PGMAllHandler.cpp@ 99681

Last change on this file since 99681 was 99360, checked in by vboxsync, 21 months ago
VMM/PGM: Nested VMX: bugref:10318 Skip some redundant checks while repeatedly registeration the virtual VMX APIC-access page.
Property svn:eol-style set to `native` Property svn:keywords set to `Id Revision`
File size: 84.5 KB

Line
1	/* $Id: PGMAllHandler.cpp 99360 2023-04-10 05:44:28Z vboxsync $ */
2	/** @file
3	* PGM - Page Manager / Monitor, Access Handlers.
4	*/
5
6	/*
7	* Copyright (C) 2006-2023 Oracle and/or its affiliates.
8	*
9	* This file is part of VirtualBox base platform packages, as
10	* available from https://www.virtualbox.org.
11	*
12	* This program is free software; you can redistribute it and/or
13	* modify it under the terms of the GNU General Public License
14	* as published by the Free Software Foundation, in version 3 of the
15	* License.
16	*
17	* This program is distributed in the hope that it will be useful, but
18	* WITHOUT ANY WARRANTY; without even the implied warranty of
19	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20	* General Public License for more details.
21	*
22	* You should have received a copy of the GNU General Public License
23	* along with this program; if not, see <https://www.gnu.org/licenses>.
24	*
25	* SPDX-License-Identifier: GPL-3.0-only
26	*/
27
28
29	/*********************************************************************************************************************************
30	* Header Files *
31	*********************************************************************************************************************************/
32	#define LOG_GROUP LOG_GROUP_PGM
33	#define VBOX_WITHOUT_PAGING_BIT_FIELDS /* 64-bit bitfields are just asking for trouble. See @bugref{9841} and others. */
34	#include <VBox/vmm/dbgf.h>
35	#include <VBox/vmm/pgm.h>
36	#include <VBox/vmm/iem.h>
37	#include <VBox/vmm/iom.h>
38	#include <VBox/vmm/mm.h>
39	#include <VBox/vmm/em.h>
40	#include <VBox/vmm/nem.h>
41	#include <VBox/vmm/stam.h>
42	#include <VBox/vmm/dbgf.h>
43	#ifdef IN_RING0
44	# include <VBox/vmm/pdmdev.h>
45	#endif
46	#include "PGMInternal.h"
47	#include <VBox/vmm/vmcc.h>
48	#include "PGMInline.h"
49
50	#include <VBox/log.h>
51	#include <iprt/assert.h>
52	#if defined(RT_ARCH_AMD64) \|\| defined(RT_ARCH_X86)
53	# include <iprt/asm-amd64-x86.h>
54	#endif
55	#include <iprt/string.h>
56	#include <VBox/param.h>
57	#include <VBox/err.h>
58	#include <VBox/vmm/selm.h>
59
60
61	/*********************************************************************************************************************************
62	* Global Variables *
63	*********************************************************************************************************************************/
64	/** Dummy physical access handler type record. */
65	CTX_SUFF(PGMPHYSHANDLERTYPEINT) const g_pgmHandlerPhysicalDummyType =
66	{
67	/* .hType = */ UINT64_C(0x93b7557e1937aaff),
68	/* .enmKind = */ PGMPHYSHANDLERKIND_INVALID,
69	/* .uState = */ PGM_PAGE_HNDL_PHYS_STATE_ALL,
70	/* .fKeepPgmLock = */ true,
71	/* .fRing0DevInsIdx = */ false,
72	#ifdef IN_RING0
73	/* .fNotInHm = */ false,
74	/* .pfnHandler = */ pgmR0HandlerPhysicalHandlerToRing3,
75	/* .pfnPfHandler = */ pgmR0HandlerPhysicalPfHandlerToRing3,
76	#elif defined(IN_RING3)
77	/* .fRing0Enabled = */ false,
78	/* .fNotInHm = */ false,
79	/* .pfnHandler = */ pgmR3HandlerPhysicalHandlerInvalid,
80	#else
81	# error "unsupported context"
82	#endif
83	/* .pszDesc = */ "dummy"
84	};
85
86
87	/*********************************************************************************************************************************
88	* Internal Functions *
89	*********************************************************************************************************************************/
90	static int pgmHandlerPhysicalSetRamFlagsAndFlushShadowPTs(PVMCC pVM, PPGMPHYSHANDLER pCur, PPGMRAMRANGE pRam,
91	void *pvBitmap, uint32_t offBitmap);
92	static void pgmHandlerPhysicalDeregisterNotifyNEM(PVMCC pVM, PPGMPHYSHANDLER pCur);
93	static void pgmHandlerPhysicalResetRamFlags(PVMCC pVM, PPGMPHYSHANDLER pCur);
94
95
96	#ifndef IN_RING3
97
98	/**
99	* @callback_method_impl{FNPGMPHYSHANDLER,
100	* Dummy for forcing ring-3 handling of the access.}
101	*/
102	DECLCALLBACK(VBOXSTRICTRC)
103	pgmR0HandlerPhysicalHandlerToRing3(PVMCC pVM, PVMCPUCC pVCpu, RTGCPHYS GCPhys, void pvPhys, void pvBuf, size_t cbBuf,
104	PGMACCESSTYPE enmAccessType, PGMACCESSORIGIN enmOrigin, uint64_t uUser)
105	{
106	RT_NOREF(pVM, pVCpu, GCPhys, pvPhys, pvBuf, cbBuf, enmAccessType, enmOrigin, uUser);
107	return VINF_EM_RAW_EMULATE_INSTR;
108	}
109
110
111	/**
112	* @callback_method_impl{FNPGMRZPHYSPFHANDLER,
113	* Dummy for forcing ring-3 handling of the access.}
114	*/
115	DECLCALLBACK(VBOXSTRICTRC)
116	pgmR0HandlerPhysicalPfHandlerToRing3(PVMCC pVM, PVMCPUCC pVCpu, RTGCUINT uErrorCode, PCPUMCTX pCtx,
117	RTGCPTR pvFault, RTGCPHYS GCPhysFault, uint64_t uUser)
118	{
119	RT_NOREF(pVM, pVCpu, uErrorCode, pCtx, pvFault, GCPhysFault, uUser);
120	return VINF_EM_RAW_EMULATE_INSTR;
121	}
122
123	#endif /* !IN_RING3 */
124
125
126	/**
127	* Worker for pgmHandlerPhysicalExCreate.
128	*
129	* @returns A new physical handler on success or NULL on failure.
130	* @param pVM The cross context VM structure.
131	* @param pType The physical handler type.
132	* @param hType The physical handler type registeration handle.
133	* @param uUser User argument to the handlers (not pointer).
134	* @param pszDesc Description of this handler. If NULL, the type description
135	* will be used instead.
136	*/
137	DECL_FORCE_INLINE(PPGMPHYSHANDLER) pgmHandlerPhysicalExCreateWorker(PVMCC pVM, PCPGMPHYSHANDLERTYPEINT pType,
138	PGMPHYSHANDLERTYPE hType, uint64_t uUser,
139	R3PTRTYPE(const char *) pszDesc)
140	{
141	PGM_LOCK_ASSERT_OWNER(pVM);
142	PPGMPHYSHANDLER pNew = pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator.allocateNode();
143	if (pNew)
144	{
145	pNew->Key = NIL_RTGCPHYS;
146	pNew->KeyLast = NIL_RTGCPHYS;
147	pNew->cPages = 0;
148	pNew->cAliasedPages = 0;
149	pNew->cTmpOffPages = 0;
150	pNew->uUser = uUser;
151	pNew->hType = hType;
152	pNew->pszDesc = pszDesc != NIL_RTR3PTR ? pszDesc
153	#ifdef IN_RING3
154	: pType->pszDesc;
155	#else
156	: pVM->pgm.s.aPhysHandlerTypes[hType & PGMPHYSHANDLERTYPE_IDX_MASK].pszDesc;
157	NOREF(pType);
158	#endif
159	}
160	return pNew;
161	}
162
163
164	/**
165	* Creates a physical access handler, allocation part.
166	*
167	* @returns VBox status code.
168	* @retval VERR_OUT_OF_RESOURCES if no more handlers available.
169	*
170	* @param pVM The cross context VM structure.
171	* @param hType The handler type registration handle.
172	* @param uUser User argument to the handlers (not pointer).
173	* @param pszDesc Description of this handler. If NULL, the type
174	* description will be used instead.
175	* @param ppPhysHandler Where to return the access handler structure on
176	* success.
177	*/
178	int pgmHandlerPhysicalExCreate(PVMCC pVM, PGMPHYSHANDLERTYPE hType, uint64_t uUser,
179	R3PTRTYPE(const char ) pszDesc, PPGMPHYSHANDLER ppPhysHandler)
180	{
181	/*
182	* Validate input.
183	*/
184	PCPGMPHYSHANDLERTYPEINT const pType = pgmHandlerPhysicalTypeHandleToPtr(pVM, hType);
185	AssertReturn(pType, VERR_INVALID_HANDLE);
186	AssertReturn(pType->enmKind > PGMPHYSHANDLERKIND_INVALID && pType->enmKind < PGMPHYSHANDLERKIND_END, VERR_INVALID_HANDLE);
187	AssertPtr(ppPhysHandler);
188
189	Log(("pgmHandlerPhysicalExCreate: uUser=%#RX64 hType=%#x (%d, %s) pszDesc=%RHv:%s\n",
190	uUser, hType, pType->enmKind, pType->pszDesc, pszDesc, R3STRING(pszDesc)));
191
192	/*
193	* Allocate and initialize the new entry.
194	*/
195	int rc = PGM_LOCK(pVM);
196	AssertRCReturn(rc, rc);
197	*ppPhysHandler = pgmHandlerPhysicalExCreateWorker(pVM, pType, hType, uUser, pszDesc);
198	PGM_UNLOCK(pVM);
199	if (*ppPhysHandler)
200	return VINF_SUCCESS;
201	return VERR_OUT_OF_RESOURCES;
202	}
203
204
205	/**
206	* Duplicates a physical access handler.
207	*
208	* @returns VBox status code.
209	* @retval VINF_SUCCESS when successfully installed.
210	*
211	* @param pVM The cross context VM structure.
212	* @param pPhysHandlerSrc The source handler to duplicate
213	* @param ppPhysHandler Where to return the access handler structure on
214	* success.
215	*/
216	int pgmHandlerPhysicalExDup(PVMCC pVM, PPGMPHYSHANDLER pPhysHandlerSrc, PPGMPHYSHANDLER *ppPhysHandler)
217	{
218	return pgmHandlerPhysicalExCreate(pVM, pPhysHandlerSrc->hType, pPhysHandlerSrc->uUser,
219	pPhysHandlerSrc->pszDesc, ppPhysHandler);
220	}
221
222
223	/**
224	* Register a access handler for a physical range.
225	*
226	* @returns VBox status code.
227	* @retval VINF_SUCCESS when successfully installed.
228	* @retval VINF_PGM_GCPHYS_ALIASED could be returned.
229	*
230	* @param pVM The cross context VM structure.
231	* @param pPhysHandler The physical handler.
232	* @param GCPhys Start physical address.
233	* @param GCPhysLast Last physical address. (inclusive)
234	*/
235	int pgmHandlerPhysicalExRegister(PVMCC pVM, PPGMPHYSHANDLER pPhysHandler, RTGCPHYS GCPhys, RTGCPHYS GCPhysLast)
236	{
237	/*
238	* Validate input.
239	*/
240	AssertReturn(pPhysHandler, VERR_INVALID_POINTER);
241	PGMPHYSHANDLERTYPE const hType = pPhysHandler->hType;
242	PCPGMPHYSHANDLERTYPEINT const pType = pgmHandlerPhysicalTypeHandleToPtr(pVM, hType);
243	AssertReturn(pType, VERR_INVALID_HANDLE);
244	AssertReturn(pType->enmKind > PGMPHYSHANDLERKIND_INVALID && pType->enmKind < PGMPHYSHANDLERKIND_END, VERR_INVALID_HANDLE);
245
246	AssertPtr(pPhysHandler);
247
248	Log(("pgmHandlerPhysicalExRegister: GCPhys=%RGp GCPhysLast=%RGp hType=%#x (%d, %s) pszDesc=%RHv:%s\n", GCPhys, GCPhysLast,
249	hType, pType->enmKind, pType->pszDesc, pPhysHandler->pszDesc, R3STRING(pPhysHandler->pszDesc)));
250	AssertReturn(pPhysHandler->Key == NIL_RTGCPHYS, VERR_WRONG_ORDER);
251
252	AssertMsgReturn(GCPhys < GCPhysLast, ("GCPhys >= GCPhysLast (%#x >= %#x)\n", GCPhys, GCPhysLast), VERR_INVALID_PARAMETER);
253	Assert(GCPhysLast - GCPhys < _4G); /* ASSUMPTION in PGMAllPhys.cpp */
254
255	switch (pType->enmKind)
256	{
257	case PGMPHYSHANDLERKIND_WRITE:
258	if (!pType->fNotInHm)
259	break;
260	RT_FALL_THRU(); /* Simplification: fNotInHm can only be used with full pages */
261	case PGMPHYSHANDLERKIND_MMIO:
262	case PGMPHYSHANDLERKIND_ALL:
263	/* Simplification for PGMPhysRead, PGMR0Trap0eHandlerNPMisconfig and others: Full pages. */
264	AssertMsgReturn(!(GCPhys & GUEST_PAGE_OFFSET_MASK), ("%RGp\n", GCPhys), VERR_INVALID_PARAMETER);
265	AssertMsgReturn((GCPhysLast & GUEST_PAGE_OFFSET_MASK) == GUEST_PAGE_OFFSET_MASK, ("%RGp\n", GCPhysLast), VERR_INVALID_PARAMETER);
266	break;
267	default:
268	AssertMsgFailed(("Invalid input enmKind=%d!\n", pType->enmKind));
269	return VERR_INVALID_PARAMETER;
270	}
271
272	/*
273	* We require the range to be within registered ram.
274	* There is no apparent need to support ranges which cover more than one ram range.
275	*/
276	PPGMRAMRANGE pRam = pgmPhysGetRange(pVM, GCPhys);
277	if ( !pRam
278	\|\| GCPhysLast > pRam->GCPhysLast)
279	{
280	#ifdef IN_RING3
281	DBGFR3Info(pVM->pUVM, "phys", NULL, NULL);
282	#endif
283	AssertMsgFailed(("No RAM range for %RGp-%RGp\n", GCPhys, GCPhysLast));
284	return VERR_PGM_HANDLER_PHYSICAL_NO_RAM_RANGE;
285	}
286	Assert(GCPhys >= pRam->GCPhys && GCPhys < pRam->GCPhysLast);
287	Assert(GCPhysLast <= pRam->GCPhysLast && GCPhysLast >= pRam->GCPhys);
288
289	/*
290	* Try insert into list.
291	*/
292	pPhysHandler->Key = GCPhys;
293	pPhysHandler->KeyLast = GCPhysLast;
294	pPhysHandler->cPages = (GCPhysLast - (GCPhys & X86_PTE_PAE_PG_MASK) + GUEST_PAGE_SIZE) >> GUEST_PAGE_SHIFT;
295
296	int rc = PGM_LOCK(pVM);
297	if (RT_SUCCESS(rc))
298	{
299	rc = pVM->VMCC_CTX(pgm).s.pPhysHandlerTree->insert(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator, pPhysHandler);
300	if (RT_SUCCESS(rc))
301	{
302	rc = pgmHandlerPhysicalSetRamFlagsAndFlushShadowPTs(pVM, pPhysHandler, pRam, NULL /pvBitmap/, 0 /offBitmap/);
303	if (rc == VINF_PGM_SYNC_CR3)
304	rc = VINF_PGM_GCPHYS_ALIASED;
305
306	#if defined(IN_RING3) \|\| defined(IN_RING0)
307	NEMHCNotifyHandlerPhysicalRegister(pVM, pType->enmKind, GCPhys, GCPhysLast - GCPhys + 1);
308	#endif
309	PGM_UNLOCK(pVM);
310
311	if (rc != VINF_SUCCESS)
312	Log(("PGMHandlerPhysicalRegisterEx: returns %Rrc (%RGp-%RGp)\n", rc, GCPhys, GCPhysLast));
313	return rc;
314	}
315	PGM_UNLOCK(pVM);
316	}
317
318	pPhysHandler->Key = NIL_RTGCPHYS;
319	pPhysHandler->KeyLast = NIL_RTGCPHYS;
320
321	AssertMsgReturn(rc == VERR_ALREADY_EXISTS, ("%Rrc GCPhys=%RGp GCPhysLast=%RGp\n", rc, GCPhys, GCPhysLast), rc);
322
323	#if defined(IN_RING3) && defined(VBOX_STRICT)
324	DBGFR3Info(pVM->pUVM, "handlers", "phys nostats", NULL);
325	#endif
326	AssertMsgFailed(("Conflict! GCPhys=%RGp GCPhysLast=%RGp pszDesc=%s/%s\n",
327	GCPhys, GCPhysLast, R3STRING(pPhysHandler->pszDesc), R3STRING(pType->pszDesc)));
328	return VERR_PGM_HANDLER_PHYSICAL_CONFLICT;
329	}
330
331
332	/**
333	* Worker for pgmHandlerPhysicalRegisterVmxApicAccessPage.
334	*
335	* @returns VBox status code.
336	* @retval VINF_SUCCESS when successfully installed.
337	* @retval VINF_PGM_GCPHYS_ALIASED could be returned.
338	*
339	* @param pVM The cross context VM structure.
340	* @param pPhysHandler The physical handler.
341	* @param GCPhys The address of the virtual VMX APIC-access page. Must be
342	* page aligned.
343	*/
344	static int pgmHandlerPhysicalRegisterVmxApicAccessPage(PVMCC pVM, PPGMPHYSHANDLER pPhysHandler, RTGCPHYS GCPhys)
345	{
346	PGM_LOCK_ASSERT_OWNER(pVM);
347	LogFunc(("GCPhys=%RGp\n", GCPhys));
348
349	/*
350	* We require the range to be within registered ram.
351	* There is no apparent need to support ranges which cover more than one ram range.
352	*/
353	PPGMRAMRANGE pRam = pgmPhysGetRange(pVM, GCPhys);
354	RTGCPHYS const GCPhysLast = GCPhys \| X86_PAGE_4K_OFFSET_MASK;
355	if ( !pRam
356	\|\| GCPhysLast > pRam->GCPhysLast)
357	{
358	#ifdef IN_RING3
359	DBGFR3Info(pVM->pUVM, "phys", NULL, NULL);
360	#endif
361	AssertMsgFailed(("No RAM range for %RGp-%RGp\n", GCPhys, GCPhysLast));
362	return VERR_PGM_HANDLER_PHYSICAL_NO_RAM_RANGE;
363	}
364	Assert(GCPhys >= pRam->GCPhys && GCPhys < pRam->GCPhysLast);
365	Assert(GCPhysLast <= pRam->GCPhysLast && GCPhysLast >= pRam->GCPhys);
366
367	/*
368	* Try insert into list.
369	*/
370	pPhysHandler->Key = GCPhys;
371	pPhysHandler->KeyLast = GCPhysLast;
372	pPhysHandler->cPages = (GCPhysLast - (GCPhys & X86_PTE_PAE_PG_MASK) + GUEST_PAGE_SIZE) >> GUEST_PAGE_SHIFT;
373
374	int rc = pVM->VMCC_CTX(pgm).s.pPhysHandlerTree->insert(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator, pPhysHandler);
375	if (RT_SUCCESS(rc))
376	{
377	rc = pgmHandlerPhysicalSetRamFlagsAndFlushShadowPTs(pVM, pPhysHandler, pRam, NULL /pvBitmap/, 0 /offBitmap/);
378	if (rc == VINF_PGM_SYNC_CR3)
379	rc = VINF_PGM_GCPHYS_ALIASED;
380
381	#if defined(IN_RING3) \|\| defined(IN_RING0)
382	NEMHCNotifyHandlerPhysicalRegister(pVM, PGMPHYSHANDLERKIND_ALL, GCPhys, GCPhysLast - GCPhys + 1);
383	#endif
384	return rc;
385	}
386
387	pPhysHandler->Key = NIL_RTGCPHYS;
388	pPhysHandler->KeyLast = NIL_RTGCPHYS;
389
390	AssertMsgReturn(rc == VERR_ALREADY_EXISTS, ("%Rrc GCPhys=%RGp GCPhysLast=%RGp\n", rc, GCPhys, GCPhysLast), rc);
391	#if defined(IN_RING3) && defined(VBOX_STRICT)
392	DBGFR3Info(pVM->pUVM, "handlers", "phys nostats", NULL);
393	#endif
394	AssertMsgFailed(("Conflict! GCPhys=%RGp GCPhysLast=%RGp\n", GCPhys, GCPhysLast));
395	return VERR_PGM_HANDLER_PHYSICAL_CONFLICT;
396	}
397
398
399	/**
400	* Register a access handler for a physical range.
401	*
402	* @returns VBox status code.
403	* @retval VINF_SUCCESS when successfully installed.
404	* @retval VINF_PGM_GCPHYS_ALIASED when the shadow PTs could be updated because
405	* the guest page aliased or/and mapped by multiple PTs. A CR3 sync has been
406	* flagged together with a pool clearing.
407	* @retval VERR_PGM_HANDLER_PHYSICAL_CONFLICT if the range conflicts with an existing
408	* one. A debug assertion is raised.
409	*
410	* @param pVM The cross context VM structure.
411	* @param GCPhys Start physical address.
412	* @param GCPhysLast Last physical address. (inclusive)
413	* @param hType The handler type registration handle.
414	* @param uUser User argument to the handler.
415	* @param pszDesc Description of this handler. If NULL, the type
416	* description will be used instead.
417	*/
418	VMMDECL(int) PGMHandlerPhysicalRegister(PVMCC pVM, RTGCPHYS GCPhys, RTGCPHYS GCPhysLast, PGMPHYSHANDLERTYPE hType,
419	uint64_t uUser, R3PTRTYPE(const char *) pszDesc)
420	{
421	#ifdef LOG_ENABLED
422	PCPGMPHYSHANDLERTYPEINT pType = pgmHandlerPhysicalTypeHandleToPtr(pVM, hType);
423	Log(("PGMHandlerPhysicalRegister: GCPhys=%RGp GCPhysLast=%RGp uUser=%#RX64 hType=%#x (%d, %s) pszDesc=%RHv:%s\n",
424	GCPhys, GCPhysLast, uUser, hType, pType->enmKind, R3STRING(pType->pszDesc), pszDesc, R3STRING(pszDesc)));
425	#endif
426
427	PPGMPHYSHANDLER pNew;
428	int rc = pgmHandlerPhysicalExCreate(pVM, hType, uUser, pszDesc, &pNew);
429	if (RT_SUCCESS(rc))
430	{
431	rc = pgmHandlerPhysicalExRegister(pVM, pNew, GCPhys, GCPhysLast);
432	if (RT_SUCCESS(rc))
433	return rc;
434	pgmHandlerPhysicalExDestroy(pVM, pNew);
435	}
436	return rc;
437	}
438
439
440	/**
441	* Register an access handler for a virtual VMX APIC-access page.
442	*
443	* This holds the PGM lock across the whole operation to resolve races between
444	* VCPUs registering the same page simultaneously. It's also a slightly slimmer
445	* version of the regular registeration function as it's specific to the VMX
446	* APIC-access page.
447	*
448	* @returns VBox status code.
449	* @retval VINF_SUCCESS when successfully installed.
450	* @retval VINF_PGM_GCPHYS_ALIASED when the shadow PTs could be updated because
451	* the guest page aliased or/and mapped by multiple PTs. A CR3 sync has been
452	* flagged together with a pool clearing.
453	* @retval VERR_PGM_HANDLER_PHYSICAL_CONFLICT if the range conflicts with an existing
454	* one. A debug assertion is raised.
455	*
456	* @param pVM The cross context VM structure.
457	* @param GCPhys The address of the VMX virtual-APIC access page. Must be
458	* page aligned.
459	* @param hType The handler type registration handle.
460	*/
461	VMMDECL(int) PGMHandlerPhysicalRegisterVmxApicAccessPage(PVMCC pVM, RTGCPHYS GCPhys, PGMPHYSHANDLERTYPE hType)
462	{
463	PCPGMPHYSHANDLERTYPEINT const pType = pgmHandlerPhysicalTypeHandleToPtr(pVM, hType);
464	AssertReturn(pType, VERR_INVALID_HANDLE);
465	AssertMsg(!(GCPhys & GUEST_PAGE_OFFSET_MASK), ("%RGp\n", GCPhys));
466
467	/*
468	* Find if the VMX APIC access page has already been registered at this address.
469	*/
470	int rc = PGM_LOCK(pVM);
471	AssertRCReturn(rc, rc);
472
473	PPGMPHYSHANDLER pHandler;
474	rc = pgmHandlerPhysicalLookup(pVM, GCPhys, &pHandler);
475	if (RT_SUCCESS(rc))
476	{
477	PCPGMPHYSHANDLERTYPEINT const pHandlerType = PGMPHYSHANDLER_GET_TYPE_NO_NULL(pVM, pHandler);
478	Assert(GCPhys >= pHandler->Key && GCPhys <= pHandler->KeyLast);
479	Assert( pHandlerType->enmKind == PGMPHYSHANDLERKIND_WRITE
480	\|\| pHandlerType->enmKind == PGMPHYSHANDLERKIND_ALL
481	\|\| pHandlerType->enmKind == PGMPHYSHANDLERKIND_MMIO);
482
483	/* Check it's the virtual VMX APIC-access page. */
484	if (pHandlerType->fNotInHm)
485	{
486	Assert(pHandlerType->enmKind == PGMPHYSHANDLERKIND_ALL);
487	rc = VINF_SUCCESS;
488	}
489	else
490	{
491	rc = VERR_PGM_HANDLER_PHYSICAL_CONFLICT;
492	AssertMsgFailed(("Conflict! GCPhys=%RGp enmKind=%#x fNotInHm=%RTbool\n", GCPhys, pHandlerType->enmKind,
493	pHandlerType->fNotInHm));
494	}
495
496	PGM_UNLOCK(pVM);
497	return rc;
498	}
499
500	/*
501	* Validate the page handler parameters before registering the virtual VMX APIC-access page.
502	*/
503	AssertReturn(pType->enmKind == PGMPHYSHANDLERKIND_ALL, VERR_INVALID_HANDLE);
504	AssertReturn(pType->fNotInHm, VERR_PGM_HANDLER_IPE_1);
505
506	/*
507	* Create and register a physical handler for the virtual VMX APIC-access page.
508	*/
509	pHandler = pgmHandlerPhysicalExCreateWorker(pVM, pType, hType, 0 /uUser/, NULL /pszDesc/);
510	if (pHandler)
511	{
512	rc = pgmHandlerPhysicalRegisterVmxApicAccessPage(pVM, pHandler, GCPhys);
513	if (RT_SUCCESS(rc))
514	{ /* likely */ }
515	else
516	pgmHandlerPhysicalExDestroy(pVM, pHandler);
517	}
518	else
519	rc = VERR_OUT_OF_RESOURCES;
520
521	PGM_UNLOCK(pVM);
522	return rc;
523	}
524
525
526	/**
527	* Sets ram range flags and attempts updating shadow PTs.
528	*
529	* @returns VBox status code.
530	* @retval VINF_SUCCESS when shadow PTs was successfully updated.
531	* @retval VINF_PGM_SYNC_CR3 when the shadow PTs could be updated because
532	* the guest page aliased or/and mapped by multiple PTs. FFs set.
533	* @param pVM The cross context VM structure.
534	* @param pCur The physical handler.
535	* @param pRam The RAM range.
536	* @param pvBitmap Dirty bitmap. Optional.
537	* @param offBitmap Dirty bitmap offset.
538	*/
539	static int pgmHandlerPhysicalSetRamFlagsAndFlushShadowPTs(PVMCC pVM, PPGMPHYSHANDLER pCur, PPGMRAMRANGE pRam,
540	void *pvBitmap, uint32_t offBitmap)
541	{
542	/*
543	* Iterate the guest ram pages updating the flags and flushing PT entries
544	* mapping the page.
545	*/
546	bool fFlushTLBs = false;
547	int rc = VINF_SUCCESS;
548	PCPGMPHYSHANDLERTYPEINT pCurType = PGMPHYSHANDLER_GET_TYPE_NO_NULL(pVM, pCur);
549	const unsigned uState = pCurType->uState;
550	uint32_t cPages = pCur->cPages;
551	uint32_t i = (pCur->Key - pRam->GCPhys) >> GUEST_PAGE_SHIFT;
552	for (;;)
553	{
554	PPGMPAGE pPage = &pRam->aPages[i];
555	AssertMsg(pCurType->enmKind != PGMPHYSHANDLERKIND_MMIO \|\| PGM_PAGE_IS_MMIO(pPage),
556	("%RGp %R[pgmpage]\n", pRam->GCPhys + (i << GUEST_PAGE_SHIFT), pPage));
557
558	/* Only do upgrades. */
559	if (PGM_PAGE_GET_HNDL_PHYS_STATE(pPage) < uState)
560	{
561	PGM_PAGE_SET_HNDL_PHYS_STATE(pPage, uState, pCurType->fNotInHm);
562
563	const RTGCPHYS GCPhysPage = pRam->GCPhys + (i << GUEST_PAGE_SHIFT);
564	int rc2 = pgmPoolTrackUpdateGCPhys(pVM, GCPhysPage, pPage,
565	false /* allow updates of PTEs (instead of flushing) */, &fFlushTLBs);
566	if (rc2 != VINF_SUCCESS && rc == VINF_SUCCESS)
567	rc = rc2;
568
569	#ifdef VBOX_WITH_NATIVE_NEM
570	/* Tell NEM about the protection update. */
571	if (VM_IS_NEM_ENABLED(pVM))
572	{
573	uint8_t u2State = PGM_PAGE_GET_NEM_STATE(pPage);
574	PGMPAGETYPE enmType = (PGMPAGETYPE)PGM_PAGE_GET_TYPE(pPage);
575	NEMHCNotifyPhysPageProtChanged(pVM, GCPhysPage, PGM_PAGE_GET_HCPHYS(pPage),
576	PGM_RAMRANGE_CALC_PAGE_R3PTR(pRam, GCPhysPage),
577	pgmPhysPageCalcNemProtection(pPage, enmType), enmType, &u2State);
578	PGM_PAGE_SET_NEM_STATE(pPage, u2State);
579	}
580	#endif
581	if (pvBitmap)
582	ASMBitSet(pvBitmap, offBitmap);
583	}
584
585	/* next */
586	if (--cPages == 0)
587	break;
588	i++;
589	offBitmap++;
590	}
591
592	if (fFlushTLBs)
593	{
594	PGM_INVL_ALL_VCPU_TLBS(pVM);
595	Log(("pgmHandlerPhysicalSetRamFlagsAndFlushShadowPTs: flushing guest TLBs; rc=%d\n", rc));
596	}
597	else
598	Log(("pgmHandlerPhysicalSetRamFlagsAndFlushShadowPTs: doesn't flush guest TLBs. rc=%Rrc; sync flags=%x VMCPU_FF_PGM_SYNC_CR3=%d\n", rc, VMMGetCpu(pVM)->pgm.s.fSyncFlags, VMCPU_FF_IS_SET(VMMGetCpu(pVM), VMCPU_FF_PGM_SYNC_CR3)));
599
600	return rc;
601	}
602
603
604	/**
605	* Deregister a physical page access handler.
606	*
607	* @returns VBox status code.
608	* @param pVM The cross context VM structure.
609	* @param pPhysHandler The handler to deregister (but not free).
610	*/
611	int pgmHandlerPhysicalExDeregister(PVMCC pVM, PPGMPHYSHANDLER pPhysHandler)
612	{
613	LogFlow(("pgmHandlerPhysicalExDeregister: Removing Range %RGp-%RGp %s\n",
614	pPhysHandler->Key, pPhysHandler->KeyLast, R3STRING(pPhysHandler->pszDesc)));
615
616	int rc = PGM_LOCK(pVM);
617	AssertRCReturn(rc, rc);
618
619	RTGCPHYS const GCPhys = pPhysHandler->Key;
620	AssertReturnStmt(GCPhys != NIL_RTGCPHYS, PGM_UNLOCK(pVM), VERR_PGM_HANDLER_NOT_FOUND);
621
622	/*
623	* Remove the handler from the tree.
624	*/
625
626	PPGMPHYSHANDLER pRemoved;
627	rc = pVM->VMCC_CTX(pgm).s.pPhysHandlerTree->remove(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator, GCPhys, &pRemoved);
628	if (RT_SUCCESS(rc))
629	{
630	if (pRemoved == pPhysHandler)
631	{
632	/*
633	* Clear the page bits, notify the REM about this change and clear
634	* the cache.
635	*/
636	pgmHandlerPhysicalResetRamFlags(pVM, pPhysHandler);
637	if (VM_IS_NEM_ENABLED(pVM))
638	pgmHandlerPhysicalDeregisterNotifyNEM(pVM, pPhysHandler);
639	pVM->pgm.s.idxLastPhysHandler = 0;
640
641	pPhysHandler->Key = NIL_RTGCPHYS;
642	pPhysHandler->KeyLast = NIL_RTGCPHYS;
643
644	PGM_UNLOCK(pVM);
645
646	return VINF_SUCCESS;
647	}
648
649	/*
650	* Both of the failure conditions here are considered internal processing
651	* errors because they can only be caused by race conditions or corruption.
652	* If we ever need to handle concurrent deregistration, we have to move
653	* the NIL_RTGCPHYS check inside the PGM lock.
654	*/
655	pVM->VMCC_CTX(pgm).s.pPhysHandlerTree->insert(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator, pRemoved);
656	}
657
658	PGM_UNLOCK(pVM);
659
660	if (RT_FAILURE(rc))
661	AssertMsgFailed(("Didn't find range starting at %RGp in the tree! %Rrc=rc\n", GCPhys, rc));
662	else
663	AssertMsgFailed(("Found different handle at %RGp in the tree: got %p insteaded of %p\n",
664	GCPhys, pRemoved, pPhysHandler));
665	return VERR_PGM_HANDLER_IPE_1;
666	}
667
668
669	/**
670	* Destroys (frees) a physical handler.
671	*
672	* The caller must deregister it before destroying it!
673	*
674	* @returns VBox status code.
675	* @param pVM The cross context VM structure.
676	* @param pHandler The handler to free. NULL if ignored.
677	*/
678	int pgmHandlerPhysicalExDestroy(PVMCC pVM, PPGMPHYSHANDLER pHandler)
679	{
680	if (pHandler)
681	{
682	AssertPtr(pHandler);
683	AssertReturn(pHandler->Key == NIL_RTGCPHYS, VERR_WRONG_ORDER);
684
685	int rc = PGM_LOCK(pVM);
686	if (RT_SUCCESS(rc))
687	{
688	rc = pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator.freeNode(pHandler);
689	PGM_UNLOCK(pVM);
690	}
691	return rc;
692	}
693	return VINF_SUCCESS;
694	}
695
696
697	/**
698	* Deregister a physical page access handler.
699	*
700	* @returns VBox status code.
701	* @param pVM The cross context VM structure.
702	* @param GCPhys Start physical address.
703	*/
704	VMMDECL(int) PGMHandlerPhysicalDeregister(PVMCC pVM, RTGCPHYS GCPhys)
705	{
706	AssertReturn(pVM->VMCC_CTX(pgm).s.pPhysHandlerTree, VERR_PGM_HANDLER_IPE_1);
707
708	/*
709	* Find the handler.
710	*/
711	int rc = PGM_LOCK(pVM);
712	AssertRCReturn(rc, rc);
713
714	PPGMPHYSHANDLER pRemoved;
715	rc = pVM->VMCC_CTX(pgm).s.pPhysHandlerTree->remove(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator, GCPhys, &pRemoved);
716	if (RT_SUCCESS(rc))
717	{
718	Assert(pRemoved->Key == GCPhys);
719	LogFlow(("PGMHandlerPhysicalDeregister: Removing Range %RGp-%RGp %s\n",
720	pRemoved->Key, pRemoved->KeyLast, R3STRING(pRemoved->pszDesc)));
721
722	/*
723	* Clear the page bits, notify the REM about this change and clear
724	* the cache.
725	*/
726	pgmHandlerPhysicalResetRamFlags(pVM, pRemoved);
727	if (VM_IS_NEM_ENABLED(pVM))
728	pgmHandlerPhysicalDeregisterNotifyNEM(pVM, pRemoved);
729	pVM->pgm.s.idxLastPhysHandler = 0;
730
731	pRemoved->Key = NIL_RTGCPHYS;
732	rc = pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator.freeNode(pRemoved);
733
734	PGM_UNLOCK(pVM);
735	return rc;
736	}
737
738	PGM_UNLOCK(pVM);
739
740	if (rc == VERR_NOT_FOUND)
741	{
742	AssertMsgFailed(("Didn't find range starting at %RGp\n", GCPhys));
743	rc = VERR_PGM_HANDLER_NOT_FOUND;
744	}
745	return rc;
746	}
747
748
749	/**
750	* Shared code with modify.
751	*/
752	static void pgmHandlerPhysicalDeregisterNotifyNEM(PVMCC pVM, PPGMPHYSHANDLER pCur)
753	{
754	#ifdef VBOX_WITH_NATIVE_NEM
755	PCPGMPHYSHANDLERTYPEINT pCurType = PGMPHYSHANDLER_GET_TYPE_NO_NULL(pVM, pCur);
756	RTGCPHYS GCPhysStart = pCur->Key;
757	RTGCPHYS GCPhysLast = pCur->KeyLast;
758
759	/*
760	* Page align the range.
761	*
762	* Since we've reset (recalculated) the physical handler state of all pages
763	* we can make use of the page states to figure out whether a page should be
764	* included in the REM notification or not.
765	*/
766	if ( (pCur->Key & GUEST_PAGE_OFFSET_MASK)
767	\|\| ((pCur->KeyLast + 1) & GUEST_PAGE_OFFSET_MASK))
768	{
769	Assert(pCurType->enmKind != PGMPHYSHANDLERKIND_MMIO);
770
771	if (GCPhysStart & GUEST_PAGE_OFFSET_MASK)
772	{
773	PPGMPAGE pPage = pgmPhysGetPage(pVM, GCPhysStart);
774	if ( pPage
775	&& PGM_PAGE_GET_HNDL_PHYS_STATE(pPage) != PGM_PAGE_HNDL_PHYS_STATE_NONE)
776	{
777	RTGCPHYS GCPhys = (GCPhysStart + (GUEST_PAGE_SIZE - 1)) & X86_PTE_PAE_PG_MASK;
778	if ( GCPhys > GCPhysLast
779	\|\| GCPhys < GCPhysStart)
780	return;
781	GCPhysStart = GCPhys;
782	}
783	else
784	GCPhysStart &= X86_PTE_PAE_PG_MASK;
785	Assert(!pPage \|\| PGM_PAGE_GET_TYPE(pPage) != PGMPAGETYPE_MMIO); /* these are page aligned atm! */
786	}
787
788	if (GCPhysLast & GUEST_PAGE_OFFSET_MASK)
789	{
790	PPGMPAGE pPage = pgmPhysGetPage(pVM, GCPhysLast);
791	if ( pPage
792	&& PGM_PAGE_GET_HNDL_PHYS_STATE(pPage) != PGM_PAGE_HNDL_PHYS_STATE_NONE)
793	{
794	RTGCPHYS GCPhys = (GCPhysLast & X86_PTE_PAE_PG_MASK) - 1;
795	if ( GCPhys < GCPhysStart
796	\|\| GCPhys > GCPhysLast)
797	return;
798	GCPhysLast = GCPhys;
799	}
800	else
801	GCPhysLast \|= GUEST_PAGE_OFFSET_MASK;
802	Assert(!pPage \|\| PGM_PAGE_GET_TYPE(pPage) != PGMPAGETYPE_MMIO); /* these are page aligned atm! */
803	}
804	}
805
806	/*
807	* Tell NEM.
808	*/
809	PPGMRAMRANGE const pRam = pgmPhysGetRange(pVM, GCPhysStart);
810	RTGCPHYS const cb = GCPhysLast - GCPhysStart + 1;
811	uint8_t u2State = UINT8_MAX;
812	NEMHCNotifyHandlerPhysicalDeregister(pVM, pCurType->enmKind, GCPhysStart, cb,
813	pRam ? PGM_RAMRANGE_CALC_PAGE_R3PTR(pRam, GCPhysStart) : NULL, &u2State);
814	if (u2State != UINT8_MAX && pRam)
815	pgmPhysSetNemStateForPages(&pRam->aPages[(GCPhysStart - pRam->GCPhys) >> GUEST_PAGE_SHIFT],
816	cb >> GUEST_PAGE_SHIFT, u2State);
817	#else
818	RT_NOREF(pVM, pCur);
819	#endif
820	}
821
822
823	/**
824	* pgmHandlerPhysicalResetRamFlags helper that checks for other handlers on
825	* edge pages.
826	*/
827	DECLINLINE(void) pgmHandlerPhysicalRecalcPageState(PVMCC pVM, RTGCPHYS GCPhys, bool fAbove, PPGMRAMRANGE *ppRamHint)
828	{
829	/*
830	* Look for other handlers.
831	*/
832	unsigned uState = PGM_PAGE_HNDL_PHYS_STATE_NONE;
833	for (;;)
834	{
835	PPGMPHYSHANDLER pCur;
836	int rc;
837	if (fAbove)
838	rc = pVM->VMCC_CTX(pgm).s.pPhysHandlerTree->lookupMatchingOrAbove(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator,
839	GCPhys, &pCur);
840	else
841	rc = pVM->VMCC_CTX(pgm).s.pPhysHandlerTree->lookupMatchingOrBelow(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator,
842	GCPhys, &pCur);
843	if (rc == VERR_NOT_FOUND)
844	break;
845	AssertRCBreak(rc);
846	if (((fAbove ? pCur->Key : pCur->KeyLast) >> GUEST_PAGE_SHIFT) != (GCPhys >> GUEST_PAGE_SHIFT))
847	break;
848	PCPGMPHYSHANDLERTYPEINT pCurType = PGMPHYSHANDLER_GET_TYPE_NO_NULL(pVM, pCur);
849	uState = RT_MAX(uState, pCurType->uState);
850
851	/* next? */
852	RTGCPHYS GCPhysNext = fAbove
853	? pCur->KeyLast + 1
854	: pCur->Key - 1;
855	if ((GCPhysNext >> GUEST_PAGE_SHIFT) != (GCPhys >> GUEST_PAGE_SHIFT))
856	break;
857	GCPhys = GCPhysNext;
858	}
859
860	/*
861	* Update if we found something that is a higher priority state than the current.
862	* Note! The PGMPHYSHANDLER_F_NOT_IN_HM can be ignored here as it requires whole pages.
863	*/
864	if (uState != PGM_PAGE_HNDL_PHYS_STATE_NONE)
865	{
866	PPGMPAGE pPage;
867	int rc = pgmPhysGetPageWithHintEx(pVM, GCPhys, &pPage, ppRamHint);
868	if ( RT_SUCCESS(rc)
869	&& PGM_PAGE_GET_HNDL_PHYS_STATE(pPage) < uState)
870	{
871	/* This should normally not be necessary. */
872	PGM_PAGE_SET_HNDL_PHYS_STATE_ONLY(pPage, uState);
873	bool fFlushTLBs;
874	rc = pgmPoolTrackUpdateGCPhys(pVM, GCPhys, pPage, false /fFlushPTEs/, &fFlushTLBs);
875	if (RT_SUCCESS(rc) && fFlushTLBs)
876	PGM_INVL_ALL_VCPU_TLBS(pVM);
877	else
878	AssertRC(rc);
879
880	#ifdef VBOX_WITH_NATIVE_NEM
881	/* Tell NEM about the protection update. */
882	if (VM_IS_NEM_ENABLED(pVM))
883	{
884	uint8_t u2State = PGM_PAGE_GET_NEM_STATE(pPage);
885	PGMPAGETYPE enmType = (PGMPAGETYPE)PGM_PAGE_GET_TYPE(pPage);
886	NEMHCNotifyPhysPageProtChanged(pVM, GCPhys, PGM_PAGE_GET_HCPHYS(pPage),
887	PGM_RAMRANGE_CALC_PAGE_R3PTR(*ppRamHint, GCPhys),
888	pgmPhysPageCalcNemProtection(pPage, enmType), enmType, &u2State);
889	PGM_PAGE_SET_NEM_STATE(pPage, u2State);
890	}
891	#endif
892	}
893	else
894	AssertRC(rc);
895	}
896	}
897
898
899	/**
900	* Resets an aliased page.
901	*
902	* @param pVM The cross context VM structure.
903	* @param pPage The page.
904	* @param GCPhysPage The page address in case it comes in handy.
905	* @param pRam The RAM range the page is associated with (for NEM
906	* notifications).
907	* @param fDoAccounting Whether to perform accounting. (Only set during
908	* reset where pgmR3PhysRamReset doesn't have the
909	* handler structure handy.)
910	* @param fFlushIemTlbs Whether to perform IEM TLB flushing or not. This
911	* can be cleared only if the caller does the flushing
912	* after calling this function.
913	*/
914	void pgmHandlerPhysicalResetAliasedPage(PVMCC pVM, PPGMPAGE pPage, RTGCPHYS GCPhysPage, PPGMRAMRANGE pRam,
915	bool fDoAccounting, bool fFlushIemTlbs)
916	{
917	Assert( PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_MMIO2_ALIAS_MMIO
918	\|\| PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_SPECIAL_ALIAS_MMIO);
919	Assert(PGM_PAGE_GET_HNDL_PHYS_STATE(pPage) == PGM_PAGE_HNDL_PHYS_STATE_DISABLED);
920	#ifdef VBOX_WITH_NATIVE_NEM
921	RTHCPHYS const HCPhysPrev = PGM_PAGE_GET_HCPHYS(pPage);
922	#endif
923
924	/*
925	* Flush any shadow page table references first.
926	*/
927	bool fFlushTLBs = false;
928	int rc = pgmPoolTrackUpdateGCPhys(pVM, GCPhysPage, pPage, true /fFlushPTEs/, &fFlushTLBs);
929	AssertLogRelRCReturnVoid(rc);
930	#if defined(VBOX_VMM_TARGET_ARMV8)
931	AssertReleaseFailed();
932	#else
933	HMFlushTlbOnAllVCpus(pVM);
934	#endif
935
936	/*
937	* Make it an MMIO/Zero page.
938	*/
939	PGM_PAGE_SET_HCPHYS(pVM, pPage, pVM->pgm.s.HCPhysZeroPg);
940	PGM_PAGE_SET_TYPE(pVM, pPage, PGMPAGETYPE_MMIO);
941	PGM_PAGE_SET_STATE(pVM, pPage, PGM_PAGE_STATE_ZERO);
942	PGM_PAGE_SET_PAGEID(pVM, pPage, NIL_GMM_PAGEID);
943	PGM_PAGE_SET_HNDL_PHYS_STATE_ONLY(pPage, PGM_PAGE_HNDL_PHYS_STATE_ALL);
944
945	/*
946	* Flush its TLB entry.
947	*/
948	pgmPhysInvalidatePageMapTLBEntry(pVM, GCPhysPage);
949	if (fFlushIemTlbs)
950	IEMTlbInvalidateAllPhysicalAllCpus(pVM, NIL_VMCPUID);
951
952	/*
953	* Do accounting for pgmR3PhysRamReset.
954	*/
955	if (fDoAccounting)
956	{
957	PPGMPHYSHANDLER pHandler;
958	rc = pgmHandlerPhysicalLookup(pVM, GCPhysPage, &pHandler);
959	if (RT_SUCCESS(rc))
960	{
961	Assert(pHandler->cAliasedPages > 0);
962	pHandler->cAliasedPages--;
963	}
964	else
965	AssertMsgFailed(("rc=%Rrc GCPhysPage=%RGp\n", rc, GCPhysPage));
966	}
967
968	#ifdef VBOX_WITH_NATIVE_NEM
969	/*
970	* Tell NEM about the protection change.
971	*/
972	if (VM_IS_NEM_ENABLED(pVM))
973	{
974	uint8_t u2State = PGM_PAGE_GET_NEM_STATE(pPage);
975	NEMHCNotifyPhysPageChanged(pVM, GCPhysPage, HCPhysPrev, pVM->pgm.s.HCPhysZeroPg,
976	PGM_RAMRANGE_CALC_PAGE_R3PTR(pRam, GCPhysPage),
977	NEM_PAGE_PROT_NONE, PGMPAGETYPE_MMIO, &u2State);
978	PGM_PAGE_SET_NEM_STATE(pPage, u2State);
979	}
980	#else
981	RT_NOREF(pRam);
982	#endif
983	}
984
985
986	/**
987	* Resets ram range flags.
988	*
989	* @returns VBox status code.
990	* @retval VINF_SUCCESS when shadow PTs was successfully updated.
991	* @param pVM The cross context VM structure.
992	* @param pCur The physical handler.
993	*
994	* @remark We don't start messing with the shadow page tables, as we've
995	* already got code in Trap0e which deals with out of sync handler
996	* flags (originally conceived for global pages).
997	*/
998	static void pgmHandlerPhysicalResetRamFlags(PVMCC pVM, PPGMPHYSHANDLER pCur)
999	{
1000	/*
1001	* Iterate the guest ram pages updating the state.
1002	*/
1003	RTUINT cPages = pCur->cPages;
1004	RTGCPHYS GCPhys = pCur->Key;
1005	PPGMRAMRANGE pRamHint = NULL;
1006	for (;;)
1007	{
1008	PPGMPAGE pPage;
1009	int rc = pgmPhysGetPageWithHintEx(pVM, GCPhys, &pPage, &pRamHint);
1010	if (RT_SUCCESS(rc))
1011	{
1012	/* Reset aliased MMIO pages to MMIO, since this aliasing is our business.
1013	(We don't flip MMIO to RAM though, that's PGMPhys.cpp's job.) */
1014	bool fNemNotifiedAlready = false;
1015	if ( PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_MMIO2_ALIAS_MMIO
1016	\|\| PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_SPECIAL_ALIAS_MMIO)
1017	{
1018	Assert(pCur->cAliasedPages > 0);
1019	pgmHandlerPhysicalResetAliasedPage(pVM, pPage, GCPhys, pRamHint, false /fDoAccounting/, true /fFlushIemTlbs/);
1020	pCur->cAliasedPages--;
1021	fNemNotifiedAlready = true;
1022	}
1023	#ifdef VBOX_STRICT
1024	PCPGMPHYSHANDLERTYPEINT const pCurType = PGMPHYSHANDLER_GET_TYPE(pVM, pCur);
1025	AssertMsg(pCurType && (pCurType->enmKind != PGMPHYSHANDLERKIND_MMIO \|\| PGM_PAGE_IS_MMIO(pPage)),
1026	("%RGp %R[pgmpage]\n", GCPhys, pPage));
1027	#endif
1028	PGM_PAGE_SET_HNDL_PHYS_STATE(pPage, PGM_PAGE_HNDL_PHYS_STATE_NONE, false);
1029
1030	#ifdef VBOX_WITH_NATIVE_NEM
1031	/* Tell NEM about the protection change. */
1032	if (VM_IS_NEM_ENABLED(pVM) && !fNemNotifiedAlready)
1033	{
1034	uint8_t u2State = PGM_PAGE_GET_NEM_STATE(pPage);
1035	PGMPAGETYPE enmType = (PGMPAGETYPE)PGM_PAGE_GET_TYPE(pPage);
1036	NEMHCNotifyPhysPageProtChanged(pVM, GCPhys, PGM_PAGE_GET_HCPHYS(pPage),
1037	PGM_RAMRANGE_CALC_PAGE_R3PTR(pRamHint, GCPhys),
1038	pgmPhysPageCalcNemProtection(pPage, enmType), enmType, &u2State);
1039	PGM_PAGE_SET_NEM_STATE(pPage, u2State);
1040	}
1041	#endif
1042	RT_NOREF(fNemNotifiedAlready);
1043	}
1044	else
1045	AssertRC(rc);
1046
1047	/* next */
1048	if (--cPages == 0)
1049	break;
1050	GCPhys += GUEST_PAGE_SIZE;
1051	}
1052
1053	pCur->cAliasedPages = 0;
1054	pCur->cTmpOffPages = 0;
1055
1056	/*
1057	* Check for partial start and end pages.
1058	*/
1059	if (pCur->Key & GUEST_PAGE_OFFSET_MASK)
1060	pgmHandlerPhysicalRecalcPageState(pVM, pCur->Key - 1, false /* fAbove */, &pRamHint);
1061	if ((pCur->KeyLast & GUEST_PAGE_OFFSET_MASK) != GUEST_PAGE_OFFSET_MASK)
1062	pgmHandlerPhysicalRecalcPageState(pVM, pCur->KeyLast + 1, true /* fAbove */, &pRamHint);
1063	}
1064
1065
1066	#if 0 /* unused */
1067	/**
1068	* Modify a physical page access handler.
1069	*
1070	* Modification can only be done to the range it self, not the type or anything else.
1071	*
1072	* @returns VBox status code.
1073	* For all return codes other than VERR_PGM_HANDLER_NOT_FOUND and VINF_SUCCESS the range is deregistered
1074	* and a new registration must be performed!
1075	* @param pVM The cross context VM structure.
1076	* @param GCPhysCurrent Current location.
1077	* @param GCPhys New location.
1078	* @param GCPhysLast New last location.
1079	*/
1080	VMMDECL(int) PGMHandlerPhysicalModify(PVMCC pVM, RTGCPHYS GCPhysCurrent, RTGCPHYS GCPhys, RTGCPHYS GCPhysLast)
1081	{
1082	/*
1083	* Remove it.
1084	*/
1085	int rc;
1086	PGM_LOCK_VOID(pVM);
1087	PPGMPHYSHANDLER pCur = (PPGMPHYSHANDLER)RTAvlroGCPhysRemove(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers, GCPhysCurrent);
1088	if (pCur)
1089	{
1090	/*
1091	* Clear the ram flags. (We're gonna move or free it!)
1092	*/
1093	pgmHandlerPhysicalResetRamFlags(pVM, pCur);
1094	PCPGMPHYSHANDLERTYPEINT const pCurType = PGMPHYSHANDLER_GET_TYPE_NO_NULL(pVM, pCur);
1095	@todo pCurType validation
1096	bool const fRestoreAsRAM = pCurType->pfnHandlerR3 /** @todo this isn't entirely correct. */
1097	&& pCurType->enmKind != PGMPHYSHANDLERKIND_MMIO;
1098
1099	/*
1100	* Validate the new range, modify and reinsert.
1101	*/
1102	if (GCPhysLast >= GCPhys)
1103	{
1104	/*
1105	* We require the range to be within registered ram.
1106	* There is no apparent need to support ranges which cover more than one ram range.
1107	*/
1108	PPGMRAMRANGE pRam = pgmPhysGetRange(pVM, GCPhys);
1109	if ( pRam
1110	&& GCPhys <= pRam->GCPhysLast
1111	&& GCPhysLast >= pRam->GCPhys)
1112	{
1113	pCur->Core.Key = GCPhys;
1114	pCur->Core.KeyLast = GCPhysLast;
1115	pCur->cPages = (GCPhysLast - (GCPhys & X86_PTE_PAE_PG_MASK) + 1) >> GUEST_PAGE_SHIFT;
1116
1117	if (RTAvlroGCPhysInsert(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers, &pCur->Core))
1118	{
1119	RTGCPHYS const cb = GCPhysLast - GCPhys + 1;
1120	PGMPHYSHANDLERKIND const enmKind = pCurType->enmKind;
1121
1122	/*
1123	* Set ram flags, flush shadow PT entries and finally tell REM about this.
1124	*/
1125	rc = pgmHandlerPhysicalSetRamFlagsAndFlushShadowPTs(pVM, pCur, pRam, NULL, 0);
1126
1127	/** @todo NEM: not sure we need this notification... */
1128	NEMHCNotifyHandlerPhysicalModify(pVM, enmKind, GCPhysCurrent, GCPhys, cb, fRestoreAsRAM);
1129
1130	PGM_UNLOCK(pVM);
1131
1132	PGM_INVL_ALL_VCPU_TLBS(pVM);
1133	Log(("PGMHandlerPhysicalModify: GCPhysCurrent=%RGp -> GCPhys=%RGp GCPhysLast=%RGp\n",
1134	GCPhysCurrent, GCPhys, GCPhysLast));
1135	return VINF_SUCCESS;
1136	}
1137
1138	AssertMsgFailed(("Conflict! GCPhys=%RGp GCPhysLast=%RGp\n", GCPhys, GCPhysLast));
1139	rc = VERR_PGM_HANDLER_PHYSICAL_CONFLICT;
1140	}
1141	else
1142	{
1143	AssertMsgFailed(("No RAM range for %RGp-%RGp\n", GCPhys, GCPhysLast));
1144	rc = VERR_PGM_HANDLER_PHYSICAL_NO_RAM_RANGE;
1145	}
1146	}
1147	else
1148	{
1149	AssertMsgFailed(("Invalid range %RGp-%RGp\n", GCPhys, GCPhysLast));
1150	rc = VERR_INVALID_PARAMETER;
1151	}
1152
1153	/*
1154	* Invalid new location, flush the cache and free it.
1155	* We've only gotta notify REM and free the memory.
1156	*/
1157	if (VM_IS_NEM_ENABLED(pVM))
1158	pgmHandlerPhysicalDeregisterNotifyNEM(pVM, pCur);
1159	pVM->pgm.s.pLastPhysHandlerR0 = 0;
1160	pVM->pgm.s.pLastPhysHandlerR3 = 0;
1161	PGMHandlerPhysicalTypeRelease(pVM, pCur->hType);
1162	MMHyperFree(pVM, pCur);
1163	}
1164	else
1165	{
1166	AssertMsgFailed(("Didn't find range starting at %RGp\n", GCPhysCurrent));
1167	rc = VERR_PGM_HANDLER_NOT_FOUND;
1168	}
1169
1170	PGM_UNLOCK(pVM);
1171	return rc;
1172	}
1173	#endif /* unused */
1174
1175
1176	/**
1177	* Changes the user callback arguments associated with a physical access handler.
1178	*
1179	* @returns VBox status code.
1180	* @param pVM The cross context VM structure.
1181	* @param GCPhys Start physical address of the handler.
1182	* @param uUser User argument to the handlers.
1183	*/
1184	VMMDECL(int) PGMHandlerPhysicalChangeUserArg(PVMCC pVM, RTGCPHYS GCPhys, uint64_t uUser)
1185	{
1186	/*
1187	* Find the handler and make the change.
1188	*/
1189	int rc = PGM_LOCK(pVM);
1190	AssertRCReturn(rc, rc);
1191
1192	PPGMPHYSHANDLER pCur;
1193	rc = pVM->VMCC_CTX(pgm).s.pPhysHandlerTree->lookup(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator, GCPhys, &pCur);
1194	if (RT_SUCCESS(rc))
1195	{
1196	Assert(pCur->Key == GCPhys);
1197	pCur->uUser = uUser;
1198	}
1199	else if (rc == VERR_NOT_FOUND)
1200	{
1201	AssertMsgFailed(("Didn't find range starting at %RGp\n", GCPhys));
1202	rc = VERR_PGM_HANDLER_NOT_FOUND;
1203	}
1204
1205	PGM_UNLOCK(pVM);
1206	return rc;
1207	}
1208
1209	#if 0 /* unused */
1210
1211	/**
1212	* Splits a physical access handler in two.
1213	*
1214	* @returns VBox status code.
1215	* @param pVM The cross context VM structure.
1216	* @param GCPhys Start physical address of the handler.
1217	* @param GCPhysSplit The split address.
1218	*/
1219	VMMDECL(int) PGMHandlerPhysicalSplit(PVMCC pVM, RTGCPHYS GCPhys, RTGCPHYS GCPhysSplit)
1220	{
1221	AssertReturn(GCPhys < GCPhysSplit, VERR_INVALID_PARAMETER);
1222
1223	/*
1224	* Do the allocation without owning the lock.
1225	*/
1226	PPGMPHYSHANDLER pNew;
1227	int rc = MMHyperAlloc(pVM, sizeof(pNew), 0, MM_TAG_PGM_HANDLERS, (void *)&pNew);
1228	if (RT_FAILURE(rc))
1229	return rc;
1230
1231	/*
1232	* Get the handler.
1233	*/
1234	PGM_LOCK_VOID(pVM);
1235	PPGMPHYSHANDLER pCur = (PPGMPHYSHANDLER)RTAvlroGCPhysGet(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers, GCPhys);
1236	if (RT_LIKELY(pCur))
1237	{
1238	if (RT_LIKELY(GCPhysSplit <= pCur->Core.KeyLast))
1239	{
1240	/*
1241	* Create new handler node for the 2nd half.
1242	*/
1243	pNew = pCur;
1244	pNew->Core.Key = GCPhysSplit;
1245	pNew->cPages = (pNew->Core.KeyLast - (pNew->Core.Key & X86_PTE_PAE_PG_MASK) + GUEST_PAGE_SIZE) >> GUEST_PAGE_SHIFT;
1246
1247	pCur->Core.KeyLast = GCPhysSplit - 1;
1248	pCur->cPages = (pCur->Core.KeyLast - (pCur->Core.Key & X86_PTE_PAE_PG_MASK) + GUEST_PAGE_SIZE) >> GUEST_PAGE_SHIFT;
1249
1250	if (RT_LIKELY(RTAvlroGCPhysInsert(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers, &pNew->Core)))
1251	{
1252	LogFlow(("PGMHandlerPhysicalSplit: %RGp-%RGp and %RGp-%RGp\n",
1253	pCur->Core.Key, pCur->Core.KeyLast, pNew->Core.Key, pNew->Core.KeyLast));
1254	PGM_UNLOCK(pVM);
1255	return VINF_SUCCESS;
1256	}
1257	AssertMsgFailed(("whu?\n"));
1258	rc = VERR_PGM_PHYS_HANDLER_IPE;
1259	}
1260	else
1261	{
1262	AssertMsgFailed(("outside range: %RGp-%RGp split %RGp\n", pCur->Core.Key, pCur->Core.KeyLast, GCPhysSplit));
1263	rc = VERR_INVALID_PARAMETER;
1264	}
1265	}
1266	else
1267	{
1268	AssertMsgFailed(("Didn't find range starting at %RGp\n", GCPhys));
1269	rc = VERR_PGM_HANDLER_NOT_FOUND;
1270	}
1271	PGM_UNLOCK(pVM);
1272	MMHyperFree(pVM, pNew);
1273	return rc;
1274	}
1275
1276
1277	/**
1278	* Joins up two adjacent physical access handlers which has the same callbacks.
1279	*
1280	* @returns VBox status code.
1281	* @param pVM The cross context VM structure.
1282	* @param GCPhys1 Start physical address of the first handler.
1283	* @param GCPhys2 Start physical address of the second handler.
1284	*/
1285	VMMDECL(int) PGMHandlerPhysicalJoin(PVMCC pVM, RTGCPHYS GCPhys1, RTGCPHYS GCPhys2)
1286	{
1287	/*
1288	* Get the handlers.
1289	*/
1290	int rc;
1291	PGM_LOCK_VOID(pVM);
1292	PPGMPHYSHANDLER pCur1 = (PPGMPHYSHANDLER)RTAvlroGCPhysGet(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers, GCPhys1);
1293	if (RT_LIKELY(pCur1))
1294	{
1295	PPGMPHYSHANDLER pCur2 = (PPGMPHYSHANDLER)RTAvlroGCPhysGet(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers, GCPhys2);
1296	if (RT_LIKELY(pCur2))
1297	{
1298	/*
1299	* Make sure that they are adjacent, and that they've got the same callbacks.
1300	*/
1301	if (RT_LIKELY(pCur1->Core.KeyLast + 1 == pCur2->Core.Key))
1302	{
1303	if (RT_LIKELY(pCur1->hType == pCur2->hType))
1304	{
1305	PPGMPHYSHANDLER pCur3 = (PPGMPHYSHANDLER)RTAvlroGCPhysRemove(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers, GCPhys2);
1306	if (RT_LIKELY(pCur3 == pCur2))
1307	{
1308	pCur1->Core.KeyLast = pCur2->Core.KeyLast;
1309	pCur1->cPages = (pCur1->Core.KeyLast - (pCur1->Core.Key & X86_PTE_PAE_PG_MASK) + GUEST_PAGE_SIZE) >> GUEST_PAGE_SHIFT;
1310	LogFlow(("PGMHandlerPhysicalJoin: %RGp-%RGp %RGp-%RGp\n",
1311	pCur1->Core.Key, pCur1->Core.KeyLast, pCur2->Core.Key, pCur2->Core.KeyLast));
1312	pVM->pgm.s.pLastPhysHandlerR0 = 0;
1313	pVM->pgm.s.pLastPhysHandlerR3 = 0;
1314	PGMHandlerPhysicalTypeRelease(pVM, pCur2->hType);
1315	MMHyperFree(pVM, pCur2);
1316	PGM_UNLOCK(pVM);
1317	return VINF_SUCCESS;
1318	}
1319
1320	Assert(pCur3 == pCur2);
1321	rc = VERR_PGM_PHYS_HANDLER_IPE;
1322	}
1323	else
1324	{
1325	AssertMsgFailed(("mismatching handlers\n"));
1326	rc = VERR_ACCESS_DENIED;
1327	}
1328	}
1329	else
1330	{
1331	AssertMsgFailed(("not adjacent: %RGp-%RGp %RGp-%RGp\n",
1332	pCur1->Core.Key, pCur1->Core.KeyLast, pCur2->Core.Key, pCur2->Core.KeyLast));
1333	rc = VERR_INVALID_PARAMETER;
1334	}
1335	}
1336	else
1337	{
1338	AssertMsgFailed(("Didn't find range starting at %RGp\n", GCPhys2));
1339	rc = VERR_PGM_HANDLER_NOT_FOUND;
1340	}
1341	}
1342	else
1343	{
1344	AssertMsgFailed(("Didn't find range starting at %RGp\n", GCPhys1));
1345	rc = VERR_PGM_HANDLER_NOT_FOUND;
1346	}
1347	PGM_UNLOCK(pVM);
1348	return rc;
1349
1350	}
1351
1352	#endif /* unused */
1353
1354	/**
1355	* Resets any modifications to individual pages in a physical page access
1356	* handler region.
1357	*
1358	* This is used in pair with PGMHandlerPhysicalPageTempOff(),
1359	* PGMHandlerPhysicalPageAliasMmio2() or PGMHandlerPhysicalPageAliasHC().
1360	*
1361	* @returns VBox status code.
1362	* @param pVM The cross context VM structure.
1363	* @param GCPhys The start address of the handler regions, i.e. what you
1364	* passed to PGMR3HandlerPhysicalRegister(),
1365	* PGMHandlerPhysicalRegisterEx() or
1366	* PGMHandlerPhysicalModify().
1367	*/
1368	VMMDECL(int) PGMHandlerPhysicalReset(PVMCC pVM, RTGCPHYS GCPhys)
1369	{
1370	LogFlow(("PGMHandlerPhysicalReset GCPhys=%RGp\n", GCPhys));
1371	int rc = PGM_LOCK(pVM);
1372	AssertRCReturn(rc, rc);
1373
1374	/*
1375	* Find the handler.
1376	*/
1377	PPGMPHYSHANDLER pCur;
1378	rc = pVM->VMCC_CTX(pgm).s.pPhysHandlerTree->lookup(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator, GCPhys, &pCur);
1379	if (RT_SUCCESS(rc))
1380	{
1381	Assert(pCur->Key == GCPhys);
1382
1383	/*
1384	* Validate kind.
1385	*/
1386	PCPGMPHYSHANDLERTYPEINT pCurType = PGMPHYSHANDLER_GET_TYPE_NO_NULL(pVM, pCur);
1387	switch (pCurType->enmKind)
1388	{
1389	case PGMPHYSHANDLERKIND_WRITE:
1390	case PGMPHYSHANDLERKIND_ALL:
1391	case PGMPHYSHANDLERKIND_MMIO: /* NOTE: Only use when clearing MMIO ranges with aliased MMIO2 pages! */
1392	{
1393	STAM_COUNTER_INC(&pVM->pgm.s.Stats.CTX_MID_Z(Stat,PhysHandlerReset)); /** @todo move out of switch */
1394	PPGMRAMRANGE pRam = pgmPhysGetRange(pVM, GCPhys);
1395	Assert(pRam);
1396	Assert(pRam->GCPhys <= pCur->Key);
1397	Assert(pRam->GCPhysLast >= pCur->KeyLast);
1398
1399	if (pCurType->enmKind == PGMPHYSHANDLERKIND_MMIO)
1400	{
1401	/*
1402	* Reset all the PGMPAGETYPE_MMIO2_ALIAS_MMIO pages first and that's it.
1403	* This could probably be optimized a bit wrt to flushing, but I'm too lazy
1404	* to do that now...
1405	*/
1406	if (pCur->cAliasedPages)
1407	{
1408	PPGMPAGE pPage = &pRam->aPages[(pCur->Key - pRam->GCPhys) >> GUEST_PAGE_SHIFT];
1409	RTGCPHYS GCPhysPage = pCur->Key;
1410	uint32_t cLeft = pCur->cPages;
1411	bool fFlushIemTlb = false;
1412	while (cLeft-- > 0)
1413	{
1414	if ( PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_MMIO2_ALIAS_MMIO
1415	\|\| PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_SPECIAL_ALIAS_MMIO)
1416	{
1417	fFlushIemTlb \|= PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_MMIO2_ALIAS_MMIO;
1418	Assert(pCur->cAliasedPages > 0);
1419	pgmHandlerPhysicalResetAliasedPage(pVM, pPage, GCPhysPage, pRam,
1420	false /fDoAccounting/, false /fFlushIemTlbs/);
1421	--pCur->cAliasedPages;
1422	#ifndef VBOX_STRICT
1423	if (pCur->cAliasedPages == 0)
1424	break;
1425	#endif
1426	}
1427	Assert(PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_MMIO);
1428	GCPhysPage += GUEST_PAGE_SIZE;
1429	pPage++;
1430	}
1431	Assert(pCur->cAliasedPages == 0);
1432
1433	/*
1434	* Flush IEM TLBs in case they contain any references to aliased pages.
1435	* This is only necessary for MMIO2 aliases.
1436	*/
1437	if (fFlushIemTlb)
1438	IEMTlbInvalidateAllPhysicalAllCpus(pVM, NIL_VMCPUID);
1439	}
1440	}
1441	else if (pCur->cTmpOffPages > 0)
1442	{
1443	/*
1444	* Set the flags and flush shadow PT entries.
1445	*/
1446	rc = pgmHandlerPhysicalSetRamFlagsAndFlushShadowPTs(pVM, pCur, pRam, NULL /pvBitmap/, 0 /offBitmap/);
1447	}
1448
1449	pCur->cAliasedPages = 0;
1450	pCur->cTmpOffPages = 0;
1451
1452	rc = VINF_SUCCESS;
1453	break;
1454	}
1455
1456	/*
1457	* Invalid.
1458	*/
1459	default:
1460	AssertMsgFailed(("Invalid type %d/%#x! Corruption!\n", pCurType->enmKind, pCur->hType));
1461	rc = VERR_PGM_PHYS_HANDLER_IPE;
1462	break;
1463	}
1464	}
1465	else if (rc == VERR_NOT_FOUND)
1466	{
1467	AssertMsgFailed(("Didn't find MMIO Range starting at %#x\n", GCPhys));
1468	rc = VERR_PGM_HANDLER_NOT_FOUND;
1469	}
1470
1471	PGM_UNLOCK(pVM);
1472	return rc;
1473	}
1474
1475
1476	/**
1477	* Special version of PGMHandlerPhysicalReset used by MMIO2 w/ dirty page
1478	* tracking.
1479	*
1480	* @returns VBox status code.
1481	* @param pVM The cross context VM structure.
1482	* @param GCPhys The start address of the handler region.
1483	* @param pvBitmap Dirty bitmap. Caller has cleared this already, only
1484	* dirty bits will be set. Caller also made sure it's big
1485	* enough.
1486	* @param offBitmap Dirty bitmap offset.
1487	* @remarks Caller must own the PGM critical section.
1488	*/
1489	DECLHIDDEN(int) pgmHandlerPhysicalResetMmio2WithBitmap(PVMCC pVM, RTGCPHYS GCPhys, void *pvBitmap, uint32_t offBitmap)
1490	{
1491	LogFlow(("pgmHandlerPhysicalResetMmio2WithBitmap GCPhys=%RGp\n", GCPhys));
1492	PGM_LOCK_ASSERT_OWNER(pVM);
1493
1494	/*
1495	* Find the handler.
1496	*/
1497	PPGMPHYSHANDLER pCur;
1498	int rc = pVM->VMCC_CTX(pgm).s.pPhysHandlerTree->lookup(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator, GCPhys, &pCur);
1499	if (RT_SUCCESS(rc))
1500	{
1501	Assert(pCur->Key == GCPhys);
1502
1503	/*
1504	* Validate kind.
1505	*/
1506	PCPGMPHYSHANDLERTYPEINT pCurType = PGMPHYSHANDLER_GET_TYPE(pVM, pCur);
1507	if ( pCurType
1508	&& pCurType->enmKind == PGMPHYSHANDLERKIND_WRITE)
1509	{
1510	STAM_COUNTER_INC(&pVM->pgm.s.Stats.CTX_MID_Z(Stat,PhysHandlerReset));
1511
1512	PPGMRAMRANGE pRam = pgmPhysGetRange(pVM, GCPhys);
1513	Assert(pRam);
1514	Assert(pRam->GCPhys <= pCur->Key);
1515	Assert(pRam->GCPhysLast >= pCur->KeyLast);
1516
1517	/*
1518	* Set the flags and flush shadow PT entries.
1519	*/
1520	if (pCur->cTmpOffPages > 0)
1521	{
1522	rc = pgmHandlerPhysicalSetRamFlagsAndFlushShadowPTs(pVM, pCur, pRam, pvBitmap, offBitmap);
1523	pCur->cTmpOffPages = 0;
1524	}
1525	else
1526	rc = VINF_SUCCESS;
1527	}
1528	else
1529	{
1530	AssertFailed();
1531	rc = VERR_WRONG_TYPE;
1532	}
1533	}
1534	else if (rc == VERR_NOT_FOUND)
1535	{
1536	AssertMsgFailed(("Didn't find MMIO Range starting at %#x\n", GCPhys));
1537	rc = VERR_PGM_HANDLER_NOT_FOUND;
1538	}
1539
1540	return rc;
1541	}
1542
1543
1544	/**
1545	* Temporarily turns off the access monitoring of a page within a monitored
1546	* physical write/all page access handler region.
1547	*
1548	* Use this when no further \#PFs are required for that page. Be aware that
1549	* a page directory sync might reset the flags, and turn on access monitoring
1550	* for the page.
1551	*
1552	* The caller must do required page table modifications.
1553	*
1554	* @returns VBox status code.
1555	* @param pVM The cross context VM structure.
1556	* @param GCPhys The start address of the access handler. This
1557	* must be a fully page aligned range or we risk
1558	* messing up other handlers installed for the
1559	* start and end pages.
1560	* @param GCPhysPage The physical address of the page to turn off
1561	* access monitoring for.
1562	*/
1563	VMMDECL(int) PGMHandlerPhysicalPageTempOff(PVMCC pVM, RTGCPHYS GCPhys, RTGCPHYS GCPhysPage)
1564	{
1565	LogFlow(("PGMHandlerPhysicalPageTempOff GCPhysPage=%RGp\n", GCPhysPage));
1566	int rc = PGM_LOCK(pVM);
1567	AssertRCReturn(rc, rc);
1568
1569	/*
1570	* Validate the range.
1571	*/
1572	PPGMPHYSHANDLER pCur;
1573	rc = pVM->VMCC_CTX(pgm).s.pPhysHandlerTree->lookup(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator, GCPhys, &pCur);
1574	if (RT_SUCCESS(rc))
1575	{
1576	Assert(pCur->Key == GCPhys);
1577	if (RT_LIKELY( GCPhysPage >= pCur->Key
1578	&& GCPhysPage <= pCur->KeyLast))
1579	{
1580	Assert(!(pCur->Key & GUEST_PAGE_OFFSET_MASK));
1581	Assert((pCur->KeyLast & GUEST_PAGE_OFFSET_MASK) == GUEST_PAGE_OFFSET_MASK);
1582
1583	PCPGMPHYSHANDLERTYPEINT const pCurType = PGMPHYSHANDLER_GET_TYPE(pVM, pCur);
1584	AssertReturnStmt( pCurType
1585	&& ( pCurType->enmKind == PGMPHYSHANDLERKIND_WRITE
1586	\|\| pCurType->enmKind == PGMPHYSHANDLERKIND_ALL),
1587	PGM_UNLOCK(pVM), VERR_ACCESS_DENIED);
1588
1589	/*
1590	* Change the page status.
1591	*/
1592	PPGMPAGE pPage;
1593	PPGMRAMRANGE pRam;
1594	rc = pgmPhysGetPageAndRangeEx(pVM, GCPhysPage, &pPage, &pRam);
1595	AssertReturnStmt(RT_SUCCESS_NP(rc), PGM_UNLOCK(pVM), rc);
1596	if (PGM_PAGE_GET_HNDL_PHYS_STATE(pPage) != PGM_PAGE_HNDL_PHYS_STATE_DISABLED)
1597	{
1598	PGM_PAGE_SET_HNDL_PHYS_STATE_ONLY(pPage, PGM_PAGE_HNDL_PHYS_STATE_DISABLED);
1599	pCur->cTmpOffPages++;
1600
1601	#ifdef VBOX_WITH_NATIVE_NEM
1602	/* Tell NEM about the protection change (VGA is using this to track dirty pages). */
1603	if (VM_IS_NEM_ENABLED(pVM))
1604	{
1605	uint8_t u2State = PGM_PAGE_GET_NEM_STATE(pPage);
1606	PGMPAGETYPE enmType = (PGMPAGETYPE)PGM_PAGE_GET_TYPE(pPage);
1607	NEMHCNotifyPhysPageProtChanged(pVM, GCPhysPage, PGM_PAGE_GET_HCPHYS(pPage),
1608	PGM_RAMRANGE_CALC_PAGE_R3PTR(pRam, GCPhysPage),
1609	pgmPhysPageCalcNemProtection(pPage, enmType), enmType, &u2State);
1610	PGM_PAGE_SET_NEM_STATE(pPage, u2State);
1611	}
1612	#endif
1613	}
1614	PGM_UNLOCK(pVM);
1615	return VINF_SUCCESS;
1616	}
1617	PGM_UNLOCK(pVM);
1618	AssertMsgFailed(("The page %#x is outside the range %#x-%#x\n", GCPhysPage, pCur->Key, pCur->KeyLast));
1619	return VERR_INVALID_PARAMETER;
1620	}
1621	PGM_UNLOCK(pVM);
1622
1623	if (rc == VERR_NOT_FOUND)
1624	{
1625	AssertMsgFailed(("Specified physical handler start address %#x is invalid.\n", GCPhys));
1626	return VERR_PGM_HANDLER_NOT_FOUND;
1627	}
1628	return rc;
1629	}
1630
1631
1632	/**
1633	* Resolves an MMIO2 page.
1634	*
1635	* Caller as taken the PGM lock.
1636	*
1637	* @returns Pointer to the page if valid, NULL otherwise
1638	* @param pVM The cross context VM structure.
1639	* @param pDevIns The device owning it.
1640	* @param hMmio2 The MMIO2 region.
1641	* @param offMmio2Page The offset into the region.
1642	*/
1643	static PPGMPAGE pgmPhysResolveMmio2PageLocked(PVMCC pVM, PPDMDEVINS pDevIns, PGMMMIO2HANDLE hMmio2, RTGCPHYS offMmio2Page)
1644	{
1645	/* Only works if the handle is in the handle table! */
1646	AssertReturn(hMmio2 != 0, NULL);
1647	hMmio2--;
1648
1649	/* Must check the first one for PGMREGMMIO2RANGE_F_FIRST_CHUNK. */
1650	AssertReturn(hMmio2 < RT_ELEMENTS(pVM->pgm.s.apMmio2RangesR3), NULL);
1651	PPGMREGMMIO2RANGE pCur = pVM->pgm.s.CTX_SUFF(apMmio2Ranges)[hMmio2];
1652	AssertReturn(pCur, NULL);
1653	AssertReturn(pCur->fFlags & PGMREGMMIO2RANGE_F_FIRST_CHUNK, NULL);
1654
1655	/* Loop thru the sub-ranges till we find the one covering offMmio2. */
1656	for (;;)
1657	{
1658	#ifdef IN_RING3
1659	AssertReturn(pCur->pDevInsR3 == pDevIns, NULL);
1660	#else
1661	AssertReturn(pCur->pDevInsR3 == pDevIns->pDevInsForR3, NULL);
1662	#endif
1663
1664	/* Does it match the offset? */
1665	if (offMmio2Page < pCur->cbReal)
1666	return &pCur->RamRange.aPages[offMmio2Page >> GUEST_PAGE_SHIFT];
1667
1668	/* Advance if we can. */
1669	AssertReturn(!(pCur->fFlags & PGMREGMMIO2RANGE_F_LAST_CHUNK), NULL);
1670	offMmio2Page -= pCur->cbReal;
1671	hMmio2++;
1672	AssertReturn(hMmio2 < RT_ELEMENTS(pVM->pgm.s.apMmio2RangesR3), NULL);
1673	pCur = pVM->pgm.s.CTX_SUFF(apMmio2Ranges)[hMmio2];
1674	AssertReturn(pCur, NULL);
1675	}
1676	}
1677
1678
1679	/**
1680	* Replaces an MMIO page with an MMIO2 page.
1681	*
1682	* This is a worker for IOMMMIOMapMMIO2Page that works in a similar way to
1683	* PGMHandlerPhysicalPageTempOff but for an MMIO page. Since an MMIO page has no
1684	* backing, the caller must provide a replacement page. For various reasons the
1685	* replacement page must be an MMIO2 page.
1686	*
1687	* The caller must do required page table modifications. You can get away
1688	* without making any modifications since it's an MMIO page, the cost is an extra
1689	* \#PF which will the resync the page.
1690	*
1691	* Call PGMHandlerPhysicalReset() to restore the MMIO page.
1692	*
1693	* The caller may still get handler callback even after this call and must be
1694	* able to deal correctly with such calls. The reason for these callbacks are
1695	* either that we're executing in the recompiler (which doesn't know about this
1696	* arrangement) or that we've been restored from saved state (where we won't
1697	* save the change).
1698	*
1699	* @returns VBox status code.
1700	* @param pVM The cross context VM structure.
1701	* @param GCPhys The start address of the access handler. This
1702	* must be a fully page aligned range or we risk
1703	* messing up other handlers installed for the
1704	* start and end pages.
1705	* @param GCPhysPage The physical address of the page to turn off
1706	* access monitoring for and replace with the MMIO2
1707	* page.
1708	* @param pDevIns The device instance owning @a hMmio2.
1709	* @param hMmio2 Handle to the MMIO2 region containing the page
1710	* to remap in the the MMIO page at @a GCPhys.
1711	* @param offMmio2PageRemap The offset into @a hMmio2 of the MMIO2 page that
1712	* should serve as backing memory.
1713	*
1714	* @remark May cause a page pool flush if used on a page that is already
1715	* aliased.
1716	*
1717	* @note This trick does only work reliably if the two pages are never ever
1718	* mapped in the same page table. If they are the page pool code will
1719	* be confused should either of them be flushed. See the special case
1720	* of zero page aliasing mentioned in #3170.
1721	*
1722	*/
1723	VMMDECL(int) PGMHandlerPhysicalPageAliasMmio2(PVMCC pVM, RTGCPHYS GCPhys, RTGCPHYS GCPhysPage,
1724	PPDMDEVINS pDevIns, PGMMMIO2HANDLE hMmio2, RTGCPHYS offMmio2PageRemap)
1725	{
1726	#ifdef VBOX_WITH_PGM_NEM_MODE
1727	AssertReturn(!VM_IS_NEM_ENABLED(pVM) \|\| !pVM->pgm.s.fNemMode, VERR_PGM_NOT_SUPPORTED_FOR_NEM_MODE);
1728	#endif
1729	int rc = PGM_LOCK(pVM);
1730	AssertRCReturn(rc, rc);
1731
1732	/*
1733	* Resolve the MMIO2 reference.
1734	*/
1735	PPGMPAGE pPageRemap = pgmPhysResolveMmio2PageLocked(pVM, pDevIns, hMmio2, offMmio2PageRemap);
1736	if (RT_LIKELY(pPageRemap))
1737	AssertMsgReturnStmt(PGM_PAGE_GET_TYPE(pPageRemap) == PGMPAGETYPE_MMIO2,
1738	("hMmio2=%RU64 offMmio2PageRemap=%RGp %R[pgmpage]\n", hMmio2, offMmio2PageRemap, pPageRemap),
1739	PGM_UNLOCK(pVM), VERR_PGM_PHYS_NOT_MMIO2);
1740	else
1741	{
1742	PGM_UNLOCK(pVM);
1743	return VERR_OUT_OF_RANGE;
1744	}
1745
1746	/*
1747	* Lookup and validate the range.
1748	*/
1749	PPGMPHYSHANDLER pCur;
1750	rc = pVM->VMCC_CTX(pgm).s.pPhysHandlerTree->lookup(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator, GCPhys, &pCur);
1751	if (RT_SUCCESS(rc))
1752	{
1753	Assert(pCur->Key == GCPhys);
1754	if (RT_LIKELY( GCPhysPage >= pCur->Key
1755	&& GCPhysPage <= pCur->KeyLast))
1756	{
1757	PCPGMPHYSHANDLERTYPEINT const pCurType = PGMPHYSHANDLER_GET_TYPE_NO_NULL(pVM, pCur);
1758	AssertReturnStmt(pCurType->enmKind == PGMPHYSHANDLERKIND_MMIO, PGM_UNLOCK(pVM), VERR_ACCESS_DENIED);
1759	AssertReturnStmt(!(pCur->Key & GUEST_PAGE_OFFSET_MASK), PGM_UNLOCK(pVM), VERR_INVALID_PARAMETER);
1760	AssertReturnStmt((pCur->KeyLast & GUEST_PAGE_OFFSET_MASK) == GUEST_PAGE_OFFSET_MASK,
1761	PGM_UNLOCK(pVM), VERR_INVALID_PARAMETER);
1762
1763	/*
1764	* Validate the page.
1765	*/
1766	PPGMPAGE pPage;
1767	PPGMRAMRANGE pRam;
1768	rc = pgmPhysGetPageAndRangeEx(pVM, GCPhysPage, &pPage, &pRam);
1769	AssertReturnStmt(RT_SUCCESS_NP(rc), PGM_UNLOCK(pVM), rc);
1770	if (PGM_PAGE_GET_TYPE(pPage) != PGMPAGETYPE_MMIO)
1771	{
1772	AssertMsgReturn(PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_MMIO2_ALIAS_MMIO,
1773	("GCPhysPage=%RGp %R[pgmpage]\n", GCPhysPage, pPage),
1774	VERR_PGM_PHYS_NOT_MMIO2);
1775	if (PGM_PAGE_GET_HCPHYS(pPage) == PGM_PAGE_GET_HCPHYS(pPageRemap))
1776	{
1777	PGM_UNLOCK(pVM);
1778	return VINF_PGM_HANDLER_ALREADY_ALIASED;
1779	}
1780
1781	/*
1782	* The page is already mapped as some other page, reset it
1783	* to an MMIO/ZERO page before doing the new mapping.
1784	*/
1785	Log(("PGMHandlerPhysicalPageAliasMmio2: GCPhysPage=%RGp (%R[pgmpage]; %RHp -> %RHp\n",
1786	GCPhysPage, pPage, PGM_PAGE_GET_HCPHYS(pPage), PGM_PAGE_GET_HCPHYS(pPageRemap)));
1787	pgmHandlerPhysicalResetAliasedPage(pVM, pPage, GCPhysPage, pRam,
1788	false /fDoAccounting/, false /fFlushIemTlbs/);
1789	pCur->cAliasedPages--;
1790
1791	/* Since this may be present in the TLB and now be wrong, invalid
1792	the guest physical address part of the IEM TLBs. Note, we do
1793	this here as we will not invalid */
1794	IEMTlbInvalidateAllPhysicalAllCpus(pVM, NIL_VMCPUID);
1795	}
1796	Assert(PGM_PAGE_IS_ZERO(pPage));
1797
1798	/*
1799	* Do the actual remapping here.
1800	* This page now serves as an alias for the backing memory specified.
1801	*/
1802	LogFlow(("PGMHandlerPhysicalPageAliasMmio2: %RGp (%R[pgmpage]) alias for %RU64/%RGp (%R[pgmpage])\n",
1803	GCPhysPage, pPage, hMmio2, offMmio2PageRemap, pPageRemap ));
1804	PGM_PAGE_SET_HCPHYS(pVM, pPage, PGM_PAGE_GET_HCPHYS(pPageRemap));
1805	PGM_PAGE_SET_TYPE(pVM, pPage, PGMPAGETYPE_MMIO2_ALIAS_MMIO);
1806	PGM_PAGE_SET_STATE(pVM, pPage, PGM_PAGE_STATE_ALLOCATED);
1807	PGM_PAGE_SET_PAGEID(pVM, pPage, PGM_PAGE_GET_PAGEID(pPageRemap));
1808	PGM_PAGE_SET_HNDL_PHYS_STATE_ONLY(pPage, PGM_PAGE_HNDL_PHYS_STATE_DISABLED);
1809	pCur->cAliasedPages++;
1810	Assert(pCur->cAliasedPages <= pCur->cPages);
1811
1812	/*
1813	* Flush its TLB entry.
1814	*
1815	* Not calling IEMTlbInvalidateAllPhysicalAllCpus here to conserve
1816	* all the other IEM TLB entires. When this one is kicked out and
1817	* reloaded, it will be using the MMIO2 alias, but till then we'll
1818	* continue doing MMIO.
1819	*/
1820	pgmPhysInvalidatePageMapTLBEntry(pVM, GCPhysPage);
1821	/** @todo Do some preformance checks of calling
1822	* IEMTlbInvalidateAllPhysicalAllCpus when in IEM mode, to see if it
1823	* actually makes sense or not. Screen updates are typically massive
1824	* and important when this kind of aliasing is used, so it may pay of... */
1825
1826	#ifdef VBOX_WITH_NATIVE_NEM
1827	/* Tell NEM about the backing and protection change. */
1828	if (VM_IS_NEM_ENABLED(pVM))
1829	{
1830	uint8_t u2State = PGM_PAGE_GET_NEM_STATE(pPage);
1831	NEMHCNotifyPhysPageChanged(pVM, GCPhysPage, pVM->pgm.s.HCPhysZeroPg, PGM_PAGE_GET_HCPHYS(pPage),
1832	PGM_RAMRANGE_CALC_PAGE_R3PTR(pRam, GCPhysPage),
1833	pgmPhysPageCalcNemProtection(pPage, PGMPAGETYPE_MMIO2_ALIAS_MMIO),
1834	PGMPAGETYPE_MMIO2_ALIAS_MMIO, &u2State);
1835	PGM_PAGE_SET_NEM_STATE(pPage, u2State);
1836	}
1837	#endif
1838	LogFlow(("PGMHandlerPhysicalPageAliasMmio2: => %R[pgmpage]\n", pPage));
1839	PGM_UNLOCK(pVM);
1840	return VINF_SUCCESS;
1841	}
1842
1843	PGM_UNLOCK(pVM);
1844	AssertMsgFailed(("The page %#x is outside the range %#x-%#x\n", GCPhysPage, pCur->Key, pCur->KeyLast));
1845	return VERR_INVALID_PARAMETER;
1846	}
1847
1848	PGM_UNLOCK(pVM);
1849	if (rc == VERR_NOT_FOUND)
1850	{
1851	AssertMsgFailed(("Specified physical handler start address %#x is invalid.\n", GCPhys));
1852	return VERR_PGM_HANDLER_NOT_FOUND;
1853	}
1854	return rc;
1855	}
1856
1857
1858	/**
1859	* Replaces an MMIO page with an arbitrary HC page in the shadow page tables.
1860	*
1861	* This differs from PGMHandlerPhysicalPageAliasMmio2 in that the page doesn't
1862	* need to be a known MMIO2 page and that only shadow paging may access the
1863	* page. The latter distinction is important because the only use for this
1864	* feature is for mapping the special APIC access page that VT-x uses to detect
1865	* APIC MMIO operations, the page is shared between all guest CPUs and actually
1866	* not written to. At least at the moment.
1867	*
1868	* The caller must do required page table modifications. You can get away
1869	* without making any modifications since it's an MMIO page, the cost is an extra
1870	* \#PF which will the resync the page.
1871	*
1872	* Call PGMHandlerPhysicalReset() to restore the MMIO page.
1873	*
1874	*
1875	* @returns VBox status code.
1876	* @param pVM The cross context VM structure.
1877	* @param GCPhys The start address of the access handler. This
1878	* must be a fully page aligned range or we risk
1879	* messing up other handlers installed for the
1880	* start and end pages.
1881	* @param GCPhysPage The physical address of the page to turn off
1882	* access monitoring for.
1883	* @param HCPhysPageRemap The physical address of the HC page that
1884	* serves as backing memory.
1885	*
1886	* @remark May cause a page pool flush if used on a page that is already
1887	* aliased.
1888	*/
1889	VMMDECL(int) PGMHandlerPhysicalPageAliasHC(PVMCC pVM, RTGCPHYS GCPhys, RTGCPHYS GCPhysPage, RTHCPHYS HCPhysPageRemap)
1890	{
1891	/// Assert(!IOMIsLockOwner(pVM)); /* We mustn't own any other locks when calling this */
1892	#ifdef VBOX_WITH_PGM_NEM_MODE
1893	AssertReturn(!VM_IS_NEM_ENABLED(pVM) \|\| !pVM->pgm.s.fNemMode, VERR_PGM_NOT_SUPPORTED_FOR_NEM_MODE);
1894	#endif
1895	int rc = PGM_LOCK(pVM);
1896	AssertRCReturn(rc, rc);
1897
1898	/*
1899	* Lookup and validate the range.
1900	*/
1901	PPGMPHYSHANDLER pCur;
1902	rc = pVM->VMCC_CTX(pgm).s.pPhysHandlerTree->lookup(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator, GCPhys, &pCur);
1903	if (RT_SUCCESS(rc))
1904	{
1905	Assert(pCur->Key == GCPhys);
1906	if (RT_LIKELY( GCPhysPage >= pCur->Key
1907	&& GCPhysPage <= pCur->KeyLast))
1908	{
1909	PCPGMPHYSHANDLERTYPEINT const pCurType = PGMPHYSHANDLER_GET_TYPE_NO_NULL(pVM, pCur);
1910	AssertReturnStmt(pCurType->enmKind == PGMPHYSHANDLERKIND_MMIO, PGM_UNLOCK(pVM), VERR_ACCESS_DENIED);
1911	AssertReturnStmt(!(pCur->Key & GUEST_PAGE_OFFSET_MASK), PGM_UNLOCK(pVM), VERR_INVALID_PARAMETER);
1912	AssertReturnStmt((pCur->KeyLast & GUEST_PAGE_OFFSET_MASK) == GUEST_PAGE_OFFSET_MASK,
1913	PGM_UNLOCK(pVM), VERR_INVALID_PARAMETER);
1914
1915	/*
1916	* Get and validate the pages.
1917	*/
1918	PPGMPAGE pPage;
1919	rc = pgmPhysGetPageEx(pVM, GCPhysPage, &pPage);
1920	AssertReturnStmt(RT_SUCCESS_NP(rc), PGM_UNLOCK(pVM), rc);
1921	if (PGM_PAGE_GET_TYPE(pPage) != PGMPAGETYPE_MMIO)
1922	{
1923	PGM_UNLOCK(pVM);
1924	AssertMsgReturn(PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_SPECIAL_ALIAS_MMIO,
1925	("GCPhysPage=%RGp %R[pgmpage]\n", GCPhysPage, pPage),
1926	VERR_PGM_PHYS_NOT_MMIO2);
1927	return VINF_PGM_HANDLER_ALREADY_ALIASED;
1928	}
1929	Assert(PGM_PAGE_IS_ZERO(pPage));
1930
1931	/*
1932	* Do the actual remapping here.
1933	* This page now serves as an alias for the backing memory
1934	* specified as far as shadow paging is concerned.
1935	*/
1936	LogFlow(("PGMHandlerPhysicalPageAliasHC: %RGp (%R[pgmpage]) alias for %RHp\n",
1937	GCPhysPage, pPage, HCPhysPageRemap));
1938	PGM_PAGE_SET_HCPHYS(pVM, pPage, HCPhysPageRemap);
1939	PGM_PAGE_SET_TYPE(pVM, pPage, PGMPAGETYPE_SPECIAL_ALIAS_MMIO);
1940	PGM_PAGE_SET_STATE(pVM, pPage, PGM_PAGE_STATE_ALLOCATED);
1941	PGM_PAGE_SET_PAGEID(pVM, pPage, NIL_GMM_PAGEID);
1942	PGM_PAGE_SET_HNDL_PHYS_STATE_ONLY(pPage, PGM_PAGE_HNDL_PHYS_STATE_DISABLED);
1943	pCur->cAliasedPages++;
1944	Assert(pCur->cAliasedPages <= pCur->cPages);
1945
1946	/*
1947	* Flush its TLB entry.
1948	*
1949	* Not calling IEMTlbInvalidateAllPhysicalAllCpus here as special
1950	* aliased MMIO pages are handled like MMIO by the IEM TLB.
1951	*/
1952	pgmPhysInvalidatePageMapTLBEntry(pVM, GCPhysPage);
1953
1954	#ifdef VBOX_WITH_NATIVE_NEM
1955	/* Tell NEM about the backing and protection change. */
1956	if (VM_IS_NEM_ENABLED(pVM))
1957	{
1958	PPGMRAMRANGE pRam = pgmPhysGetRange(pVM, GCPhysPage);
1959	uint8_t u2State = PGM_PAGE_GET_NEM_STATE(pPage);
1960	NEMHCNotifyPhysPageChanged(pVM, GCPhysPage, pVM->pgm.s.HCPhysZeroPg, PGM_PAGE_GET_HCPHYS(pPage),
1961	PGM_RAMRANGE_CALC_PAGE_R3PTR(pRam, GCPhysPage),
1962	pgmPhysPageCalcNemProtection(pPage, PGMPAGETYPE_SPECIAL_ALIAS_MMIO),
1963	PGMPAGETYPE_SPECIAL_ALIAS_MMIO, &u2State);
1964	PGM_PAGE_SET_NEM_STATE(pPage, u2State);
1965	}
1966	#endif
1967	LogFlow(("PGMHandlerPhysicalPageAliasHC: => %R[pgmpage]\n", pPage));
1968	PGM_UNLOCK(pVM);
1969	return VINF_SUCCESS;
1970	}
1971	PGM_UNLOCK(pVM);
1972	AssertMsgFailed(("The page %#x is outside the range %#x-%#x\n", GCPhysPage, pCur->Key, pCur->KeyLast));
1973	return VERR_INVALID_PARAMETER;
1974	}
1975	PGM_UNLOCK(pVM);
1976
1977	if (rc == VERR_NOT_FOUND)
1978	{
1979	AssertMsgFailed(("Specified physical handler start address %#x is invalid.\n", GCPhys));
1980	return VERR_PGM_HANDLER_NOT_FOUND;
1981	}
1982	return rc;
1983	}
1984
1985
1986	/**
1987	* Checks if a physical range is handled
1988	*
1989	* @returns boolean
1990	* @param pVM The cross context VM structure.
1991	* @param GCPhys Start physical address earlier passed to PGMR3HandlerPhysicalRegister().
1992	* @remarks Caller must take the PGM lock...
1993	* @thread EMT.
1994	*/
1995	VMMDECL(bool) PGMHandlerPhysicalIsRegistered(PVMCC pVM, RTGCPHYS GCPhys)
1996	{
1997	/*
1998	* Find the handler.
1999	*/
2000	PGM_LOCK_VOID(pVM);
2001	PPGMPHYSHANDLER pCur;
2002	int rc = pgmHandlerPhysicalLookup(pVM, GCPhys, &pCur);
2003	if (RT_SUCCESS(rc))
2004	{
2005	#ifdef VBOX_STRICT
2006	Assert(GCPhys >= pCur->Key && GCPhys <= pCur->KeyLast);
2007	PCPGMPHYSHANDLERTYPEINT const pCurType = PGMPHYSHANDLER_GET_TYPE_NO_NULL(pVM, pCur);
2008	Assert( pCurType->enmKind == PGMPHYSHANDLERKIND_WRITE
2009	\|\| pCurType->enmKind == PGMPHYSHANDLERKIND_ALL
2010	\|\| pCurType->enmKind == PGMPHYSHANDLERKIND_MMIO);
2011	#endif
2012	PGM_UNLOCK(pVM);
2013	return true;
2014	}
2015	PGM_UNLOCK(pVM);
2016	return false;
2017	}
2018
2019
2020	/**
2021	* Checks if it's an disabled all access handler or write access handler at the
2022	* given address.
2023	*
2024	* @returns true if it's an all access handler, false if it's a write access
2025	* handler.
2026	* @param pVM The cross context VM structure.
2027	* @param GCPhys The address of the page with a disabled handler.
2028	*
2029	* @remarks The caller, PGMR3PhysTlbGCPhys2Ptr, must hold the PGM lock.
2030	*/
2031	bool pgmHandlerPhysicalIsAll(PVMCC pVM, RTGCPHYS GCPhys)
2032	{
2033	PGM_LOCK_VOID(pVM);
2034	PPGMPHYSHANDLER pCur;
2035	int rc = pgmHandlerPhysicalLookup(pVM, GCPhys, &pCur);
2036	AssertRCReturnStmt(rc, PGM_UNLOCK(pVM), true);
2037
2038	/* Only whole pages can be disabled. */
2039	Assert( pCur->Key <= (GCPhys & ~(RTGCPHYS)GUEST_PAGE_OFFSET_MASK)
2040	&& pCur->KeyLast >= (GCPhys \| GUEST_PAGE_OFFSET_MASK));
2041
2042	PCPGMPHYSHANDLERTYPEINT const pCurType = PGMPHYSHANDLER_GET_TYPE_NO_NULL(pVM, pCur);
2043	Assert( pCurType->enmKind == PGMPHYSHANDLERKIND_WRITE
2044	\|\| pCurType->enmKind == PGMPHYSHANDLERKIND_ALL
2045	\|\| pCurType->enmKind == PGMPHYSHANDLERKIND_MMIO); /* sanity */
2046	bool const fRet = pCurType->enmKind != PGMPHYSHANDLERKIND_WRITE;
2047	PGM_UNLOCK(pVM);
2048	return fRet;
2049	}
2050
2051	#ifdef VBOX_STRICT
2052
2053	/**
2054	* State structure used by the PGMAssertHandlerAndFlagsInSync() function
2055	* and its AVL enumerators.
2056	*/
2057	typedef struct PGMAHAFIS
2058	{
2059	/** The current physical address. */
2060	RTGCPHYS GCPhys;
2061	/** Number of errors. */
2062	unsigned cErrors;
2063	/** Pointer to the VM. */
2064	PVM pVM;
2065	} PGMAHAFIS, *PPGMAHAFIS;
2066
2067
2068	/**
2069	* Asserts that the handlers+guest-page-tables == ramrange-flags and
2070	* that the physical addresses associated with virtual handlers are correct.
2071	*
2072	* @returns Number of mismatches.
2073	* @param pVM The cross context VM structure.
2074	*/
2075	VMMDECL(unsigned) PGMAssertHandlerAndFlagsInSync(PVMCC pVM)
2076	{
2077	PPGM pPGM = &pVM->pgm.s;
2078	PGMAHAFIS State;
2079	State.GCPhys = 0;
2080	State.cErrors = 0;
2081	State.pVM = pVM;
2082
2083	PGM_LOCK_ASSERT_OWNER(pVM);
2084
2085	/*
2086	* Check the RAM flags against the handlers.
2087	*/
2088	PPGMPHYSHANDLERTREE const pPhysHandlerTree = pVM->VMCC_CTX(pgm).s.pPhysHandlerTree;
2089	for (PPGMRAMRANGE pRam = pPGM->CTX_SUFF(pRamRangesX); pRam; pRam = pRam->CTX_SUFF(pNext))
2090	{
2091	const uint32_t cPages = pRam->cb >> GUEST_PAGE_SHIFT;
2092	for (uint32_t iPage = 0; iPage < cPages; iPage++)
2093	{
2094	PGMPAGE const *pPage = &pRam->aPages[iPage];
2095	if (PGM_PAGE_HAS_ANY_HANDLERS(pPage))
2096	{
2097	State.GCPhys = pRam->GCPhys + (iPage << GUEST_PAGE_SHIFT);
2098
2099	/*
2100	* Physical first - calculate the state based on the handlers
2101	* active on the page, then compare.
2102	*/
2103	if (PGM_PAGE_HAS_ANY_PHYSICAL_HANDLERS(pPage))
2104	{
2105	/* the first */
2106	PPGMPHYSHANDLER pPhys;
2107	int rc = pPhysHandlerTree->lookup(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator, State.GCPhys, &pPhys);
2108	if (rc == VERR_NOT_FOUND)
2109	{
2110	rc = pPhysHandlerTree->lookupMatchingOrAbove(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator,
2111	State.GCPhys, &pPhys);
2112	if (RT_SUCCESS(rc))
2113	{
2114	Assert(pPhys->Key >= State.GCPhys);
2115	if (pPhys->Key > (State.GCPhys + GUEST_PAGE_SIZE - 1))
2116	pPhys = NULL;
2117	}
2118	else
2119	AssertLogRelMsgReturn(rc == VERR_NOT_FOUND, ("rc=%Rrc GCPhys=%RGp\n", rc, State.GCPhys), 999);
2120	}
2121	else
2122	AssertLogRelMsgReturn(RT_SUCCESS(rc), ("rc=%Rrc GCPhys=%RGp\n", rc, State.GCPhys), 999);
2123
2124	if (pPhys)
2125	{
2126	PCPGMPHYSHANDLERTYPEINT pPhysType = pgmHandlerPhysicalTypeHandleToPtr(pVM, pPhys->hType);
2127	unsigned uState = pPhysType->uState;
2128	bool const fNotInHm = pPhysType->fNotInHm; /* whole pages, so no need to accumulate sub-page configs. */
2129
2130	/* more? */
2131	while (pPhys->KeyLast < (State.GCPhys \| GUEST_PAGE_OFFSET_MASK))
2132	{
2133	PPGMPHYSHANDLER pPhys2;
2134	rc = pPhysHandlerTree->lookupMatchingOrAbove(&pVM->VMCC_CTX(pgm).s.PhysHandlerAllocator,
2135	pPhys->KeyLast + 1, &pPhys2);
2136	if (rc == VERR_NOT_FOUND)
2137	break;
2138	AssertLogRelMsgReturn(RT_SUCCESS(rc), ("rc=%Rrc KeyLast+1=%RGp\n", rc, pPhys->KeyLast + 1), 999);
2139	if (pPhys2->Key > (State.GCPhys \| GUEST_PAGE_OFFSET_MASK))
2140	break;
2141	PCPGMPHYSHANDLERTYPEINT pPhysType2 = pgmHandlerPhysicalTypeHandleToPtr(pVM, pPhys2->hType);
2142	uState = RT_MAX(uState, pPhysType2->uState);
2143	pPhys = pPhys2;
2144	}
2145
2146	/* compare.*/
2147	if ( PGM_PAGE_GET_HNDL_PHYS_STATE(pPage) != uState
2148	&& PGM_PAGE_GET_HNDL_PHYS_STATE(pPage) != PGM_PAGE_HNDL_PHYS_STATE_DISABLED)
2149	{
2150	AssertMsgFailed(("ram range vs phys handler flags mismatch. GCPhys=%RGp state=%d expected=%d %s\n",
2151	State.GCPhys, PGM_PAGE_GET_HNDL_PHYS_STATE(pPage), uState, pPhysType->pszDesc));
2152	State.cErrors++;
2153	}
2154	AssertMsgStmt(PGM_PAGE_IS_HNDL_PHYS_NOT_IN_HM(pPage) == fNotInHm,
2155	("ram range vs phys handler flags mismatch. GCPhys=%RGp fNotInHm=%d, %d %s\n",
2156	State.GCPhys, PGM_PAGE_IS_HNDL_PHYS_NOT_IN_HM(pPage), fNotInHm, pPhysType->pszDesc),
2157	State.cErrors++);
2158	}
2159	else
2160	{
2161	AssertMsgFailed(("ram range vs phys handler mismatch. no handler for GCPhys=%RGp\n", State.GCPhys));
2162	State.cErrors++;
2163	}
2164	}
2165	}
2166	} /* foreach page in ram range. */
2167	} /* foreach ram range. */
2168
2169	/*
2170	* Do the reverse check for physical handlers.
2171	*/
2172	/** @todo */
2173
2174	return State.cErrors;
2175	}
2176
2177	#endif /* VBOX_STRICT */
2178

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/PGMAllHandler.cpp@ 99681

Download in other formats: