PGMAllHandler.cpp@ 105354

Last change on this file since 105354 was 104840, checked in by vboxsync, 6 months ago
VMM/PGM: Refactored RAM ranges, MMIO2 ranges and ROM ranges and added MMIO ranges (to PGM) so we can safely access RAM ranges at runtime w/o fear of them ever being freed up. It is now only possible to create these during VM creation and loading, and they will live till VM destruction (except for MMIO2 which could be destroyed during loading (PCNet fun)). The lookup handling is by table instead of pointer tree. No more ring-0 pointers in shared data. bugref:10687 bugref:10093
Property svn:eol-style set to `native` Property svn:keywords set to `Id Revision`
File size: 86.1 KB

Line
1	/* $Id: PGMAllHandler.cpp 104840 2024-06-05 00:59:51Z vboxsync $ */
2	/** @file
3	* PGM - Page Manager / Monitor, Access Handlers.
4	*/
5
6	/*
7	* Copyright (C) 2006-2023 Oracle and/or its affiliates.
8	*
9	* This file is part of VirtualBox base platform packages, as
10	* available from https://www.virtualbox.org.
11	*
12	* This program is free software; you can redistribute it and/or
13	* modify it under the terms of the GNU General Public License
14	* as published by the Free Software Foundation, in version 3 of the
15	* License.
16	*
17	* This program is distributed in the hope that it will be useful, but
18	* WITHOUT ANY WARRANTY; without even the implied warranty of
19	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20	* General Public License for more details.
21	*
22	* You should have received a copy of the GNU General Public License
23	* along with this program; if not, see <https://www.gnu.org/licenses>.
24	*
25	* SPDX-License-Identifier: GPL-3.0-only
26	*/
27
28
29	/*********************************************************************************************************************************
30	* Header Files *
31	*********************************************************************************************************************************/
32	#define LOG_GROUP LOG_GROUP_PGM
33	#define VBOX_WITHOUT_PAGING_BIT_FIELDS /* 64-bit bitfields are just asking for trouble. See @bugref{9841} and others. */
34	#include <VBox/vmm/dbgf.h>
35	#include <VBox/vmm/pgm.h>
36	#include <VBox/vmm/iem.h>
37	#include <VBox/vmm/iom.h>
38	#include <VBox/vmm/mm.h>
39	#include <VBox/vmm/em.h>
40	#include <VBox/vmm/nem.h>
41	#include <VBox/vmm/stam.h>
42	#include <VBox/vmm/dbgf.h>
43	#ifdef IN_RING0
44	# include <VBox/vmm/pdmdev.h>
45	#endif
46	#include "PGMInternal.h"
47	#include <VBox/vmm/vmcc.h>
48	#include "PGMInline.h"
49
50	#include <VBox/log.h>
51	#include <iprt/assert.h>
52	#if defined(RT_ARCH_AMD64) \|\| defined(RT_ARCH_X86)
53	# include <iprt/asm-amd64-x86.h>
54	#endif
55	#include <iprt/string.h>
56	#include <VBox/param.h>
57	#include <VBox/err.h>
58	#include <VBox/vmm/selm.h>
59
60
61	/*********************************************************************************************************************************
62	* Global Variables *
63	*********************************************************************************************************************************/
64	/** Dummy physical access handler type record. */
65	CTX_SUFF(PGMPHYSHANDLERTYPEINT) const g_pgmHandlerPhysicalDummyType =
66	{
67	/* .hType = */ UINT64_C(0x93b7557e1937aaff),
68	/* .enmKind = */ PGMPHYSHANDLERKIND_INVALID,
69	/* .uState = */ PGM_PAGE_HNDL_PHYS_STATE_ALL,
70	/* .fKeepPgmLock = */ true,
71	/* .fRing0DevInsIdx = */ false,
72	#ifdef IN_RING0
73	/* .fNotInHm = */ false,
74	/* .pfnHandler = */ pgmR0HandlerPhysicalHandlerToRing3,
75	/* .pfnPfHandler = */ pgmR0HandlerPhysicalPfHandlerToRing3,
76	#elif defined(IN_RING3)
77	/* .fRing0Enabled = */ false,
78	/* .fNotInHm = */ false,
79	/* .pfnHandler = */ pgmR3HandlerPhysicalHandlerInvalid,
80	#else
81	# error "unsupported context"
82	#endif
83	/* .pszDesc = */ "dummy"
84	};
85
86
87	/*********************************************************************************************************************************
88	* Internal Functions *
89	*********************************************************************************************************************************/
90	static int pgmHandlerPhysicalSetRamFlagsAndFlushShadowPTs(PVMCC pVM, PPGMPHYSHANDLER pCur, PPGMRAMRANGE pRam,
91	void *pvBitmap, uint32_t offBitmap);
92	static void pgmHandlerPhysicalDeregisterNotifyNEM(PVMCC pVM, PPGMPHYSHANDLER pCur);
93	static void pgmHandlerPhysicalResetRamFlags(PVMCC pVM, PPGMPHYSHANDLER pCur);
94
95
96	#ifndef IN_RING3
97
98	/**
99	* @callback_method_impl{FNPGMPHYSHANDLER,
100	* Dummy for forcing ring-3 handling of the access.}
101	*/
102	DECLCALLBACK(VBOXSTRICTRC)
103	pgmR0HandlerPhysicalHandlerToRing3(PVMCC pVM, PVMCPUCC pVCpu, RTGCPHYS GCPhys, void pvPhys, void pvBuf, size_t cbBuf,
104	PGMACCESSTYPE enmAccessType, PGMACCESSORIGIN enmOrigin, uint64_t uUser)
105	{
106	RT_NOREF(pVM, pVCpu, GCPhys, pvPhys, pvBuf, cbBuf, enmAccessType, enmOrigin, uUser);
107	return VINF_EM_RAW_EMULATE_INSTR;
108	}
109
110
111	/**
112	* @callback_method_impl{FNPGMRZPHYSPFHANDLER,
113	* Dummy for forcing ring-3 handling of the access.}
114	*/
115	DECLCALLBACK(VBOXSTRICTRC)
116	pgmR0HandlerPhysicalPfHandlerToRing3(PVMCC pVM, PVMCPUCC pVCpu, RTGCUINT uErrorCode, PCPUMCTX pCtx,
117	RTGCPTR pvFault, RTGCPHYS GCPhysFault, uint64_t uUser)
118	{
119	RT_NOREF(pVM, pVCpu, uErrorCode, pCtx, pvFault, GCPhysFault, uUser);
120	return VINF_EM_RAW_EMULATE_INSTR;
121	}
122
123	#endif /* !IN_RING3 */
124
125
126	/**
127	* Worker for pgmHandlerPhysicalExCreate.
128	*
129	* @returns A new physical handler on success or NULL on failure.
130	* @param pVM The cross context VM structure.
131	* @param pType The physical handler type.
132	* @param hType The physical handler type registeration handle.
133	* @param uUser User argument to the handlers (not pointer).
134	* @param pszDesc Description of this handler. If NULL, the type description
135	* will be used instead.
136	*/
137	DECL_FORCE_INLINE(PPGMPHYSHANDLER) pgmHandlerPhysicalExCreateWorker(PVMCC pVM, PCPGMPHYSHANDLERTYPEINT pType,
138	PGMPHYSHANDLERTYPE hType, uint64_t uUser,
139	R3PTRTYPE(const char *) pszDesc)
140	{
141	PGM_LOCK_ASSERT_OWNER(pVM);
142	PPGMPHYSHANDLER pNew = pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator.allocateNode();
143	if (pNew)
144	{
145	pNew->Key = NIL_RTGCPHYS;
146	pNew->KeyLast = NIL_RTGCPHYS;
147	pNew->cPages = 0;
148	pNew->cAliasedPages = 0;
149	pNew->cTmpOffPages = 0;
150	pNew->uUser = uUser;
151	pNew->hType = hType;
152	pNew->pszDesc = pszDesc != NIL_RTR3PTR ? pszDesc
153	#ifdef IN_RING3
154	: pType->pszDesc;
155	#else
156	: pVM->pgm.s.aPhysHandlerTypes[hType & PGMPHYSHANDLERTYPE_IDX_MASK].pszDesc;
157	NOREF(pType);
158	#endif
159	}
160	return pNew;
161	}
162
163
164	/**
165	* Creates a physical access handler, allocation part.
166	*
167	* @returns VBox status code.
168	* @retval VERR_OUT_OF_RESOURCES if no more handlers available.
169	*
170	* @param pVM The cross context VM structure.
171	* @param hType The handler type registration handle.
172	* @param uUser User argument to the handlers (not pointer).
173	* @param pszDesc Description of this handler. If NULL, the type
174	* description will be used instead.
175	* @param ppPhysHandler Where to return the access handler structure on
176	* success.
177	*/
178	int pgmHandlerPhysicalExCreate(PVMCC pVM, PGMPHYSHANDLERTYPE hType, uint64_t uUser,
179	R3PTRTYPE(const char ) pszDesc, PPGMPHYSHANDLER ppPhysHandler)
180	{
181	/*
182	* Validate input.
183	*/
184	PCPGMPHYSHANDLERTYPEINT const pType = pgmHandlerPhysicalTypeHandleToPtr(pVM, hType);
185	AssertReturn(pType, VERR_INVALID_HANDLE);
186	AssertReturn(pType->enmKind > PGMPHYSHANDLERKIND_INVALID && pType->enmKind < PGMPHYSHANDLERKIND_END, VERR_INVALID_HANDLE);
187	AssertPtr(ppPhysHandler);
188
189	Log(("pgmHandlerPhysicalExCreate: uUser=%#RX64 hType=%#x (%d, %s) pszDesc=%RHv:%s\n",
190	uUser, hType, pType->enmKind, pType->pszDesc, pszDesc, R3STRING(pszDesc)));
191
192	/*
193	* Allocate and initialize the new entry.
194	*/
195	int rc = PGM_LOCK(pVM);
196	AssertRCReturn(rc, rc);
197	*ppPhysHandler = pgmHandlerPhysicalExCreateWorker(pVM, pType, hType, uUser, pszDesc);
198	PGM_UNLOCK(pVM);
199	if (*ppPhysHandler)
200	return VINF_SUCCESS;
201	return VERR_OUT_OF_RESOURCES;
202	}
203
204
205	/**
206	* Duplicates a physical access handler.
207	*
208	* @returns VBox status code.
209	* @retval VINF_SUCCESS when successfully installed.
210	*
211	* @param pVM The cross context VM structure.
212	* @param pPhysHandlerSrc The source handler to duplicate
213	* @param ppPhysHandler Where to return the access handler structure on
214	* success.
215	*/
216	int pgmHandlerPhysicalExDup(PVMCC pVM, PPGMPHYSHANDLER pPhysHandlerSrc, PPGMPHYSHANDLER *ppPhysHandler)
217	{
218	return pgmHandlerPhysicalExCreate(pVM, pPhysHandlerSrc->hType, pPhysHandlerSrc->uUser,
219	pPhysHandlerSrc->pszDesc, ppPhysHandler);
220	}
221
222
223	/**
224	* Register a access handler for a physical range.
225	*
226	* @returns VBox status code.
227	* @retval VINF_SUCCESS when successfully installed.
228	* @retval VINF_PGM_GCPHYS_ALIASED could be returned.
229	*
230	* @param pVM The cross context VM structure.
231	* @param pPhysHandler The physical handler.
232	* @param GCPhys Start physical address.
233	* @param GCPhysLast Last physical address. (inclusive)
234	*/
235	int pgmHandlerPhysicalExRegister(PVMCC pVM, PPGMPHYSHANDLER pPhysHandler, RTGCPHYS GCPhys, RTGCPHYS GCPhysLast)
236	{
237	/*
238	* Validate input.
239	*/
240	AssertReturn(pPhysHandler, VERR_INVALID_POINTER);
241	PGMPHYSHANDLERTYPE const hType = pPhysHandler->hType;
242	PCPGMPHYSHANDLERTYPEINT const pType = pgmHandlerPhysicalTypeHandleToPtr(pVM, hType);
243	AssertReturn(pType, VERR_INVALID_HANDLE);
244	AssertReturn(pType->enmKind > PGMPHYSHANDLERKIND_INVALID && pType->enmKind < PGMPHYSHANDLERKIND_END, VERR_INVALID_HANDLE);
245
246	AssertPtr(pPhysHandler);
247
248	Log(("pgmHandlerPhysicalExRegister: GCPhys=%RGp GCPhysLast=%RGp hType=%#x (%d, %s) pszDesc=%RHv:%s\n", GCPhys, GCPhysLast,
249	hType, pType->enmKind, pType->pszDesc, pPhysHandler->pszDesc, R3STRING(pPhysHandler->pszDesc)));
250	AssertReturn(pPhysHandler->Key == NIL_RTGCPHYS, VERR_WRONG_ORDER);
251
252	AssertMsgReturn(GCPhys < GCPhysLast, ("GCPhys >= GCPhysLast (%#x >= %#x)\n", GCPhys, GCPhysLast), VERR_INVALID_PARAMETER);
253	Assert(GCPhysLast - GCPhys < _4G); /* ASSUMPTION in PGMAllPhys.cpp */
254
255	switch (pType->enmKind)
256	{
257	case PGMPHYSHANDLERKIND_WRITE:
258	if (!pType->fNotInHm)
259	break;
260	RT_FALL_THRU(); /* Simplification: fNotInHm can only be used with full pages */
261	case PGMPHYSHANDLERKIND_MMIO:
262	case PGMPHYSHANDLERKIND_ALL:
263	/* Simplification for PGMPhysRead, PGMR0Trap0eHandlerNPMisconfig and others: Full pages. */
264	AssertMsgReturn(!(GCPhys & GUEST_PAGE_OFFSET_MASK), ("%RGp\n", GCPhys), VERR_INVALID_PARAMETER);
265	AssertMsgReturn((GCPhysLast & GUEST_PAGE_OFFSET_MASK) == GUEST_PAGE_OFFSET_MASK, ("%RGp\n", GCPhysLast), VERR_INVALID_PARAMETER);
266	break;
267	default:
268	AssertMsgFailed(("Invalid input enmKind=%d!\n", pType->enmKind));
269	return VERR_INVALID_PARAMETER;
270	}
271
272	/*
273	* We require the range to be within registered ram.
274	* There is no apparent need to support ranges which cover more than one ram range.
275	*/
276	PPGMRAMRANGE pRam = pgmPhysGetRange(pVM, GCPhys);
277	if ( !pRam
278	\|\| GCPhysLast > pRam->GCPhysLast)
279	{
280	#ifdef IN_RING3
281	DBGFR3Info(pVM->pUVM, "phys", NULL, NULL);
282	#endif
283	AssertMsgFailed(("No RAM range for %RGp-%RGp\n", GCPhys, GCPhysLast));
284	return VERR_PGM_HANDLER_PHYSICAL_NO_RAM_RANGE;
285	}
286	Assert(GCPhys >= pRam->GCPhys && GCPhys < pRam->GCPhysLast);
287	Assert(GCPhysLast <= pRam->GCPhysLast && GCPhysLast >= pRam->GCPhys);
288
289	/*
290	* Try insert into list.
291	*/
292	pPhysHandler->Key = GCPhys;
293	pPhysHandler->KeyLast = GCPhysLast;
294	pPhysHandler->cPages = (GCPhysLast - (GCPhys & X86_PTE_PAE_PG_MASK) + GUEST_PAGE_SIZE) >> GUEST_PAGE_SHIFT;
295
296	int rc = PGM_LOCK(pVM);
297	if (RT_SUCCESS(rc))
298	{
299	rc = pVM->VMCC_CTX(pgm).s.pPhysHandlerTree->insert(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator, pPhysHandler);
300	if (RT_SUCCESS(rc))
301	{
302	rc = pgmHandlerPhysicalSetRamFlagsAndFlushShadowPTs(pVM, pPhysHandler, pRam, NULL /pvBitmap/, 0 /offBitmap/);
303	if (rc == VINF_PGM_SYNC_CR3)
304	rc = VINF_PGM_GCPHYS_ALIASED;
305
306	#if defined(IN_RING3) \|\| defined(IN_RING0)
307	NEMHCNotifyHandlerPhysicalRegister(pVM, pType->enmKind, GCPhys, GCPhysLast - GCPhys + 1);
308	#endif
309	PGM_UNLOCK(pVM);
310
311	if (rc != VINF_SUCCESS)
312	Log(("PGMHandlerPhysicalRegisterEx: returns %Rrc (%RGp-%RGp)\n", rc, GCPhys, GCPhysLast));
313	return rc;
314	}
315	PGM_UNLOCK(pVM);
316	}
317
318	pPhysHandler->Key = NIL_RTGCPHYS;
319	pPhysHandler->KeyLast = NIL_RTGCPHYS;
320
321	AssertMsgReturn(rc == VERR_ALREADY_EXISTS, ("%Rrc GCPhys=%RGp GCPhysLast=%RGp\n", rc, GCPhys, GCPhysLast), rc);
322
323	#if defined(IN_RING3) && defined(VBOX_STRICT)
324	DBGFR3Info(pVM->pUVM, "handlers", "phys nostats", NULL);
325	#endif
326	AssertMsgFailed(("Conflict! GCPhys=%RGp GCPhysLast=%RGp pszDesc=%s/%s\n",
327	GCPhys, GCPhysLast, R3STRING(pPhysHandler->pszDesc), R3STRING(pType->pszDesc)));
328	return VERR_PGM_HANDLER_PHYSICAL_CONFLICT;
329	}
330
331
332	/**
333	* Worker for pgmHandlerPhysicalRegisterVmxApicAccessPage.
334	*
335	* @returns VBox status code.
336	* @retval VINF_SUCCESS when successfully installed.
337	* @retval VINF_PGM_GCPHYS_ALIASED could be returned.
338	*
339	* @param pVM The cross context VM structure.
340	* @param pPhysHandler The physical handler.
341	* @param GCPhys The address of the virtual VMX APIC-access page. Must be
342	* page aligned.
343	*/
344	static int pgmHandlerPhysicalRegisterVmxApicAccessPage(PVMCC pVM, PPGMPHYSHANDLER pPhysHandler, RTGCPHYS GCPhys)
345	{
346	PGM_LOCK_ASSERT_OWNER(pVM);
347	LogFunc(("GCPhys=%RGp\n", GCPhys));
348
349	/*
350	* We require the range to be within registered ram.
351	* There is no apparent need to support ranges which cover more than one ram range.
352	*/
353	PPGMRAMRANGE pRam = pgmPhysGetRange(pVM, GCPhys);
354	RTGCPHYS const GCPhysLast = GCPhys \| X86_PAGE_4K_OFFSET_MASK;
355	if ( !pRam
356	\|\| GCPhysLast > pRam->GCPhysLast)
357	{
358	#ifdef IN_RING3
359	DBGFR3Info(pVM->pUVM, "phys", NULL, NULL);
360	#endif
361	AssertMsgFailed(("No RAM range for %RGp-%RGp\n", GCPhys, GCPhysLast));
362	return VERR_PGM_HANDLER_PHYSICAL_NO_RAM_RANGE;
363	}
364	Assert(GCPhys >= pRam->GCPhys && GCPhys < pRam->GCPhysLast);
365	Assert(GCPhysLast <= pRam->GCPhysLast && GCPhysLast >= pRam->GCPhys);
366
367	/*
368	* Try insert into list.
369	*/
370	pPhysHandler->Key = GCPhys;
371	pPhysHandler->KeyLast = GCPhysLast;
372	pPhysHandler->cPages = (GCPhysLast - (GCPhys & X86_PTE_PAE_PG_MASK) + GUEST_PAGE_SIZE) >> GUEST_PAGE_SHIFT;
373
374	int rc = pVM->VMCC_CTX(pgm).s.pPhysHandlerTree->insert(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator, pPhysHandler);
375	if (RT_SUCCESS(rc))
376	{
377	rc = pgmHandlerPhysicalSetRamFlagsAndFlushShadowPTs(pVM, pPhysHandler, pRam, NULL /pvBitmap/, 0 /offBitmap/);
378	if (rc == VINF_PGM_SYNC_CR3)
379	rc = VINF_PGM_GCPHYS_ALIASED;
380
381	#if defined(IN_RING3) \|\| defined(IN_RING0)
382	NEMHCNotifyHandlerPhysicalRegister(pVM, PGMPHYSHANDLERKIND_ALL, GCPhys, GCPhysLast - GCPhys + 1);
383	#endif
384	return rc;
385	}
386
387	pPhysHandler->Key = NIL_RTGCPHYS;
388	pPhysHandler->KeyLast = NIL_RTGCPHYS;
389
390	AssertMsgReturn(rc == VERR_ALREADY_EXISTS, ("%Rrc GCPhys=%RGp GCPhysLast=%RGp\n", rc, GCPhys, GCPhysLast), rc);
391	#if defined(IN_RING3) && defined(VBOX_STRICT)
392	DBGFR3Info(pVM->pUVM, "handlers", "phys nostats", NULL);
393	#endif
394	AssertMsgFailed(("Conflict! GCPhys=%RGp GCPhysLast=%RGp\n", GCPhys, GCPhysLast));
395	return VERR_PGM_HANDLER_PHYSICAL_CONFLICT;
396	}
397
398
399	/**
400	* Register a access handler for a physical range.
401	*
402	* @returns VBox status code.
403	* @retval VINF_SUCCESS when successfully installed.
404	* @retval VINF_PGM_GCPHYS_ALIASED when the shadow PTs could be updated because
405	* the guest page aliased or/and mapped by multiple PTs. A CR3 sync has been
406	* flagged together with a pool clearing.
407	* @retval VERR_PGM_HANDLER_PHYSICAL_CONFLICT if the range conflicts with an existing
408	* one. A debug assertion is raised.
409	*
410	* @param pVM The cross context VM structure.
411	* @param GCPhys Start physical address.
412	* @param GCPhysLast Last physical address. (inclusive)
413	* @param hType The handler type registration handle.
414	* @param uUser User argument to the handler.
415	* @param pszDesc Description of this handler. If NULL, the type
416	* description will be used instead.
417	*/
418	VMMDECL(int) PGMHandlerPhysicalRegister(PVMCC pVM, RTGCPHYS GCPhys, RTGCPHYS GCPhysLast, PGMPHYSHANDLERTYPE hType,
419	uint64_t uUser, R3PTRTYPE(const char *) pszDesc)
420	{
421	#ifdef LOG_ENABLED
422	PCPGMPHYSHANDLERTYPEINT pType = pgmHandlerPhysicalTypeHandleToPtr(pVM, hType);
423	Log(("PGMHandlerPhysicalRegister: GCPhys=%RGp GCPhysLast=%RGp uUser=%#RX64 hType=%#x (%d, %s) pszDesc=%RHv:%s\n",
424	GCPhys, GCPhysLast, uUser, hType, pType->enmKind, R3STRING(pType->pszDesc), pszDesc, R3STRING(pszDesc)));
425	#endif
426
427	PPGMPHYSHANDLER pNew;
428	int rc = pgmHandlerPhysicalExCreate(pVM, hType, uUser, pszDesc, &pNew);
429	if (RT_SUCCESS(rc))
430	{
431	rc = pgmHandlerPhysicalExRegister(pVM, pNew, GCPhys, GCPhysLast);
432	if (RT_SUCCESS(rc))
433	return rc;
434	pgmHandlerPhysicalExDestroy(pVM, pNew);
435	}
436	return rc;
437	}
438
439
440	/**
441	* Register an access handler for a virtual VMX APIC-access page.
442	*
443	* This holds the PGM lock across the whole operation to resolve races between
444	* VCPUs registering the same page simultaneously. It's also a slightly slimmer
445	* version of the regular registeration function as it's specific to the VMX
446	* APIC-access page.
447	*
448	* @returns VBox status code.
449	* @retval VINF_SUCCESS when successfully installed.
450	* @retval VINF_PGM_GCPHYS_ALIASED when the shadow PTs could be updated because
451	* the guest page aliased or/and mapped by multiple PTs. A CR3 sync has been
452	* flagged together with a pool clearing.
453	* @retval VERR_PGM_HANDLER_PHYSICAL_CONFLICT if the range conflicts with an existing
454	* one. A debug assertion is raised.
455	*
456	* @param pVM The cross context VM structure.
457	* @param GCPhys The address of the VMX virtual-APIC access page. Must be
458	* page aligned.
459	* @param hType The handler type registration handle.
460	*/
461	VMMDECL(int) PGMHandlerPhysicalRegisterVmxApicAccessPage(PVMCC pVM, RTGCPHYS GCPhys, PGMPHYSHANDLERTYPE hType)
462	{
463	PCPGMPHYSHANDLERTYPEINT const pType = pgmHandlerPhysicalTypeHandleToPtr(pVM, hType);
464	AssertReturn(pType, VERR_INVALID_HANDLE);
465	AssertMsg(!(GCPhys & GUEST_PAGE_OFFSET_MASK), ("%RGp\n", GCPhys));
466
467	/*
468	* Find if the VMX APIC access page has already been registered at this address.
469	*/
470	int rc = PGM_LOCK(pVM);
471	AssertRCReturn(rc, rc);
472
473	PPGMPHYSHANDLER pHandler;
474	rc = pgmHandlerPhysicalLookup(pVM, GCPhys, &pHandler);
475	if (RT_SUCCESS(rc))
476	{
477	PCPGMPHYSHANDLERTYPEINT const pHandlerType = PGMPHYSHANDLER_GET_TYPE_NO_NULL(pVM, pHandler);
478	Assert(GCPhys >= pHandler->Key && GCPhys <= pHandler->KeyLast);
479	Assert( pHandlerType->enmKind == PGMPHYSHANDLERKIND_WRITE
480	\|\| pHandlerType->enmKind == PGMPHYSHANDLERKIND_ALL
481	\|\| pHandlerType->enmKind == PGMPHYSHANDLERKIND_MMIO);
482
483	/* Check it's the virtual VMX APIC-access page. */
484	if (pHandlerType->fNotInHm)
485	{
486	Assert(pHandlerType->enmKind == PGMPHYSHANDLERKIND_ALL);
487	rc = VINF_SUCCESS;
488	}
489	else
490	{
491	rc = VERR_PGM_HANDLER_PHYSICAL_CONFLICT;
492	AssertMsgFailed(("Conflict! GCPhys=%RGp enmKind=%#x fNotInHm=%RTbool\n", GCPhys, pHandlerType->enmKind,
493	pHandlerType->fNotInHm));
494	}
495
496	PGM_UNLOCK(pVM);
497	return rc;
498	}
499
500	/*
501	* Validate the page handler parameters before registering the virtual VMX APIC-access page.
502	*/
503	AssertReturn(pType->enmKind == PGMPHYSHANDLERKIND_ALL, VERR_INVALID_HANDLE);
504	AssertReturn(pType->fNotInHm, VERR_PGM_HANDLER_IPE_1);
505
506	/*
507	* Create and register a physical handler for the virtual VMX APIC-access page.
508	*/
509	pHandler = pgmHandlerPhysicalExCreateWorker(pVM, pType, hType, 0 /uUser/, NULL /pszDesc/);
510	if (pHandler)
511	{
512	rc = pgmHandlerPhysicalRegisterVmxApicAccessPage(pVM, pHandler, GCPhys);
513	if (RT_SUCCESS(rc))
514	{ /* likely */ }
515	else
516	pgmHandlerPhysicalExDestroy(pVM, pHandler);
517	}
518	else
519	rc = VERR_OUT_OF_RESOURCES;
520
521	PGM_UNLOCK(pVM);
522	return rc;
523	}
524
525
526	/**
527	* Sets ram range flags and attempts updating shadow PTs.
528	*
529	* @returns VBox status code.
530	* @retval VINF_SUCCESS when shadow PTs was successfully updated.
531	* @retval VINF_PGM_SYNC_CR3 when the shadow PTs could be updated because
532	* the guest page aliased or/and mapped by multiple PTs. FFs set.
533	* @param pVM The cross context VM structure.
534	* @param pCur The physical handler.
535	* @param pRam The RAM range.
536	* @param pvBitmap Dirty bitmap. Optional.
537	* @param offBitmap Dirty bitmap offset.
538	*/
539	static int pgmHandlerPhysicalSetRamFlagsAndFlushShadowPTs(PVMCC pVM, PPGMPHYSHANDLER pCur, PPGMRAMRANGE pRam,
540	void *pvBitmap, uint32_t offBitmap)
541	{
542	/*
543	* Iterate the guest ram pages updating the flags and flushing PT entries
544	* mapping the page.
545	*/
546	bool fFlushTLBs = false;
547	int rc = VINF_SUCCESS;
548	PCPGMPHYSHANDLERTYPEINT pCurType = PGMPHYSHANDLER_GET_TYPE_NO_NULL(pVM, pCur);
549	const unsigned uState = pCurType->uState;
550	uint32_t cPages = pCur->cPages;
551	uint32_t i = (pCur->Key - pRam->GCPhys) >> GUEST_PAGE_SHIFT;
552	for (;;)
553	{
554	PPGMPAGE pPage = &pRam->aPages[i];
555	AssertMsg(pCurType->enmKind != PGMPHYSHANDLERKIND_MMIO \|\| PGM_PAGE_IS_MMIO(pPage),
556	("%RGp %R[pgmpage]\n", pRam->GCPhys + (i << GUEST_PAGE_SHIFT), pPage));
557
558	/* Only do upgrades. */
559	if (PGM_PAGE_GET_HNDL_PHYS_STATE(pPage) < uState)
560	{
561	PGM_PAGE_SET_HNDL_PHYS_STATE(pPage, uState, pCurType->fNotInHm);
562
563	const RTGCPHYS GCPhysPage = pRam->GCPhys + (i << GUEST_PAGE_SHIFT);
564	int rc2 = pgmPoolTrackUpdateGCPhys(pVM, GCPhysPage, pPage,
565	false /* allow updates of PTEs (instead of flushing) */, &fFlushTLBs);
566	if (rc2 != VINF_SUCCESS && rc == VINF_SUCCESS)
567	rc = rc2;
568
569	#ifdef VBOX_WITH_NATIVE_NEM
570	/* Tell NEM about the protection update. */
571	if (VM_IS_NEM_ENABLED(pVM))
572	{
573	uint8_t u2State = PGM_PAGE_GET_NEM_STATE(pPage);
574	PGMPAGETYPE enmType = (PGMPAGETYPE)PGM_PAGE_GET_TYPE(pPage);
575	NEMHCNotifyPhysPageProtChanged(pVM, GCPhysPage, PGM_PAGE_GET_HCPHYS(pPage),
576	PGM_RAMRANGE_CALC_PAGE_R3PTR(pRam, GCPhysPage),
577	pgmPhysPageCalcNemProtection(pPage, enmType), enmType, &u2State);
578	PGM_PAGE_SET_NEM_STATE(pPage, u2State);
579	}
580	#endif
581	if (pvBitmap)
582	ASMBitSet(pvBitmap, offBitmap);
583	}
584
585	/* next */
586	if (--cPages == 0)
587	break;
588	i++;
589	offBitmap++;
590	}
591
592	if (fFlushTLBs)
593	{
594	PGM_INVL_ALL_VCPU_TLBS(pVM);
595	Log(("pgmHandlerPhysicalSetRamFlagsAndFlushShadowPTs: flushing guest TLBs; rc=%d\n", rc));
596	}
597	else
598	Log(("pgmHandlerPhysicalSetRamFlagsAndFlushShadowPTs: doesn't flush guest TLBs. rc=%Rrc; sync flags=%x VMCPU_FF_PGM_SYNC_CR3=%d\n", rc, VMMGetCpu(pVM)->pgm.s.fSyncFlags, VMCPU_FF_IS_SET(VMMGetCpu(pVM), VMCPU_FF_PGM_SYNC_CR3)));
599
600	return rc;
601	}
602
603
604	/**
605	* Deregister a physical page access handler.
606	*
607	* @returns VBox status code.
608	* @param pVM The cross context VM structure.
609	* @param pPhysHandler The handler to deregister (but not free).
610	*/
611	int pgmHandlerPhysicalExDeregister(PVMCC pVM, PPGMPHYSHANDLER pPhysHandler)
612	{
613	LogFlow(("pgmHandlerPhysicalExDeregister: Removing Range %RGp-%RGp %s\n",
614	pPhysHandler->Key, pPhysHandler->KeyLast, R3STRING(pPhysHandler->pszDesc)));
615
616	int rc = PGM_LOCK(pVM);
617	AssertRCReturn(rc, rc);
618
619	RTGCPHYS const GCPhys = pPhysHandler->Key;
620	AssertReturnStmt(GCPhys != NIL_RTGCPHYS, PGM_UNLOCK(pVM), VERR_PGM_HANDLER_NOT_FOUND);
621
622	/*
623	* Remove the handler from the tree.
624	*/
625
626	PPGMPHYSHANDLER pRemoved;
627	rc = pVM->VMCC_CTX(pgm).s.pPhysHandlerTree->remove(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator, GCPhys, &pRemoved);
628	if (RT_SUCCESS(rc))
629	{
630	if (pRemoved == pPhysHandler)
631	{
632	/*
633	* Clear the page bits, notify the REM about this change and clear
634	* the cache.
635	*/
636	pgmHandlerPhysicalResetRamFlags(pVM, pPhysHandler);
637	if (VM_IS_NEM_ENABLED(pVM))
638	pgmHandlerPhysicalDeregisterNotifyNEM(pVM, pPhysHandler);
639	pVM->pgm.s.idxLastPhysHandler = 0;
640
641	pPhysHandler->Key = NIL_RTGCPHYS;
642	pPhysHandler->KeyLast = NIL_RTGCPHYS;
643
644	PGM_UNLOCK(pVM);
645
646	return VINF_SUCCESS;
647	}
648
649	/*
650	* Both of the failure conditions here are considered internal processing
651	* errors because they can only be caused by race conditions or corruption.
652	* If we ever need to handle concurrent deregistration, we have to move
653	* the NIL_RTGCPHYS check inside the PGM lock.
654	*/
655	pVM->VMCC_CTX(pgm).s.pPhysHandlerTree->insert(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator, pRemoved);
656	}
657
658	PGM_UNLOCK(pVM);
659
660	if (RT_FAILURE(rc))
661	AssertMsgFailed(("Didn't find range starting at %RGp in the tree! %Rrc=rc\n", GCPhys, rc));
662	else
663	AssertMsgFailed(("Found different handle at %RGp in the tree: got %p insteaded of %p\n",
664	GCPhys, pRemoved, pPhysHandler));
665	return VERR_PGM_HANDLER_IPE_1;
666	}
667
668
669	/**
670	* Destroys (frees) a physical handler.
671	*
672	* The caller must deregister it before destroying it!
673	*
674	* @returns VBox status code.
675	* @param pVM The cross context VM structure.
676	* @param pHandler The handler to free. NULL if ignored.
677	*/
678	int pgmHandlerPhysicalExDestroy(PVMCC pVM, PPGMPHYSHANDLER pHandler)
679	{
680	if (pHandler)
681	{
682	AssertPtr(pHandler);
683	AssertReturn(pHandler->Key == NIL_RTGCPHYS, VERR_WRONG_ORDER);
684
685	int rc = PGM_LOCK(pVM);
686	if (RT_SUCCESS(rc))
687	{
688	rc = pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator.freeNode(pHandler);
689	PGM_UNLOCK(pVM);
690	}
691	return rc;
692	}
693	return VINF_SUCCESS;
694	}
695
696
697	/**
698	* Deregister a physical page access handler.
699	*
700	* @returns VBox status code.
701	* @param pVM The cross context VM structure.
702	* @param GCPhys Start physical address.
703	*/
704	VMMDECL(int) PGMHandlerPhysicalDeregister(PVMCC pVM, RTGCPHYS GCPhys)
705	{
706	AssertReturn(pVM->VMCC_CTX(pgm).s.pPhysHandlerTree, VERR_PGM_HANDLER_IPE_1);
707
708	/*
709	* Find the handler.
710	*/
711	int rc = PGM_LOCK(pVM);
712	AssertRCReturn(rc, rc);
713
714	PPGMPHYSHANDLER pRemoved;
715	rc = pVM->VMCC_CTX(pgm).s.pPhysHandlerTree->remove(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator, GCPhys, &pRemoved);
716	if (RT_SUCCESS(rc))
717	{
718	Assert(pRemoved->Key == GCPhys);
719	LogFlow(("PGMHandlerPhysicalDeregister: Removing Range %RGp-%RGp %s\n",
720	pRemoved->Key, pRemoved->KeyLast, R3STRING(pRemoved->pszDesc)));
721
722	/*
723	* Clear the page bits, notify the REM about this change and clear
724	* the cache.
725	*/
726	pgmHandlerPhysicalResetRamFlags(pVM, pRemoved);
727	if (VM_IS_NEM_ENABLED(pVM))
728	pgmHandlerPhysicalDeregisterNotifyNEM(pVM, pRemoved);
729	pVM->pgm.s.idxLastPhysHandler = 0;
730
731	pRemoved->Key = NIL_RTGCPHYS;
732	rc = pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator.freeNode(pRemoved);
733
734	PGM_UNLOCK(pVM);
735	return rc;
736	}
737
738	PGM_UNLOCK(pVM);
739
740	if (rc == VERR_NOT_FOUND)
741	{
742	AssertMsgFailed(("Didn't find range starting at %RGp\n", GCPhys));
743	rc = VERR_PGM_HANDLER_NOT_FOUND;
744	}
745	return rc;
746	}
747
748
749	/**
750	* Shared code with modify.
751	*/
752	static void pgmHandlerPhysicalDeregisterNotifyNEM(PVMCC pVM, PPGMPHYSHANDLER pCur)
753	{
754	#ifdef VBOX_WITH_NATIVE_NEM
755	PCPGMPHYSHANDLERTYPEINT pCurType = PGMPHYSHANDLER_GET_TYPE_NO_NULL(pVM, pCur);
756	RTGCPHYS GCPhysStart = pCur->Key;
757	RTGCPHYS GCPhysLast = pCur->KeyLast;
758
759	/*
760	* Page align the range.
761	*
762	* Since we've reset (recalculated) the physical handler state of all pages
763	* we can make use of the page states to figure out whether a page should be
764	* included in the REM notification or not.
765	*/
766	if ( (pCur->Key & GUEST_PAGE_OFFSET_MASK)
767	\|\| ((pCur->KeyLast + 1) & GUEST_PAGE_OFFSET_MASK))
768	{
769	Assert(pCurType->enmKind != PGMPHYSHANDLERKIND_MMIO);
770
771	if (GCPhysStart & GUEST_PAGE_OFFSET_MASK)
772	{
773	PPGMPAGE pPage = pgmPhysGetPage(pVM, GCPhysStart);
774	if ( pPage
775	&& PGM_PAGE_GET_HNDL_PHYS_STATE(pPage) != PGM_PAGE_HNDL_PHYS_STATE_NONE)
776	{
777	RTGCPHYS GCPhys = (GCPhysStart + (GUEST_PAGE_SIZE - 1)) & X86_PTE_PAE_PG_MASK;
778	if ( GCPhys > GCPhysLast
779	\|\| GCPhys < GCPhysStart)
780	return;
781	GCPhysStart = GCPhys;
782	}
783	else
784	GCPhysStart &= X86_PTE_PAE_PG_MASK;
785	Assert(!pPage \|\| PGM_PAGE_GET_TYPE(pPage) != PGMPAGETYPE_MMIO); /* these are page aligned atm! */
786	}
787
788	if (GCPhysLast & GUEST_PAGE_OFFSET_MASK)
789	{
790	PPGMPAGE pPage = pgmPhysGetPage(pVM, GCPhysLast);
791	if ( pPage
792	&& PGM_PAGE_GET_HNDL_PHYS_STATE(pPage) != PGM_PAGE_HNDL_PHYS_STATE_NONE)
793	{
794	RTGCPHYS GCPhys = (GCPhysLast & X86_PTE_PAE_PG_MASK) - 1;
795	if ( GCPhys < GCPhysStart
796	\|\| GCPhys > GCPhysLast)
797	return;
798	GCPhysLast = GCPhys;
799	}
800	else
801	GCPhysLast \|= GUEST_PAGE_OFFSET_MASK;
802	Assert(!pPage \|\| PGM_PAGE_GET_TYPE(pPage) != PGMPAGETYPE_MMIO); /* these are page aligned atm! */
803	}
804	}
805
806	/*
807	* Tell NEM.
808	*/
809	PPGMRAMRANGE const pRam = pgmPhysGetRange(pVM, GCPhysStart);
810	RTGCPHYS const cb = GCPhysLast - GCPhysStart + 1;
811	uint8_t u2State = UINT8_MAX;
812	NEMHCNotifyHandlerPhysicalDeregister(pVM, pCurType->enmKind, GCPhysStart, cb,
813	pRam ? PGM_RAMRANGE_CALC_PAGE_R3PTR(pRam, GCPhysStart) : NULL, &u2State);
814	if (u2State != UINT8_MAX && pRam)
815	pgmPhysSetNemStateForPages(&pRam->aPages[(GCPhysStart - pRam->GCPhys) >> GUEST_PAGE_SHIFT],
816	cb >> GUEST_PAGE_SHIFT, u2State);
817	#else
818	RT_NOREF(pVM, pCur);
819	#endif
820	}
821
822
823	/**
824	* pgmHandlerPhysicalResetRamFlags helper that checks for other handlers on
825	* edge pages.
826	*/
827	DECLINLINE(void) pgmHandlerPhysicalRecalcPageState(PVMCC pVM, RTGCPHYS GCPhys, bool fAbove, PPGMRAMRANGE *ppRamHint)
828	{
829	/*
830	* Look for other handlers.
831	*/
832	unsigned uState = PGM_PAGE_HNDL_PHYS_STATE_NONE;
833	for (;;)
834	{
835	PPGMPHYSHANDLER pCur;
836	int rc;
837	if (fAbove)
838	rc = pVM->VMCC_CTX(pgm).s.pPhysHandlerTree->lookupMatchingOrAbove(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator,
839	GCPhys, &pCur);
840	else
841	rc = pVM->VMCC_CTX(pgm).s.pPhysHandlerTree->lookupMatchingOrBelow(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator,
842	GCPhys, &pCur);
843	if (rc == VERR_NOT_FOUND)
844	break;
845	AssertRCBreak(rc);
846	if (((fAbove ? pCur->Key : pCur->KeyLast) >> GUEST_PAGE_SHIFT) != (GCPhys >> GUEST_PAGE_SHIFT))
847	break;
848	PCPGMPHYSHANDLERTYPEINT pCurType = PGMPHYSHANDLER_GET_TYPE_NO_NULL(pVM, pCur);
849	uState = RT_MAX(uState, pCurType->uState);
850
851	/* next? */
852	RTGCPHYS GCPhysNext = fAbove
853	? pCur->KeyLast + 1
854	: pCur->Key - 1;
855	if ((GCPhysNext >> GUEST_PAGE_SHIFT) != (GCPhys >> GUEST_PAGE_SHIFT))
856	break;
857	GCPhys = GCPhysNext;
858	}
859
860	/*
861	* Update if we found something that is a higher priority state than the current.
862	* Note! The PGMPHYSHANDLER_F_NOT_IN_HM can be ignored here as it requires whole pages.
863	*/
864	if (uState != PGM_PAGE_HNDL_PHYS_STATE_NONE)
865	{
866	PPGMPAGE pPage;
867	int rc = pgmPhysGetPageWithHintEx(pVM, GCPhys, &pPage, ppRamHint);
868	if ( RT_SUCCESS(rc)
869	&& PGM_PAGE_GET_HNDL_PHYS_STATE(pPage) < uState)
870	{
871	/* This should normally not be necessary. */
872	PGM_PAGE_SET_HNDL_PHYS_STATE_ONLY(pPage, uState);
873	bool fFlushTLBs;
874	rc = pgmPoolTrackUpdateGCPhys(pVM, GCPhys, pPage, false /fFlushPTEs/, &fFlushTLBs);
875	if (RT_SUCCESS(rc) && fFlushTLBs)
876	PGM_INVL_ALL_VCPU_TLBS(pVM);
877	else
878	AssertRC(rc);
879
880	#ifdef VBOX_WITH_NATIVE_NEM
881	/* Tell NEM about the protection update. */
882	if (VM_IS_NEM_ENABLED(pVM))
883	{
884	uint8_t u2State = PGM_PAGE_GET_NEM_STATE(pPage);
885	PGMPAGETYPE enmType = (PGMPAGETYPE)PGM_PAGE_GET_TYPE(pPage);
886	NEMHCNotifyPhysPageProtChanged(pVM, GCPhys, PGM_PAGE_GET_HCPHYS(pPage),
887	PGM_RAMRANGE_CALC_PAGE_R3PTR(*ppRamHint, GCPhys),
888	pgmPhysPageCalcNemProtection(pPage, enmType), enmType, &u2State);
889	PGM_PAGE_SET_NEM_STATE(pPage, u2State);
890	}
891	#endif
892	}
893	else
894	AssertRC(rc);
895	}
896	}
897
898
899	/**
900	* Resets an aliased page.
901	*
902	* @param pVM The cross context VM structure.
903	* @param pPage The page.
904	* @param GCPhysPage The page address in case it comes in handy.
905	* @param pRam The RAM range the page is associated with (for NEM
906	* notifications).
907	* @param fDoAccounting Whether to perform accounting. (Only set during
908	* reset where pgmR3PhysRamReset doesn't have the
909	* handler structure handy.)
910	* @param fFlushIemTlbs Whether to perform IEM TLB flushing or not. This
911	* can be cleared only if the caller does the flushing
912	* after calling this function.
913	*/
914	void pgmHandlerPhysicalResetAliasedPage(PVMCC pVM, PPGMPAGE pPage, RTGCPHYS GCPhysPage, PPGMRAMRANGE pRam,
915	bool fDoAccounting, bool fFlushIemTlbs)
916	{
917	Assert( PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_MMIO2_ALIAS_MMIO
918	\|\| PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_SPECIAL_ALIAS_MMIO);
919	Assert(PGM_PAGE_GET_HNDL_PHYS_STATE(pPage) == PGM_PAGE_HNDL_PHYS_STATE_DISABLED);
920	#ifdef VBOX_WITH_NATIVE_NEM
921	RTHCPHYS const HCPhysPrev = PGM_PAGE_GET_HCPHYS(pPage);
922	#endif
923
924	/*
925	* Flush any shadow page table references first.
926	*/
927	bool fFlushTLBs = false;
928	int rc = pgmPoolTrackUpdateGCPhys(pVM, GCPhysPage, pPage, true /fFlushPTEs/, &fFlushTLBs);
929	AssertLogRelRCReturnVoid(rc);
930	#if defined(VBOX_VMM_TARGET_ARMV8)
931	AssertReleaseFailed();
932	#else
933	HMFlushTlbOnAllVCpus(pVM);
934	#endif
935
936	/*
937	* Make it an MMIO/Zero page.
938	*/
939	PGM_PAGE_SET_HCPHYS(pVM, pPage, pVM->pgm.s.HCPhysZeroPg);
940	PGM_PAGE_SET_TYPE(pVM, pPage, PGMPAGETYPE_MMIO);
941	PGM_PAGE_SET_STATE(pVM, pPage, PGM_PAGE_STATE_ZERO);
942	PGM_PAGE_SET_PAGEID(pVM, pPage, NIL_GMM_PAGEID);
943	PGM_PAGE_SET_HNDL_PHYS_STATE_ONLY(pPage, PGM_PAGE_HNDL_PHYS_STATE_ALL);
944
945	/*
946	* Flush its TLB entry.
947	*/
948	pgmPhysInvalidatePageMapTLBEntry(pVM, GCPhysPage);
949	if (fFlushIemTlbs)
950	IEMTlbInvalidateAllPhysicalAllCpus(pVM, NIL_VMCPUID, IEMTLBPHYSFLUSHREASON_RESET_ALIAS);
951
952	/*
953	* Do accounting for pgmR3PhysRamReset.
954	*/
955	if (fDoAccounting)
956	{
957	PPGMPHYSHANDLER pHandler;
958	rc = pgmHandlerPhysicalLookup(pVM, GCPhysPage, &pHandler);
959	if (RT_SUCCESS(rc))
960	{
961	Assert(pHandler->cAliasedPages > 0);
962	pHandler->cAliasedPages--;
963	}
964	else
965	AssertMsgFailed(("rc=%Rrc GCPhysPage=%RGp\n", rc, GCPhysPage));
966	}
967
968	#ifdef VBOX_WITH_NATIVE_NEM
969	/*
970	* Tell NEM about the protection change.
971	*/
972	if (VM_IS_NEM_ENABLED(pVM))
973	{
974	uint8_t u2State = PGM_PAGE_GET_NEM_STATE(pPage);
975	NEMHCNotifyPhysPageChanged(pVM, GCPhysPage, HCPhysPrev, pVM->pgm.s.HCPhysZeroPg,
976	PGM_RAMRANGE_CALC_PAGE_R3PTR(pRam, GCPhysPage),
977	NEM_PAGE_PROT_NONE, PGMPAGETYPE_MMIO, &u2State);
978	PGM_PAGE_SET_NEM_STATE(pPage, u2State);
979	}
980	#else
981	RT_NOREF(pRam);
982	#endif
983	}
984
985
986	/**
987	* Resets ram range flags.
988	*
989	* @param pVM The cross context VM structure.
990	* @param pCur The physical handler.
991	*
992	* @remark We don't start messing with the shadow page tables, as we've
993	* already got code in Trap0e which deals with out of sync handler
994	* flags (originally conceived for global pages).
995	*/
996	static void pgmHandlerPhysicalResetRamFlags(PVMCC pVM, PPGMPHYSHANDLER pCur)
997	{
998	/*
999	* Iterate the guest ram pages updating the state.
1000	*/
1001	RTUINT cPages = pCur->cPages;
1002	RTGCPHYS GCPhys = pCur->Key;
1003	PPGMRAMRANGE pRamHint = NULL;
1004	for (;;)
1005	{
1006	PPGMPAGE pPage;
1007	int rc = pgmPhysGetPageWithHintEx(pVM, GCPhys, &pPage, &pRamHint);
1008	if (RT_SUCCESS(rc))
1009	{
1010	/* Reset aliased MMIO pages to MMIO, since this aliasing is our business.
1011	(We don't flip MMIO to RAM though, that's PGMPhys.cpp's job.) */
1012	bool fNemNotifiedAlready = false;
1013	if ( PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_MMIO2_ALIAS_MMIO
1014	\|\| PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_SPECIAL_ALIAS_MMIO)
1015	{
1016	Assert(pCur->cAliasedPages > 0);
1017	pgmHandlerPhysicalResetAliasedPage(pVM, pPage, GCPhys, pRamHint, false /fDoAccounting/, true /fFlushIemTlbs/);
1018	pCur->cAliasedPages--;
1019	fNemNotifiedAlready = true;
1020	}
1021	#ifdef VBOX_STRICT
1022	PCPGMPHYSHANDLERTYPEINT const pCurType = PGMPHYSHANDLER_GET_TYPE(pVM, pCur);
1023	AssertMsg(pCurType && (pCurType->enmKind != PGMPHYSHANDLERKIND_MMIO \|\| PGM_PAGE_IS_MMIO(pPage)),
1024	("%RGp %R[pgmpage]\n", GCPhys, pPage));
1025	#endif
1026	PGM_PAGE_SET_HNDL_PHYS_STATE(pPage, PGM_PAGE_HNDL_PHYS_STATE_NONE, false);
1027
1028	#ifdef VBOX_WITH_NATIVE_NEM
1029	/* Tell NEM about the protection change. */
1030	if (VM_IS_NEM_ENABLED(pVM) && !fNemNotifiedAlready)
1031	{
1032	uint8_t u2State = PGM_PAGE_GET_NEM_STATE(pPage);
1033	PGMPAGETYPE enmType = (PGMPAGETYPE)PGM_PAGE_GET_TYPE(pPage);
1034	NEMHCNotifyPhysPageProtChanged(pVM, GCPhys, PGM_PAGE_GET_HCPHYS(pPage),
1035	PGM_RAMRANGE_CALC_PAGE_R3PTR(pRamHint, GCPhys),
1036	pgmPhysPageCalcNemProtection(pPage, enmType), enmType, &u2State);
1037	PGM_PAGE_SET_NEM_STATE(pPage, u2State);
1038	}
1039	#endif
1040	RT_NOREF(fNemNotifiedAlready);
1041	}
1042	else
1043	AssertRC(rc);
1044
1045	/* next */
1046	if (--cPages == 0)
1047	break;
1048	GCPhys += GUEST_PAGE_SIZE;
1049	}
1050
1051	pCur->cAliasedPages = 0;
1052	pCur->cTmpOffPages = 0;
1053
1054	/*
1055	* Check for partial start and end pages.
1056	*/
1057	if (pCur->Key & GUEST_PAGE_OFFSET_MASK)
1058	pgmHandlerPhysicalRecalcPageState(pVM, pCur->Key - 1, false /* fAbove */, &pRamHint);
1059	if ((pCur->KeyLast & GUEST_PAGE_OFFSET_MASK) != GUEST_PAGE_OFFSET_MASK)
1060	pgmHandlerPhysicalRecalcPageState(pVM, pCur->KeyLast + 1, true /* fAbove */, &pRamHint);
1061	}
1062
1063
1064	#if 0 /* unused */
1065	/**
1066	* Modify a physical page access handler.
1067	*
1068	* Modification can only be done to the range it self, not the type or anything else.
1069	*
1070	* @returns VBox status code.
1071	* For all return codes other than VERR_PGM_HANDLER_NOT_FOUND and VINF_SUCCESS the range is deregistered
1072	* and a new registration must be performed!
1073	* @param pVM The cross context VM structure.
1074	* @param GCPhysCurrent Current location.
1075	* @param GCPhys New location.
1076	* @param GCPhysLast New last location.
1077	*/
1078	VMMDECL(int) PGMHandlerPhysicalModify(PVMCC pVM, RTGCPHYS GCPhysCurrent, RTGCPHYS GCPhys, RTGCPHYS GCPhysLast)
1079	{
1080	/*
1081	* Remove it.
1082	*/
1083	int rc;
1084	PGM_LOCK_VOID(pVM);
1085	PPGMPHYSHANDLER pCur = (PPGMPHYSHANDLER)RTAvlroGCPhysRemove(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers, GCPhysCurrent);
1086	if (pCur)
1087	{
1088	/*
1089	* Clear the ram flags. (We're gonna move or free it!)
1090	*/
1091	pgmHandlerPhysicalResetRamFlags(pVM, pCur);
1092	PCPGMPHYSHANDLERTYPEINT const pCurType = PGMPHYSHANDLER_GET_TYPE_NO_NULL(pVM, pCur);
1093	@todo pCurType validation
1094	bool const fRestoreAsRAM = pCurType->pfnHandlerR3 /** @todo this isn't entirely correct. */
1095	&& pCurType->enmKind != PGMPHYSHANDLERKIND_MMIO;
1096
1097	/*
1098	* Validate the new range, modify and reinsert.
1099	*/
1100	if (GCPhysLast >= GCPhys)
1101	{
1102	/*
1103	* We require the range to be within registered ram.
1104	* There is no apparent need to support ranges which cover more than one ram range.
1105	*/
1106	PPGMRAMRANGE pRam = pgmPhysGetRange(pVM, GCPhys);
1107	if ( pRam
1108	&& GCPhys <= pRam->GCPhysLast
1109	&& GCPhysLast >= pRam->GCPhys)
1110	{
1111	pCur->Core.Key = GCPhys;
1112	pCur->Core.KeyLast = GCPhysLast;
1113	pCur->cPages = (GCPhysLast - (GCPhys & X86_PTE_PAE_PG_MASK) + 1) >> GUEST_PAGE_SHIFT;
1114
1115	if (RTAvlroGCPhysInsert(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers, &pCur->Core))
1116	{
1117	RTGCPHYS const cb = GCPhysLast - GCPhys + 1;
1118	PGMPHYSHANDLERKIND const enmKind = pCurType->enmKind;
1119
1120	/*
1121	* Set ram flags, flush shadow PT entries and finally tell REM about this.
1122	*/
1123	rc = pgmHandlerPhysicalSetRamFlagsAndFlushShadowPTs(pVM, pCur, pRam, NULL, 0);
1124
1125	/** @todo NEM: not sure we need this notification... */
1126	NEMHCNotifyHandlerPhysicalModify(pVM, enmKind, GCPhysCurrent, GCPhys, cb, fRestoreAsRAM);
1127
1128	PGM_UNLOCK(pVM);
1129
1130	PGM_INVL_ALL_VCPU_TLBS(pVM);
1131	Log(("PGMHandlerPhysicalModify: GCPhysCurrent=%RGp -> GCPhys=%RGp GCPhysLast=%RGp\n",
1132	GCPhysCurrent, GCPhys, GCPhysLast));
1133	return VINF_SUCCESS;
1134	}
1135
1136	AssertMsgFailed(("Conflict! GCPhys=%RGp GCPhysLast=%RGp\n", GCPhys, GCPhysLast));
1137	rc = VERR_PGM_HANDLER_PHYSICAL_CONFLICT;
1138	}
1139	else
1140	{
1141	AssertMsgFailed(("No RAM range for %RGp-%RGp\n", GCPhys, GCPhysLast));
1142	rc = VERR_PGM_HANDLER_PHYSICAL_NO_RAM_RANGE;
1143	}
1144	}
1145	else
1146	{
1147	AssertMsgFailed(("Invalid range %RGp-%RGp\n", GCPhys, GCPhysLast));
1148	rc = VERR_INVALID_PARAMETER;
1149	}
1150
1151	/*
1152	* Invalid new location, flush the cache and free it.
1153	* We've only gotta notify REM and free the memory.
1154	*/
1155	if (VM_IS_NEM_ENABLED(pVM))
1156	pgmHandlerPhysicalDeregisterNotifyNEM(pVM, pCur);
1157	pVM->pgm.s.pLastPhysHandlerR0 = 0;
1158	pVM->pgm.s.pLastPhysHandlerR3 = 0;
1159	PGMHandlerPhysicalTypeRelease(pVM, pCur->hType);
1160	MMHyperFree(pVM, pCur);
1161	}
1162	else
1163	{
1164	AssertMsgFailed(("Didn't find range starting at %RGp\n", GCPhysCurrent));
1165	rc = VERR_PGM_HANDLER_NOT_FOUND;
1166	}
1167
1168	PGM_UNLOCK(pVM);
1169	return rc;
1170	}
1171	#endif /* unused */
1172
1173
1174	/**
1175	* Changes the user callback arguments associated with a physical access handler.
1176	*
1177	* @returns VBox status code.
1178	* @param pVM The cross context VM structure.
1179	* @param GCPhys Start physical address of the handler.
1180	* @param uUser User argument to the handlers.
1181	*/
1182	VMMDECL(int) PGMHandlerPhysicalChangeUserArg(PVMCC pVM, RTGCPHYS GCPhys, uint64_t uUser)
1183	{
1184	/*
1185	* Find the handler and make the change.
1186	*/
1187	int rc = PGM_LOCK(pVM);
1188	AssertRCReturn(rc, rc);
1189
1190	PPGMPHYSHANDLER pCur;
1191	rc = pVM->VMCC_CTX(pgm).s.pPhysHandlerTree->lookup(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator, GCPhys, &pCur);
1192	if (RT_SUCCESS(rc))
1193	{
1194	Assert(pCur->Key == GCPhys);
1195	pCur->uUser = uUser;
1196	}
1197	else if (rc == VERR_NOT_FOUND)
1198	{
1199	AssertMsgFailed(("Didn't find range starting at %RGp\n", GCPhys));
1200	rc = VERR_PGM_HANDLER_NOT_FOUND;
1201	}
1202
1203	PGM_UNLOCK(pVM);
1204	return rc;
1205	}
1206
1207	#if 0 /* unused */
1208
1209	/**
1210	* Splits a physical access handler in two.
1211	*
1212	* @returns VBox status code.
1213	* @param pVM The cross context VM structure.
1214	* @param GCPhys Start physical address of the handler.
1215	* @param GCPhysSplit The split address.
1216	*/
1217	VMMDECL(int) PGMHandlerPhysicalSplit(PVMCC pVM, RTGCPHYS GCPhys, RTGCPHYS GCPhysSplit)
1218	{
1219	AssertReturn(GCPhys < GCPhysSplit, VERR_INVALID_PARAMETER);
1220
1221	/*
1222	* Do the allocation without owning the lock.
1223	*/
1224	PPGMPHYSHANDLER pNew;
1225	int rc = MMHyperAlloc(pVM, sizeof(pNew), 0, MM_TAG_PGM_HANDLERS, (void *)&pNew);
1226	if (RT_FAILURE(rc))
1227	return rc;
1228
1229	/*
1230	* Get the handler.
1231	*/
1232	PGM_LOCK_VOID(pVM);
1233	PPGMPHYSHANDLER pCur = (PPGMPHYSHANDLER)RTAvlroGCPhysGet(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers, GCPhys);
1234	if (RT_LIKELY(pCur))
1235	{
1236	if (RT_LIKELY(GCPhysSplit <= pCur->Core.KeyLast))
1237	{
1238	/*
1239	* Create new handler node for the 2nd half.
1240	*/
1241	pNew = pCur;
1242	pNew->Core.Key = GCPhysSplit;
1243	pNew->cPages = (pNew->Core.KeyLast - (pNew->Core.Key & X86_PTE_PAE_PG_MASK) + GUEST_PAGE_SIZE) >> GUEST_PAGE_SHIFT;
1244
1245	pCur->Core.KeyLast = GCPhysSplit - 1;
1246	pCur->cPages = (pCur->Core.KeyLast - (pCur->Core.Key & X86_PTE_PAE_PG_MASK) + GUEST_PAGE_SIZE) >> GUEST_PAGE_SHIFT;
1247
1248	if (RT_LIKELY(RTAvlroGCPhysInsert(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers, &pNew->Core)))
1249	{
1250	LogFlow(("PGMHandlerPhysicalSplit: %RGp-%RGp and %RGp-%RGp\n",
1251	pCur->Core.Key, pCur->Core.KeyLast, pNew->Core.Key, pNew->Core.KeyLast));
1252	PGM_UNLOCK(pVM);
1253	return VINF_SUCCESS;
1254	}
1255	AssertMsgFailed(("whu?\n"));
1256	rc = VERR_PGM_PHYS_HANDLER_IPE;
1257	}
1258	else
1259	{
1260	AssertMsgFailed(("outside range: %RGp-%RGp split %RGp\n", pCur->Core.Key, pCur->Core.KeyLast, GCPhysSplit));
1261	rc = VERR_INVALID_PARAMETER;
1262	}
1263	}
1264	else
1265	{
1266	AssertMsgFailed(("Didn't find range starting at %RGp\n", GCPhys));
1267	rc = VERR_PGM_HANDLER_NOT_FOUND;
1268	}
1269	PGM_UNLOCK(pVM);
1270	MMHyperFree(pVM, pNew);
1271	return rc;
1272	}
1273
1274
1275	/**
1276	* Joins up two adjacent physical access handlers which has the same callbacks.
1277	*
1278	* @returns VBox status code.
1279	* @param pVM The cross context VM structure.
1280	* @param GCPhys1 Start physical address of the first handler.
1281	* @param GCPhys2 Start physical address of the second handler.
1282	*/
1283	VMMDECL(int) PGMHandlerPhysicalJoin(PVMCC pVM, RTGCPHYS GCPhys1, RTGCPHYS GCPhys2)
1284	{
1285	/*
1286	* Get the handlers.
1287	*/
1288	int rc;
1289	PGM_LOCK_VOID(pVM);
1290	PPGMPHYSHANDLER pCur1 = (PPGMPHYSHANDLER)RTAvlroGCPhysGet(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers, GCPhys1);
1291	if (RT_LIKELY(pCur1))
1292	{
1293	PPGMPHYSHANDLER pCur2 = (PPGMPHYSHANDLER)RTAvlroGCPhysGet(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers, GCPhys2);
1294	if (RT_LIKELY(pCur2))
1295	{
1296	/*
1297	* Make sure that they are adjacent, and that they've got the same callbacks.
1298	*/
1299	if (RT_LIKELY(pCur1->Core.KeyLast + 1 == pCur2->Core.Key))
1300	{
1301	if (RT_LIKELY(pCur1->hType == pCur2->hType))
1302	{
1303	PPGMPHYSHANDLER pCur3 = (PPGMPHYSHANDLER)RTAvlroGCPhysRemove(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers, GCPhys2);
1304	if (RT_LIKELY(pCur3 == pCur2))
1305	{
1306	pCur1->Core.KeyLast = pCur2->Core.KeyLast;
1307	pCur1->cPages = (pCur1->Core.KeyLast - (pCur1->Core.Key & X86_PTE_PAE_PG_MASK) + GUEST_PAGE_SIZE) >> GUEST_PAGE_SHIFT;
1308	LogFlow(("PGMHandlerPhysicalJoin: %RGp-%RGp %RGp-%RGp\n",
1309	pCur1->Core.Key, pCur1->Core.KeyLast, pCur2->Core.Key, pCur2->Core.KeyLast));
1310	pVM->pgm.s.pLastPhysHandlerR0 = 0;
1311	pVM->pgm.s.pLastPhysHandlerR3 = 0;
1312	PGMHandlerPhysicalTypeRelease(pVM, pCur2->hType);
1313	MMHyperFree(pVM, pCur2);
1314	PGM_UNLOCK(pVM);
1315	return VINF_SUCCESS;
1316	}
1317
1318	Assert(pCur3 == pCur2);
1319	rc = VERR_PGM_PHYS_HANDLER_IPE;
1320	}
1321	else
1322	{
1323	AssertMsgFailed(("mismatching handlers\n"));
1324	rc = VERR_ACCESS_DENIED;
1325	}
1326	}
1327	else
1328	{
1329	AssertMsgFailed(("not adjacent: %RGp-%RGp %RGp-%RGp\n",
1330	pCur1->Core.Key, pCur1->Core.KeyLast, pCur2->Core.Key, pCur2->Core.KeyLast));
1331	rc = VERR_INVALID_PARAMETER;
1332	}
1333	}
1334	else
1335	{
1336	AssertMsgFailed(("Didn't find range starting at %RGp\n", GCPhys2));
1337	rc = VERR_PGM_HANDLER_NOT_FOUND;
1338	}
1339	}
1340	else
1341	{
1342	AssertMsgFailed(("Didn't find range starting at %RGp\n", GCPhys1));
1343	rc = VERR_PGM_HANDLER_NOT_FOUND;
1344	}
1345	PGM_UNLOCK(pVM);
1346	return rc;
1347
1348	}
1349
1350	#endif /* unused */
1351
1352	/**
1353	* Resets any modifications to individual pages in a physical page access
1354	* handler region.
1355	*
1356	* This is used in pair with PGMHandlerPhysicalPageTempOff(),
1357	* PGMHandlerPhysicalPageAliasMmio2() or PGMHandlerPhysicalPageAliasHC().
1358	*
1359	* @returns VBox status code.
1360	* @param pVM The cross context VM structure.
1361	* @param GCPhys The start address of the handler regions, i.e. what you
1362	* passed to PGMR3HandlerPhysicalRegister(),
1363	* PGMHandlerPhysicalRegisterEx() or
1364	* PGMHandlerPhysicalModify().
1365	*/
1366	VMMDECL(int) PGMHandlerPhysicalReset(PVMCC pVM, RTGCPHYS GCPhys)
1367	{
1368	LogFlow(("PGMHandlerPhysicalReset GCPhys=%RGp\n", GCPhys));
1369	int rc = PGM_LOCK(pVM);
1370	AssertRCReturn(rc, rc);
1371
1372	/*
1373	* Find the handler.
1374	*/
1375	PPGMPHYSHANDLER pCur;
1376	rc = pVM->VMCC_CTX(pgm).s.pPhysHandlerTree->lookup(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator, GCPhys, &pCur);
1377	if (RT_SUCCESS(rc))
1378	{
1379	Assert(pCur->Key == GCPhys);
1380
1381	/*
1382	* Validate kind.
1383	*/
1384	PCPGMPHYSHANDLERTYPEINT pCurType = PGMPHYSHANDLER_GET_TYPE_NO_NULL(pVM, pCur);
1385	switch (pCurType->enmKind)
1386	{
1387	case PGMPHYSHANDLERKIND_WRITE:
1388	case PGMPHYSHANDLERKIND_ALL:
1389	case PGMPHYSHANDLERKIND_MMIO: /* NOTE: Only use when clearing MMIO ranges with aliased MMIO2 pages! */
1390	{
1391	STAM_COUNTER_INC(&pVM->pgm.s.Stats.CTX_MID_Z(Stat,PhysHandlerReset)); /** @todo move out of switch */
1392	PPGMRAMRANGE pRam = pgmPhysGetRange(pVM, GCPhys);
1393	Assert(pRam);
1394	Assert(pRam->GCPhys <= pCur->Key);
1395	Assert(pRam->GCPhysLast >= pCur->KeyLast);
1396
1397	if (pCurType->enmKind == PGMPHYSHANDLERKIND_MMIO)
1398	{
1399	/*
1400	* Reset all the PGMPAGETYPE_MMIO2_ALIAS_MMIO pages first and that's it.
1401	* This could probably be optimized a bit wrt to flushing, but I'm too lazy
1402	* to do that now...
1403	*/
1404	if (pCur->cAliasedPages)
1405	{
1406	PPGMPAGE pPage = &pRam->aPages[(pCur->Key - pRam->GCPhys) >> GUEST_PAGE_SHIFT];
1407	RTGCPHYS GCPhysPage = pCur->Key;
1408	uint32_t cLeft = pCur->cPages;
1409	bool fFlushIemTlb = false;
1410	while (cLeft-- > 0)
1411	{
1412	if ( PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_MMIO2_ALIAS_MMIO
1413	\|\| PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_SPECIAL_ALIAS_MMIO)
1414	{
1415	fFlushIemTlb \|= PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_MMIO2_ALIAS_MMIO;
1416	Assert(pCur->cAliasedPages > 0);
1417	pgmHandlerPhysicalResetAliasedPage(pVM, pPage, GCPhysPage, pRam,
1418	false /fDoAccounting/, false /fFlushIemTlbs/);
1419	--pCur->cAliasedPages;
1420	#ifndef VBOX_STRICT
1421	if (pCur->cAliasedPages == 0)
1422	break;
1423	#endif
1424	}
1425	Assert(PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_MMIO);
1426	GCPhysPage += GUEST_PAGE_SIZE;
1427	pPage++;
1428	}
1429	Assert(pCur->cAliasedPages == 0);
1430
1431	/*
1432	* Flush IEM TLBs in case they contain any references to aliased pages.
1433	* This is only necessary for MMIO2 aliases.
1434	*/
1435	if (fFlushIemTlb)
1436	IEMTlbInvalidateAllPhysicalAllCpus(pVM, NIL_VMCPUID, IEMTLBPHYSFLUSHREASON_HANDLER_RESET);
1437	}
1438	}
1439	else if (pCur->cTmpOffPages > 0)
1440	{
1441	/*
1442	* Set the flags and flush shadow PT entries.
1443	*/
1444	rc = pgmHandlerPhysicalSetRamFlagsAndFlushShadowPTs(pVM, pCur, pRam, NULL /pvBitmap/, 0 /offBitmap/);
1445	}
1446
1447	pCur->cAliasedPages = 0;
1448	pCur->cTmpOffPages = 0;
1449
1450	rc = VINF_SUCCESS;
1451	break;
1452	}
1453
1454	/*
1455	* Invalid.
1456	*/
1457	default:
1458	AssertMsgFailed(("Invalid type %d/%#x! Corruption!\n", pCurType->enmKind, pCur->hType));
1459	rc = VERR_PGM_PHYS_HANDLER_IPE;
1460	break;
1461	}
1462	}
1463	else if (rc == VERR_NOT_FOUND)
1464	{
1465	AssertMsgFailed(("Didn't find MMIO Range starting at %#x\n", GCPhys));
1466	rc = VERR_PGM_HANDLER_NOT_FOUND;
1467	}
1468
1469	PGM_UNLOCK(pVM);
1470	return rc;
1471	}
1472
1473
1474	/**
1475	* Special version of PGMHandlerPhysicalReset used by MMIO2 w/ dirty page
1476	* tracking.
1477	*
1478	* @returns VBox status code.
1479	* @param pVM The cross context VM structure.
1480	* @param GCPhys The start address of the handler region.
1481	* @param pvBitmap Dirty bitmap. Caller has cleared this already, only
1482	* dirty bits will be set. Caller also made sure it's big
1483	* enough.
1484	* @param offBitmap Dirty bitmap offset.
1485	* @remarks Caller must own the PGM critical section.
1486	*/
1487	DECLHIDDEN(int) pgmHandlerPhysicalResetMmio2WithBitmap(PVMCC pVM, RTGCPHYS GCPhys, void *pvBitmap, uint32_t offBitmap)
1488	{
1489	LogFlow(("pgmHandlerPhysicalResetMmio2WithBitmap GCPhys=%RGp\n", GCPhys));
1490	PGM_LOCK_ASSERT_OWNER(pVM);
1491
1492	/*
1493	* Find the handler.
1494	*/
1495	PPGMPHYSHANDLER pCur;
1496	int rc = pVM->VMCC_CTX(pgm).s.pPhysHandlerTree->lookup(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator, GCPhys, &pCur);
1497	if (RT_SUCCESS(rc))
1498	{
1499	Assert(pCur->Key == GCPhys);
1500
1501	/*
1502	* Validate kind.
1503	*/
1504	PCPGMPHYSHANDLERTYPEINT pCurType = PGMPHYSHANDLER_GET_TYPE(pVM, pCur);
1505	if ( pCurType
1506	&& pCurType->enmKind == PGMPHYSHANDLERKIND_WRITE)
1507	{
1508	STAM_COUNTER_INC(&pVM->pgm.s.Stats.CTX_MID_Z(Stat,PhysHandlerReset));
1509
1510	#ifdef VBOX_STRICT
1511	PPGMRAMRANGE const pRamStrict = pgmPhysGetRange(pVM, GCPhys);
1512	Assert(pRamStrict && pRamStrict->GCPhys <= pCur->Key);
1513	Assert(pRamStrict && pRamStrict->GCPhysLast >= pCur->KeyLast);
1514	#endif
1515
1516	/*
1517	* Set the flags and flush shadow PT entries.
1518	*/
1519	if (pCur->cTmpOffPages > 0)
1520	{
1521	PPGMRAMRANGE const pRam = pgmPhysGetRange(pVM, GCPhys);
1522	if (pRam) /* paranoia */
1523	rc = pgmHandlerPhysicalSetRamFlagsAndFlushShadowPTs(pVM, pCur, pRam, pvBitmap, offBitmap);
1524	else
1525	AssertFailed();
1526	pCur->cTmpOffPages = 0;
1527	}
1528	else
1529	rc = VINF_SUCCESS;
1530	}
1531	else
1532	{
1533	AssertFailed();
1534	rc = VERR_WRONG_TYPE;
1535	}
1536	}
1537	else if (rc == VERR_NOT_FOUND)
1538	{
1539	AssertMsgFailed(("Didn't find MMIO Range starting at %#x\n", GCPhys));
1540	rc = VERR_PGM_HANDLER_NOT_FOUND;
1541	}
1542
1543	return rc;
1544	}
1545
1546
1547	/**
1548	* Temporarily turns off the access monitoring of a page within a monitored
1549	* physical write/all page access handler region.
1550	*
1551	* Use this when no further \#PFs are required for that page. Be aware that
1552	* a page directory sync might reset the flags, and turn on access monitoring
1553	* for the page.
1554	*
1555	* The caller must do required page table modifications.
1556	*
1557	* @returns VBox status code.
1558	* @param pVM The cross context VM structure.
1559	* @param GCPhys The start address of the access handler. This
1560	* must be a fully page aligned range or we risk
1561	* messing up other handlers installed for the
1562	* start and end pages.
1563	* @param GCPhysPage The physical address of the page to turn off
1564	* access monitoring for.
1565	*/
1566	VMMDECL(int) PGMHandlerPhysicalPageTempOff(PVMCC pVM, RTGCPHYS GCPhys, RTGCPHYS GCPhysPage)
1567	{
1568	LogFlow(("PGMHandlerPhysicalPageTempOff GCPhysPage=%RGp\n", GCPhysPage));
1569	int rc = PGM_LOCK(pVM);
1570	AssertRCReturn(rc, rc);
1571
1572	/*
1573	* Validate the range.
1574	*/
1575	PPGMPHYSHANDLER pCur;
1576	rc = pVM->VMCC_CTX(pgm).s.pPhysHandlerTree->lookup(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator, GCPhys, &pCur);
1577	if (RT_SUCCESS(rc))
1578	{
1579	Assert(pCur->Key == GCPhys);
1580	if (RT_LIKELY( GCPhysPage >= pCur->Key
1581	&& GCPhysPage <= pCur->KeyLast))
1582	{
1583	Assert(!(pCur->Key & GUEST_PAGE_OFFSET_MASK));
1584	Assert((pCur->KeyLast & GUEST_PAGE_OFFSET_MASK) == GUEST_PAGE_OFFSET_MASK);
1585
1586	PCPGMPHYSHANDLERTYPEINT const pCurType = PGMPHYSHANDLER_GET_TYPE(pVM, pCur);
1587	AssertReturnStmt( pCurType
1588	&& ( pCurType->enmKind == PGMPHYSHANDLERKIND_WRITE
1589	\|\| pCurType->enmKind == PGMPHYSHANDLERKIND_ALL),
1590	PGM_UNLOCK(pVM), VERR_ACCESS_DENIED);
1591
1592	/*
1593	* Change the page status.
1594	*/
1595	PPGMPAGE pPage;
1596	PPGMRAMRANGE pRam;
1597	rc = pgmPhysGetPageAndRangeEx(pVM, GCPhysPage, &pPage, &pRam);
1598	AssertReturnStmt(RT_SUCCESS_NP(rc), PGM_UNLOCK(pVM), rc);
1599	if (PGM_PAGE_GET_HNDL_PHYS_STATE(pPage) != PGM_PAGE_HNDL_PHYS_STATE_DISABLED)
1600	{
1601	PGM_PAGE_SET_HNDL_PHYS_STATE_ONLY(pPage, PGM_PAGE_HNDL_PHYS_STATE_DISABLED);
1602	pCur->cTmpOffPages++;
1603
1604	#ifdef VBOX_WITH_NATIVE_NEM
1605	/* Tell NEM about the protection change (VGA is using this to track dirty pages). */
1606	if (VM_IS_NEM_ENABLED(pVM))
1607	{
1608	uint8_t u2State = PGM_PAGE_GET_NEM_STATE(pPage);
1609	PGMPAGETYPE enmType = (PGMPAGETYPE)PGM_PAGE_GET_TYPE(pPage);
1610	NEMHCNotifyPhysPageProtChanged(pVM, GCPhysPage, PGM_PAGE_GET_HCPHYS(pPage),
1611	PGM_RAMRANGE_CALC_PAGE_R3PTR(pRam, GCPhysPage),
1612	pgmPhysPageCalcNemProtection(pPage, enmType), enmType, &u2State);
1613	PGM_PAGE_SET_NEM_STATE(pPage, u2State);
1614	}
1615	#endif
1616	}
1617	PGM_UNLOCK(pVM);
1618	return VINF_SUCCESS;
1619	}
1620	PGM_UNLOCK(pVM);
1621	AssertMsgFailed(("The page %#x is outside the range %#x-%#x\n", GCPhysPage, pCur->Key, pCur->KeyLast));
1622	return VERR_INVALID_PARAMETER;
1623	}
1624	PGM_UNLOCK(pVM);
1625
1626	if (rc == VERR_NOT_FOUND)
1627	{
1628	AssertMsgFailed(("Specified physical handler start address %#x is invalid.\n", GCPhys));
1629	return VERR_PGM_HANDLER_NOT_FOUND;
1630	}
1631	return rc;
1632	}
1633
1634
1635	/**
1636	* Resolves an MMIO2 page.
1637	*
1638	* Caller as taken the PGM lock.
1639	*
1640	* @returns Pointer to the page if valid, NULL otherwise
1641	* @param pVM The cross context VM structure.
1642	* @param pDevIns The device owning it.
1643	* @param hMmio2 The MMIO2 region.
1644	* @param offMmio2Page The offset into the region.
1645	*/
1646	static PPGMPAGE pgmPhysResolveMmio2PageLocked(PVMCC pVM, PPDMDEVINS pDevIns, PGMMMIO2HANDLE hMmio2, RTGCPHYS offMmio2Page)
1647	{
1648	/* Only works if the handle is in the handle table! */
1649	AssertReturn(hMmio2 != 0, NULL);
1650	uint32_t const cMmio2Ranges = RT_MIN(pVM->pgm.s.cMmio2Ranges, RT_ELEMENTS(pVM->pgm.s.aMmio2Ranges));
1651	AssertReturn(hMmio2 <= cMmio2Ranges, NULL);
1652	AssertCompile(RT_ELEMENTS(pVM->pgm.s.apMmio2RamRanges) == RT_ELEMENTS(pVM->pgm.s.aMmio2Ranges));
1653	#ifdef IN_RING0
1654	AssertCompile(RT_ELEMENTS(pVM->pgmr0.s.apMmio2RamRanges) == RT_ELEMENTS(pVM->pgm.s.aMmio2Ranges));
1655	AssertCompile(RT_ELEMENTS(pVM->pgmr0.s.acMmio2RangePages) == RT_ELEMENTS(pVM->pgm.s.aMmio2Ranges));
1656	#endif
1657	uint32_t const idxFirst = hMmio2 - 1U;
1658
1659	/* Must check the first one for PGMREGMMIO2RANGE_F_FIRST_CHUNK. */
1660	AssertReturn(pVM->pgm.s.aMmio2Ranges[idxFirst].fFlags & PGMREGMMIO2RANGE_F_FIRST_CHUNK, NULL);
1661	#ifdef IN_RING0
1662	AssertReturn(pVM->pgmr0.s.ahMmio2MapObjs[idxFirst] != NIL_RTR0MEMOBJ, NULL); /* Only the first chunk has a backing object. */
1663	#endif
1664
1665	/* Loop thru the sub-ranges till we find the one covering offMmio2. */
1666	for (uint32_t idx = idxFirst; idx < cMmio2Ranges; idx++)
1667	{
1668	#ifdef IN_RING3
1669	AssertReturn(pVM->pgm.s.aMmio2Ranges[idx].pDevInsR3 == pDevIns, NULL);
1670	#else
1671	AssertReturn(pVM->pgm.s.aMmio2Ranges[idx].pDevInsR3 == pDevIns->pDevInsForR3, NULL);
1672	#endif
1673
1674	/* Does it match the offset? */
1675	PPGMRAMRANGE const pRamRange = pVM->CTX_EXPR(pgm, pgmr0, pgm).s.apMmio2RamRanges[idx];
1676	AssertReturn(pRamRange, NULL);
1677	#ifdef IN_RING3
1678	RTGCPHYS const cbRange = RT_MIN(pRamRange->cb, pVM->pgm.s.aMmio2Ranges[idx].cbReal);
1679	#else
1680	RTGCPHYS const cbRange = RT_MIN(pRamRange->cb, (RTGCPHYS)pVM->pgmr0.s.acMmio2RangePages[idx] << GUEST_PAGE_SHIFT);
1681	#endif
1682	if (offMmio2Page < cbRange)
1683	return &pRamRange->aPages[offMmio2Page >> GUEST_PAGE_SHIFT];
1684
1685	/* Advance. */
1686	AssertReturn(!(pVM->pgm.s.aMmio2Ranges[idx].fFlags & PGMREGMMIO2RANGE_F_LAST_CHUNK), NULL);
1687	offMmio2Page -= cbRange;
1688	}
1689	AssertFailed();
1690	return NULL;
1691	}
1692
1693
1694	/**
1695	* Replaces an MMIO page with an MMIO2 page.
1696	*
1697	* This is a worker for IOMMMIOMapMMIO2Page that works in a similar way to
1698	* PGMHandlerPhysicalPageTempOff but for an MMIO page. Since an MMIO page has no
1699	* backing, the caller must provide a replacement page. For various reasons the
1700	* replacement page must be an MMIO2 page.
1701	*
1702	* The caller must do required page table modifications. You can get away
1703	* without making any modifications since it's an MMIO page, the cost is an extra
1704	* \#PF which will the resync the page.
1705	*
1706	* Call PGMHandlerPhysicalReset() to restore the MMIO page.
1707	*
1708	* The caller may still get handler callback even after this call and must be
1709	* able to deal correctly with such calls. The reason for these callbacks are
1710	* either that we're executing in the recompiler (which doesn't know about this
1711	* arrangement) or that we've been restored from saved state (where we won't
1712	* save the change).
1713	*
1714	* @returns VBox status code.
1715	* @param pVM The cross context VM structure.
1716	* @param GCPhys The start address of the access handler. This
1717	* must be a fully page aligned range or we risk
1718	* messing up other handlers installed for the
1719	* start and end pages.
1720	* @param GCPhysPage The physical address of the page to turn off
1721	* access monitoring for and replace with the MMIO2
1722	* page.
1723	* @param pDevIns The device instance owning @a hMmio2.
1724	* @param hMmio2 Handle to the MMIO2 region containing the page
1725	* to remap in the the MMIO page at @a GCPhys.
1726	* @param offMmio2PageRemap The offset into @a hMmio2 of the MMIO2 page that
1727	* should serve as backing memory.
1728	*
1729	* @remark May cause a page pool flush if used on a page that is already
1730	* aliased.
1731	*
1732	* @note This trick does only work reliably if the two pages are never ever
1733	* mapped in the same page table. If they are the page pool code will
1734	* be confused should either of them be flushed. See the special case
1735	* of zero page aliasing mentioned in #3170.
1736	*
1737	*/
1738	VMMDECL(int) PGMHandlerPhysicalPageAliasMmio2(PVMCC pVM, RTGCPHYS GCPhys, RTGCPHYS GCPhysPage,
1739	PPDMDEVINS pDevIns, PGMMMIO2HANDLE hMmio2, RTGCPHYS offMmio2PageRemap)
1740	{
1741	#ifdef VBOX_WITH_PGM_NEM_MODE
1742	AssertReturn(!VM_IS_NEM_ENABLED(pVM) \|\| !pVM->pgm.s.fNemMode, VERR_PGM_NOT_SUPPORTED_FOR_NEM_MODE);
1743	#endif
1744	int rc = PGM_LOCK(pVM);
1745	AssertRCReturn(rc, rc);
1746
1747	/*
1748	* Resolve the MMIO2 reference.
1749	*/
1750	PPGMPAGE pPageRemap = pgmPhysResolveMmio2PageLocked(pVM, pDevIns, hMmio2, offMmio2PageRemap);
1751	if (RT_LIKELY(pPageRemap))
1752	AssertMsgReturnStmt(PGM_PAGE_GET_TYPE(pPageRemap) == PGMPAGETYPE_MMIO2,
1753	("hMmio2=%RU64 offMmio2PageRemap=%RGp %R[pgmpage]\n", hMmio2, offMmio2PageRemap, pPageRemap),
1754	PGM_UNLOCK(pVM), VERR_PGM_PHYS_NOT_MMIO2);
1755	else
1756	{
1757	PGM_UNLOCK(pVM);
1758	return VERR_OUT_OF_RANGE;
1759	}
1760
1761	/*
1762	* Lookup and validate the range.
1763	*/
1764	PPGMPHYSHANDLER pCur;
1765	rc = pVM->VMCC_CTX(pgm).s.pPhysHandlerTree->lookup(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator, GCPhys, &pCur);
1766	if (RT_SUCCESS(rc))
1767	{
1768	Assert(pCur->Key == GCPhys);
1769	if (RT_LIKELY( GCPhysPage >= pCur->Key
1770	&& GCPhysPage <= pCur->KeyLast))
1771	{
1772	PCPGMPHYSHANDLERTYPEINT const pCurType = PGMPHYSHANDLER_GET_TYPE_NO_NULL(pVM, pCur);
1773	AssertReturnStmt(pCurType->enmKind == PGMPHYSHANDLERKIND_MMIO, PGM_UNLOCK(pVM), VERR_ACCESS_DENIED);
1774	AssertReturnStmt(!(pCur->Key & GUEST_PAGE_OFFSET_MASK), PGM_UNLOCK(pVM), VERR_INVALID_PARAMETER);
1775	AssertReturnStmt((pCur->KeyLast & GUEST_PAGE_OFFSET_MASK) == GUEST_PAGE_OFFSET_MASK,
1776	PGM_UNLOCK(pVM), VERR_INVALID_PARAMETER);
1777
1778	/*
1779	* Validate the page.
1780	*/
1781	PPGMPAGE pPage;
1782	PPGMRAMRANGE pRam;
1783	rc = pgmPhysGetPageAndRangeEx(pVM, GCPhysPage, &pPage, &pRam);
1784	AssertReturnStmt(RT_SUCCESS_NP(rc), PGM_UNLOCK(pVM), rc);
1785	if (PGM_PAGE_GET_TYPE(pPage) != PGMPAGETYPE_MMIO)
1786	{
1787	AssertMsgReturn(PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_MMIO2_ALIAS_MMIO,
1788	("GCPhysPage=%RGp %R[pgmpage]\n", GCPhysPage, pPage),
1789	VERR_PGM_PHYS_NOT_MMIO2);
1790	if (PGM_PAGE_GET_HCPHYS(pPage) == PGM_PAGE_GET_HCPHYS(pPageRemap))
1791	{
1792	PGM_UNLOCK(pVM);
1793	return VINF_PGM_HANDLER_ALREADY_ALIASED;
1794	}
1795
1796	/*
1797	* The page is already mapped as some other page, reset it
1798	* to an MMIO/ZERO page before doing the new mapping.
1799	*/
1800	Log(("PGMHandlerPhysicalPageAliasMmio2: GCPhysPage=%RGp (%R[pgmpage]; %RHp -> %RHp\n",
1801	GCPhysPage, pPage, PGM_PAGE_GET_HCPHYS(pPage), PGM_PAGE_GET_HCPHYS(pPageRemap)));
1802	pgmHandlerPhysicalResetAliasedPage(pVM, pPage, GCPhysPage, pRam,
1803	false /fDoAccounting/, false /fFlushIemTlbs/);
1804	pCur->cAliasedPages--;
1805
1806	/* Since this may be present in the TLB and now be wrong, invalid
1807	the guest physical address part of the IEM TLBs. Note, we do
1808	this here as we will not invalid */
1809	IEMTlbInvalidateAllPhysicalAllCpus(pVM, NIL_VMCPUID, IEMTLBPHYSFLUSHREASON_MMIO2_ALIAS);
1810	}
1811	Assert(PGM_PAGE_IS_ZERO(pPage));
1812
1813	/*
1814	* Do the actual remapping here.
1815	* This page now serves as an alias for the backing memory specified.
1816	*/
1817	LogFlow(("PGMHandlerPhysicalPageAliasMmio2: %RGp (%R[pgmpage]) alias for %RU64/%RGp (%R[pgmpage])\n",
1818	GCPhysPage, pPage, hMmio2, offMmio2PageRemap, pPageRemap ));
1819	PGM_PAGE_SET_HCPHYS(pVM, pPage, PGM_PAGE_GET_HCPHYS(pPageRemap));
1820	PGM_PAGE_SET_TYPE(pVM, pPage, PGMPAGETYPE_MMIO2_ALIAS_MMIO);
1821	PGM_PAGE_SET_STATE(pVM, pPage, PGM_PAGE_STATE_ALLOCATED);
1822	PGM_PAGE_SET_PAGEID(pVM, pPage, PGM_PAGE_GET_PAGEID(pPageRemap));
1823	PGM_PAGE_SET_HNDL_PHYS_STATE_ONLY(pPage, PGM_PAGE_HNDL_PHYS_STATE_DISABLED);
1824	pCur->cAliasedPages++;
1825	Assert(pCur->cAliasedPages <= pCur->cPages);
1826
1827	/*
1828	* Flush its TLB entry.
1829	*
1830	* Not calling IEMTlbInvalidateAllPhysicalAllCpus here to conserve
1831	* all the other IEM TLB entires. When this one is kicked out and
1832	* reloaded, it will be using the MMIO2 alias, but till then we'll
1833	* continue doing MMIO.
1834	*/
1835	pgmPhysInvalidatePageMapTLBEntry(pVM, GCPhysPage);
1836	/** @todo Do some preformance checks of calling
1837	* IEMTlbInvalidateAllPhysicalAllCpus when in IEM mode, to see if it
1838	* actually makes sense or not. Screen updates are typically massive
1839	* and important when this kind of aliasing is used, so it may pay of... */
1840
1841	#ifdef VBOX_WITH_NATIVE_NEM
1842	/* Tell NEM about the backing and protection change. */
1843	if (VM_IS_NEM_ENABLED(pVM))
1844	{
1845	uint8_t u2State = PGM_PAGE_GET_NEM_STATE(pPage);
1846	NEMHCNotifyPhysPageChanged(pVM, GCPhysPage, pVM->pgm.s.HCPhysZeroPg, PGM_PAGE_GET_HCPHYS(pPage),
1847	PGM_RAMRANGE_CALC_PAGE_R3PTR(pRam, GCPhysPage),
1848	pgmPhysPageCalcNemProtection(pPage, PGMPAGETYPE_MMIO2_ALIAS_MMIO),
1849	PGMPAGETYPE_MMIO2_ALIAS_MMIO, &u2State);
1850	PGM_PAGE_SET_NEM_STATE(pPage, u2State);
1851	}
1852	#endif
1853	LogFlow(("PGMHandlerPhysicalPageAliasMmio2: => %R[pgmpage]\n", pPage));
1854	PGM_UNLOCK(pVM);
1855	return VINF_SUCCESS;
1856	}
1857
1858	PGM_UNLOCK(pVM);
1859	AssertMsgFailed(("The page %#x is outside the range %#x-%#x\n", GCPhysPage, pCur->Key, pCur->KeyLast));
1860	return VERR_INVALID_PARAMETER;
1861	}
1862
1863	PGM_UNLOCK(pVM);
1864	if (rc == VERR_NOT_FOUND)
1865	{
1866	AssertMsgFailed(("Specified physical handler start address %#x is invalid.\n", GCPhys));
1867	return VERR_PGM_HANDLER_NOT_FOUND;
1868	}
1869	return rc;
1870	}
1871
1872
1873	/**
1874	* Replaces an MMIO page with an arbitrary HC page in the shadow page tables.
1875	*
1876	* This differs from PGMHandlerPhysicalPageAliasMmio2 in that the page doesn't
1877	* need to be a known MMIO2 page and that only shadow paging may access the
1878	* page. The latter distinction is important because the only use for this
1879	* feature is for mapping the special APIC access page that VT-x uses to detect
1880	* APIC MMIO operations, the page is shared between all guest CPUs and actually
1881	* not written to. At least at the moment.
1882	*
1883	* The caller must do required page table modifications. You can get away
1884	* without making any modifications since it's an MMIO page, the cost is an extra
1885	* \#PF which will the resync the page.
1886	*
1887	* Call PGMHandlerPhysicalReset() to restore the MMIO page.
1888	*
1889	*
1890	* @returns VBox status code.
1891	* @param pVM The cross context VM structure.
1892	* @param GCPhys The start address of the access handler. This
1893	* must be a fully page aligned range or we risk
1894	* messing up other handlers installed for the
1895	* start and end pages.
1896	* @param GCPhysPage The physical address of the page to turn off
1897	* access monitoring for.
1898	* @param HCPhysPageRemap The physical address of the HC page that
1899	* serves as backing memory.
1900	*
1901	* @remark May cause a page pool flush if used on a page that is already
1902	* aliased.
1903	*/
1904	VMMDECL(int) PGMHandlerPhysicalPageAliasHC(PVMCC pVM, RTGCPHYS GCPhys, RTGCPHYS GCPhysPage, RTHCPHYS HCPhysPageRemap)
1905	{
1906	/// Assert(!IOMIsLockOwner(pVM)); /* We mustn't own any other locks when calling this */
1907	#ifdef VBOX_WITH_PGM_NEM_MODE
1908	AssertReturn(!VM_IS_NEM_ENABLED(pVM) \|\| !pVM->pgm.s.fNemMode, VERR_PGM_NOT_SUPPORTED_FOR_NEM_MODE);
1909	#endif
1910	int rc = PGM_LOCK(pVM);
1911	AssertRCReturn(rc, rc);
1912
1913	/*
1914	* Lookup and validate the range.
1915	*/
1916	PPGMPHYSHANDLER pCur;
1917	rc = pVM->VMCC_CTX(pgm).s.pPhysHandlerTree->lookup(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator, GCPhys, &pCur);
1918	if (RT_SUCCESS(rc))
1919	{
1920	Assert(pCur->Key == GCPhys);
1921	if (RT_LIKELY( GCPhysPage >= pCur->Key
1922	&& GCPhysPage <= pCur->KeyLast))
1923	{
1924	PCPGMPHYSHANDLERTYPEINT const pCurType = PGMPHYSHANDLER_GET_TYPE_NO_NULL(pVM, pCur);
1925	AssertReturnStmt(pCurType->enmKind == PGMPHYSHANDLERKIND_MMIO, PGM_UNLOCK(pVM), VERR_ACCESS_DENIED);
1926	AssertReturnStmt(!(pCur->Key & GUEST_PAGE_OFFSET_MASK), PGM_UNLOCK(pVM), VERR_INVALID_PARAMETER);
1927	AssertReturnStmt((pCur->KeyLast & GUEST_PAGE_OFFSET_MASK) == GUEST_PAGE_OFFSET_MASK,
1928	PGM_UNLOCK(pVM), VERR_INVALID_PARAMETER);
1929
1930	/*
1931	* Get and validate the pages.
1932	*/
1933	PPGMPAGE pPage = NULL;
1934	#ifdef VBOX_WITH_NATIVE_NEM
1935	PPGMRAMRANGE pRam = NULL;
1936	rc = pgmPhysGetPageAndRangeEx(pVM, GCPhysPage, &pPage, &pRam);
1937	#else
1938	rc = pgmPhysGetPageEx(pVM, GCPhysPage, &pPage);
1939	#endif
1940	AssertReturnStmt(RT_SUCCESS_NP(rc), PGM_UNLOCK(pVM), rc);
1941	if (PGM_PAGE_GET_TYPE(pPage) != PGMPAGETYPE_MMIO)
1942	{
1943	PGM_UNLOCK(pVM);
1944	AssertMsgReturn(PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_SPECIAL_ALIAS_MMIO,
1945	("GCPhysPage=%RGp %R[pgmpage]\n", GCPhysPage, pPage),
1946	VERR_PGM_PHYS_NOT_MMIO2);
1947	return VINF_PGM_HANDLER_ALREADY_ALIASED;
1948	}
1949	Assert(PGM_PAGE_IS_ZERO(pPage));
1950
1951	/*
1952	* Do the actual remapping here.
1953	* This page now serves as an alias for the backing memory
1954	* specified as far as shadow paging is concerned.
1955	*/
1956	LogFlow(("PGMHandlerPhysicalPageAliasHC: %RGp (%R[pgmpage]) alias for %RHp\n",
1957	GCPhysPage, pPage, HCPhysPageRemap));
1958	PGM_PAGE_SET_HCPHYS(pVM, pPage, HCPhysPageRemap);
1959	PGM_PAGE_SET_TYPE(pVM, pPage, PGMPAGETYPE_SPECIAL_ALIAS_MMIO);
1960	PGM_PAGE_SET_STATE(pVM, pPage, PGM_PAGE_STATE_ALLOCATED);
1961	PGM_PAGE_SET_PAGEID(pVM, pPage, NIL_GMM_PAGEID);
1962	PGM_PAGE_SET_HNDL_PHYS_STATE_ONLY(pPage, PGM_PAGE_HNDL_PHYS_STATE_DISABLED);
1963	pCur->cAliasedPages++;
1964	Assert(pCur->cAliasedPages <= pCur->cPages);
1965
1966	/*
1967	* Flush its TLB entry.
1968	*
1969	* Not calling IEMTlbInvalidateAllPhysicalAllCpus here as special
1970	* aliased MMIO pages are handled like MMIO by the IEM TLB.
1971	*/
1972	pgmPhysInvalidatePageMapTLBEntry(pVM, GCPhysPage);
1973
1974	#ifdef VBOX_WITH_NATIVE_NEM
1975	/* Tell NEM about the backing and protection change. */
1976	if (VM_IS_NEM_ENABLED(pVM))
1977	{
1978	uint8_t u2State = PGM_PAGE_GET_NEM_STATE(pPage);
1979	NEMHCNotifyPhysPageChanged(pVM, GCPhysPage, pVM->pgm.s.HCPhysZeroPg, PGM_PAGE_GET_HCPHYS(pPage),
1980	PGM_RAMRANGE_CALC_PAGE_R3PTR(pRam, GCPhysPage),
1981	pgmPhysPageCalcNemProtection(pPage, PGMPAGETYPE_SPECIAL_ALIAS_MMIO),
1982	PGMPAGETYPE_SPECIAL_ALIAS_MMIO, &u2State);
1983	PGM_PAGE_SET_NEM_STATE(pPage, u2State);
1984	}
1985	#endif
1986	LogFlow(("PGMHandlerPhysicalPageAliasHC: => %R[pgmpage]\n", pPage));
1987	PGM_UNLOCK(pVM);
1988	return VINF_SUCCESS;
1989	}
1990	PGM_UNLOCK(pVM);
1991	AssertMsgFailed(("The page %#x is outside the range %#x-%#x\n", GCPhysPage, pCur->Key, pCur->KeyLast));
1992	return VERR_INVALID_PARAMETER;
1993	}
1994	PGM_UNLOCK(pVM);
1995
1996	if (rc == VERR_NOT_FOUND)
1997	{
1998	AssertMsgFailed(("Specified physical handler start address %#x is invalid.\n", GCPhys));
1999	return VERR_PGM_HANDLER_NOT_FOUND;
2000	}
2001	return rc;
2002	}
2003
2004
2005	/**
2006	* Checks if a physical range is handled
2007	*
2008	* @returns boolean
2009	* @param pVM The cross context VM structure.
2010	* @param GCPhys Start physical address earlier passed to PGMR3HandlerPhysicalRegister().
2011	* @remarks Caller must take the PGM lock...
2012	* @thread EMT.
2013	*/
2014	VMMDECL(bool) PGMHandlerPhysicalIsRegistered(PVMCC pVM, RTGCPHYS GCPhys)
2015	{
2016	/*
2017	* Find the handler.
2018	*/
2019	PGM_LOCK_VOID(pVM);
2020	PPGMPHYSHANDLER pCur;
2021	int rc = pgmHandlerPhysicalLookup(pVM, GCPhys, &pCur);
2022	if (RT_SUCCESS(rc))
2023	{
2024	#ifdef VBOX_STRICT
2025	Assert(GCPhys >= pCur->Key && GCPhys <= pCur->KeyLast);
2026	PCPGMPHYSHANDLERTYPEINT const pCurType = PGMPHYSHANDLER_GET_TYPE_NO_NULL(pVM, pCur);
2027	Assert( pCurType->enmKind == PGMPHYSHANDLERKIND_WRITE
2028	\|\| pCurType->enmKind == PGMPHYSHANDLERKIND_ALL
2029	\|\| pCurType->enmKind == PGMPHYSHANDLERKIND_MMIO);
2030	#endif
2031	PGM_UNLOCK(pVM);
2032	return true;
2033	}
2034	PGM_UNLOCK(pVM);
2035	return false;
2036	}
2037
2038
2039	/**
2040	* Checks if it's an disabled all access handler or write access handler at the
2041	* given address.
2042	*
2043	* @returns true if it's an all access handler, false if it's a write access
2044	* handler.
2045	* @param pVM The cross context VM structure.
2046	* @param GCPhys The address of the page with a disabled handler.
2047	*
2048	* @remarks The caller, PGMR3PhysTlbGCPhys2Ptr, must hold the PGM lock.
2049	*/
2050	bool pgmHandlerPhysicalIsAll(PVMCC pVM, RTGCPHYS GCPhys)
2051	{
2052	PGM_LOCK_VOID(pVM);
2053	PPGMPHYSHANDLER pCur;
2054	int rc = pgmHandlerPhysicalLookup(pVM, GCPhys, &pCur);
2055	AssertRCReturnStmt(rc, PGM_UNLOCK(pVM), true);
2056
2057	/* Only whole pages can be disabled. */
2058	Assert( pCur->Key <= (GCPhys & ~(RTGCPHYS)GUEST_PAGE_OFFSET_MASK)
2059	&& pCur->KeyLast >= (GCPhys \| GUEST_PAGE_OFFSET_MASK));
2060
2061	PCPGMPHYSHANDLERTYPEINT const pCurType = PGMPHYSHANDLER_GET_TYPE_NO_NULL(pVM, pCur);
2062	Assert( pCurType->enmKind == PGMPHYSHANDLERKIND_WRITE
2063	\|\| pCurType->enmKind == PGMPHYSHANDLERKIND_ALL
2064	\|\| pCurType->enmKind == PGMPHYSHANDLERKIND_MMIO); /* sanity */
2065	bool const fRet = pCurType->enmKind != PGMPHYSHANDLERKIND_WRITE;
2066	PGM_UNLOCK(pVM);
2067	return fRet;
2068	}
2069
2070	#ifdef VBOX_STRICT
2071
2072	/**
2073	* State structure used by the PGMAssertHandlerAndFlagsInSync() function
2074	* and its AVL enumerators.
2075	*/
2076	typedef struct PGMAHAFIS
2077	{
2078	/** The current physical address. */
2079	RTGCPHYS GCPhys;
2080	/** Number of errors. */
2081	unsigned cErrors;
2082	/** Pointer to the VM. */
2083	PVM pVM;
2084	} PGMAHAFIS, *PPGMAHAFIS;
2085
2086
2087	/**
2088	* Asserts that the handlers+guest-page-tables == ramrange-flags and
2089	* that the physical addresses associated with virtual handlers are correct.
2090	*
2091	* @returns Number of mismatches.
2092	* @param pVM The cross context VM structure.
2093	*/
2094	VMMDECL(unsigned) PGMAssertHandlerAndFlagsInSync(PVMCC pVM)
2095	{
2096	PGMAHAFIS State;
2097	State.GCPhys = 0;
2098	State.cErrors = 0;
2099	State.pVM = pVM;
2100
2101	PGM_LOCK_ASSERT_OWNER(pVM);
2102
2103	/*
2104	* Check the RAM flags against the handlers.
2105	*/
2106	PPGMPHYSHANDLERTREE const pPhysHandlerTree = pVM->VMCC_CTX(pgm).s.pPhysHandlerTree;
2107	uint32_t const cLookupEntries = RT_MIN(pVM->pgm.s.RamRangeUnion.cLookupEntries,
2108	RT_ELEMENTS(pVM->pgm.s.aRamRangeLookup));
2109	for (uint32_t idxLookup = 0; idxLookup < cLookupEntries; idxLookup++)
2110	{
2111	uint32_t const idRamRange = PGMRAMRANGELOOKUPENTRY_GET_ID(pVM->pgm.s.aRamRangeLookup[idxLookup]);
2112	AssertContinue(idRamRange < RT_ELEMENTS(pVM->pgm.s.apRamRanges));
2113	PPGMRAMRANGE const pRam = pVM->CTX_EXPR(pgm, pgmr0, pgm).s.apRamRanges[idRamRange];
2114	AssertContinue(pRam);
2115	const uint32_t cPages = pRam->cb >> GUEST_PAGE_SHIFT;
2116	for (uint32_t iPage = 0; iPage < cPages; iPage++)
2117	{
2118	PGMPAGE const *pPage = &pRam->aPages[iPage];
2119	if (PGM_PAGE_HAS_ANY_HANDLERS(pPage))
2120	{
2121	State.GCPhys = pRam->GCPhys + (iPage << GUEST_PAGE_SHIFT);
2122
2123	/*
2124	* Physical first - calculate the state based on the handlers
2125	* active on the page, then compare.
2126	*/
2127	if (PGM_PAGE_HAS_ANY_PHYSICAL_HANDLERS(pPage))
2128	{
2129	/* the first */
2130	PPGMPHYSHANDLER pPhys;
2131	int rc = pPhysHandlerTree->lookup(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator, State.GCPhys, &pPhys);
2132	if (rc == VERR_NOT_FOUND)
2133	{
2134	rc = pPhysHandlerTree->lookupMatchingOrAbove(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator,
2135	State.GCPhys, &pPhys);
2136	if (RT_SUCCESS(rc))
2137	{
2138	Assert(pPhys->Key >= State.GCPhys);
2139	if (pPhys->Key > (State.GCPhys + GUEST_PAGE_SIZE - 1))
2140	pPhys = NULL;
2141	}
2142	else
2143	AssertLogRelMsgReturn(rc == VERR_NOT_FOUND, ("rc=%Rrc GCPhys=%RGp\n", rc, State.GCPhys), 999);
2144	}
2145	else
2146	AssertLogRelMsgReturn(RT_SUCCESS(rc), ("rc=%Rrc GCPhys=%RGp\n", rc, State.GCPhys), 999);
2147
2148	if (pPhys)
2149	{
2150	PCPGMPHYSHANDLERTYPEINT pPhysType = pgmHandlerPhysicalTypeHandleToPtr(pVM, pPhys->hType);
2151	unsigned uState = pPhysType->uState;
2152	bool const fNotInHm = pPhysType->fNotInHm; /* whole pages, so no need to accumulate sub-page configs. */
2153
2154	/* more? */
2155	while (pPhys->KeyLast < (State.GCPhys \| GUEST_PAGE_OFFSET_MASK))
2156	{
2157	PPGMPHYSHANDLER pPhys2;
2158	rc = pPhysHandlerTree->lookupMatchingOrAbove(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator,
2159	pPhys->KeyLast + 1, &pPhys2);
2160	if (rc == VERR_NOT_FOUND)
2161	break;
2162	AssertLogRelMsgReturn(RT_SUCCESS(rc), ("rc=%Rrc KeyLast+1=%RGp\n", rc, pPhys->KeyLast + 1), 999);
2163	if (pPhys2->Key > (State.GCPhys \| GUEST_PAGE_OFFSET_MASK))
2164	break;
2165	PCPGMPHYSHANDLERTYPEINT pPhysType2 = pgmHandlerPhysicalTypeHandleToPtr(pVM, pPhys2->hType);
2166	uState = RT_MAX(uState, pPhysType2->uState);
2167	pPhys = pPhys2;
2168	}
2169
2170	/* compare.*/
2171	if ( PGM_PAGE_GET_HNDL_PHYS_STATE(pPage) != uState
2172	&& PGM_PAGE_GET_HNDL_PHYS_STATE(pPage) != PGM_PAGE_HNDL_PHYS_STATE_DISABLED)
2173	{
2174	AssertMsgFailed(("ram range vs phys handler flags mismatch. GCPhys=%RGp state=%d expected=%d %s\n",
2175	State.GCPhys, PGM_PAGE_GET_HNDL_PHYS_STATE(pPage), uState, pPhysType->pszDesc));
2176	State.cErrors++;
2177	}
2178	AssertMsgStmt(PGM_PAGE_IS_HNDL_PHYS_NOT_IN_HM(pPage) == fNotInHm,
2179	("ram range vs phys handler flags mismatch. GCPhys=%RGp fNotInHm=%d, %d %s\n",
2180	State.GCPhys, PGM_PAGE_IS_HNDL_PHYS_NOT_IN_HM(pPage), fNotInHm, pPhysType->pszDesc),
2181	State.cErrors++);
2182	}
2183	else
2184	{
2185	AssertMsgFailed(("ram range vs phys handler mismatch. no handler for GCPhys=%RGp\n", State.GCPhys));
2186	State.cErrors++;
2187	}
2188	}
2189	}
2190	} /* foreach page in ram range. */
2191	} /* foreach ram range. */
2192
2193	/*
2194	* Do the reverse check for physical handlers.
2195	*/
2196	/** @todo */
2197
2198	return State.cErrors;
2199	}
2200
2201	#endif /* VBOX_STRICT */
2202

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/PGMAllHandler.cpp@ 105354

Download in other formats: