDst.u & SHW_PDE_PG_MASK, SHW_POOL_ROOT_IDX, iPDDst);
891	pPdeDst->u = 0;
892	STAM_COUNTER_INC(&pVM->pgm.s.CTXMID(Stat,InvalidatePagePDNAs));
893	PGM_INVL_GUEST_TLBS();
894	}
895	# endif
896	else if (!fIsBigPage)
897	{
898	/*
899	* 4KB - page.
900	*/
901	PPGMPOOLPAGE pShwPage = pgmPoolGetPageByHCPhys(pVM, PdeDst.u & SHW_PDE_PG_MASK);
902	RTGCPHYS GCPhys = PdeSrc.u & GST_PDE_PG_MASK;
903	# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
904	/* Select the right PDE as we're emulating a 4kb page table with 2 shadow page tables. */
905	GCPhys \|= (iPDDst & 1) * (PAGE_SIZE/2);
906	# endif
907	if (pShwPage->GCPhys == GCPhys)
908	{
909	# if 0 /* likely cause of a major performance regression; must be SyncPageWorkerTrackDeref then */
910	const unsigned iPTEDst = (GCPtrPage >> SHW_PT_SHIFT) & SHW_PT_MASK;
911	PSHWPT pPT = (PSHWPT)PGMPOOL_PAGE_2_PTR(pVM, pShwPage);
912	if (pPT->a[iPTEDst].n.u1Present)
913	{
914	# ifdef PGMPOOL_WITH_USER_TRACKING
915	/* This is very unlikely with caching/monitoring enabled. */
916	PGM_BTH_NAME(SyncPageWorkerTrackDeref)(pVM, pShwPage, pPT->a[iPTEDst].u & SHW_PTE_PG_MASK);
917	# endif
918	pPT->a[iPTEDst].u = 0;
919	}
920	# else /* Syncing it here isn't 100% safe and it's probably not worth spending time syncing it. */
921	rc = PGM_BTH_NAME(SyncPage)(pVM, PdeSrc, GCPtrPage, 1, 0);
922	if (VBOX_SUCCESS(rc))
923	rc = VINF_SUCCESS;
924	# endif
925	STAM_COUNTER_INC(&pVM->pgm.s.CTXMID(Stat,InvalidatePage4KBPages));
926	PGM_INVL_PG(GCPtrPage);
927	}
928	else
929	{
930	/*
931	* The page table address changed.
932	*/
933	LogFlow(("InvalidatePage: Out-of-sync at %VGp PdeSrc=%RX64 PdeDst=%RX64 ShwGCPhys=%VGp iPDDst=%#x\n",
934	GCPtrPage, (uint64_t)PdeSrc.u, (uint64_t)PdeDst.u, pShwPage->GCPhys, iPDDst));
935	pgmPoolFree(pVM, PdeDst.u & SHW_PDE_PG_MASK, SHW_POOL_ROOT_IDX, iPDDst);
936	pPdeDst->u = 0;
937	STAM_COUNTER_INC(&pVM->pgm.s.CTXMID(Stat,InvalidatePagePDOutOfSync));
938	PGM_INVL_GUEST_TLBS();
939	}
940	}
941	else
942	{
943	/*
944	* 4MB - page.
945	*/
946	/* Before freeing the page, check if anything really changed. */
947	PPGMPOOLPAGE pShwPage = pgmPoolGetPageByHCPhys(pVM, PdeDst.u & SHW_PDE_PG_MASK);
948	RTGCPHYS GCPhys = PdeSrc.u & GST_PDE_BIG_PG_MASK;
949	# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
950	/* Select the right PDE as we're emulating a 4MB page directory with two 2 MB shadow PDEs.*/
951	GCPhys \|= GCPtrPage & (1 << X86_PD_PAE_SHIFT);
952	# endif
953	if ( pShwPage->GCPhys == GCPhys
954	&& pShwPage->enmKind == BTH_PGMPOOLKIND_PT_FOR_BIG)
955	{
956	/* ASSUMES a the given bits are identical for 4M and normal PDEs */
957	/** @todo PAT */
958	# ifdef PGM_SYNC_DIRTY_BIT
959	if ( (PdeSrc.u & (X86_PDE_P \| X86_PDE_RW \| X86_PDE_US \| X86_PDE_PWT \| X86_PDE_PCD))
960	== (PdeDst.u & (X86_PDE_P \| X86_PDE_RW \| X86_PDE_US \| X86_PDE_PWT \| X86_PDE_PCD))
961	&& ( PdeSrc.b.u1Dirty /** @todo rainy day: What about read-only 4M pages? not very common, but still... */
962	\|\| (PdeDst.u & PGM_PDFLAGS_TRACK_DIRTY)))
963	# else
964	if ( (PdeSrc.u & (X86_PDE_P \| X86_PDE_RW \| X86_PDE_US \| X86_PDE_PWT \| X86_PDE_PCD))
965	== (PdeDst.u & (X86_PDE_P \| X86_PDE_RW \| X86_PDE_US \| X86_PDE_PWT \| X86_PDE_PCD)))
966	# endif
967	{
968	LogFlow(("Skipping flush for big page containing %VGv (PD=%X)-> nothing has changed!\n", GCPtrPage, iPDSrc));
969	STAM_COUNTER_INC(&pVM->pgm.s.CTXMID(Stat,InvalidatePage4MBPagesSkip));
970	return VINF_SUCCESS;
971	}
972	}
973
974	/*
975	* Ok, the page table is present and it's been changed in the guest.
976	* If we're in host context, we'll just mark it as not present taking the lazy approach.
977	* We could do this for some flushes in GC too, but we need an algorithm for
978	* deciding which 4MB pages containing code likely to be executed very soon.
979	*/
980	pgmPoolFree(pVM, PdeDst.u & SHW_PDE_PG_MASK, SHW_POOL_ROOT_IDX, iPDDst);
981	pPdeDst->u = 0;
982	STAM_COUNTER_INC(&pVM->pgm.s.CTXMID(Stat,InvalidatePage4MBPages));
983	PGM_INVL_BIG_PG(GCPtrPage);
984	}
985	}
986	else
987	{
988	/*
989	* Page directory is not present, mark shadow PDE not present.
990	*/
991	if (!(PdeDst.u & PGM_PDFLAGS_MAPPING))
992	{
993	pgmPoolFree(pVM, PdeDst.u & SHW_PDE_PG_MASK, SHW_POOL_ROOT_IDX, iPDDst);
994	pPdeDst->u = 0;
995	STAM_COUNTER_INC(&pVM->pgm.s.CTXMID(Stat,InvalidatePagePDNPs));
996	PGM_INVL_PG(GCPtrPage);
997	}
998	else
999	{
1000	Assert(pgmMapAreMappingsEnabled(&pVM->pgm.s));
1001	STAM_COUNTER_INC(&pVM->pgm.s.CTXMID(Stat,InvalidatePagePDMappings));
1002	}
1003	}
1004
1005	return rc;
1006
1007	#elif PGM_GST_TYPE == PGM_TYPE_AMD64
1008	//# error not implemented
1009	return VERR_INTERNAL_ERROR;
1010
1011	#else /* guest real and protected mode */
1012	/* There's no such thing as InvalidatePage when paging is disabled, so just ignore. */
1013	return VINF_SUCCESS;
1014	#endif
1015	}
1016
1017
1018	#ifdef PGMPOOL_WITH_USER_TRACKING
1019	/**
1020	* Update the tracking of shadowed pages.
1021	*
1022	* @param pVM The VM handle.
1023	* @param pShwPage The shadow page.
1024	* @param HCPhys The physical page we is being dereferenced.
1025	*/
1026	DECLINLINE(void) PGM_BTH_NAME(SyncPageWorkerTrackDeref)(PVM pVM, PPGMPOOLPAGE pShwPage, RTHCPHYS HCPhys)
1027	{
1028	# ifdef PGMPOOL_WITH_GCPHYS_TRACKING
1029	STAM_PROFILE_START(&pVM->pgm.s.StatTrackDeref, a);
1030	LogFlow(("SyncPageWorkerTrackDeref: Damn HCPhys=%VHp pShwPage->idx=%#x!!!\n", HCPhys, pShwPage->idx));
1031
1032	/** @todo If this turns out to be a bottle neck (very likely) two things can be done:
1033	* 1. have a medium sized HCPhys -> GCPhys TLB (hash?)
1034	* 2. write protect all shadowed pages. I.e. implement caching.
1035	*/
1036	/*
1037	* Find the guest address.
1038	*/
1039	for (PPGMRAMRANGE pRam = CTXALLSUFF(pVM->pgm.s.pRamRanges);
1040	pRam;
1041	pRam = CTXALLSUFF(pRam->pNext))
1042	{
1043	unsigned iPage = pRam->cb >> PAGE_SHIFT;
1044	while (iPage-- > 0)
1045	{
1046	if (PGM_PAGE_GET_HCPHYS(&pRam->aPages[iPage]) == HCPhys)
1047	{
1048	PPGMPOOL pPool = pVM->pgm.s.CTXSUFF(pPool);
1049	pgmTrackDerefGCPhys(pPool, pShwPage, &pRam->aPages[iPage]);
1050	pShwPage->cPresent--;
1051	pPool->cPresent--;
1052	STAM_PROFILE_STOP(&pVM->pgm.s.StatTrackDeref, a);
1053	return;
1054	}
1055	}
1056	}
1057
1058	for (;;)
1059	AssertReleaseMsgFailed(("HCPhys=%VHp wasn't found!\n", HCPhys));
1060	# else /* !PGMPOOL_WITH_GCPHYS_TRACKING */
1061	pShwPage->cPresent--;
1062	pVM->pgm.s.CTXSUFF(pPool)->cPresent--;
1063	# endif /* !PGMPOOL_WITH_GCPHYS_TRACKING */
1064	}
1065
1066
1067	/**
1068	* Update the tracking of shadowed pages.
1069	*
1070	* @param pVM The VM handle.
1071	* @param pShwPage The shadow page.
1072	* @param u16 The top 16-bit of the pPage->HCPhys.
1073	* @param pPage Pointer to the guest page. this will be modified.
1074	* @param iPTDst The index into the shadow table.
1075	*/
1076	DECLINLINE(void) PGM_BTH_NAME(SyncPageWorkerTrackAddref)(PVM pVM, PPGMPOOLPAGE pShwPage, uint16_t u16, PPGMPAGE pPage, const unsigned iPTDst)
1077	{
1078	# ifdef PGMPOOL_WITH_GCPHYS_TRACKING
1079	/*
1080	* We're making certain assumptions about the placement of cRef and idx.
1081	*/
1082	Assert(MM_RAM_FLAGS_IDX_SHIFT == 48);
1083	Assert(MM_RAM_FLAGS_CREFS_SHIFT > MM_RAM_FLAGS_IDX_SHIFT);
1084
1085	/*
1086	* Just deal with the simple first time here.
1087	*/
1088	if (!u16)
1089	{
1090	STAM_COUNTER_INC(&pVM->pgm.s.StatTrackVirgin);
1091	u16 = (1 << (MM_RAM_FLAGS_CREFS_SHIFT - MM_RAM_FLAGS_IDX_SHIFT)) \| pShwPage->idx;
1092	}
1093	else
1094	u16 = pgmPoolTrackPhysExtAddref(pVM, u16, pShwPage->idx);
1095
1096	/* write back, trying to be clever... */
1097	Log2(("SyncPageWorkerTrackAddRef: u16=%#x pPage->HCPhys=%VHp->%VHp iPTDst=%#x\n",
1098	u16, pPage->HCPhys, (pPage->HCPhys & MM_RAM_FLAGS_NO_REFS_MASK) \| ((uint64_t)u16 << MM_RAM_FLAGS_CREFS_SHIFT), iPTDst));
1099	((uint16_t )&pPage->HCPhys + 3) = u16; /** @todo PAGE FLAGS */
1100	# endif /* PGMPOOL_WITH_GCPHYS_TRACKING */
1101
1102	/* update statistics. */
1103	pVM->pgm.s.CTXSUFF(pPool)->cPresent++;
1104	pShwPage->cPresent++;
1105	if (pShwPage->iFirstPresent > iPTDst)
1106	pShwPage->iFirstPresent = iPTDst;
1107	}
1108	#endif /* PGMPOOL_WITH_USER_TRACKING */
1109
1110
1111	/**
1112	* Creates a 4K shadow page for a guest page.
1113	*
1114	* For 4M pages the caller must convert the PDE4M to a PTE, this includes adjusting the
1115	* physical address. The PdeSrc argument only the flags are used. No page structured
1116	* will be mapped in this function.
1117	*
1118	* @param pVM VM handle.
1119	* @param pPteDst Destination page table entry.
1120	* @param PdeSrc Source page directory entry (i.e. Guest OS page directory entry).
1121	* Can safely assume that only the flags are being used.
1122	* @param PteSrc Source page table entry (i.e. Guest OS page table entry).
1123	* @param pShwPage Pointer to the shadow page.
1124	* @param iPTDst The index into the shadow table.
1125	*
1126	* @remark Not used for 2/4MB pages!
1127	*/
1128	DECLINLINE(void) PGM_BTH_NAME(SyncPageWorker)(PVM pVM, PSHWPTE pPteDst, GSTPDE PdeSrc, GSTPTE PteSrc, PPGMPOOLPAGE pShwPage, unsigned iPTDst)
1129	{
1130	if (PteSrc.n.u1Present)
1131	{
1132	/*
1133	* Find the ram range.
1134	*/
1135	PPGMPAGE pPage;
1136	int rc = pgmPhysGetPageEx(&pVM->pgm.s, PteSrc.u & GST_PTE_PG_MASK, &pPage);
1137	if (VBOX_SUCCESS(rc))
1138	{
1139	/** @todo investiage PWT, PCD and PAT. */
1140	/*
1141	* Make page table entry.
1142	*/
1143	const RTHCPHYS HCPhys = pPage->HCPhys; /** @todo FLAGS */
1144	SHWPTE PteDst;
1145	if (PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage))
1146	{
1147	/** @todo r=bird: Are we actually handling dirty and access bits for pages with access handlers correctly? No. */
1148	if (!PGM_PAGE_HAS_ACTIVE_ALL_HANDLERS(pPage))
1149	PteDst.u = (PteSrc.u & ~(X86_PTE_PAE_PG_MASK \| X86_PTE_AVL_MASK \| X86_PTE_PAT \| X86_PTE_PCD \| X86_PTE_PWT \| X86_PTE_RW))
1150	\| (HCPhys & X86_PTE_PAE_PG_MASK);
1151	else
1152	{
1153	LogFlow(("SyncPageWorker: monitored page (%VGp) -> mark not present\n", HCPhys));
1154	PteDst.u = 0;
1155	}
1156	/** @todo count these two kinds. */
1157	}
1158	else
1159	{
1160	#ifdef PGM_SYNC_DIRTY_BIT
1161	# ifdef PGM_SYNC_ACCESSED_BIT
1162	/*
1163	* If the page or page directory entry is not marked accessed,
1164	* we mark the page not present.
1165	*/
1166	if (!PteSrc.n.u1Accessed \|\| !PdeSrc.n.u1Accessed)
1167	{
1168	LogFlow(("SyncPageWorker: page and or page directory not accessed -> mark not present\n"));
1169	STAM_COUNTER_INC(&pVM->pgm.s.CTXMID(Stat,AccessedPage));
1170	PteDst.u = 0;
1171	}
1172	else
1173	# endif
1174	/*
1175	* If the page is not flagged as dirty and is writable, then make it read-only, so we can set the dirty bit
1176	* when the page is modified.
1177	*/
1178	if (!PteSrc.n.u1Dirty && (PdeSrc.n.u1Write & PteSrc.n.u1Write))
1179	{
1180	STAM_COUNTER_INC(&pVM->pgm.s.CTXMID(Stat,DirtyPage));
1181	PteDst.u = (PteSrc.u & ~(X86_PTE_PAE_PG_MASK \| X86_PTE_AVL_MASK \| X86_PTE_PAT \| X86_PTE_PCD \| X86_PTE_PWT \| X86_PTE_RW))
1182	\| (HCPhys & X86_PTE_PAE_PG_MASK)
1183	\| PGM_PTFLAGS_TRACK_DIRTY;
1184	}
1185	else
1186	{
1187	STAM_COUNTER_INC(&pVM->pgm.s.CTXMID(Stat,DirtyPageSkipped));
1188	PteDst.u = (PteSrc.u & ~(X86_PTE_PAE_PG_MASK \| X86_PTE_AVL_MASK \| X86_PTE_PAT \| X86_PTE_PCD \| X86_PTE_PWT))
1189	\| (HCPhys & X86_PTE_PAE_PG_MASK);
1190	}
1191	#endif
1192	}
1193
1194	#ifdef PGMPOOL_WITH_USER_TRACKING
1195	/*
1196	* Keep user track up to date.
1197	*/
1198	if (PteDst.n.u1Present)
1199	{
1200	if (!pPteDst->n.u1Present)
1201	PGM_BTH_NAME(SyncPageWorkerTrackAddref)(pVM, pShwPage, HCPhys >> MM_RAM_FLAGS_IDX_SHIFT, pPage, iPTDst);
1202	else if ((pPteDst->u & SHW_PTE_PG_MASK) != (PteDst.u & SHW_PTE_PG_MASK))
1203	{
1204	Log2(("SyncPageWorker: deref! *pPteDst=%RX64 PteDst=%RX64\n", (uint64_t)pPteDst->u, (uint64_t)PteDst.u));
1205	PGM_BTH_NAME(SyncPageWorkerTrackDeref)(pVM, pShwPage, pPteDst->u & SHW_PTE_PG_MASK);
1206	PGM_BTH_NAME(SyncPageWorkerTrackAddref)(pVM, pShwPage, HCPhys >> MM_RAM_FLAGS_IDX_SHIFT, pPage, iPTDst);
1207	}
1208	}
1209	else if (pPteDst->n.u1Present)
1210	{
1211	Log2(("SyncPageWorker: deref! *pPteDst=%RX64\n", (uint64_t)pPteDst->u));
1212	PGM_BTH_NAME(SyncPageWorkerTrackDeref)(pVM, pShwPage, pPteDst->u & SHW_PTE_PG_MASK);
1213	}
1214	#endif /* PGMPOOL_WITH_USER_TRACKING */
1215
1216	/*
1217	* Update statistics and commit the entry.
1218	*/
1219	if (!PteSrc.n.u1Global)
1220	pShwPage->fSeenNonGlobal = true;
1221	*pPteDst = PteDst;
1222	}
1223	/* else MMIO or invalid page, we must handle them manually in the #PF handler. */
1224	/** @todo count these. */
1225	}
1226	else
1227	{
1228	/*
1229	* Page not-present.
1230	*/
1231	LogFlow(("SyncPageWorker: page not present in Pte\n"));
1232	#ifdef PGMPOOL_WITH_USER_TRACKING
1233	/* Keep user track up to date. */
1234	if (pPteDst->n.u1Present)
1235	{
1236	Log2(("SyncPageWorker: deref! *pPteDst=%RX64\n", (uint64_t)pPteDst->u));
1237	PGM_BTH_NAME(SyncPageWorkerTrackDeref)(pVM, pShwPage, pPteDst->u & SHW_PTE_PG_MASK);
1238	}
1239	#endif /* PGMPOOL_WITH_USER_TRACKING */
1240	pPteDst->u = 0;
1241	/** @todo count these. */
1242	}
1243	}
1244
1245
1246	/**
1247	* Syncs a guest OS page.
1248	*
1249	* There are no conflicts at this point, neither is there any need for
1250	* page table allocations.
1251	*
1252	* @returns VBox status code.
1253	* @returns VINF_PGM_SYNCPAGE_MODIFIED_PDE if it modifies the PDE in any way.
1254	* @param pVM VM handle.
1255	* @param PdeSrc Page directory entry of the guest.
1256	* @param GCPtrPage Guest context page address.
1257	* @param cPages Number of pages to sync (PGM_SYNC_N_PAGES) (default=1).
1258	* @param uErr Fault error (X86_TRAP_PF_*).
1259	*/
1260	PGM_BTH_DECL(int, SyncPage)(PVM pVM, GSTPDE PdeSrc, RTGCUINTPTR GCPtrPage, unsigned cPages, unsigned uErr)
1261	{
1262	LogFlow(("SyncPage: GCPtrPage=%VGv cPages=%d uErr=%#x\n", GCPtrPage, cPages, uErr));
1263
1264	#if PGM_GST_TYPE == PGM_TYPE_32BIT \
1265	\|\| PGM_GST_TYPE == PGM_TYPE_PAE
1266
1267	/*
1268	* Assert preconditions.
1269	*/
1270	STAM_COUNTER_INC(&pVM->pgm.s.StatGCSyncPagePD[(GCPtrPage >> X86_PD_SHIFT) & GST_PD_MASK]);
1271	Assert(PdeSrc.n.u1Present);
1272	Assert(cPages);
1273
1274	/*
1275	* Get the shadow PDE, find the shadow page table in the pool.
1276	*/
1277	const unsigned iPDDst = GCPtrPage >> SHW_PD_SHIFT;
1278	# if PGM_SHW_TYPE == PGM_TYPE_32BIT
1279	X86PDE PdeDst = pVM->pgm.s.CTXMID(p,32BitPD)->a[iPDDst];
1280	# else /* PAE */
1281	X86PDEPAE PdeDst = pVM->pgm.s.CTXMID(ap,PaePDs)[0]->a[iPDDst];
1282	# endif
1283	Assert(PdeDst.n.u1Present);
1284	PPGMPOOLPAGE pShwPage = pgmPoolGetPageByHCPhys(pVM, PdeDst.u & SHW_PDE_PG_MASK);
1285
1286	/*
1287	* Check that the page is present and that the shadow PDE isn't out of sync.
1288	*/
1289	const bool fBigPage = PdeSrc.b.u1Size && (CPUMGetGuestCR4(pVM) & X86_CR4_PSE);
1290	RTGCPHYS GCPhys;
1291	if (!fBigPage)
1292	{
1293	GCPhys = PdeSrc.u & GST_PDE_PG_MASK;
1294	# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
1295	/* Select the right PDE as we're emulating a 4kb page table with 2 shadow page tables. */
1296	GCPhys \|= (iPDDst & 1) * (PAGE_SIZE/2);
1297	# endif
1298	}
1299	else
1300	{
1301	GCPhys = PdeSrc.u & GST_PDE_BIG_PG_MASK;
1302	# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
1303	/* Select the right PDE as we're emulating a 4MB page directory with two 2 MB shadow PDEs.*/
1304	GCPhys \|= GCPtrPage & (1 << X86_PD_PAE_SHIFT);
1305	# endif
1306	}
1307	if ( pShwPage->GCPhys == GCPhys
1308	&& PdeSrc.n.u1Present
1309	&& (PdeSrc.n.u1User == PdeDst.n.u1User)
1310	&& (PdeSrc.n.u1Write == PdeDst.n.u1Write \|\| !PdeDst.n.u1Write)
1311	# if PGM_GST_TYPE == PGM_TYPE_PAE
1312	&& (PdeSrc.n.u1NoExecute == PdeDst.n.u1NoExecute)
1313	# endif
1314	)
1315	{
1316	# ifdef PGM_SYNC_ACCESSED_BIT
1317	/*
1318	* Check that the PDE is marked accessed already.
1319	* Since we set the accessed bit before getting here on a #PF, this
1320	* check is only meant for dealing with non-#PF'ing paths.
1321	*/
1322	if (PdeSrc.n.u1Accessed)
1323	# endif
1324	{
1325	PSHWPT pPTDst = (PSHWPT)PGMPOOL_PAGE_2_PTR(pVM, pShwPage);
1326	if (!fBigPage)
1327	{
1328	/*
1329	* 4KB Page - Map the guest page table.
1330	*/
1331	PGSTPT pPTSrc;
1332	int rc = PGM_GCPHYS_2_PTR(pVM, PdeSrc.u & GST_PDE_PG_MASK, &pPTSrc);
1333	if (VBOX_SUCCESS(rc))
1334	{
1335	# ifdef PGM_SYNC_N_PAGES
1336	Assert(cPages == 1 \|\| !(uErr & X86_TRAP_PF_P));
1337	if (cPages > 1 && !(uErr & X86_TRAP_PF_P))
1338	{
1339	/*
1340	* This code path is currently only taken when the caller is PGMTrap0eHandler
1341	* for non-present pages!
1342	*
1343	* We're setting PGM_SYNC_NR_PAGES pages around the faulting page to sync it and
1344	* deal with locality.
1345	*/
1346	unsigned iPTDst = (GCPtrPage >> SHW_PT_SHIFT) & SHW_PT_MASK;
1347	# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
1348	/* Select the right PDE as we're emulating a 4kb page table with 2 shadow page tables. */
1349	const unsigned offPTSrc = ((GCPtrPage >> SHW_PD_SHIFT) & 1) * 512;
1350	# else
1351	const unsigned offPTSrc = 0;
1352	# endif
1353	const unsigned iPTDstEnd = RT_MIN(iPTDst + PGM_SYNC_NR_PAGES / 2, ELEMENTS(pPTDst->a));
1354	if (iPTDst < PGM_SYNC_NR_PAGES / 2)
1355	iPTDst = 0;
1356	else
1357	iPTDst -= PGM_SYNC_NR_PAGES / 2;
1358	for (; iPTDst < iPTDstEnd; iPTDst++)
1359	{
1360	if (!pPTDst->a[iPTDst].n.u1Present)
1361	{
1362	GSTPTE PteSrc = pPTSrc->a[offPTSrc + iPTDst];
1363	RTGCUINTPTR GCPtrCurPage = ((RTGCUINTPTR)GCPtrPage & ~(RTGCUINTPTR)(GST_PT_MASK << GST_PT_SHIFT)) \| ((offPTSrc + iPTDst) << PAGE_SHIFT);
1364	NOREF(GCPtrCurPage);
1365	#ifndef IN_RING0
1366	/*
1367	* Assuming kernel code will be marked as supervisor - and not as user level
1368	* and executed using a conforming code selector - And marked as readonly.
1369	* Also assume that if we're monitoring a page, it's of no interest to CSAM.
1370	*/
1371	PPGMPAGE pPage;
1372	if ( ((PdeSrc.u & PteSrc.u) & (X86_PTE_RW \| X86_PTE_US))
1373	\|\| iPTDst == ((GCPtrPage >> SHW_PT_SHIFT) & SHW_PT_MASK) /* always sync GCPtrPage */
1374	\|\| !CSAMDoesPageNeedScanning(pVM, (RTGCPTR)GCPtrCurPage)
1375	\|\| ( (pPage = pgmPhysGetPage(&pVM->pgm.s, PteSrc.u & GST_PTE_PG_MASK))
1376	&& PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage))
1377	)
1378	#endif /* else: CSAM not active */
1379	PGM_BTH_NAME(SyncPageWorker)(pVM, &pPTDst->a[iPTDst], PdeSrc, PteSrc, pShwPage, iPTDst);
1380	Log2(("SyncPage: 4K+ %VGv PteSrc:{P=%d RW=%d U=%d raw=%08llx} PteDst=%08llx%s\n",
1381	GCPtrCurPage, PteSrc.n.u1Present,
1382	PteSrc.n.u1Write & PdeSrc.n.u1Write,
1383	PteSrc.n.u1User & PdeSrc.n.u1User,
1384	(uint64_t)PteSrc.u,
1385	(uint64_t)pPTDst->a[iPTDst].u,
1386	pPTDst->a[iPTDst].u & PGM_PTFLAGS_TRACK_DIRTY ? " Track-Dirty" : ""));
1387	}
1388	}
1389	}
1390	else
1391	# endif /* PGM_SYNC_N_PAGES */
1392	{
1393	const unsigned iPTSrc = (GCPtrPage >> GST_PT_SHIFT) & GST_PT_MASK;
1394	GSTPTE PteSrc = pPTSrc->a[iPTSrc];
1395	const unsigned iPTDst = (GCPtrPage >> SHW_PT_SHIFT) & SHW_PT_MASK;
1396	PGM_BTH_NAME(SyncPageWorker)(pVM, &pPTDst->a[iPTDst], PdeSrc, PteSrc, pShwPage, iPTDst);
1397	Log2(("SyncPage: 4K %VGv PteSrc:{P=%d RW=%d U=%d raw=%08llx}%s\n",
1398	GCPtrPage, PteSrc.n.u1Present,
1399	PteSrc.n.u1Write & PdeSrc.n.u1Write,
1400	PteSrc.n.u1User & PdeSrc.n.u1User,
1401	(uint64_t)PteSrc.u,
1402	pPTDst->a[iPTDst].u & PGM_PTFLAGS_TRACK_DIRTY ? " Track-Dirty" : ""));
1403	}
1404	}
1405	else /* MMIO or invalid page: emulated in #PF handler. */
1406	{
1407	LogFlow(("PGM_GCPHYS_2_PTR %VGp failed with %Vrc\n", GCPhys, rc));
1408	Assert(!pPTDst->a[(GCPtrPage >> SHW_PT_SHIFT) & SHW_PT_MASK].n.u1Present);
1409	}
1410	}
1411	else
1412	{
1413	/*
1414	* 4/2MB page - lazy syncing shadow 4K pages.
1415	* (There are many causes of getting here, it's no longer only CSAM.)
1416	*/
1417	/* Calculate the GC physical address of this 4KB shadow page. */
1418	RTGCPHYS GCPhys = (PdeSrc.u & GST_PDE_BIG_PG_MASK) \| ((RTGCUINTPTR)GCPtrPage & GST_BIG_PAGE_OFFSET_MASK);
1419	/* Find ram range. */
1420	PPGMPAGE pPage;
1421	int rc = pgmPhysGetPageEx(&pVM->pgm.s, GCPhys, &pPage);
1422	if (VBOX_SUCCESS(rc))
1423	{
1424	/*
1425	* Make shadow PTE entry.
1426	*/
1427	const RTHCPHYS HCPhys = pPage->HCPhys; /** @todo PAGE FLAGS */
1428	SHWPTE PteDst;
1429	PteDst.u = (PdeSrc.u & ~(X86_PTE_PAE_PG_MASK \| X86_PTE_AVL_MASK \| X86_PTE_PAT \| X86_PTE_PCD \| X86_PTE_PWT))
1430	\| (HCPhys & X86_PTE_PAE_PG_MASK);
1431	if (PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage))
1432	{
1433	if (!PGM_PAGE_HAS_ACTIVE_ALL_HANDLERS(pPage))
1434	PteDst.n.u1Write = 0;
1435	else
1436	PteDst.u = 0;
1437	}
1438	const unsigned iPTDst = (GCPtrPage >> SHW_PT_SHIFT) & SHW_PT_MASK;
1439	# ifdef PGMPOOL_WITH_USER_TRACKING
1440	if (PteDst.n.u1Present && !pPTDst->a[iPTDst].n.u1Present)
1441	PGM_BTH_NAME(SyncPageWorkerTrackAddref)(pVM, pShwPage, HCPhys >> MM_RAM_FLAGS_IDX_SHIFT, pPage, iPTDst);
1442	# endif
1443	pPTDst->a[iPTDst] = PteDst;
1444
1445
1446	# ifdef PGM_SYNC_DIRTY_BIT
1447	/*
1448	* If the page is not flagged as dirty and is writable, then make it read-only
1449	* at PD level, so we can set the dirty bit when the page is modified.
1450	*
1451	* ASSUMES that page access handlers are implemented on page table entry level.
1452	* Thus we will first catch the dirty access and set PDE.D and restart. If
1453	* there is an access handler, we'll trap again and let it work on the problem.
1454	*/
1455	/** @todo r=bird: figure out why we need this here, SyncPT should've taken care of this already.
1456	* As for invlpg, it simply frees the whole shadow PT.
1457	* ...It's possibly because the guest clears it and the guest doesn't really tell us... */
1458	if (!PdeSrc.b.u1Dirty && PdeSrc.b.u1Write)
1459	{
1460	STAM_COUNTER_INC(&pVM->pgm.s.CTXMID(Stat,DirtyPageBig));
1461	PdeDst.u \|= PGM_PDFLAGS_TRACK_DIRTY;
1462	PdeDst.n.u1Write = 0;
1463	}
1464	else
1465	{
1466	PdeDst.au32[0] &= ~PGM_PDFLAGS_TRACK_DIRTY;
1467	PdeDst.n.u1Write = PdeSrc.n.u1Write;
1468	}
1469	# if PGM_SHW_TYPE == PGM_TYPE_32BIT
1470	pVM->pgm.s.CTXMID(p,32BitPD)->a[iPDDst] = PdeDst;
1471	# else /* PAE */
1472	pVM->pgm.s.CTXMID(ap,PaePDs)[0]->a[iPDDst] = PdeDst;
1473	# endif
1474	# endif /* PGM_SYNC_DIRTY_BIT */
1475	Log2(("SyncPage: BIG %VGv PdeSrc:{P=%d RW=%d U=%d raw=%08llx} GCPhys=%VGp%s\n",
1476	GCPtrPage, PdeSrc.n.u1Present, PdeSrc.n.u1Write, PdeSrc.n.u1User, (uint64_t)PdeSrc.u, GCPhys,
1477	PdeDst.u & PGM_PDFLAGS_TRACK_DIRTY ? " Track-Dirty" : ""));
1478	}
1479	else
1480	LogFlow(("PGM_GCPHYS_2_PTR %VGp (big) failed with %Vrc\n", GCPhys, rc));
1481	}
1482	return VINF_SUCCESS;
1483	}
1484	# ifdef PGM_SYNC_ACCESSED_BIT
1485	STAM_COUNTER_INC(&pVM->pgm.s.CTXMID(Stat,SyncPagePDNAs));
1486	#endif
1487	}
1488	else
1489	{
1490	STAM_COUNTER_INC(&pVM->pgm.s.CTXMID(Stat,SyncPagePDOutOfSync));
1491	Log2(("SyncPage: Out-Of-Sync PDE at %VGp PdeSrc=%RX64 PdeDst=%RX64\n",
1492	GCPtrPage, (uint64_t)PdeSrc.u, (uint64_t)PdeDst.u));
1493	}
1494
1495	/*
1496	* Mark the PDE not present. Restart the instruction and let #PF call SyncPT.
1497	* Yea, I'm lazy.
1498	*/
1499	pgmPoolFree(pVM, PdeDst.u & SHW_PDE_PG_MASK, SHW_POOL_ROOT_IDX, iPDDst);
1500	# if PGM_SHW_TYPE == PGM_TYPE_32BIT
1501	pVM->pgm.s.CTXMID(p,32BitPD)->a[iPDDst].u = 0;
1502	# else /* PAE */
1503	pVM->pgm.s.CTXMID(ap,PaePDs)[0]->a[iPDDst].u = 0;
1504	# endif
1505	PGM_INVL_GUEST_TLBS();
1506	return VINF_PGM_SYNCPAGE_MODIFIED_PDE;
1507
1508	#elif PGM_GST_TYPE == PGM_TYPE_REAL \|\| PGM_GST_TYPE == PGM_TYPE_PROT
1509
1510	# ifdef PGM_SYNC_N_PAGES
1511	/*
1512	* Get the shadow PDE, find the shadow page table in the pool.
1513	*/
1514	const unsigned iPDDst = GCPtrPage >> SHW_PD_SHIFT;
1515	# if PGM_SHW_TYPE == PGM_TYPE_32BIT
1516	X86PDE PdeDst = pVM->pgm.s.CTXMID(p,32BitPD)->a[iPDDst];
1517	# else /* PAE */
1518	X86PDEPAE PdeDst = pVM->pgm.s.CTXMID(ap,PaePDs)[0]->a[iPDDst];
1519	# endif
1520	Assert(PdeDst.n.u1Present);
1521	PPGMPOOLPAGE pShwPage = pgmPoolGetPageByHCPhys(pVM, PdeDst.u & SHW_PDE_PG_MASK);
1522	PSHWPT pPTDst = (PSHWPT)PGMPOOL_PAGE_2_PTR(pVM, pShwPage);
1523
1524	# if PGM_SHW_TYPE == PGM_TYPE_PAE
1525	/* Select the right PDE as we're emulating a 4kb page table with 2 shadow page tables. */
1526	const unsigned offPTSrc = ((GCPtrPage >> SHW_PD_SHIFT) & 1) * 512;
1527	# else
1528	const unsigned offPTSrc = 0;
1529	# endif
1530
1531	Assert(cPages == 1 \|\| !(uErr & X86_TRAP_PF_P));
1532	if (cPages > 1 && !(uErr & X86_TRAP_PF_P))
1533	{
1534	/*
1535	* This code path is currently only taken when the caller is PGMTrap0eHandler
1536	* for non-present pages!
1537	*
1538	* We're setting PGM_SYNC_NR_PAGES pages around the faulting page to sync it and
1539	* deal with locality.
1540	*/
1541	unsigned iPTDst = (GCPtrPage >> SHW_PT_SHIFT) & SHW_PT_MASK;
1542	const unsigned iPTDstEnd = RT_MIN(iPTDst + PGM_SYNC_NR_PAGES / 2, ELEMENTS(pPTDst->a));
1543	if (iPTDst < PGM_SYNC_NR_PAGES / 2)
1544	iPTDst = 0;
1545	else
1546	iPTDst -= PGM_SYNC_NR_PAGES / 2;
1547	for (; iPTDst < iPTDstEnd; iPTDst++)
1548	{
1549	if (!pPTDst->a[iPTDst].n.u1Present)
1550	{
1551	GSTPTE PteSrc;
1552
1553	RTGCUINTPTR GCPtrCurPage = ((RTGCUINTPTR)GCPtrPage & ~(RTGCUINTPTR)(GST_PT_MASK << GST_PT_SHIFT)) \| ((offPTSrc + iPTDst) << PAGE_SHIFT);
1554
1555	/* Fake the page table entry */
1556	PteSrc.u = GCPtrCurPage;
1557	PteSrc.n.u1Present = 1;
1558	PteSrc.n.u1Dirty = 1;
1559	PteSrc.n.u1Accessed = 1;
1560	PteSrc.n.u1Write = 1;
1561	PteSrc.n.u1User = 1;
1562
1563	PGM_BTH_NAME(SyncPageWorker)(pVM, &pPTDst->a[iPTDst], PdeSrc, PteSrc, pShwPage, iPTDst);
1564
1565	Log2(("SyncPage: 4K+ %VGv PteSrc:{P=%d RW=%d U=%d raw=%08llx} PteDst=%08llx%s\n",
1566	GCPtrCurPage, PteSrc.n.u1Present,
1567	PteSrc.n.u1Write & PdeSrc.n.u1Write,
1568	PteSrc.n.u1User & PdeSrc.n.u1User,
1569	(uint64_t)PteSrc.u,
1570	(uint64_t)pPTDst->a[iPTDst].u,
1571	pPTDst->a[iPTDst].u & PGM_PTFLAGS_TRACK_DIRTY ? " Track-Dirty" : ""));
1572	}
1573	}
1574	}
1575	else
1576	# endif /* PGM_SYNC_N_PAGES */
1577	{
1578	GSTPTE PteSrc;
1579	const unsigned iPTDst = (GCPtrPage >> SHW_PT_SHIFT) & SHW_PT_MASK;
1580	RTGCUINTPTR GCPtrCurPage = ((RTGCUINTPTR)GCPtrPage & ~(RTGCUINTPTR)(GST_PT_MASK << GST_PT_SHIFT)) \| ((offPTSrc + iPTDst) << PAGE_SHIFT);
1581
1582	/* Fake the page table entry */
1583	PteSrc.u = GCPtrCurPage;
1584	PteSrc.n.u1Present = 1;
1585	PteSrc.n.u1Dirty = 1;
1586	PteSrc.n.u1Accessed = 1;
1587	PteSrc.n.u1Write = 1;
1588	PteSrc.n.u1User = 1;
1589	PGM_BTH_NAME(SyncPageWorker)(pVM, &pPTDst->a[iPTDst], PdeSrc, PteSrc, pShwPage, iPTDst);
1590
1591	Log2(("SyncPage: 4K %VGv PteSrc:{P=%d RW=%d U=%d raw=%08llx}%s\n",
1592	GCPtrPage, PteSrc.n.u1Present,
1593	PteSrc.n.u1Write & PdeSrc.n.u1Write,
1594	PteSrc.n.u1User & PdeSrc.n.u1User,
1595	(uint64_t)PteSrc.u,
1596	pPTDst->a[iPTDst].u & PGM_PTFLAGS_TRACK_DIRTY ? " Track-Dirty" : ""));
1597	}
1598	return VINF_SUCCESS;
1599
1600	#else /* PGM_GST_TYPE == PGM_TYPE_AMD64 */
1601	AssertReleaseMsgFailed(("Shw=%d Gst=%d is not implemented!\n", PGM_GST_TYPE, PGM_SHW_TYPE));
1602	return VERR_INTERNAL_ERROR;
1603	#endif /* PGM_GST_TYPE == PGM_TYPE_AMD64 */
1604	}
1605
1606
1607
1608	#if PGM_WITH_PAGING(PGM_GST_TYPE)
1609
1610	# ifdef PGM_SYNC_DIRTY_BIT
1611
1612	/**
1613	* Investigate page fault and handle write protection page faults caused by
1614	* dirty bit tracking.
1615	*
1616	* @returns VBox status code.
1617	* @param pVM VM handle.
1618	* @param uErr Page fault error code.
1619	* @param pPdeDst Shadow page directory entry.
1620	* @param pPdeSrc Guest page directory entry.
1621	* @param GCPtrPage Guest context page address.
1622	*/
1623	PGM_BTH_DECL(int, CheckPageFault)(PVM pVM, uint32_t uErr, PSHWPDE pPdeDst, PGSTPDE pPdeSrc, RTGCUINTPTR GCPtrPage)
1624	{
1625	bool fWriteProtect = !!(CPUMGetGuestCR0(pVM) & X86_CR0_WP);
1626	bool fUserLevelFault = !!(uErr & X86_TRAP_PF_US);
1627	bool fWriteFault = !!(uErr & X86_TRAP_PF_RW);
1628	# if PGM_WITH_NX(PGM_GST_TYPE)
1629	bool fNoExecuteBitValid = !!(CPUMGetGuestEFER(pVM) & MSR_K6_EFER_NXE);
1630	# endif
1631
1632	STAM_PROFILE_START(&pVM->pgm.s.CTXMID(Stat, DirtyBitTracking), a);
1633	LogFlow(("CheckPageFault: GCPtrPage=%VGv uErr=%#x PdeSrc=%08x\n", GCPtrPage, uErr, pPdeSrc->u));
1634
1635	# if PGM_GST_TYPE == PGM_TYPE_AMD64
1636	AssertFailed();
1637	# elif PGM_GST_TYPE == PGM_TYPE_PAE
1638	PX86PDPE pPdpeSrc = &pVM->pgm.s.CTXSUFF(pGstPaePDPT)->a[(GCPtrPage >> GST_PDPT_SHIFT) & GST_PDPT_MASK];
1639
1640	/*
1641	* Real page fault?
1642	*/
1643	if ( (uErr & X86_TRAP_PF_RSVD)
1644	\|\| !pPdpeSrc->n.u1Present
1645	# if PGM_WITH_NX(PGM_GST_TYPE)
1646	\|\| (fNoExecuteBitValid && (uErr & X86_TRAP_PF_ID) && pPdpeSrc->n.u1NoExecute)
1647	# endif
1648	\|\| (fWriteFault && !pPdpeSrc->n.u1Write && (fUserLevelFault \|\| fWriteProtect))
1649	\|\| (fUserLevelFault && !pPdpeSrc->n.u1User) )
1650	{
1651	# ifdef IN_GC
1652	STAM_COUNTER_INC(&pVM->pgm.s.StatGCDirtyTrackRealPF);
1653	# endif
1654	STAM_PROFILE_STOP(&pVM->pgm.s.CTXMID(Stat, DirtyBitTracking), a);
1655	LogFlow(("CheckPageFault: real page fault at %VGv (0)\n", GCPtrPage));
1656
1657	if ( pPdpeSrc->n.u1Present
1658	&& pPdeSrc->n.u1Present)
1659	{
1660	/* Check the present bit as the shadow tables can cause different error codes by being out of sync.
1661	* See the 2nd case below as well.
1662	*/
1663	if (pPdeSrc->b.u1Size && (CPUMGetGuestCR4(pVM) & X86_CR4_PSE))
1664	{
1665	TRPMSetErrorCode(pVM, uErr \| X86_TRAP_PF_P); /* page-level protection violation */
1666	}
1667	else
1668	{
1669	/*
1670	* Map the guest page table.
1671	*/
1672	PGSTPT pPTSrc;
1673	int rc = PGM_GCPHYS_2_PTR(pVM, pPdeSrc->u & GST_PDE_PG_MASK, &pPTSrc);
1674	if (VBOX_SUCCESS(rc))
1675	{
1676	PGSTPTE pPteSrc = &pPTSrc->a[(GCPtrPage >> PAGE_SHIFT) & GST_PT_MASK];
1677	const GSTPTE PteSrc = *pPteSrc;
1678	if (pPteSrc->n.u1Present)
1679	TRPMSetErrorCode(pVM, uErr \| X86_TRAP_PF_P); /* page-level protection violation */
1680	}
1681	AssertRC(rc);
1682	}
1683	}
1684	return VINF_EM_RAW_GUEST_TRAP;
1685	}
1686	# endif
1687
1688	/*
1689	* Real page fault?
1690	*/
1691	if ( (uErr & X86_TRAP_PF_RSVD)
1692	\|\| !pPdeSrc->n.u1Present
1693	# if PGM_WITH_NX(PGM_GST_TYPE)
1694	\|\| (fNoExecuteBitValid && (uErr & X86_TRAP_PF_ID) && pPdeSrc->n.u1NoExecute)
1695	# endif
1696	\|\| (fWriteFault && !pPdeSrc->n.u1Write && (fUserLevelFault \|\| fWriteProtect))
1697	\|\| (fUserLevelFault && !pPdeSrc->n.u1User) )
1698	{
1699	# ifdef IN_GC
1700	STAM_COUNTER_INC(&pVM->pgm.s.StatGCDirtyTrackRealPF);
1701	# endif
1702	STAM_PROFILE_STOP(&pVM->pgm.s.CTXMID(Stat, DirtyBitTracking), a);
1703	LogFlow(("CheckPageFault: real page fault at %VGv (1)\n", GCPtrPage));
1704
1705	if (pPdeSrc->n.u1Present)
1706	{
1707	/* Check the present bit as the shadow tables can cause different error codes by being out of sync.
1708	* See the 2nd case below as well.
1709	*/
1710	if (pPdeSrc->b.u1Size && (CPUMGetGuestCR4(pVM) & X86_CR4_PSE))
1711	{
1712	TRPMSetErrorCode(pVM, uErr \| X86_TRAP_PF_P); /* page-level protection violation */
1713	}
1714	else
1715	{
1716	/*
1717	* Map the guest page table.
1718	*/
1719	PGSTPT pPTSrc;
1720	int rc = PGM_GCPHYS_2_PTR(pVM, pPdeSrc->u & GST_PDE_PG_MASK, &pPTSrc);
1721	if (VBOX_SUCCESS(rc))
1722	{
1723	PGSTPTE pPteSrc = &pPTSrc->a[(GCPtrPage >> PAGE_SHIFT) & GST_PT_MASK];
1724	const GSTPTE PteSrc = *pPteSrc;
1725	if (pPteSrc->n.u1Present)
1726	TRPMSetErrorCode(pVM, uErr \| X86_TRAP_PF_P); /* page-level protection violation */
1727	}
1728	AssertRC(rc);
1729	}
1730	}
1731	return VINF_EM_RAW_GUEST_TRAP;
1732	}
1733
1734	/*
1735	* First check the easy case where the page directory has been marked read-only to track
1736	* the dirty bit of an emulated BIG page
1737	*/
1738	if (pPdeSrc->b.u1Size && (CPUMGetGuestCR4(pVM) & X86_CR4_PSE))
1739	{
1740	/* Mark guest page directory as accessed */
1741	pPdeSrc->b.u1Accessed = 1;
1742
1743	/*
1744	* Only write protection page faults are relevant here.
1745	*/
1746	if (fWriteFault)
1747	{
1748	/* Mark guest page directory as dirty (BIG page only). */
1749	pPdeSrc->b.u1Dirty = 1;
1750
1751	if (pPdeDst->n.u1Present && (pPdeDst->u & PGM_PDFLAGS_TRACK_DIRTY))
1752	{
1753	STAM_COUNTER_INC(&pVM->pgm.s.CTXMID(Stat,DirtyPageTrap));
1754
1755	Assert(pPdeSrc->b.u1Write);
1756
1757	pPdeDst->n.u1Write = 1;
1758	pPdeDst->n.u1Accessed = 1;
1759	pPdeDst->au32[0] &= ~PGM_PDFLAGS_TRACK_DIRTY;
1760	PGM_INVL_BIG_PG(GCPtrPage);
1761	STAM_PROFILE_STOP(&pVM->pgm.s.CTXMID(Stat,DirtyBitTracking), a);
1762	return VINF_PGM_HANDLED_DIRTY_BIT_FAULT;
1763	}
1764	}
1765	STAM_PROFILE_STOP(&pVM->pgm.s.CTXMID(Stat,DirtyBitTracking), a);
1766	return VINF_PGM_NO_DIRTY_BIT_TRACKING;
1767	}
1768	/* else: 4KB page table */
1769
1770	/*
1771	* Map the guest page table.
1772	*/
1773	PGSTPT pPTSrc;
1774	int rc = PGM_GCPHYS_2_PTR(pVM, pPdeSrc->u & GST_PDE_PG_MASK, &pPTSrc);
1775	if (VBOX_SUCCESS(rc))
1776	{
1777	/*
1778	* Real page fault?
1779	*/
1780	PGSTPTE pPteSrc = &pPTSrc->a[(GCPtrPage >> PAGE_SHIFT) & GST_PT_MASK];
1781	const GSTPTE PteSrc = *pPteSrc;
1782	if ( !PteSrc.n.u1Present
1783	# if PGM_WITH_NX(PGM_GST_TYPE)
1784	\|\| ((uErr & X86_TRAP_PF_ID) && !PteSrc.n.u1NoExecute)
1785	# endif
1786	\|\| (fWriteFault && !PteSrc.n.u1Write && (fUserLevelFault \|\| fWriteProtect))
1787	\|\| (fUserLevelFault && !PteSrc.n.u1User)
1788	)
1789	{
1790	# ifdef IN_GC
1791	STAM_COUNTER_INC(&pVM->pgm.s.StatGCDirtyTrackRealPF);
1792	# endif
1793	STAM_PROFILE_STOP(&pVM->pgm.s.CTXMID(Stat,DirtyBitTracking), a);
1794	LogFlow(("CheckPageFault: real page fault at %VGv PteSrc.u=%08x (2)\n", GCPtrPage, PteSrc.u));
1795
1796	/* Check the present bit as the shadow tables can cause different error codes by being out of sync.
1797	* See the 2nd case above as well.
1798	*/
1799	if (pPdeSrc->n.u1Present && pPteSrc->n.u1Present)
1800	TRPMSetErrorCode(pVM, uErr \| X86_TRAP_PF_P); /* page-level protection violation */
1801
1802	STAM_PROFILE_STOP(&pVM->pgm.s.CTXMID(Stat,DirtyBitTracking), a);
1803	return VINF_EM_RAW_GUEST_TRAP;
1804	}
1805	LogFlow(("CheckPageFault: page fault at %VGv PteSrc.u=%08x\n", GCPtrPage, PteSrc.u));
1806
1807	/*
1808	* Set the accessed bits in the page directory and the page table.
1809	*/
1810	pPdeSrc->n.u1Accessed = 1;
1811	pPteSrc->n.u1Accessed = 1;
1812
1813	/*
1814	* Only write protection page faults are relevant here.
1815	*/
1816	if (fWriteFault)
1817	{
1818	/* Write access, so mark guest entry as dirty. */
1819	# if defined(IN_GC) && defined(VBOX_WITH_STATISTICS)
1820	if (!pPteSrc->n.u1Dirty)
1821	STAM_COUNTER_INC(&pVM->pgm.s.StatGCDirtiedPage);
1822	else
1823	STAM_COUNTER_INC(&pVM->pgm.s.StatGCPageAlreadyDirty);
1824	# endif
1825	pPteSrc->n.u1Dirty = 1;
1826
1827	if (pPdeDst->n.u1Present)
1828	{
1829	/* Bail out here as pgmPoolGetPageByHCPhys will return NULL and we'll crash below.
1830	* Our individual shadow handlers will provide more information and force a fatal exit.
1831	*/
1832	if (MMHyperIsInsideArea(pVM, (RTGCPTR)GCPtrPage))
1833	{
1834	LogRel(("CheckPageFault: write to hypervisor region %VGv\n", GCPtrPage));
1835	STAM_PROFILE_STOP(&pVM->pgm.s.CTXMID(Stat,DirtyBitTracking), a);
1836	return VINF_SUCCESS;
1837	}
1838
1839	/*
1840	* Map shadow page table.
1841	*/
1842	PPGMPOOLPAGE pShwPage = pgmPoolGetPageByHCPhys(pVM, pPdeDst->u & SHW_PDE_PG_MASK);
1843	if (pShwPage)
1844	{
1845	PSHWPT pPTDst = (PSHWPT)PGMPOOL_PAGE_2_PTR(pVM, pShwPage);
1846	PSHWPTE pPteDst = &pPTDst->a[(GCPtrPage >> SHW_PT_SHIFT) & SHW_PT_MASK];
1847	if ( pPteDst->n.u1Present /** @todo Optimize accessed bit emulation? */
1848	&& (pPteDst->u & PGM_PTFLAGS_TRACK_DIRTY))
1849	{
1850	LogFlow(("DIRTY page trap addr=%VGv\n", GCPtrPage));
1851	# ifdef VBOX_STRICT
1852	PPGMPAGE pPage = pgmPhysGetPage(&pVM->pgm.s, pPteSrc->u & GST_PTE_PG_MASK);
1853	if (pPage)
1854	AssertMsg(!PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage),
1855	("Unexpected dirty bit tracking on monitored page %VGv (phys %VGp)!!!!!!\n", GCPtrPage, pPteSrc->u & X86_PTE_PAE_PG_MASK));
1856	# endif
1857	STAM_COUNTER_INC(&pVM->pgm.s.CTXMID(Stat,DirtyPageTrap));
1858
1859	Assert(pPteSrc->n.u1Write);
1860
1861	pPteDst->n.u1Write = 1;
1862	pPteDst->n.u1Dirty = 1;
1863	pPteDst->n.u1Accessed = 1;
1864	pPteDst->au32[0] &= ~PGM_PTFLAGS_TRACK_DIRTY;
1865	PGM_INVL_PG(GCPtrPage);
1866
1867	STAM_PROFILE_STOP(&pVM->pgm.s.CTXMID(Stat,DirtyBitTracking), a);
1868	return VINF_PGM_HANDLED_DIRTY_BIT_FAULT;
1869	}
1870	}
1871	else
1872	AssertMsgFailed(("pgmPoolGetPageByHCPhys %VGp failed!\n", pPdeDst->u & SHW_PDE_PG_MASK));
1873	}
1874	}
1875	/** @todo Optimize accessed bit emulation? */
1876	# ifdef VBOX_STRICT
1877	/*
1878	* Sanity check.
1879	*/
1880	else if ( !pPteSrc->n.u1Dirty
1881	&& (pPdeSrc->n.u1Write & pPteSrc->n.u1Write)
1882	&& pPdeDst->n.u1Present)
1883	{
1884	PPGMPOOLPAGE pShwPage = pgmPoolGetPageByHCPhys(pVM, pPdeDst->u & SHW_PDE_PG_MASK);
1885	PSHWPT pPTDst = (PSHWPT)PGMPOOL_PAGE_2_PTR(pVM, pShwPage);
1886	PSHWPTE pPteDst = &pPTDst->a[(GCPtrPage >> SHW_PT_SHIFT) & SHW_PT_MASK];
1887	if ( pPteDst->n.u1Present
1888	&& pPteDst->n.u1Write)
1889	LogFlow(("Writable present page %VGv not marked for dirty bit tracking!!!\n", GCPtrPage));
1890	}
1891	# endif /* VBOX_STRICT */
1892	STAM_PROFILE_STOP(&pVM->pgm.s.CTXMID(Stat,DirtyBitTracking), a);
1893	return VINF_PGM_NO_DIRTY_BIT_TRACKING;
1894	}
1895	AssertRC(rc);
1896	STAM_PROFILE_STOP(&pVM->pgm.s.CTXMID(Stat,DirtyBitTracking), a);
1897	return rc;
1898	}
1899
1900	# endif
1901
1902	#endif /* PGM_WITH_PAGING(PGM_GST_TYPE) */
1903
1904
1905	/**
1906	* Sync a shadow page table.
1907	*
1908	* The shadow page table is not present. This includes the case where
1909	* there is a conflict with a mapping.
1910	*
1911	* @returns VBox status code.
1912	* @param pVM VM handle.
1913	* @param iPD Page directory index.
1914	* @param pPDSrc Source page directory (i.e. Guest OS page directory).
1915	* Assume this is a temporary mapping.
1916	* @param GCPtrPage GC Pointer of the page that caused the fault
1917	*/
1918	PGM_BTH_DECL(int, SyncPT)(PVM pVM, unsigned iPDSrc, PGSTPD pPDSrc, RTGCUINTPTR GCPtrPage)
1919	{
1920	STAM_PROFILE_START(&pVM->pgm.s.CTXMID(Stat,SyncPT), a);
1921	STAM_COUNTER_INC(&pVM->pgm.s.StatGCSyncPtPD[iPDSrc]);
1922	LogFlow(("SyncPT: GCPtrPage=%VGv\n", GCPtrPage));
1923
1924	#if PGM_GST_TYPE == PGM_TYPE_32BIT \
1925	\|\| PGM_GST_TYPE == PGM_TYPE_PAE
1926
1927	/*
1928	* Validate input a little bit.
1929	*/
1930	Assert(iPDSrc == (GCPtrPage >> GST_PD_SHIFT));
1931	# if PGM_SHW_TYPE == PGM_TYPE_32BIT
1932	PX86PD pPDDst = pVM->pgm.s.CTXMID(p,32BitPD);
1933	# else
1934	PX86PDPAE pPDDst = pVM->pgm.s.CTXMID(ap,PaePDs)[0];
1935	# endif
1936	const unsigned iPDDst = GCPtrPage >> SHW_PD_SHIFT;
1937	PSHWPDE pPdeDst = &pPDDst->a[iPDDst];
1938	SHWPDE PdeDst = *pPdeDst;
1939
1940	# if PGM_GST_TYPE == PGM_TYPE_32BIT
1941	/*
1942	* Check for conflicts.
1943	* GC: In case of a conflict we'll go to Ring-3 and do a full SyncCR3.
1944	* HC: Simply resolve the conflict.
1945	*/
1946	if (PdeDst.u & PGM_PDFLAGS_MAPPING)
1947	{
1948	Assert(pgmMapAreMappingsEnabled(&pVM->pgm.s));
1949	# ifndef IN_RING3
1950	Log(("SyncPT: Conflict at %VGv\n", GCPtrPage));
1951	STAM_PROFILE_STOP(&pVM->pgm.s.CTXMID(Stat,SyncPT), a);
1952	return VERR_ADDRESS_CONFLICT;
1953	# else
1954	PPGMMAPPING pMapping = pgmGetMapping(pVM, (RTGCPTR)GCPtrPage);
1955	Assert(pMapping);
1956	int rc = pgmR3SyncPTResolveConflict(pVM, pMapping, pPDSrc, iPDSrc);
1957	if (VBOX_FAILURE(rc))
1958	{
1959	STAM_PROFILE_STOP(&pVM->pgm.s.CTXMID(Stat,SyncPT), a);
1960	return rc;
1961	}
1962	PdeDst = *pPdeDst;
1963	# endif
1964	}
1965	# else /* PGM_GST_TYPE == PGM_TYPE_32BIT */
1966	/* PAE and AMD64 modes are hardware accelerated only, so there are no mappings. */
1967	Assert(!pgmMapAreMappingsEnabled(&pVM->pgm.s));
1968	# endif /* PGM_GST_TYPE == PGM_TYPE_32BIT */
1969	Assert(!PdeDst.n.u1Present); /* We're only supposed to call SyncPT on PDE!P and conflicts.*/
1970
1971	/*
1972	* Sync page directory entry.
1973	*/
1974	int rc = VINF_SUCCESS;
1975	GSTPDE PdeSrc = pPDSrc->a[iPDSrc];
1976	if (PdeSrc.n.u1Present)
1977	{
1978	/*
1979	* Allocate & map the page table.
1980	*/
1981	PSHWPT pPTDst;
1982	const bool fPageTable = !PdeSrc.b.u1Size \|\| !(CPUMGetGuestCR4(pVM) & X86_CR4_PSE);
1983	PPGMPOOLPAGE pShwPage;
1984	RTGCPHYS GCPhys;
1985	if (fPageTable)
1986	{
1987	GCPhys = PdeSrc.u & GST_PDE_PG_MASK;
1988	# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
1989	/* Select the right PDE as we're emulating a 4kb page table with 2 shadow page tables. */
1990	GCPhys \|= (iPDDst & 1) * (PAGE_SIZE / 2);
1991	# endif
1992	rc = pgmPoolAlloc(pVM, GCPhys, BTH_PGMPOOLKIND_PT_FOR_PT, SHW_POOL_ROOT_IDX, iPDDst, &pShwPage);
1993	}
1994	else
1995	{
1996	GCPhys = PdeSrc.u & GST_PDE_BIG_PG_MASK;
1997	# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
1998	/* Select the right PDE as we're emulating a 4MB page directory with two 2 MB shadow PDEs.*/
1999	GCPhys \|= GCPtrPage & (1 << X86_PD_PAE_SHIFT);
2000	# endif
2001	rc = pgmPoolAlloc(pVM, GCPhys, BTH_PGMPOOLKIND_PT_FOR_BIG, SHW_POOL_ROOT_IDX, iPDDst, &pShwPage);
2002	}
2003	if (rc == VINF_SUCCESS)
2004	pPTDst = (PSHWPT)PGMPOOL_PAGE_2_PTR(pVM, pShwPage);
2005	else if (rc == VINF_PGM_CACHED_PAGE)
2006	{
2007	/*
2008	* The PT was cached, just hook it up.
2009	*/
2010	if (fPageTable)
2011	PdeDst.u = pShwPage->Core.Key
2012	\| (PdeSrc.u & ~(GST_PDE_PG_MASK \| X86_PDE_AVL_MASK \| X86_PDE_PCD \| X86_PDE_PWT \| X86_PDE_PS \| X86_PDE4M_G \| X86_PDE4M_D));
2013	else
2014	{
2015	PdeDst.u = pShwPage->Core.Key
2016	\| (PdeSrc.u & ~(GST_PDE_PG_MASK \| X86_PDE_AVL_MASK \| X86_PDE_PCD \| X86_PDE_PWT \| X86_PDE_PS \| X86_PDE4M_G \| X86_PDE4M_D));
2017	# ifdef PGM_SYNC_DIRTY_BIT /* (see explanation and assumptions further down.) */
2018	if (!PdeSrc.b.u1Dirty && PdeSrc.b.u1Write)
2019	{
2020	STAM_COUNTER_INC(&pVM->pgm.s.CTXMID(Stat,DirtyPageBig));
2021	PdeDst.u \|= PGM_PDFLAGS_TRACK_DIRTY;
2022	PdeDst.b.u1Write = 0;
2023	}
2024	# endif
2025	}
2026	*pPdeDst = PdeDst;
2027	return VINF_SUCCESS;
2028	}
2029	else if (rc == VERR_PGM_POOL_FLUSHED)
2030	return VINF_PGM_SYNC_CR3;
2031	else
2032	AssertMsgFailedReturn(("rc=%Vrc\n", rc), VERR_INTERNAL_ERROR);
2033	PdeDst.u &= X86_PDE_AVL_MASK;
2034	PdeDst.u \|= pShwPage->Core.Key;
2035
2036	# ifdef PGM_SYNC_DIRTY_BIT
2037	/*
2038	* Page directory has been accessed (this is a fault situation, remember).
2039	*/
2040	pPDSrc->a[iPDSrc].n.u1Accessed = 1;
2041	# endif
2042	if (fPageTable)
2043	{
2044	/*
2045	* Page table - 4KB.
2046	*
2047	* Sync all or just a few entries depending on PGM_SYNC_N_PAGES.
2048	*/
2049	Log2(("SyncPT: 4K %VGv PdeSrc:{P=%d RW=%d U=%d raw=%08llx}\n",
2050	GCPtrPage, PdeSrc.b.u1Present, PdeSrc.b.u1Write, PdeSrc.b.u1User, (uint64_t)PdeSrc.u));
2051	PGSTPT pPTSrc;
2052	rc = PGM_GCPHYS_2_PTR(pVM, PdeSrc.u & GST_PDE_PG_MASK, &pPTSrc);
2053	if (VBOX_SUCCESS(rc))
2054	{
2055	/*
2056	* Start by syncing the page directory entry so CSAM's TLB trick works.
2057	*/
2058	PdeDst.u = (PdeDst.u & (SHW_PDE_PG_MASK \| X86_PDE_AVL_MASK))
2059	\| (PdeSrc.u & ~(GST_PDE_PG_MASK \| X86_PDE_AVL_MASK \| X86_PDE_PCD \| X86_PDE_PWT \| X86_PDE_PS \| X86_PDE4M_G \| X86_PDE4M_D));
2060	*pPdeDst = PdeDst;
2061
2062	/*
2063	* Directory/page user or supervisor privilege: (same goes for read/write)
2064	*
2065	* Directory Page Combined
2066	* U/S U/S U/S
2067	* 0 0 0
2068	* 0 1 0
2069	* 1 0 0
2070	* 1 1 1
2071	*
2072	* Simple AND operation. Table listed for completeness.
2073	*
2074	*/
2075	STAM_COUNTER_INC(CTXSUFF(&pVM->pgm.s.StatSynPT4k));
2076	# ifdef PGM_SYNC_N_PAGES
2077	unsigned iPTBase = (GCPtrPage >> SHW_PT_SHIFT) & SHW_PT_MASK;
2078	unsigned iPTDst = iPTBase;
2079	const unsigned iPTDstEnd = RT_MIN(iPTDst + PGM_SYNC_NR_PAGES / 2, ELEMENTS(pPTDst->a));
2080	if (iPTDst <= PGM_SYNC_NR_PAGES / 2)
2081	iPTDst = 0;
2082	else
2083	iPTDst -= PGM_SYNC_NR_PAGES / 2;
2084	# else /* !PGM_SYNC_N_PAGES */
2085	unsigned iPTDst = 0;
2086	const unsigned iPTDstEnd = ELEMENTS(pPTDst->a);
2087	# endif /* !PGM_SYNC_N_PAGES */
2088	# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
2089	/* Select the right PDE as we're emulating a 4kb page table with 2 shadow page tables. */
2090	const unsigned offPTSrc = ((GCPtrPage >> SHW_PD_SHIFT) & 1) * 512;
2091	# else
2092	const unsigned offPTSrc = 0;
2093	# endif
2094	for (; iPTDst < iPTDstEnd; iPTDst++)
2095	{
2096	const unsigned iPTSrc = iPTDst + offPTSrc;
2097	const GSTPTE PteSrc = pPTSrc->a[iPTSrc];
2098
2099	if (PteSrc.n.u1Present) /* we've already cleared it above */
2100	{
2101	# ifndef IN_RING0
2102	/*
2103	* Assuming kernel code will be marked as supervisor - and not as user level
2104	* and executed using a conforming code selector - And marked as readonly.
2105	* Also assume that if we're monitoring a page, it's of no interest to CSAM.
2106	*/
2107	PPGMPAGE pPage;
2108	if ( ((PdeSrc.u & pPTSrc->a[iPTSrc].u) & (X86_PTE_RW \| X86_PTE_US))
2109	\|\| !CSAMDoesPageNeedScanning(pVM, (RTGCPTR)((iPDSrc << GST_PD_SHIFT) \| (iPTSrc << PAGE_SHIFT)))
2110	\|\| ( (pPage = pgmPhysGetPage(&pVM->pgm.s, PteSrc.u & GST_PTE_PG_MASK))
2111	&& PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage))
2112	)
2113	# endif
2114	PGM_BTH_NAME(SyncPageWorker)(pVM, &pPTDst->a[iPTDst], PdeSrc, PteSrc, pShwPage, iPTDst);
2115	Log2(("SyncPT: 4K+ %VGv PteSrc:{P=%d RW=%d U=%d raw=%08llx}%s dst.raw=%08llx iPTSrc=%x PdeSrc.u=%x physpte=%VGp\n",
2116	(RTGCPTR)((iPDSrc << GST_PD_SHIFT) \| (iPTSrc << PAGE_SHIFT)),
2117	PteSrc.n.u1Present,
2118	PteSrc.n.u1Write & PdeSrc.n.u1Write,
2119	PteSrc.n.u1User & PdeSrc.n.u1User,
2120	(uint64_t)PteSrc.u,
2121	pPTDst->a[iPTDst].u & PGM_PTFLAGS_TRACK_DIRTY ? " Track-Dirty" : "", pPTDst->a[iPTDst].u, iPTSrc, PdeSrc.au32[0],
2122	(PdeSrc.u & GST_PDE_PG_MASK) + iPTSrc*sizeof(PteSrc)));
2123	}
2124	} /* for PTEs */
2125	}
2126	}
2127	else
2128	{
2129	/*
2130	* Big page - 2/4MB.
2131	*
2132	* We'll walk the ram range list in parallel and optimize lookups.
2133	* We will only sync on shadow page table at a time.
2134	*/
2135	STAM_COUNTER_INC(CTXSUFF(&pVM->pgm.s.StatSynPT4M));
2136
2137	/**
2138	* @todo It might be more efficient to sync only a part of the 4MB page (similar to what we do for 4kb PDs).
2139	*/
2140
2141	/*
2142	* Start by syncing the page directory entry.
2143	*/
2144	PdeDst.u = (PdeDst.u & (SHW_PDE_PG_MASK \| (X86_PDE_AVL_MASK & ~PGM_PDFLAGS_TRACK_DIRTY)))
2145	\| (PdeSrc.u & ~(GST_PDE_PG_MASK \| X86_PDE_AVL_MASK \| X86_PDE_PCD \| X86_PDE_PWT \| X86_PDE_PS \| X86_PDE4M_G \| X86_PDE4M_D));
2146
2147	# ifdef PGM_SYNC_DIRTY_BIT
2148	/*
2149	* If the page is not flagged as dirty and is writable, then make it read-only
2150	* at PD level, so we can set the dirty bit when the page is modified.
2151	*
2152	* ASSUMES that page access handlers are implemented on page table entry level.
2153	* Thus we will first catch the dirty access and set PDE.D and restart. If
2154	* there is an access handler, we'll trap again and let it work on the problem.
2155	*/
2156	/** @todo move the above stuff to a section in the PGM documentation. */
2157	Assert(!(PdeDst.u & PGM_PDFLAGS_TRACK_DIRTY));
2158	if (!PdeSrc.b.u1Dirty && PdeSrc.b.u1Write)
2159	{
2160	STAM_COUNTER_INC(&pVM->pgm.s.CTXMID(Stat,DirtyPageBig));
2161	PdeDst.u \|= PGM_PDFLAGS_TRACK_DIRTY;
2162	PdeDst.b.u1Write = 0;
2163	}
2164	# endif /* PGM_SYNC_DIRTY_BIT */
2165	*pPdeDst = PdeDst;
2166
2167	/*
2168	* Fill the shadow page table.
2169	*/
2170	/* Get address and flags from the source PDE. */
2171	SHWPTE PteDstBase;
2172	PteDstBase.u = PdeSrc.u & ~(GST_PDE_PG_MASK \| X86_PTE_AVL_MASK \| X86_PTE_PAT \| X86_PTE_PCD \| X86_PTE_PWT);
2173
2174	/* Loop thru the entries in the shadow PT. */
2175	const RTGCUINTPTR GCPtr = (GCPtrPage >> SHW_PD_SHIFT) << SHW_PD_SHIFT; NOREF(GCPtr);
2176	Log2(("SyncPT: BIG %VGv PdeSrc:{P=%d RW=%d U=%d raw=%08llx} Shw=%VGv GCPhys=%VGp %s\n",
2177	GCPtrPage, PdeSrc.b.u1Present, PdeSrc.b.u1Write, PdeSrc.b.u1User, (uint64_t)PdeSrc.u, GCPtr,
2178	GCPhys, PdeDst.u & PGM_PDFLAGS_TRACK_DIRTY ? " Track-Dirty" : ""));
2179	PPGMRAMRANGE pRam = CTXALLSUFF(pVM->pgm.s.pRamRanges);
2180	unsigned iPTDst = 0;
2181	while (iPTDst < ELEMENTS(pPTDst->a))
2182	{
2183	/* Advance ram range list. */
2184	while (pRam && GCPhys > pRam->GCPhysLast)
2185	pRam = CTXALLSUFF(pRam->pNext);
2186	if (pRam && GCPhys >= pRam->GCPhys)
2187	{
2188	unsigned iHCPage = (GCPhys - pRam->GCPhys) >> PAGE_SHIFT;
2189	do
2190	{
2191	/* Make shadow PTE. */
2192	PPGMPAGE pPage = &pRam->aPages[iHCPage];
2193	SHWPTE PteDst;
2194
2195	/* Make sure the RAM has already been allocated. */
2196	if (pRam->fFlags & MM_RAM_FLAGS_DYNAMIC_ALLOC) /** @todo PAGE FLAGS */
2197	{
2198	if (RT_UNLIKELY(!PGM_PAGE_GET_HCPHYS(pPage)))
2199	{
2200	# ifdef IN_RING3
2201	int rc = pgmr3PhysGrowRange(pVM, GCPhys);
2202	# else
2203	int rc = CTXALLMID(VMM, CallHost)(pVM, VMMCALLHOST_PGM_RAM_GROW_RANGE, GCPhys);
2204	# endif
2205	if (rc != VINF_SUCCESS)
2206	return rc;
2207	}
2208	}
2209
2210	if (PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage))
2211	{
2212	if (!PGM_PAGE_HAS_ACTIVE_ALL_HANDLERS(pPage))
2213	{
2214	PteDst.u = PGM_PAGE_GET_HCPHYS(pPage) \| PteDstBase.u;
2215	PteDst.n.u1Write = 0;
2216	}
2217	else
2218	PteDst.u = 0;
2219	}
2220	# ifndef IN_RING0
2221	/*
2222	* Assuming kernel code will be marked as supervisor and not as user level and executed
2223	* using a conforming code selector. Don't check for readonly, as that implies the whole
2224	* 4MB can be code or readonly data. Linux enables write access for its large pages.
2225	*/
2226	else if ( !PdeSrc.n.u1User
2227	&& CSAMDoesPageNeedScanning(pVM, (RTGCPTR)(GCPtr \| (iPTDst << SHW_PT_SHIFT))))
2228	PteDst.u = 0;
2229	# endif
2230	else
2231	PteDst.u = PGM_PAGE_GET_HCPHYS(pPage) \| PteDstBase.u;
2232	# ifdef PGMPOOL_WITH_USER_TRACKING
2233	if (PteDst.n.u1Present)
2234	PGM_BTH_NAME(SyncPageWorkerTrackAddref)(pVM, pShwPage, pPage->HCPhys >> MM_RAM_FLAGS_IDX_SHIFT, pPage, iPTDst); /** @todo PAGE FLAGS */
2235	# endif
2236	/* commit it */
2237	pPTDst->a[iPTDst] = PteDst;
2238	Log4(("SyncPT: BIG %VGv PteDst:{P=%d RW=%d U=%d raw=%08llx}%s\n",
2239	(RTGCPTR)(GCPtr \| (iPTDst << SHW_PT_SHIFT)), PteDst.n.u1Present, PteDst.n.u1Write, PteDst.n.u1User, (uint64_t)PteDst.u,
2240	PteDst.u & PGM_PTFLAGS_TRACK_DIRTY ? " Track-Dirty" : ""));
2241
2242	/* advance */
2243	GCPhys += PAGE_SIZE;
2244	iHCPage++;
2245	iPTDst++;
2246	} while ( iPTDst < ELEMENTS(pPTDst->a)
2247	&& GCPhys <= pRam->GCPhysLast);
2248	}
2249	else if (pRam)
2250	{
2251	Log(("Invalid pages at %VGp\n", GCPhys));
2252	do
2253	{
2254	pPTDst->a[iPTDst].u = 0; /* MMIO or invalid page, we must handle them manually. */
2255	GCPhys += PAGE_SIZE;
2256	iPTDst++;
2257	} while ( iPTDst < ELEMENTS(pPTDst->a)
2258	&& GCPhys < pRam->GCPhys);
2259	}
2260	else
2261	{
2262	Log(("Invalid pages at %VGp (2)\n", GCPhys));
2263	for ( ; iPTDst < ELEMENTS(pPTDst->a); iPTDst++)
2264	pPTDst->a[iPTDst].u = 0; /* MMIO or invalid page, we must handle them manually. */
2265	}
2266	} /* while more PTEs */
2267	} /* 4KB / 4MB */
2268	}
2269	else
2270	AssertRelease(!PdeDst.n.u1Present);
2271
2272	STAM_PROFILE_STOP(&pVM->pgm.s.CTXMID(Stat,SyncPT), a);
2273	# ifdef IN_GC
2274	if (VBOX_FAILURE(rc))
2275	STAM_COUNTER_INC(&pVM->pgm.s.CTXMID(Stat,SyncPTFailed));
2276	# endif
2277	return rc;
2278
2279	#elif PGM_GST_TYPE == PGM_TYPE_REAL \|\| PGM_GST_TYPE == PGM_TYPE_PROT
2280
2281	int rc = VINF_SUCCESS;
2282
2283	/*
2284	* Validate input a little bit.
2285	*/
2286	# if PGM_SHW_TYPE == PGM_TYPE_32BIT
2287	PX86PD pPDDst = pVM->pgm.s.CTXMID(p,32BitPD);
2288	# else
2289	PX86PDPAE pPDDst = pVM->pgm.s.CTXMID(ap,PaePDs)[0];
2290	# endif
2291	const unsigned iPDDst = GCPtrPage >> SHW_PD_SHIFT;
2292	PSHWPDE pPdeDst = &pPDDst->a[iPDDst];
2293	SHWPDE PdeDst = *pPdeDst;
2294
2295	Assert(!(PdeDst.u & PGM_PDFLAGS_MAPPING));
2296	Assert(!PdeDst.n.u1Present); /* We're only supposed to call SyncPT on PDE!P and conflicts.*/
2297
2298	GSTPDE PdeSrc;
2299	PdeSrc.au32[0] = 0; /* faked so we don't have to #ifdef everything */
2300	PdeSrc.n.u1Present = 1;
2301	PdeSrc.n.u1Write = 1;
2302	PdeSrc.n.u1Accessed = 1;
2303	PdeSrc.n.u1User = 1;
2304
2305	/*
2306	* Allocate & map the page table.
2307	*/
2308	PSHWPT pPTDst;
2309	PPGMPOOLPAGE pShwPage;
2310	RTGCPHYS GCPhys;
2311
2312	/* Virtual address = physical address */
2313	GCPhys = GCPtrPage & X86_PAGE_4K_BASE_MASK_32;
2314	rc = pgmPoolAlloc(pVM, GCPhys, BTH_PGMPOOLKIND_PT_FOR_PT, SHW_POOL_ROOT_IDX, iPDDst, &pShwPage);
2315
2316	if ( rc == VINF_SUCCESS
2317	\|\| rc == VINF_PGM_CACHED_PAGE)
2318	pPTDst = (PSHWPT)PGMPOOL_PAGE_2_PTR(pVM, pShwPage);
2319	else
2320	AssertMsgFailedReturn(("rc=%Vrc\n", rc), VERR_INTERNAL_ERROR);
2321
2322	PdeDst.u &= X86_PDE_AVL_MASK;
2323	PdeDst.u \|= pShwPage->Core.Key;
2324	PdeDst.n.u1Present = 1;
2325	*pPdeDst = PdeDst;
2326
2327	rc = PGM_BTH_NAME(SyncPage)(pVM, PdeSrc, (RTGCUINTPTR)GCPtrPage, PGM_SYNC_NR_PAGES, 0 /* page not present */);
2328	STAM_PROFILE_STOP(&pVM->pgm.s.CTXMID(Stat,SyncPT), a);
2329	return rc;
2330
2331	#else /* PGM_GST_TYPE == PGM_TYPE_AMD64 */
2332	AssertReleaseMsgFailed(("Shw=%d Gst=%d is not implemented!\n", PGM_GST_TYPE, PGM_SHW_TYPE));
2333	STAM_PROFILE_STOP(&pVM->pgm.s.CTXMID(Stat,SyncPT), a);
2334	return VERR_INTERNAL_ERROR;
2335	#endif /* PGM_GST_TYPE == PGM_TYPE_AMD64 */
2336	}
2337
2338
2339
2340	/**
2341	* Prefetch a page/set of pages.
2342	*
2343	* Typically used to sync commonly used pages before entering raw mode
2344	* after a CR3 reload.
2345	*
2346	* @returns VBox status code.
2347	* @param pVM VM handle.
2348	* @param GCPtrPage Page to invalidate.
2349	*/
2350	PGM_BTH_DECL(int, PrefetchPage)(PVM pVM, RTGCUINTPTR GCPtrPage)
2351	{
2352	#if (PGM_GST_TYPE == PGM_TYPE_32BIT \|\| PGM_GST_TYPE == PGM_TYPE_REAL \|\| PGM_GST_TYPE == PGM_TYPE_PROT \|\| PGM_GST_TYPE == PGM_TYPE_PAE) && PGM_SHW_TYPE != PGM_TYPE_AMD64
2353	/*
2354	* Check that all Guest levels thru the PDE are present, getting the
2355	* PD and PDE in the processes.
2356	*/
2357	int rc = VINF_SUCCESS;
2358	# if PGM_WITH_PAGING(PGM_GST_TYPE)
2359	# if PGM_GST_TYPE == PGM_TYPE_32BIT
2360	const unsigned iPDSrc = (RTGCUINTPTR)GCPtrPage >> GST_PD_SHIFT;
2361	PGSTPD pPDSrc = CTXSUFF(pVM->pgm.s.pGuestPD);
2362	# else /* PAE */
2363	unsigned iPDSrc;
2364	PGSTPD pPDSrc = pgmGstGetPaePDPtr(&pVM->pgm.s, GCPtrPage, &iPDSrc);
2365	# endif
2366	const GSTPDE PdeSrc = pPDSrc->a[iPDSrc];
2367	# else
2368	PGSTPD pPDSrc = NULL;
2369	const unsigned iPDSrc = 0;
2370	GSTPDE PdeSrc;
2371
2372	PdeSrc.au32[0] = 0; /* faked so we don't have to #ifdef everything */
2373	PdeSrc.n.u1Present = 1;
2374	PdeSrc.n.u1Write = 1;
2375	PdeSrc.n.u1Accessed = 1;
2376	PdeSrc.n.u1User = 1;
2377	# endif
2378
2379	# ifdef PGM_SYNC_ACCESSED_BIT
2380	if (PdeSrc.n.u1Present && PdeSrc.n.u1Accessed)
2381	# else
2382	if (PdeSrc.n.u1Present)
2383	# endif
2384	{
2385	# if PGM_SHW_TYPE == PGM_TYPE_32BIT
2386	const X86PDE PdeDst = pVM->pgm.s.CTXMID(p,32BitPD)->a[GCPtrPage >> SHW_PD_SHIFT];
2387	# else
2388	const X86PDEPAE PdeDst = pVM->pgm.s.CTXMID(ap,PaePDs)[0]->a[GCPtrPage >> SHW_PD_SHIFT];
2389	# endif
2390	if (!(PdeDst.u & PGM_PDFLAGS_MAPPING))
2391	{
2392	if (!PdeDst.n.u1Present)
2393	/** r=bird: This guy will set the A bit on the PDE, probably harmless. */
2394	rc = PGM_BTH_NAME(SyncPT)(pVM, iPDSrc, pPDSrc, GCPtrPage);
2395	else
2396	{
2397	/** @note We used to sync PGM_SYNC_NR_PAGES pages, which triggered assertions in CSAM, because
2398	* R/W attributes of nearby pages were reset. Not sure how that could happen. Anyway, it
2399	* makes no sense to prefetch more than one page.
2400	*/
2401	rc = PGM_BTH_NAME(SyncPage)(pVM, PdeSrc, GCPtrPage, 1, 0);
2402	if (VBOX_SUCCESS(rc))
2403	rc = VINF_SUCCESS;
2404	}
2405	}
2406	}
2407	return rc;
2408
2409	#else /* PGM_GST_TYPE == PGM_TYPE_AMD64 */
2410
2411	AssertReleaseMsgFailed(("Shw=%d Gst=%d is not implemented!\n", PGM_SHW_TYPE, PGM_GST_TYPE));
2412	return VERR_INTERNAL_ERROR;
2413	#endif /* PGM_GST_TYPE == PGM_TYPE_AMD64 */
2414	}
2415
2416
2417
2418
2419	/**
2420	* Syncs a page during a PGMVerifyAccess() call.
2421	*
2422	* @returns VBox status code (informational included).
2423	* @param GCPtrPage The address of the page to sync.
2424	* @param fPage The effective guest page flags.
2425	* @param uErr The trap error code.
2426	*/
2427	PGM_BTH_DECL(int, VerifyAccessSyncPage)(PVM pVM, RTGCUINTPTR GCPtrPage, unsigned fPage, unsigned uErr)
2428	{
2429	LogFlow(("VerifyAccessSyncPage: GCPtrPage=%VGv fPage=%#x uErr=%#x\n", GCPtrPage, fPage, uErr));
2430
2431	#if (PGM_GST_TYPE == PGM_TYPE_32BIT \|\| PGM_GST_TYPE == PGM_TYPE_REAL \|\| PGM_GST_TYPE == PGM_TYPE_PROT \|\| PGM_GST_TYPE == PGM_TYPE_PAE) && PGM_SHW_TYPE != PGM_TYPE_AMD64
2432
2433	# ifndef IN_RING0
2434	if (!(fPage & X86_PTE_US))
2435	{
2436	/*
2437	* Mark this page as safe.
2438	*/
2439	/** @todo not correct for pages that contain both code and data!! */
2440	Log(("CSAMMarkPage %VGv; scanned=%d\n", GCPtrPage, true));
2441	CSAMMarkPage(pVM, (RTGCPTR)GCPtrPage, true);
2442	}
2443	# endif
2444	/*
2445	* Get guest PD and index.
2446	*/
2447
2448	# if PGM_WITH_PAGING(PGM_GST_TYPE)
2449	# if PGM_GST_TYPE == PGM_TYPE_32BIT
2450	const unsigned iPDSrc = (RTGCUINTPTR)GCPtrPage >> GST_PD_SHIFT;
2451	PGSTPD pPDSrc = CTXSUFF(pVM->pgm.s.pGuestPD);
2452	# else /* PAE */
2453	unsigned iPDSrc;
2454	PGSTPD pPDSrc = pgmGstGetPaePDPtr(&pVM->pgm.s, GCPtrPage, &iPDSrc);
2455	# endif
2456	# else
2457	PGSTPD pPDSrc = NULL;
2458	const unsigned iPDSrc = 0;
2459	# endif
2460	int rc = VINF_SUCCESS;
2461
2462	/*
2463	* First check if the shadow pd is present.
2464	*/
2465	# if PGM_SHW_TYPE == PGM_TYPE_32BIT
2466	PX86PDE pPdeDst = &pVM->pgm.s.CTXMID(p,32BitPD)->a[GCPtrPage >> SHW_PD_SHIFT];
2467	# else
2468	PX86PDEPAE pPdeDst = &pVM->pgm.s.CTXMID(ap,PaePDs)[0]->a[GCPtrPage >> SHW_PD_SHIFT];
2469	# endif
2470	if (!pPdeDst->n.u1Present)
2471	{
2472	rc = PGM_BTH_NAME(SyncPT)(pVM, iPDSrc, pPDSrc, GCPtrPage);
2473	AssertRC(rc);
2474	if (rc != VINF_SUCCESS)
2475	return rc;
2476	}
2477
2478	# if PGM_WITH_PAGING(PGM_GST_TYPE)
2479	/* Check for dirty bit fault */
2480	rc = PGM_BTH_NAME(CheckPageFault)(pVM, uErr, pPdeDst, &pPDSrc->a[iPDSrc], GCPtrPage);
2481	if (rc == VINF_PGM_HANDLED_DIRTY_BIT_FAULT)
2482	Log(("PGMVerifyAccess: success (dirty)\n"));
2483	else
2484	{
2485	GSTPDE PdeSrc = pPDSrc->a[iPDSrc];
2486	#else
2487	{
2488	GSTPDE PdeSrc;
2489	PdeSrc.au32[0] = 0; /* faked so we don't have to #ifdef everything */
2490	PdeSrc.n.u1Present = 1;
2491	PdeSrc.n.u1Write = 1;
2492	PdeSrc.n.u1Accessed = 1;
2493	PdeSrc.n.u1User = 1;
2494
2495	#endif /* PGM_WITH_PAGING(PGM_GST_TYPE) */
2496	Assert(rc != VINF_EM_RAW_GUEST_TRAP);
2497	if (uErr & X86_TRAP_PF_US)
2498	STAM_COUNTER_INC(&pVM->pgm.s.StatGCPageOutOfSyncUser);
2499	else /* supervisor */
2500	STAM_COUNTER_INC(&pVM->pgm.s.StatGCPageOutOfSyncSupervisor);
2501
2502	rc = PGM_BTH_NAME(SyncPage)(pVM, PdeSrc, GCPtrPage, 1, 0);
2503	if (VBOX_SUCCESS(rc))
2504	{
2505	/* Page was successfully synced */
2506	Log2(("PGMVerifyAccess: success (sync)\n"));
2507	rc = VINF_SUCCESS;
2508	}
2509	else
2510	{
2511	Log(("PGMVerifyAccess: access violation for %VGv rc=%d\n", GCPtrPage, rc));
2512	return VINF_EM_RAW_GUEST_TRAP;
2513	}
2514	}
2515	return rc;
2516
2517	#else /* PGM_GST_TYPE != PGM_TYPE_32BIT */
2518
2519	AssertReleaseMsgFailed(("Shw=%d Gst=%d is not implemented!\n", PGM_GST_TYPE, PGM_SHW_TYPE));
2520	return VERR_INTERNAL_ERROR;
2521	#endif /* PGM_GST_TYPE != PGM_TYPE_32BIT */
2522	}
2523
2524
2525	#if PGM_GST_TYPE == PGM_TYPE_32BIT \|\| PGM_GST_TYPE == PGM_TYPE_PAE
2526	# if PGM_SHW_TYPE == PGM_TYPE_32BIT \|\| PGM_SHW_TYPE == PGM_TYPE_PAE
2527	/**
2528	* Figures out which kind of shadow page this guest PDE warrants.
2529	*
2530	* @returns Shadow page kind.
2531	* @param pPdeSrc The guest PDE in question.
2532	* @param cr4 The current guest cr4 value.
2533	*/
2534	DECLINLINE(PGMPOOLKIND) PGM_BTH_NAME(CalcPageKind)(const GSTPDE *pPdeSrc, uint32_t cr4)
2535	{
2536	if (!pPdeSrc->n.u1Size \|\| !(cr4 & X86_CR4_PSE))
2537	return BTH_PGMPOOLKIND_PT_FOR_PT;
2538	//switch (pPdeSrc->u & (X86_PDE4M_RW \| X86_PDE4M_US /\| X86_PDE4M_PAE_NX/))
2539	//{
2540	// case 0:
2541	// return BTH_PGMPOOLKIND_PT_FOR_BIG_RO;
2542	// case X86_PDE4M_RW:
2543	// return BTH_PGMPOOLKIND_PT_FOR_BIG_RW;
2544	// case X86_PDE4M_US:
2545	// return BTH_PGMPOOLKIND_PT_FOR_BIG_US;
2546	// case X86_PDE4M_RW \| X86_PDE4M_US:
2547	// return BTH_PGMPOOLKIND_PT_FOR_BIG_RW_US;
2548	# if 0
2549	// case X86_PDE4M_PAE_NX:
2550	// return BTH_PGMPOOLKIND_PT_FOR_BIG_NX;
2551	// case X86_PDE4M_RW \| X86_PDE4M_PAE_NX:
2552	// return BTH_PGMPOOLKIND_PT_FOR_BIG_RW_NX;
2553	// case X86_PDE4M_US \| X86_PDE4M_PAE_NX:
2554	// return BTH_PGMPOOLKIND_PT_FOR_BIG_US_NX;
2555	// case X86_PDE4M_RW \| X86_PDE4M_US \| X86_PDE4M_PAE_NX:
2556	// return BTH_PGMPOOLKIND_PT_FOR_BIG_RW_US_NX;
2557	# endif
2558	return BTH_PGMPOOLKIND_PT_FOR_BIG;
2559	//}
2560	}
2561	# endif
2562	#endif
2563
2564	#undef MY_STAM_COUNTER_INC
2565	#define MY_STAM_COUNTER_INC(a) do { } while (0)
2566
2567
2568	/**
2569	* Syncs the paging hierarchy starting at CR3.
2570	*
2571	* @returns VBox status code, no specials.
2572	* @param pVM The virtual machine.
2573	* @param cr0 Guest context CR0 register
2574	* @param cr3 Guest context CR3 register
2575	* @param cr4 Guest context CR4 register
2576	* @param fGlobal Including global page directories or not
2577	*/
2578	PGM_BTH_DECL(int, SyncCR3)(PVM pVM, uint32_t cr0, uint32_t cr3, uint32_t cr4, bool fGlobal)
2579	{
2580	if (VM_FF_ISSET(pVM, VM_FF_PGM_SYNC_CR3))
2581	fGlobal = true; /* Change this CR3 reload to be a global one. */
2582
2583	/*
2584	* Update page access handlers.
2585	* The virtual are always flushed, while the physical are only on demand.
2586	* WARNING: We are incorrectly not doing global flushing on Virtual Handler updates. We'll
2587	* have to look into that later because it will have a bad influence on the performance.
2588	* @note SvL: There's no need for that. Just invalidate the virtual range(s).
2589	* bird: Yes, but that won't work for aliases.
2590	*/
2591	/** @todo this MUST go away. See #1557. */
2592	STAM_PROFILE_START(&pVM->pgm.s.CTXMID(Stat,SyncCR3Handlers), h);
2593	PGM_GST_NAME(HandlerVirtualUpdate)(pVM, cr4);
2594	STAM_PROFILE_STOP(&pVM->pgm.s.CTXMID(Stat,SyncCR3Handlers), h);
2595
2596	#ifdef PGMPOOL_WITH_MONITORING
2597	/*
2598	* When monitoring shadowed pages, we reset the modification counters on CR3 sync.
2599	* Occationally we will have to clear all the shadow page tables because we wanted
2600	* to monitor a page which was mapped by too many shadowed page tables. This operation
2601	* sometimes refered to as a 'lightweight flush'.
2602	*/
2603	if (!(pVM->pgm.s.fSyncFlags & PGM_SYNC_CLEAR_PGM_POOL))
2604	pgmPoolMonitorModifiedClearAll(pVM);
2605	else
2606	{
2607	# ifdef IN_RING3
2608	pVM->pgm.s.fSyncFlags &= ~PGM_SYNC_CLEAR_PGM_POOL;
2609	pgmPoolClearAll(pVM);
2610	# else
2611	LogFlow(("SyncCR3: PGM_SYNC_CLEAR_PGM_POOL is set -> VINF_PGM_SYNC_CR3\n"));
2612	return VINF_PGM_SYNC_CR3;
2613	# endif
2614	}
2615	#endif
2616
2617	Assert(fGlobal \|\| (cr4 & X86_CR4_PGE));
2618	MY_STAM_COUNTER_INC(fGlobal ? &pVM->pgm.s.CTXMID(Stat,SyncCR3Global) : &pVM->pgm.s.CTXMID(Stat,SyncCR3NotGlobal));
2619
2620	#if PGM_GST_TYPE == PGM_TYPE_32BIT \|\| PGM_GST_TYPE == PGM_TYPE_PAE
2621	/*
2622	* Get page directory addresses.
2623	*/
2624	# if PGM_SHW_TYPE == PGM_TYPE_32BIT
2625	PX86PDE pPDEDst = &pVM->pgm.s.CTXMID(p,32BitPD)->a[0];
2626	# else
2627	PX86PDEPAE pPDEDst = &pVM->pgm.s.CTXMID(ap,PaePDs)[0]->a[0];
2628	# endif
2629
2630	# if PGM_GST_TYPE == PGM_TYPE_32BIT
2631	PGSTPD pPDSrc = CTXSUFF(pVM->pgm.s.pGuestPD);
2632	Assert(pPDSrc);
2633	# ifndef IN_GC
2634	Assert(MMPhysGCPhys2HCVirt(pVM, (RTGCPHYS)(cr3 & GST_CR3_PAGE_MASK), sizeof(*pPDSrc)) == pPDSrc);
2635	# endif
2636	# endif
2637
2638	/*
2639	* Iterate the page directory.
2640	*/
2641	PPGMMAPPING pMapping;
2642	unsigned iPdNoMapping;
2643	const bool fRawR0Enabled = EMIsRawRing0Enabled(pVM);
2644	PPGMPOOL pPool = pVM->pgm.s.CTXSUFF(pPool);
2645
2646	/* Only check mappings if they are supposed to be put into the shadow page table. */
2647	if (pgmMapAreMappingsEnabled(&pVM->pgm.s))
2648	{
2649	pMapping = pVM->pgm.s.CTXALLSUFF(pMappings);
2650	iPdNoMapping = (pMapping) ? pMapping->GCPtr >> X86_PD_SHIFT : ~0U; /** PAE todo */
2651	}
2652	else
2653	{
2654	pMapping = 0;
2655	iPdNoMapping = ~0U;
2656	}
2657	# if PGM_GST_TYPE == PGM_TYPE_PAE \|\| PGM_GST_TYPE == PGM_TYPE_AMD64
2658	for (unsigned iPDPTE = 0; iPDPTE < GST_PDPE_ENTRIES; iPDPTE++)
2659	{
2660	unsigned iPDSrc;
2661	# if PGM_SHW_TYPE == PGM_TYPE_PAE
2662	PX86PDPAE pPDPAE = pVM->pgm.s.CTXMID(ap,PaePDs)[0];
2663	# else
2664	AssertFailed(); /* @todo */
2665	PX86PDPE pPDPAE = pVM->pgm.s.CTXMID(ap,PaePDs)[iPDPTE * X86_PG_AMD64_ENTRIES];
2666	# endif
2667	PX86PDEPAE pPDEDst = &pPDPAE->a[iPDPTE * X86_PG_PAE_ENTRIES];
2668	PGSTPD pPDSrc = pgmGstGetPaePDPtr(&pVM->pgm.s, iPDPTE << X86_PDPT_SHIFT, &iPDSrc);
2669
2670	if (pPDSrc == NULL)
2671	{
2672	/* PDPT not present */
2673	pVM->pgm.s.CTXMID(p,PaePDPT)->a[iPDPTE].n.u1Present = 0;
2674	continue;
2675	}
2676	# else /* PGM_GST_TYPE != PGM_TYPE_PAE && PGM_GST_TYPE != PGM_TYPE_AMD64 */
2677	{
2678	# endif /* PGM_GST_TYPE != PGM_TYPE_PAE && PGM_GST_TYPE != PGM_TYPE_AMD64 */
2679	for (unsigned iPD = 0; iPD < ELEMENTS(pPDSrc->a); iPD++)
2680	{
2681	# if PGM_SHW_TYPE == PGM_TYPE_32BIT
2682	Assert(&pVM->pgm.s.CTXMID(p,32BitPD)->a[iPD] == pPDEDst);
2683	# elif PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
2684	Assert(&pVM->pgm.s.CTXMID(ap,PaePDs)[iPD * 2 / 512]->a[iPD * 2 % 512] == pPDEDst);
2685	# endif
2686	register GSTPDE PdeSrc = pPDSrc->a[iPD];
2687	if ( PdeSrc.n.u1Present
2688	&& (PdeSrc.n.u1User \|\| fRawR0Enabled))
2689	{
2690	# if PGM_GST_TYPE == PGM_TYPE_32BIT
2691	/*
2692	* Check for conflicts with GC mappings.
2693	*/
2694	if (iPD == iPdNoMapping)
2695	{
2696	if (pVM->pgm.s.fMappingsFixed)
2697	{
2698	/* It's fixed, just skip the mapping. */
2699	const unsigned cPTs = pMapping->cPTs;
2700	iPD += cPTs - 1;
2701	pPDEDst += cPTs + (PGM_SHW_TYPE != PGM_TYPE_32BIT) * cPTs;
2702	pMapping = pMapping->CTXALLSUFF(pNext);
2703	iPdNoMapping = pMapping ? pMapping->GCPtr >> X86_PD_SHIFT : ~0U;
2704	continue;
2705	}
2706	# ifdef IN_RING3
2707	int rc = pgmR3SyncPTResolveConflict(pVM, pMapping, pPDSrc, iPD);
2708	if (VBOX_FAILURE(rc))
2709	return rc;
2710
2711	/*
2712	* Update iPdNoMapping and pMapping.
2713	*/
2714	pMapping = pVM->pgm.s.pMappingsR3;
2715	while (pMapping && pMapping->GCPtr < (iPD << X86_PD_SHIFT))
2716	pMapping = pMapping->pNextR3;
2717	iPdNoMapping = pMapping ? pMapping->GCPtr >> X86_PD_SHIFT : ~0U;
2718	# else
2719	LogFlow(("SyncCR3: detected conflict -> VINF_PGM_SYNC_CR3\n"));
2720	return VINF_PGM_SYNC_CR3;
2721	# endif
2722	}
2723	# else /* PGM_GST_TYPE != PGM_TYPE_32BIT */
2724	/* PAE and AMD64 modes are hardware accelerated only, so there are no mappings. */
2725	Assert(iPD != iPdNoMapping);
2726	# endif /* PGM_GST_TYPE != PGM_TYPE_32BIT */
2727	/*
2728	* Sync page directory entry.
2729	*
2730	* The current approach is to allocated the page table but to set
2731	* the entry to not-present and postpone the page table synching till
2732	* it's actually used.
2733	*/
2734	# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
2735	for (unsigned i = 0, iPdShw = iPD * 2; i < 2; i++, iPdShw++) /* pray that the compiler unrolls this */
2736	# else
2737	const unsigned iPdShw = iPD; NOREF(iPdShw);
2738	# endif
2739	{
2740	SHWPDE PdeDst = *pPDEDst;
2741	if (PdeDst.n.u1Present)
2742	{
2743	PPGMPOOLPAGE pShwPage = pgmPoolGetPage(pPool, PdeDst.u & SHW_PDE_PG_MASK);
2744	RTGCPHYS GCPhys;
2745	if ( !PdeSrc.b.u1Size
2746	\|\| !(cr4 & X86_CR4_PSE))
2747	{
2748	GCPhys = PdeSrc.u & GST_PDE_PG_MASK;
2749	# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
2750	/* Select the right PDE as we're emulating a 4kb page table with 2 shadow page tables. */
2751	GCPhys \|= i * (PAGE_SIZE / 2);
2752	# endif
2753	}
2754	else
2755	{
2756	GCPhys = PdeSrc.u & GST_PDE_BIG_PG_MASK;
2757	# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
2758	/* Select the right PDE as we're emulating a 4MB page directory with two 2 MB shadow PDEs.*/
2759	GCPhys \|= i * X86_PAGE_2M_SIZE;
2760	# endif
2761	}
2762
2763	if ( pShwPage->GCPhys == GCPhys
2764	&& pShwPage->enmKind == PGM_BTH_NAME(CalcPageKind)(&PdeSrc, cr4)
2765	&& ( pShwPage->fCached
2766	\|\| ( !fGlobal
2767	&& ( false
2768	# ifdef PGM_SKIP_GLOBAL_PAGEDIRS_ON_NONGLOBAL_FLUSH
2769	\|\| ( (PdeSrc.u & (X86_PDE4M_PS \| X86_PDE4M_G)) == (X86_PDE4M_PS \| X86_PDE4M_G)
2770	&& (cr4 & (X86_CR4_PGE \| X86_CR4_PSE)) == (X86_CR4_PGE \| X86_CR4_PSE)) /* global 2/4MB page. */
2771	\|\| ( !pShwPage->fSeenNonGlobal
2772	&& (cr4 & X86_CR4_PGE))
2773	# endif
2774	)
2775	)
2776	)
2777	&& ( (PdeSrc.u & (X86_PDE_US \| X86_PDE_RW)) == (PdeDst.u & (X86_PDE_US \| X86_PDE_RW))
2778	\|\| ( (cr4 & X86_CR4_PSE)
2779	&& ((PdeSrc.u & (X86_PDE_US \| X86_PDE4M_PS \| X86_PDE4M_D)) \| PGM_PDFLAGS_TRACK_DIRTY)
2780	== ((PdeDst.u & (X86_PDE_US \| X86_PDE_RW \| PGM_PDFLAGS_TRACK_DIRTY)) \| X86_PDE4M_PS))
2781	)
2782	)
2783	{
2784	# ifdef VBOX_WITH_STATISTICS
2785	if ( !fGlobal
2786	&& (PdeSrc.u & (X86_PDE4M_PS \| X86_PDE4M_G)) == (X86_PDE4M_PS \| X86_PDE4M_G)
2787	&& (cr4 & (X86_CR4_PGE \| X86_CR4_PSE)) == (X86_CR4_PGE \| X86_CR4_PSE))
2788	MY_STAM_COUNTER_INC(&pVM->pgm.s.CTXMID(Stat,SyncCR3DstSkippedGlobalPD));
2789	else if (!fGlobal && !pShwPage->fSeenNonGlobal && (cr4 & X86_CR4_PGE))
2790	MY_STAM_COUNTER_INC(&pVM->pgm.s.CTXMID(Stat,SyncCR3DstSkippedGlobalPT));
2791	else
2792	MY_STAM_COUNTER_INC(&pVM->pgm.s.CTXMID(Stat,SyncCR3DstCacheHit));
2793	# endif /* VBOX_WITH_STATISTICS */
2794	/** @todo a replacement strategy isn't really needed unless we're using a very small pool < 512 pages.
2795	* The whole ageing stuff should be put in yet another set of #ifdefs. For now, let's just skip it. */
2796	//# ifdef PGMPOOL_WITH_CACHE
2797	// pgmPoolCacheUsed(pPool, pShwPage);
2798	//# endif
2799	}
2800	else
2801	{
2802	pgmPoolFreeByPage(pPool, pShwPage, SHW_POOL_ROOT_IDX, iPdShw);
2803	pPDEDst->u = 0;
2804	MY_STAM_COUNTER_INC(&pVM->pgm.s.CTXMID(Stat,SyncCR3DstFreed));
2805	}
2806	}
2807	else
2808	MY_STAM_COUNTER_INC(&pVM->pgm.s.CTXMID(Stat,SyncCR3DstNotPresent));
2809	pPDEDst++;
2810	}
2811	}
2812	else if (iPD != iPdNoMapping)
2813	{
2814	/*
2815	* Check if there is any page directory to mark not present here.
2816	*/
2817	# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
2818	for (unsigned i = 0, iPdShw = iPD * 2; i < 2; i++, iPdShw++) /* pray that the compiler unrolls this */
2819	# else
2820	const unsigned iPdShw = iPD; NOREF(iPdShw);
2821	# endif
2822	{
2823	if (pPDEDst->n.u1Present)
2824	{
2825	pgmPoolFreeByPage(pPool, pgmPoolGetPage(pPool, pPDEDst->u & SHW_PDE_PG_MASK), SHW_POOL_ROOT_IDX, iPdShw);
2826	pPDEDst->u = 0;
2827	MY_STAM_COUNTER_INC(&pVM->pgm.s.CTXMID(Stat,SyncCR3DstFreedSrcNP));
2828	}
2829	pPDEDst++;
2830	}
2831	}
2832	else
2833	{
2834	# if PGM_GST_TYPE == PGM_TYPE_32BIT
2835	Assert(pgmMapAreMappingsEnabled(&pVM->pgm.s));
2836	const unsigned cPTs = pMapping->cPTs;
2837	if (pVM->pgm.s.fMappingsFixed)
2838	{
2839	/* It's fixed, just skip the mapping. */
2840	pMapping = pMapping->CTXALLSUFF(pNext);
2841	iPdNoMapping = pMapping ? pMapping->GCPtr >> X86_PD_SHIFT : ~0U;
2842	}
2843	else
2844	{
2845	/*
2846	* Check for conflicts for subsequent pagetables
2847	* and advance to the next mapping.
2848	*/
2849	iPdNoMapping = ~0U;
2850	unsigned iPT = cPTs;
2851	while (iPT-- > 1)
2852	{
2853	if ( pPDSrc->a[iPD + iPT].n.u1Present
2854	&& (pPDSrc->a[iPD + iPT].n.u1User \|\| fRawR0Enabled))
2855	{
2856	# ifdef IN_RING3
2857	int rc = pgmR3SyncPTResolveConflict(pVM, pMapping, pPDSrc, iPD);
2858	if (VBOX_FAILURE(rc))
2859	return rc;
2860
2861	/*
2862	* Update iPdNoMapping and pMapping.
2863	*/
2864	pMapping = pVM->pgm.s.CTXALLSUFF(pMappings);
2865	while (pMapping && pMapping->GCPtr < (iPD << X86_PD_SHIFT))
2866	pMapping = pMapping->CTXALLSUFF(pNext);
2867	iPdNoMapping = pMapping ? pMapping->GCPtr >> X86_PD_SHIFT : ~0U;
2868	break;
2869	# else
2870	LogFlow(("SyncCR3: detected conflict -> VINF_PGM_SYNC_CR3\n"));
2871	return VINF_PGM_SYNC_CR3;
2872	# endif
2873	}
2874	}
2875	if (iPdNoMapping == ~0U && pMapping)
2876	{
2877	pMapping = pMapping->CTXALLSUFF(pNext);
2878	if (pMapping)
2879	iPdNoMapping = pMapping->GCPtr >> X86_PD_SHIFT;
2880	}
2881	}
2882
2883	/* advance. */
2884	iPD += cPTs - 1;
2885	pPDEDst += cPTs + (PGM_SHW_TYPE != PGM_TYPE_32BIT) * cPTs;
2886	# else /* PGM_GST_TYPE != PGM_TYPE_32BIT */
2887	/* PAE and AMD64 modes are hardware accelerated only, so there are no mappings. */
2888	AssertFailed();
2889	# endif /* PGM_GST_TYPE != PGM_TYPE_32BIT */
2890	}
2891
2892	} /* for iPD */
2893	} /* for each PDPTE (PAE) */
2894
2895	return VINF_SUCCESS;
2896
2897	#elif PGM_GST_TYPE == PGM_TYPE_AMD64
2898	//# error not implemented
2899	return VERR_INTERNAL_ERROR;
2900	#else /* guest real and protected mode */
2901	return VINF_SUCCESS;
2902	#endif
2903	}
2904
2905
2906
2907
2908	#ifdef VBOX_STRICT
2909	#ifdef IN_GC
2910	# undef AssertMsgFailed
2911	# define AssertMsgFailed Log
2912	#endif
2913	#ifdef IN_RING3
2914	# include <VBox/dbgf.h>
2915
2916	/**
2917	* Dumps a page table hierarchy use only physical addresses and cr4/lm flags.
2918	*
2919	* @returns VBox status code (VINF_SUCCESS).
2920	* @param pVM The VM handle.
2921	* @param cr3 The root of the hierarchy.
2922	* @param crr The cr4, only PAE and PSE is currently used.
2923	* @param fLongMode Set if long mode, false if not long mode.
2924	* @param cMaxDepth Number of levels to dump.
2925	* @param pHlp Pointer to the output functions.
2926	*/
2927	__BEGIN_DECLS
2928	PGMR3DECL(int) PGMR3DumpHierarchyHC(PVM pVM, uint32_t cr3, uint32_t cr4, bool fLongMode, unsigned cMaxDepth, PCDBGFINFOHLP pHlp);
2929	__END_DECLS
2930
2931	#endif
2932
2933	/**
2934	* Checks that the shadow page table is in sync with the guest one.
2935	*
2936	* @returns The number of errors.
2937	* @param pVM The virtual machine.
2938	* @param cr3 Guest context CR3 register
2939	* @param cr4 Guest context CR4 register
2940	* @param GCPtr Where to start. Defaults to 0.
2941	* @param cb How much to check. Defaults to everything.
2942	*/
2943	PGM_BTH_DECL(unsigned, AssertCR3)(PVM pVM, uint32_t cr3, uint32_t cr4, RTGCUINTPTR GCPtr, RTGCUINTPTR cb)
2944	{
2945	unsigned cErrors = 0;
2946
2947	#if PGM_GST_TYPE == PGM_TYPE_32BIT
2948	PPGM pPGM = &pVM->pgm.s;
2949	RTHCPHYS HCPhysShw; /* page address derived from the shadow page tables. */
2950	RTGCPHYS GCPhysGst; /* page address derived from the guest page tables. */
2951	RTHCPHYS HCPhys; /* general usage. */
2952	int rc;
2953
2954	/*
2955	* Check that the Guest CR3 and all it's mappings are correct.
2956	*/
2957	AssertMsgReturn(pPGM->GCPhysCR3 == (cr3 & GST_CR3_PAGE_MASK),
2958	("Invalid GCPhysCR3=%VGp cr3=%VGp\n", pPGM->GCPhysCR3, (RTGCPHYS)cr3),
2959	false);
2960	rc = PGMShwGetPage(pVM, pPGM->pGuestPDGC, NULL, &HCPhysShw);
2961	AssertRCReturn(rc, 1);
2962	HCPhys = NIL_RTHCPHYS;
2963	rc = pgmRamGCPhys2HCPhys(pPGM, cr3 & GST_CR3_PAGE_MASK, &HCPhys);
2964	AssertMsgReturn(HCPhys == HCPhysShw, ("HCPhys=%VHp HCPhyswShw=%VHp (cr3)\n", HCPhys, HCPhysShw), false);
2965	# ifdef IN_RING3
2966	RTGCPHYS GCPhys;
2967	rc = PGMR3DbgHCPtr2GCPhys(pVM, pPGM->pGuestPDHC, &GCPhys);
2968	AssertRCReturn(rc, 1);
2969	AssertMsgReturn((cr3 & GST_CR3_PAGE_MASK) == GCPhys, ("GCPhys=%VGp cr3=%VGp\n", GCPhys, (RTGCPHYS)cr3), false);
2970	# endif
2971	const X86PD *pPDSrc = CTXSUFF(pPGM->pGuestPD);
2972
2973	/*
2974	* Get and check the Shadow CR3.
2975	*/
2976	# if PGM_SHW_TYPE == PGM_TYPE_32BIT
2977	const X86PD *pPDDst = pPGM->CTXMID(p,32BitPD);
2978	unsigned cPDEs = ELEMENTS(pPDDst->a);
2979	# else
2980	const X86PDPAE pPDDst = pPGM->CTXMID(ap,PaePDs[0]); / use it as a 2048 entry PD */
2981	unsigned cPDEs = ELEMENTS(pPDDst->a) * ELEMENTS(pPGM->apHCPaePDs);
2982	# endif
2983	if (cb != ~(RTGCUINTPTR)0)
2984	cPDEs = RT_MIN(cb >> SHW_PD_SHIFT, 1);
2985
2986	/** @todo call the other two PGMAssert() functions. /
2987
2988	/*
2989	* Iterate the shadow page directory.
2990	*/
2991	GCPtr = (GCPtr >> SHW_PD_SHIFT) << SHW_PD_SHIFT;
2992	unsigned iPDDst = GCPtr >> SHW_PD_SHIFT;
2993	cPDEs += iPDDst;
2994	for (;
2995	iPDDst < cPDEs;
2996	iPDDst++, GCPtr += _4G / cPDEs)
2997	{
2998	const SHWPDE PdeDst = pPDDst->a[iPDDst];
2999	if (PdeDst.u & PGM_PDFLAGS_MAPPING)
3000	{
3001	Assert(pgmMapAreMappingsEnabled(&pVM->pgm.s));
3002	if ((PdeDst.u & X86_PDE_AVL_MASK) != PGM_PDFLAGS_MAPPING)
3003	{
3004	AssertMsgFailed(("Mapping shall only have PGM_PDFLAGS_MAPPING set! PdeDst.u=%#RX64\n", (uint64_t)PdeDst.u));
3005	cErrors++;
3006	continue;
3007	}
3008	}
3009	else if ( (PdeDst.u & X86_PDE_P)
3010	\|\| ((PdeDst.u & (X86_PDE_P \| PGM_PDFLAGS_TRACK_DIRTY)) == (X86_PDE_P \| PGM_PDFLAGS_TRACK_DIRTY))
3011	)
3012	{
3013	HCPhysShw = PdeDst.u & SHW_PDE_PG_MASK;
3014	PPGMPOOLPAGE pPoolPage = pgmPoolGetPageByHCPhys(pVM, HCPhysShw);
3015	if (!pPoolPage)
3016	{
3017	AssertMsgFailed(("Invalid page table address %VGp at %VGv! PdeDst=%#RX64\n",
3018	HCPhysShw, GCPtr, (uint64_t)PdeDst.u));
3019	cErrors++;
3020	continue;
3021	}
3022	const SHWPT pPTDst = (const SHWPT )PGMPOOL_PAGE_2_PTR(pVM, pPoolPage);
3023
3024	if (PdeDst.u & (X86_PDE4M_PWT \| X86_PDE4M_PCD))
3025	{
3026	AssertMsgFailed(("PDE flags PWT and/or PCD is set at %VGv! These flags are not virtualized! PdeDst=%#RX64\n",
3027	GCPtr, (uint64_t)PdeDst.u));
3028	cErrors++;
3029	}
3030
3031	if (PdeDst.u & (X86_PDE4M_G \| X86_PDE4M_D))
3032	{
3033	AssertMsgFailed(("4K PDE reserved flags at %VGv! PdeDst=%#RX64\n",
3034	GCPtr, (uint64_t)PdeDst.u));
3035	cErrors++;
3036	}
3037
3038	const X86PDE PdeSrc = pPDSrc->a[iPDDst >> (GST_PD_SHIFT - SHW_PD_SHIFT)];
3039	if (!PdeSrc.n.u1Present)
3040	{
3041	AssertMsgFailed(("Guest PDE at %VGv is not present! PdeDst=%#RX64 PdeSrc=%#RX64\n",
3042	GCPtr, (uint64_t)PdeDst.u, (uint64_t)PdeSrc.u));
3043	cErrors++;
3044	continue;
3045	}
3046
3047	if ( !PdeSrc.b.u1Size
3048	\|\| !(cr4 & X86_CR4_PSE))
3049	{
3050	GCPhysGst = PdeSrc.u & GST_PDE_PG_MASK;
3051	# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
3052	GCPhysGst \|= (iPDDst & 1) * (PAGE_SIZE / 2);
3053	# endif
3054	}
3055	else
3056	{
3057	if (PdeSrc.u & X86_PDE4M_PG_HIGH_MASK)
3058	{
3059	AssertMsgFailed(("Guest PDE at %VGv is using PSE36 or similar! PdeSrc=%#RX64\n",
3060	GCPtr, (uint64_t)PdeSrc.u));
3061	cErrors++;
3062	continue;
3063	}
3064	GCPhysGst = PdeSrc.u & GST_PDE_BIG_PG_MASK;
3065	# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
3066	GCPhysGst \|= GCPtr & RT_BIT(X86_PAGE_2M_SHIFT);
3067	# endif
3068	}
3069
3070	if ( pPoolPage->enmKind
3071	!= (!PdeSrc.b.u1Size \|\| !(cr4 & X86_CR4_PSE) ? BTH_PGMPOOLKIND_PT_FOR_PT : BTH_PGMPOOLKIND_PT_FOR_BIG))
3072	{
3073	AssertMsgFailed(("Invalid shadow page table kind %d at %VGv! PdeSrc=%#RX64\n",
3074	pPoolPage->enmKind, GCPtr, (uint64_t)PdeSrc.u));
3075	cErrors++;
3076	}
3077
3078	PPGMPAGE pPhysPage = pgmPhysGetPage(pPGM, GCPhysGst);
3079	if (!pPhysPage)
3080	{
3081	AssertMsgFailed(("Cannot find guest physical address %VGp in the PDE at %VGv! PdeSrc=%#RX64\n",
3082	GCPhysGst, GCPtr, (uint64_t)PdeSrc.u));
3083	cErrors++;
3084	continue;
3085	}
3086
3087	if (GCPhysGst != pPoolPage->GCPhys)
3088	{
3089	AssertMsgFailed(("GCPhysGst=%VGp != pPage->GCPhys=%VGp at %VGv\n",
3090	GCPhysGst, pPoolPage->GCPhys, GCPtr));
3091	cErrors++;
3092	continue;
3093	}
3094
3095	if ( !PdeSrc.b.u1Size
3096	\|\| !(cr4 & X86_CR4_PSE))
3097	{
3098	/*
3099	* Page Table.
3100	*/
3101	const GSTPT *pPTSrc;
3102	rc = PGM_GCPHYS_2_PTR(pVM, GCPhysGst & ~(RTGCPHYS)(PAGE_SIZE - 1), &pPTSrc);
3103	if (VBOX_FAILURE(rc))
3104	{
3105	AssertMsgFailed(("Cannot map/convert guest physical address %VGp in the PDE at %VGv! PdeSrc=%#RX64\n",
3106	GCPhysGst, GCPtr, (uint64_t)PdeSrc.u));
3107	cErrors++;
3108	continue;
3109	}
3110	if ( (PdeSrc.u & (X86_PDE_P \| X86_PDE_US \| X86_PDE_RW/* \| X86_PDE_A*/))
3111	!= (PdeDst.u & (X86_PDE_P \| X86_PDE_US \| X86_PDE_RW/* \| X86_PDE_A*/)))
3112	{
3113	/// @todo We get here a lot on out-of-sync CR3 entries. The access handler should zap them to avoid false alarms here!
3114	// (This problem will go away when/if we shadow multiple CR3s.)
3115	AssertMsgFailed(("4K PDE flags mismatch at %VGv! PdeSrc=%#RX64 PdeDst=%#RX64\n",
3116	GCPtr, (uint64_t)PdeSrc.u, (uint64_t)PdeDst.u));
3117	cErrors++;
3118	continue;
3119	}
3120	if (PdeDst.u & PGM_PDFLAGS_TRACK_DIRTY)
3121	{
3122	AssertMsgFailed(("4K PDEs cannot have PGM_PDFLAGS_TRACK_DIRTY set! GCPtr=%VGv PdeDst=%#RX64\n",
3123	GCPtr, (uint64_t)PdeDst.u));
3124	cErrors++;
3125	continue;
3126	}
3127
3128	/* iterate the page table. */
3129	# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
3130	/* Select the right PDE as we're emulating a 4kb page table with 2 shadow page tables. */
3131	const unsigned offPTSrc = ((GCPtr >> SHW_PD_SHIFT) & 1) * 512;
3132	# else
3133	const unsigned offPTSrc = 0;
3134	# endif
3135	for (unsigned iPT = 0, off = 0;
3136	iPT < ELEMENTS(pPTDst->a);
3137	iPT++, off += PAGE_SIZE)
3138	{
3139	const SHWPTE PteDst = pPTDst->a[iPT];
3140
3141	/* skip not-present entries. */
3142	if (!(PteDst.u & (X86_PTE_P \| PGM_PTFLAGS_TRACK_DIRTY))) /** @todo deal with ALL handlers and CSAM !P pages! */
3143	continue;
3144	Assert(PteDst.n.u1Present);
3145
3146	const GSTPTE PteSrc = pPTSrc->a[iPT + offPTSrc];
3147	if (!PteSrc.n.u1Present)
3148	{
3149	#ifdef IN_RING3
3150	PGMAssertHandlerAndFlagsInSync(pVM);
3151	PGMR3DumpHierarchyGC(pVM, cr3, cr4, (PdeSrc.u & GST_PDE_PG_MASK));
3152	#endif
3153	AssertMsgFailed(("Out of sync (!P) PTE at %VGv! PteSrc=%#RX64 PteDst=%#RX64 pPTSrc=%VGv iPTSrc=%x PdeSrc=%x physpte=%VGp\n",
3154	GCPtr + off, (uint64_t)PteSrc.u, (uint64_t)PteDst.u, pPTSrc, iPT + offPTSrc, PdeSrc.au32[0],
3155	(PdeSrc.u & GST_PDE_PG_MASK) + (iPT + offPTSrc)*sizeof(PteSrc)));
3156	cErrors++;
3157	continue;
3158	}
3159
3160	uint64_t fIgnoreFlags = GST_PTE_PG_MASK \| X86_PTE_AVL_MASK \| X86_PTE_G \| X86_PTE_D \| X86_PTE_PWT \| X86_PTE_PCD \| X86_PTE_PAT;
3161	# if 1 /** @todo sync accessed bit properly... */
3162	fIgnoreFlags \|= X86_PTE_A;
3163	# endif
3164
3165	/* match the physical addresses */
3166	HCPhysShw = PteDst.u & SHW_PTE_PG_MASK;
3167	GCPhysGst = PteSrc.u & GST_PTE_PG_MASK;
3168
3169	# ifdef IN_RING3
3170	rc = PGMPhysGCPhys2HCPhys(pVM, GCPhysGst, &HCPhys);
3171	if (VBOX_FAILURE(rc))
3172	{
3173	if (HCPhysShw != MMR3PageDummyHCPhys(pVM))
3174	{
3175	AssertMsgFailed(("Cannot find guest physical address %VGp at %VGv! PteSrc=%#RX64 PteDst=%#RX64\n",
3176	GCPhysGst, GCPtr + off, (uint64_t)PteSrc.u, (uint64_t)PteDst.u));
3177	cErrors++;
3178	continue;
3179	}
3180	}
3181	else if (HCPhysShw != (HCPhys & SHW_PTE_PG_MASK))
3182	{
3183	AssertMsgFailed(("Out of sync (phys) at %VGv! HCPhysShw=%VHp HCPhys=%VHp GCPhysGst=%VGp PteSrc=%#RX64 PteDst=%#RX64\n",
3184	GCPtr + off, HCPhysShw, HCPhys, GCPhysGst, (uint64_t)PteSrc.u, (uint64_t)PteDst.u));
3185	cErrors++;
3186	continue;
3187	}
3188	# endif
3189
3190	pPhysPage = pgmPhysGetPage(pPGM, GCPhysGst);
3191	if (!pPhysPage)
3192	{
3193	# ifdef IN_RING3 /** @todo make MMR3PageDummyHCPhys an 'All' function! */
3194	if (HCPhysShw != MMR3PageDummyHCPhys(pVM))
3195	{
3196	AssertMsgFailed(("Cannot find guest physical address %VGp at %VGv! PteSrc=%#RX64 PteDst=%#RX64\n",
3197	GCPhysGst, GCPtr + off, (uint64_t)PteSrc.u, (uint64_t)PteDst.u));
3198	cErrors++;
3199	continue;
3200	}
3201	# endif
3202	if (PteDst.n.u1Write)
3203	{
3204	AssertMsgFailed(("Invalid guest page at %VGv is writable! GCPhysGst=%VGp PteSrc=%#RX64 PteDst=%#RX64\n",
3205	GCPtr + off, GCPhysGst, (uint64_t)PteSrc.u, (uint64_t)PteDst.u));
3206	cErrors++;
3207	}
3208	fIgnoreFlags \|= X86_PTE_RW;
3209	}
3210	else if (HCPhysShw != (PGM_PAGE_GET_HCPHYS(pPhysPage) & SHW_PTE_PG_MASK))
3211	{
3212	AssertMsgFailed(("Out of sync (phys) at %VGv! HCPhysShw=%VHp HCPhys=%VHp GCPhysGst=%VGp PteSrc=%#RX64 PteDst=%#RX64\n",
3213	GCPtr + off, HCPhysShw, pPhysPage->HCPhys, GCPhysGst, (uint64_t)PteSrc.u, (uint64_t)PteDst.u));
3214	cErrors++;
3215	continue;
3216	}
3217
3218	/* flags */
3219	if (PGM_PAGE_HAS_ACTIVE_HANDLERS(pPhysPage))
3220	{
3221	if (!PGM_PAGE_HAS_ACTIVE_ALL_HANDLERS(pPhysPage))
3222	{
3223	if (PteDst.n.u1Write)
3224	{
3225	AssertMsgFailed(("WRITE access flagged at %VGv but the page is writable! HCPhys=%VGv PteSrc=%#RX64 PteDst=%#RX64\n",
3226	GCPtr + off, pPhysPage->HCPhys, (uint64_t)PteSrc.u, (uint64_t)PteDst.u));
3227	cErrors++;
3228	continue;
3229	}
3230	fIgnoreFlags \|= X86_PTE_RW;
3231	}
3232	else
3233	{
3234	if (PteDst.n.u1Present)
3235	{
3236	AssertMsgFailed(("ALL access flagged at %VGv but the page is present! HCPhys=%VHp PteSrc=%#RX64 PteDst=%#RX64\n",
3237	GCPtr + off, pPhysPage->HCPhys, (uint64_t)PteSrc.u, (uint64_t)PteDst.u));
3238	cErrors++;
3239	continue;
3240	}
3241	fIgnoreFlags \|= X86_PTE_P;
3242	}
3243	}
3244	else
3245	{
3246	if (!PteSrc.n.u1Dirty && PteSrc.n.u1Write)
3247	{
3248	if (PteDst.n.u1Write)
3249	{
3250	AssertMsgFailed(("!DIRTY page at %VGv is writable! PteSrc=%#RX64 PteDst=%#RX64\n",
3251	GCPtr + off, (uint64_t)PteSrc.u, (uint64_t)PteDst.u));
3252	cErrors++;
3253	continue;
3254	}
3255	if (!(PteDst.u & PGM_PTFLAGS_TRACK_DIRTY))
3256	{
3257	AssertMsgFailed(("!DIRTY page at %VGv is not marked TRACK_DIRTY! PteSrc=%#RX64 PteDst=%#RX64\n",
3258	GCPtr + off, (uint64_t)PteSrc.u, (uint64_t)PteDst.u));
3259	cErrors++;
3260	continue;
3261	}
3262	if (PteDst.n.u1Dirty)
3263	{
3264	AssertMsgFailed(("!DIRTY page at %VGv is marked DIRTY! PteSrc=%#RX64 PteDst=%#RX64\n",
3265	GCPtr + off, (uint64_t)PteSrc.u, (uint64_t)PteDst.u));
3266	cErrors++;
3267	}
3268	# if 0 /** @todo sync access bit properly... */
3269	if (PteDst.n.u1Accessed != PteSrc.n.u1Accessed)
3270	{
3271	AssertMsgFailed(("!DIRTY page at %VGv is has mismatching accessed bit! PteSrc=%#RX64 PteDst=%#RX64\n",
3272	GCPtr + off, (uint64_t)PteSrc.u, (uint64_t)PteDst.u));
3273	cErrors++;
3274	}
3275	fIgnoreFlags \|= X86_PTE_RW;
3276	# else
3277	fIgnoreFlags \|= X86_PTE_RW \| X86_PTE_A;
3278	# endif
3279	}
3280	else if (PteDst.u & PGM_PTFLAGS_TRACK_DIRTY)
3281	{
3282	/* access bit emulation (not implemented). */
3283	if (PteSrc.n.u1Accessed \|\| PteDst.n.u1Present)
3284	{
3285	AssertMsgFailed(("PGM_PTFLAGS_TRACK_DIRTY set at %VGv but no accessed bit emulation! PteSrc=%#RX64 PteDst=%#RX64\n",
3286	GCPtr + off, (uint64_t)PteSrc.u, (uint64_t)PteDst.u));
3287	cErrors++;
3288	continue;
3289	}
3290	if (!PteDst.n.u1Accessed)
3291	{
3292	AssertMsgFailed(("!ACCESSED page at %VGv is has the accessed bit set! PteSrc=%#RX64 PteDst=%#RX64\n",
3293	GCPtr + off, (uint64_t)PteSrc.u, (uint64_t)PteDst.u));
3294	cErrors++;
3295	}
3296	fIgnoreFlags \|= X86_PTE_P;
3297	}
3298	# ifdef DEBUG_sandervl
3299	fIgnoreFlags \|= X86_PTE_D \| X86_PTE_A;
3300	# endif
3301	}
3302
3303	if ( (PteSrc.u & ~fIgnoreFlags) != (PteDst.u & ~fIgnoreFlags)
3304	&& (PteSrc.u & ~(fIgnoreFlags \| X86_PTE_RW)) != (PteDst.u & ~fIgnoreFlags)
3305	)
3306	{
3307	AssertMsgFailed(("Flags mismatch at %VGv! %#RX64 != %#RX64 fIgnoreFlags=%#RX64 PteSrc=%#RX64 PteDst=%#RX64\n",
3308	GCPtr + off, (uint64_t)PteSrc.u & ~fIgnoreFlags, (uint64_t)PteDst.u & ~fIgnoreFlags,
3309	fIgnoreFlags, (uint64_t)PteSrc.u, (uint64_t)PteDst.u));
3310	cErrors++;
3311	continue;
3312	}
3313	} /* foreach PTE */
3314	}
3315	else
3316	{
3317	/*
3318	* Big Page.
3319	*/
3320	uint64_t fIgnoreFlags = X86_PDE_AVL_MASK \| GST_PDE_PG_MASK \| X86_PDE4M_G \| X86_PDE4M_D \| X86_PDE4M_PS \| X86_PDE4M_PWT \| X86_PDE4M_PCD;
3321	if (!PdeSrc.b.u1Dirty && PdeSrc.b.u1Write)
3322	{
3323	if (PdeDst.n.u1Write)
3324	{
3325	AssertMsgFailed(("!DIRTY page at %VGv is writable! PdeSrc=%#RX64 PdeDst=%#RX64\n",
3326	GCPtr, (uint64_t)PdeSrc.u, (uint64_t)PdeDst.u));
3327	cErrors++;
3328	continue;
3329	}
3330	if (!(PdeDst.u & PGM_PDFLAGS_TRACK_DIRTY))
3331	{
3332	AssertMsgFailed(("!DIRTY page at %VGv is not marked TRACK_DIRTY! PteSrc=%#RX64 PteDst=%#RX64\n",
3333	GCPtr, (uint64_t)PdeSrc.u, (uint64_t)PdeDst.u));
3334	cErrors++;
3335	continue;
3336	}
3337	# if 0 /** @todo sync access bit properly... */
3338	if (PdeDst.n.u1Accessed != PdeSrc.b.u1Accessed)
3339	{
3340	AssertMsgFailed(("!DIRTY page at %VGv is has mismatching accessed bit! PteSrc=%#RX64 PteDst=%#RX64\n",
3341	GCPtr, (uint64_t)PdeSrc.u, (uint64_t)PdeDst.u));
3342	cErrors++;
3343	}
3344	fIgnoreFlags \|= X86_PTE_RW;
3345	# else
3346	fIgnoreFlags \|= X86_PTE_RW \| X86_PTE_A;
3347	# endif
3348	}
3349	else if (PdeDst.u & PGM_PDFLAGS_TRACK_DIRTY)
3350	{
3351	/* access bit emulation (not implemented). */
3352	if (PdeSrc.b.u1Accessed \|\| PdeDst.n.u1Present)
3353	{
3354	AssertMsgFailed(("PGM_PDFLAGS_TRACK_DIRTY set at %VGv but no accessed bit emulation! PdeSrc=%#RX64 PdeDst=%#RX64\n",
3355	GCPtr, (uint64_t)PdeSrc.u, (uint64_t)PdeDst.u));
3356	cErrors++;
3357	continue;
3358	}
3359	if (!PdeDst.n.u1Accessed)
3360	{
3361	AssertMsgFailed(("!ACCESSED page at %VGv is has the accessed bit set! PdeSrc=%#RX64 PdeDst=%#RX64\n",
3362	GCPtr, (uint64_t)PdeSrc.u, (uint64_t)PdeDst.u));
3363	cErrors++;
3364	}
3365	fIgnoreFlags \|= X86_PTE_P;
3366	}
3367
3368	if ((PdeSrc.u & ~fIgnoreFlags) != (PdeDst.u & ~fIgnoreFlags))
3369	{
3370	AssertMsgFailed(("Flags mismatch (B) at %VGv! %#RX64 != %#RX64 fIgnoreFlags=%#RX64 PdeSrc=%#RX64 PdeDst=%#RX64\n",
3371	GCPtr, (uint64_t)PdeSrc.u & ~fIgnoreFlags, (uint64_t)PdeDst.u & ~fIgnoreFlags,
3372	fIgnoreFlags, (uint64_t)PdeSrc.u, (uint64_t)PdeDst.u));
3373	cErrors++;
3374	}
3375
3376	/* iterate the page table. */
3377	for (unsigned iPT = 0, off = 0;
3378	iPT < ELEMENTS(pPTDst->a);
3379	iPT++, off += PAGE_SIZE, GCPhysGst += PAGE_SIZE)
3380	{
3381	const SHWPTE PteDst = pPTDst->a[iPT];
3382
3383	if (PteDst.u & PGM_PTFLAGS_TRACK_DIRTY)
3384	{
3385	AssertMsgFailed(("The PTE at %VGv emulating a 2/4M page is marked TRACK_DIRTY! PdeSrc=%#RX64 PteDst=%#RX64\n",
3386	GCPtr + off, (uint64_t)PdeSrc.u, (uint64_t)PteDst.u));
3387	cErrors++;
3388	}
3389
3390	/* skip not-present entries. */
3391	if (!PteDst.n.u1Present) /** @todo deal with ALL handlers and CSAM !P pages! */
3392	continue;
3393
3394	fIgnoreFlags = X86_PTE_PAE_PG_MASK \| X86_PTE_AVL_MASK \| X86_PTE_PWT \| X86_PTE_PCD \| X86_PTE_PAT;
3395
3396	/* match the physical addresses */
3397	HCPhysShw = PteDst.u & X86_PTE_PAE_PG_MASK;
3398
3399	# ifdef IN_RING3
3400	rc = PGMPhysGCPhys2HCPhys(pVM, GCPhysGst, &HCPhys);
3401	if (VBOX_FAILURE(rc))
3402	{
3403	if (HCPhysShw != MMR3PageDummyHCPhys(pVM))
3404	{
3405	AssertMsgFailed(("Cannot find guest physical address %VGp at %VGv! PdeSrc=%#RX64 PteDst=%#RX64\n",
3406	GCPhysGst, GCPtr + off, (uint64_t)PdeSrc.u, (uint64_t)PteDst.u));
3407	cErrors++;
3408	}
3409	}
3410	else if (HCPhysShw != (HCPhys & X86_PTE_PAE_PG_MASK))
3411	{
3412	AssertMsgFailed(("Out of sync (phys) at %VGv! HCPhysShw=%VHp HCPhys=%VHp GCPhysGst=%VGp PdeSrc=%#RX64 PteDst=%#RX64\n",
3413	GCPtr + off, HCPhysShw, HCPhys, GCPhysGst, (uint64_t)PdeSrc.u, (uint64_t)PteDst.u));
3414	cErrors++;
3415	continue;
3416	}
3417	# endif
3418
3419	pPhysPage = pgmPhysGetPage(pPGM, GCPhysGst);
3420	if (!pPhysPage)
3421	{
3422	# ifdef IN_RING3 /** @todo make MMR3PageDummyHCPhys an 'All' function! */
3423	if (HCPhysShw != MMR3PageDummyHCPhys(pVM))
3424	{
3425	AssertMsgFailed(("Cannot find guest physical address %VGp at %VGv! PdeSrc=%#RX64 PteDst=%#RX64\n",
3426	GCPhysGst, GCPtr + off, (uint64_t)PdeSrc.u, (uint64_t)PteDst.u));
3427	cErrors++;
3428	continue;
3429	}
3430	# endif
3431	if (PteDst.n.u1Write)
3432	{
3433	AssertMsgFailed(("Invalid guest page at %VGv is writable! GCPhysGst=%VGp PdeSrc=%#RX64 PteDst=%#RX64\n",
3434	GCPtr + off, GCPhysGst, (uint64_t)PdeSrc.u, (uint64_t)PteDst.u));
3435	cErrors++;
3436	}
3437	fIgnoreFlags \|= X86_PTE_RW;
3438	}
3439	else if (HCPhysShw != (pPhysPage->HCPhys & X86_PTE_PAE_PG_MASK))
3440	{
3441	AssertMsgFailed(("Out of sync (phys) at %VGv! HCPhysShw=%VHp HCPhys=%VHp GCPhysGst=%VGp PdeSrc=%#RX64 PteDst=%#RX64\n",
3442	GCPtr + off, HCPhysShw, pPhysPage->HCPhys, GCPhysGst, (uint64_t)PdeSrc.u, (uint64_t)PteDst.u));
3443	cErrors++;
3444	continue;
3445	}
3446
3447	/* flags */
3448	if (PGM_PAGE_HAS_ACTIVE_HANDLERS(pPhysPage))
3449	{
3450	if (!PGM_PAGE_HAS_ACTIVE_ALL_HANDLERS(pPhysPage))
3451	{
3452	if (PGM_PAGE_GET_HNDL_PHYS_STATE(pPhysPage) != PGM_PAGE_HNDL_PHYS_STATE_DISABLED)
3453	{
3454	if (PteDst.n.u1Write)
3455	{
3456	AssertMsgFailed(("WRITE access flagged at %VGv but the page is writable! HCPhys=%VGv PdeSrc=%#RX64 PteDst=%#RX64\n",
3457	GCPtr + off, pPhysPage->HCPhys, (uint64_t)PdeSrc.u, (uint64_t)PteDst.u));
3458	cErrors++;
3459	continue;
3460	}
3461	fIgnoreFlags \|= X86_PTE_RW;
3462	}
3463	}
3464	else
3465	{
3466	if (PteDst.n.u1Present)
3467	{
3468	AssertMsgFailed(("ALL access flagged at %VGv but the page is present! HCPhys=%VGv PdeSrc=%#RX64 PteDst=%#RX64\n",
3469	GCPtr + off, pPhysPage->HCPhys, (uint64_t)PdeSrc.u, (uint64_t)PteDst.u));
3470	cErrors++;
3471	continue;
3472	}
3473	fIgnoreFlags \|= X86_PTE_P;
3474	}
3475	}
3476
3477	if ( (PdeSrc.u & ~fIgnoreFlags) != (PteDst.u & ~fIgnoreFlags)
3478	&& (PdeSrc.u & ~(fIgnoreFlags \| X86_PTE_RW)) != (PteDst.u & ~fIgnoreFlags) /* lazy phys handler dereg. */
3479	)
3480	{
3481	AssertMsgFailed(("Flags mismatch (BT) at %VGv! %#RX64 != %#RX64 fIgnoreFlags=%#RX64 PdeSrc=%#RX64 PteDst=%#RX64\n",
3482	GCPtr + off, (uint64_t)PdeSrc.u & ~fIgnoreFlags, (uint64_t)PteDst.u & ~fIgnoreFlags,
3483	fIgnoreFlags, (uint64_t)PdeSrc.u, (uint64_t)PteDst.u));
3484	cErrors++;
3485	continue;
3486	}
3487	} /* foreach PTE */
3488	}
3489	}
3490	/* not present */
3491
3492	} /* forearch PDE */
3493
3494	# ifdef DEBUG
3495	if (cErrors)
3496	LogFlow(("AssertCR3: cErrors=%d\n", cErrors));
3497	# endif
3498
3499	#elif PGM_GST_TYPE == PGM_TYPE_PAE
3500	//# error not implemented
3501
3502
3503	#elif PGM_GST_TYPE == PGM_TYPE_AMD64
3504	//# error not implemented
3505
3506	/#else: guest real and protected mode /
3507	#endif
3508	return cErrors;
3509	}
3510	#endif /* VBOX_STRICT */
3511

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/PGMAllBth.h@ 7747

Download in other formats: