PGMAllPhys.cpp@ 13532

Last change on this file since 13532 was 13186, checked in by vboxsync, 16 years ago
PGMPhys: Fix for silly edge case bug.
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 83.7 KB

Line
1	/* $Id: PGMAllPhys.cpp 13186 2008-10-10 22:21:18Z vboxsync $ */
2	/** @file
3	* PGM - Page Manager and Monitor, Physical Memory Addressing.
4	*/
5
6	/*
7	* Copyright (C) 2006-2007 Sun Microsystems, Inc.
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
18	* Clara, CA 95054 USA or visit http://www.sun.com if you need
19	* additional information or have any questions.
20	*/
21
22	/** @def PGM_IGNORE_RAM_FLAGS_RESERVED
23	* Don't respect the MM_RAM_FLAGS_RESERVED flag when converting to HC addresses.
24	*
25	* Since this flag is currently incorrectly kept set for ROM regions we will
26	* have to ignore it for now so we don't break stuff.
27	*
28	* @todo this has been fixed now I believe, remove this hack.
29	*/
30	#define PGM_IGNORE_RAM_FLAGS_RESERVED
31
32
33	/*******************************************************************************
34	* Header Files *
35	*******************************************************************************/
36	#define LOG_GROUP LOG_GROUP_PGM_PHYS
37	#include <VBox/pgm.h>
38	#include <VBox/trpm.h>
39	#include <VBox/vmm.h>
40	#include <VBox/iom.h>
41	#include <VBox/em.h>
42	#include <VBox/rem.h>
43	#include "PGMInternal.h"
44	#include <VBox/vm.h>
45	#include <VBox/param.h>
46	#include <VBox/err.h>
47	#include <iprt/assert.h>
48	#include <iprt/string.h>
49	#include <iprt/asm.h>
50	#include <VBox/log.h>
51	#ifdef IN_RING3
52	# include <iprt/thread.h>
53	#endif
54
55
56
57	#ifndef IN_RING3
58
59	/**
60	* \#PF Handler callback for Guest ROM range write access.
61	* We simply ignore the writes or fall back to the recompiler if we don't support the instruction.
62	*
63	* @returns VBox status code (appropritate for trap handling and GC return).
64	* @param pVM VM Handle.
65	* @param uErrorCode CPU Error code.
66	* @param pRegFrame Trap register frame.
67	* @param pvFault The fault address (cr2).
68	* @param GCPhysFault The GC physical address corresponding to pvFault.
69	* @param pvUser User argument. Pointer to the ROM range structure.
70	*/
71	VMMDECL(int) pgmPhysRomWriteHandler(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame, void pvFault, RTGCPHYS GCPhysFault, void pvUser)
72	{
73	int rc;
74	#ifdef VBOX_WITH_NEW_PHYS_CODE
75	PPGMROMRANGE pRom = (PPGMROMRANGE)pvUser;
76	uint32_t iPage = GCPhysFault - pRom->GCPhys;
77	Assert(iPage < (pRom->cb >> PAGE_SHIFT));
78	switch (pRom->aPages[iPage].enmProt)
79	{
80	case PGMROMPROT_READ_ROM_WRITE_IGNORE:
81	case PGMROMPROT_READ_RAM_WRITE_IGNORE:
82	{
83	#endif
84	/*
85	* If it's a simple instruction which doesn't change the cpu state
86	* we will simply skip it. Otherwise we'll have to defer it to REM.
87	*/
88	uint32_t cbOp;
89	DISCPUSTATE Cpu;
90	rc = EMInterpretDisasOne(pVM, pRegFrame, &Cpu, &cbOp);
91	if ( RT_SUCCESS(rc)
92	&& Cpu.mode == CPUMODE_32BIT /** @todo why does this matter? */
93	&& !(Cpu.prefix & (PREFIX_REPNE \| PREFIX_REP \| PREFIX_SEG)))
94	{
95	switch (Cpu.opcode)
96	{
97	/** @todo Find other instructions we can safely skip, possibly
98	* adding this kind of detection to DIS or EM. */
99	case OP_MOV:
100	pRegFrame->rip += cbOp;
101	STAM_COUNTER_INC(&pVM->pgm.s.StatRZGuestROMWriteHandled);
102	return VINF_SUCCESS;
103	}
104	}
105	else if (RT_UNLIKELY(rc == VERR_INTERNAL_ERROR))
106	return rc;
107	#ifdef VBOX_WITH_NEW_PHYS_CODE
108	break;
109	}
110
111	case PGMROMPROT_READ_RAM_WRITE_RAM:
112	rc = PGMHandlerPhysicalPageTempOff(pVM, pRom->GCPhys, GCPhysFault & X86_PTE_PG_MASK);
113	AssertRC(rc);
114	case PGMROMPROT_READ_ROM_WRITE_RAM:
115	/* Handle it in ring-3 because it's way easier there. */
116	break;
117
118	default:
119	AssertMsgFailedReturn(("enmProt=%d iPage=%d GCPhysFault=%RGp\n",
120	pRom->aPages[iPage].enmProt, iPage, GCPhysFault),
121	VERR_INTERNAL_ERROR);
122	}
123	#endif
124
125	STAM_COUNTER_INC(&pVM->pgm.s.StatRZGuestROMWriteUnhandled);
126	return VINF_EM_RAW_EMULATE_INSTR;
127	}
128
129	#endif /* IN_RING3 */
130
131	/**
132	* Checks if Address Gate 20 is enabled or not.
133	*
134	* @returns true if enabled.
135	* @returns false if disabled.
136	* @param pVM VM handle.
137	*/
138	VMMDECL(bool) PGMPhysIsA20Enabled(PVM pVM)
139	{
140	LogFlow(("PGMPhysIsA20Enabled %d\n", pVM->pgm.s.fA20Enabled));
141	return !!pVM->pgm.s.fA20Enabled ; /* stupid MS compiler doesn't trust me. */
142	}
143
144
145	/**
146	* Validates a GC physical address.
147	*
148	* @returns true if valid.
149	* @returns false if invalid.
150	* @param pVM The VM handle.
151	* @param GCPhys The physical address to validate.
152	*/
153	VMMDECL(bool) PGMPhysIsGCPhysValid(PVM pVM, RTGCPHYS GCPhys)
154	{
155	PPGMPAGE pPage = pgmPhysGetPage(&pVM->pgm.s, GCPhys);
156	return pPage != NULL;
157	}
158
159
160	/**
161	* Checks if a GC physical address is a normal page,
162	* i.e. not ROM, MMIO or reserved.
163	*
164	* @returns true if normal.
165	* @returns false if invalid, ROM, MMIO or reserved page.
166	* @param pVM The VM handle.
167	* @param GCPhys The physical address to check.
168	*/
169	VMMDECL(bool) PGMPhysIsGCPhysNormal(PVM pVM, RTGCPHYS GCPhys)
170	{
171	PPGMPAGE pPage = pgmPhysGetPage(&pVM->pgm.s, GCPhys);
172	return pPage
173	&& !(pPage->HCPhys & (MM_RAM_FLAGS_MMIO \| MM_RAM_FLAGS_ROM \| MM_RAM_FLAGS_RESERVED \| MM_RAM_FLAGS_MMIO2));
174	}
175
176
177	/**
178	* Converts a GC physical address to a HC physical address.
179	*
180	* @returns VINF_SUCCESS on success.
181	* @returns VERR_PGM_PHYS_PAGE_RESERVED it it's a valid GC physical
182	* page but has no physical backing.
183	* @returns VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid
184	* GC physical address.
185	*
186	* @param pVM The VM handle.
187	* @param GCPhys The GC physical address to convert.
188	* @param pHCPhys Where to store the HC physical address on success.
189	*/
190	VMMDECL(int) PGMPhysGCPhys2HCPhys(PVM pVM, RTGCPHYS GCPhys, PRTHCPHYS pHCPhys)
191	{
192	PPGMPAGE pPage;
193	int rc = pgmPhysGetPageEx(&pVM->pgm.s, GCPhys, &pPage);
194	if (VBOX_FAILURE(rc))
195	return rc;
196
197	#ifndef PGM_IGNORE_RAM_FLAGS_RESERVED
198	if (RT_UNLIKELY(pPage->HCPhys & MM_RAM_FLAGS_RESERVED)) /** @todo PAGE FLAGS */
199	return VERR_PGM_PHYS_PAGE_RESERVED;
200	#endif
201
202	*pHCPhys = PGM_PAGE_GET_HCPHYS(pPage) \| (GCPhys & PAGE_OFFSET_MASK);
203	return VINF_SUCCESS;
204	}
205
206
207	/**
208	* Invalidates the GC page mapping TLB.
209	*
210	* @param pVM The VM handle.
211	*/
212	VMMDECL(void) PGMPhysInvalidatePageGCMapTLB(PVM pVM)
213	{
214	/* later */
215	NOREF(pVM);
216	}
217
218
219	/**
220	* Invalidates the ring-0 page mapping TLB.
221	*
222	* @param pVM The VM handle.
223	*/
224	VMMDECL(void) PGMPhysInvalidatePageR0MapTLB(PVM pVM)
225	{
226	PGMPhysInvalidatePageR3MapTLB(pVM);
227	}
228
229
230	/**
231	* Invalidates the ring-3 page mapping TLB.
232	*
233	* @param pVM The VM handle.
234	*/
235	VMMDECL(void) PGMPhysInvalidatePageR3MapTLB(PVM pVM)
236	{
237	pgmLock(pVM);
238	for (unsigned i = 0; i < RT_ELEMENTS(pVM->pgm.s.PhysTlbHC.aEntries); i++)
239	{
240	pVM->pgm.s.PhysTlbHC.aEntries[i].GCPhys = NIL_RTGCPHYS;
241	pVM->pgm.s.PhysTlbHC.aEntries[i].pPage = 0;
242	pVM->pgm.s.PhysTlbHC.aEntries[i].pMap = 0;
243	pVM->pgm.s.PhysTlbHC.aEntries[i].pv = 0;
244	}
245	pgmUnlock(pVM);
246	}
247
248
249	/**
250	* Frees the specified RAM page.
251	*
252	* This is used by ballooning and remapping MMIO2.
253	*
254	* @param pVM Pointer to the shared VM structure.
255	* @param pPage Pointer to the page structure.
256	* @param GCPhys The guest physical address of the page, if applicable.
257	*/
258	void pgmPhysFreePage(PVM pVM, PPGMPAGE pPage, RTGCPHYS GCPhys)
259	{
260	AssertFatal(PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_RAM);
261
262	/** @todo implement this... */
263	AssertFatalFailed();
264	}
265
266
267
268	/**
269	* Makes sure that there is at least one handy page ready for use.
270	*
271	* This will also take the appropriate actions when reaching water-marks.
272	*
273	* @returns The following VBox status codes.
274	* @retval VINF_SUCCESS on success.
275	* @retval VERR_EM_NO_MEMORY if we're really out of memory.
276	*
277	* @param pVM The VM handle.
278	*
279	* @remarks Must be called from within the PGM critical section. It may
280	* nip back to ring-3/0 in some cases.
281	*/
282	static int pgmPhysEnsureHandyPage(PVM pVM)
283	{
284	/** @remarks
285	* low-water mark logic for R0 & GC:
286	* - 75%: Set FF.
287	* - 50%: Force return to ring-3 ASAP.
288	*
289	* For ring-3 there is a little problem wrt to the recompiler, so:
290	* - 75%: Set FF.
291	* - 50%: Try allocate pages; on failure we'll force REM to quite ASAP.
292	*
293	* The basic idea is that we should be able to get out of any situation with
294	* only 50% of handy pages remaining.
295	*
296	* At the moment we'll not adjust the number of handy pages relative to the
297	* actual VM RAM committment, that's too much work for now.
298	*/
299	Assert(pVM->pgm.s.cHandyPages <= RT_ELEMENTS(pVM->pgm.s.aHandyPages));
300	if ( !pVM->pgm.s.cHandyPages
301	#ifdef IN_RING3
302	\|\| pVM->pgm.s.cHandyPages - 1 <= RT_ELEMENTS(pVM->pgm.s.aHandyPages) / 2 /* 50% */
303	#endif
304	)
305	{
306	Log(("PGM: cHandyPages=%u out of %u -> allocate more\n", pVM->pgm.s.cHandyPages - 1 <= RT_ELEMENTS(pVM->pgm.s.aHandyPages)));
307	#ifdef IN_RING3
308	int rc = SUPCallVMMR0Ex(pVM->pVMR0, VMMR0_DO_PGM_ALLOCATE_HANDY_PAGES, 0, NULL);
309	#elif defined(IN_RING0)
310	/** @todo call PGMR0PhysAllocateHandyPages directly - need to make sure we can call kernel code first and deal with the seeding fallback. */
311	int rc = VMMR0CallHost(pVM, VMMCALLHOST_PGM_ALLOCATE_HANDY_PAGES, 0);
312	#else
313	int rc = VMMGCCallHost(pVM, VMMCALLHOST_PGM_ALLOCATE_HANDY_PAGES, 0);
314	#endif
315	if (RT_UNLIKELY(rc != VINF_SUCCESS))
316	{
317	Assert(rc == VINF_EM_NO_MEMORY);
318	if (!pVM->pgm.s.cHandyPages)
319	{
320	LogRel(("PGM: no more handy pages!\n"));
321	return VERR_EM_NO_MEMORY;
322	}
323	Assert(VM_FF_ISSET(pVM, VM_FF_PGM_NEED_HANDY_PAGES));
324	#ifdef IN_RING3
325	REMR3NotifyFF(pVM);
326	#else
327	VM_FF_SET(pVM, VM_FF_TO_R3);
328	#endif
329	}
330	Assert(pVM->pgm.s.cHandyPages <= RT_ELEMENTS(pVM->pgm.s.aHandyPages));
331	}
332	else if (pVM->pgm.s.cHandyPages - 1 <= (RT_ELEMENTS(pVM->pgm.s.aHandyPages) / 4) * 3) /* 75% */
333	{
334	VM_FF_SET(pVM, VM_FF_PGM_NEED_HANDY_PAGES);
335	#ifndef IN_RING3
336	if (pVM->pgm.s.cHandyPages - 1 <= RT_ELEMENTS(pVM->pgm.s.aHandyPages) / 2)
337	{
338	Log(("PGM: VM_FF_TO_R3 - cHandyPages=%u out of %u\n", pVM->pgm.s.cHandyPages - 1 <= RT_ELEMENTS(pVM->pgm.s.aHandyPages)));
339	VM_FF_SET(pVM, VM_FF_TO_R3);
340	}
341	#endif
342	}
343
344	return VINF_SUCCESS;
345	}
346
347
348	/**
349	* Replace a zero or shared page with new page that we can write to.
350	*
351	* @returns The following VBox status codes.
352	* @retval VINF_SUCCESS on success, pPage is modified.
353	* @retval VERR_EM_NO_MEMORY if we're totally out of memory.
354	*
355	* @todo Propagate VERR_EM_NO_MEMORY up the call tree.
356	*
357	* @param pVM The VM address.
358	* @param pPage The physical page tracking structure. This will
359	* be modified on success.
360	* @param GCPhys The address of the page.
361	*
362	* @remarks Must be called from within the PGM critical section. It may
363	* nip back to ring-3/0 in some cases.
364	*
365	* @remarks This function shouldn't really fail, however if it does
366	* it probably means we've screwed up the size of the amount
367	* and/or the low-water mark of handy pages. Or, that some
368	* device I/O is causing a lot of pages to be allocated while
369	* while the host is in a low-memory condition.
370	*/
371	int pgmPhysAllocPage(PVM pVM, PPGMPAGE pPage, RTGCPHYS GCPhys)
372	{
373	/*
374	* Ensure that we've got a page handy, take it and use it.
375	*/
376	int rc = pgmPhysEnsureHandyPage(pVM);
377	if (VBOX_FAILURE(rc))
378	{
379	Assert(rc == VERR_EM_NO_MEMORY);
380	return rc;
381	}
382	AssertMsg(PGM_PAGE_IS_ZERO(pPage) \|\| PGM_PAGE_IS_SHARED(pPage), ("%d %RGp\n", PGM_PAGE_GET_STATE(pPage), GCPhys));
383	Assert(!PGM_PAGE_IS_RESERVED(pPage));
384	Assert(!PGM_PAGE_IS_MMIO(pPage));
385
386	uint32_t iHandyPage = --pVM->pgm.s.cHandyPages;
387	Assert(iHandyPage < RT_ELEMENTS(pVM->pgm.s.aHandyPages));
388	Assert(pVM->pgm.s.aHandyPages[iHandyPage].HCPhysGCPhys != NIL_RTHCPHYS);
389	Assert(!(pVM->pgm.s.aHandyPages[iHandyPage].HCPhysGCPhys & ~X86_PTE_PAE_PG_MASK));
390	Assert(pVM->pgm.s.aHandyPages[iHandyPage].idPage != NIL_GMM_PAGEID);
391	Assert(pVM->pgm.s.aHandyPages[iHandyPage].idSharedPage == NIL_GMM_PAGEID);
392
393	/*
394	* There are one or two action to be taken the next time we allocate handy pages:
395	* - Tell the GMM (global memory manager) what the page is being used for.
396	* (Speeds up replacement operations - sharing and defragmenting.)
397	* - If the current backing is shared, it must be freed.
398	*/
399	const RTHCPHYS HCPhys = pVM->pgm.s.aHandyPages[iHandyPage].HCPhysGCPhys;
400	pVM->pgm.s.aHandyPages[iHandyPage].HCPhysGCPhys = GCPhys;
401
402	if (PGM_PAGE_IS_SHARED(pPage))
403	{
404	pVM->pgm.s.aHandyPages[iHandyPage].idSharedPage = PGM_PAGE_GET_PAGEID(pPage);
405	Assert(PGM_PAGE_GET_PAGEID(pPage) != NIL_GMM_PAGEID);
406	VM_FF_SET(pVM, VM_FF_PGM_NEED_HANDY_PAGES);
407
408	Log2(("PGM: Replaced shared page %#x at %RGp with %#x / %RHp\n", PGM_PAGE_GET_PAGEID(pPage),
409	GCPhys, pVM->pgm.s.aHandyPages[iHandyPage].idPage, HCPhys));
410	STAM_COUNTER_INC(&pVM->pgm.s.CTX_MID_Z(Stat,PageReplaceShared));
411	pVM->pgm.s.cSharedPages--;
412	/** @todo err.. what about copying the page content? */
413	}
414	else
415	{
416	Log2(("PGM: Replaced zero page %RGp with %#x / %RHp\n", GCPhys, pVM->pgm.s.aHandyPages[iHandyPage].idPage, HCPhys));
417	STAM_COUNTER_INC(&pVM->pgm.s.StatRZPageReplaceZero);
418	pVM->pgm.s.cZeroPages--;
419	/** @todo verify that the handy page is zero! */
420	}
421
422	/*
423	* Do the PGMPAGE modifications.
424	*/
425	pVM->pgm.s.cPrivatePages++;
426	PGM_PAGE_SET_HCPHYS(pPage, HCPhys);
427	PGM_PAGE_SET_PAGEID(pPage, pVM->pgm.s.aHandyPages[iHandyPage].idPage);
428	PGM_PAGE_SET_STATE(pPage, PGM_PAGE_STATE_ALLOCATED);
429
430	return VINF_SUCCESS;
431	}
432
433
434	/**
435	* Deal with pages that are not writable, i.e. not in the ALLOCATED state.
436	*
437	* @returns VBox status code.
438	* @retval VINF_SUCCESS on success.
439	* @retval VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical backing.
440	*
441	* @param pVM The VM address.
442	* @param pPage The physical page tracking structure.
443	* @param GCPhys The address of the page.
444	*
445	* @remarks Called from within the PGM critical section.
446	*/
447	int pgmPhysPageMakeWritable(PVM pVM, PPGMPAGE pPage, RTGCPHYS GCPhys)
448	{
449	switch (PGM_PAGE_GET_STATE(pPage))
450	{
451	case PGM_PAGE_STATE_WRITE_MONITORED:
452	PGM_PAGE_SET_WRITTEN_TO(pPage);
453	PGM_PAGE_SET_STATE(pPage, PGM_PAGE_STATE_ALLOCATED);
454	/* fall thru */
455	default: /* to shut up GCC */
456	case PGM_PAGE_STATE_ALLOCATED:
457	return VINF_SUCCESS;
458
459	/*
460	* Zero pages can be dummy pages for MMIO or reserved memory,
461	* so we need to check the flags before joining cause with
462	* shared page replacement.
463	*/
464	case PGM_PAGE_STATE_ZERO:
465	if ( PGM_PAGE_IS_MMIO(pPage)
466	\|\| PGM_PAGE_IS_RESERVED(pPage))
467	return VERR_PGM_PHYS_PAGE_RESERVED;
468	/* fall thru */
469	case PGM_PAGE_STATE_SHARED:
470	return pgmPhysAllocPage(pVM, pPage, GCPhys);
471	}
472	}
473
474
475	/**
476	* Maps a page into the current virtual address space so it can be accessed.
477	*
478	* @returns VBox status code.
479	* @retval VINF_SUCCESS on success.
480	* @retval VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical backing.
481	*
482	* @param pVM The VM address.
483	* @param pPage The physical page tracking structure.
484	* @param GCPhys The address of the page.
485	* @param ppMap Where to store the address of the mapping tracking structure.
486	* @param ppv Where to store the mapping address of the page. The page
487	* offset is masked off!
488	*
489	* @remarks Called from within the PGM critical section.
490	*/
491	int pgmPhysPageMap(PVM pVM, PPGMPAGE pPage, RTGCPHYS GCPhys, PPPGMPAGEMAP ppMap, void **ppv)
492	{
493	#if defined(IN_GC) \|\| defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
494	/*
495	* Just some sketchy GC/R0-darwin code.
496	*/
497	*ppMap = NULL;
498	RTHCPHYS HCPhys = PGM_PAGE_GET_HCPHYS(pPage);
499	Assert(HCPhys != pVM->pgm.s.HCPhysZeroPg);
500	return PGMDynMapHCPage(pVM, HCPhys, ppv);
501
502	#else /* IN_RING3 \|\| IN_RING0 */
503
504	/*
505	* Find/make Chunk TLB entry for the mapping chunk.
506	*/
507	PPGMCHUNKR3MAP pMap;
508	const uint32_t idChunk = PGM_PAGE_GET_CHUNKID(pPage);
509	PPGMCHUNKR3MAPTLBE pTlbe = &pVM->pgm.s.ChunkR3Map.Tlb.aEntries[PGM_CHUNKR3MAPTLB_IDX(idChunk)];
510	if (pTlbe->idChunk == idChunk)
511	{
512	STAM_COUNTER_INC(&pVM->pgm.s.CTX_MID_Z(Stat,ChunkR3MapTlbHits));
513	pMap = pTlbe->pChunk;
514	}
515	else if (idChunk != NIL_GMM_CHUNKID)
516	{
517	STAM_COUNTER_INC(&pVM->pgm.s.CTX_MID_Z(Stat,ChunkR3MapTlbMisses));
518
519	/*
520	* Find the chunk, map it if necessary.
521	*/
522	pMap = (PPGMCHUNKR3MAP)RTAvlU32Get(&pVM->pgm.s.ChunkR3Map.pTree, idChunk);
523	if (!pMap)
524	{
525	#ifdef IN_RING0
526	int rc = VMMR0CallHost(pVM, VMMCALLHOST_PGM_MAP_CHUNK, idChunk);
527	AssertRCReturn(rc, rc);
528	pMap = (PPGMCHUNKR3MAP)RTAvlU32Get(&pVM->pgm.s.ChunkR3Map.pTree, idChunk);
529	Assert(pMap);
530	#else
531	int rc = pgmR3PhysChunkMap(pVM, idChunk, &pMap);
532	if (VBOX_FAILURE(rc))
533	return rc;
534	#endif
535	}
536
537	/*
538	* Enter it into the Chunk TLB.
539	*/
540	pTlbe->idChunk = idChunk;
541	pTlbe->pChunk = pMap;
542	pMap->iAge = 0;
543	}
544	else
545	{
546	Assert(PGM_PAGE_IS_ZERO(pPage));
547	*ppv = pVM->pgm.s.CTXALLSUFF(pvZeroPg);
548	*ppMap = NULL;
549	return VINF_SUCCESS;
550	}
551
552	ppv = (uint8_t )pMap->pv + (PGM_PAGE_GET_PAGE_IN_CHUNK(pPage) << PAGE_SHIFT);
553	*ppMap = pMap;
554	return VINF_SUCCESS;
555	#endif /* IN_RING3 */
556	}
557
558
559	#if !defined(IN_GC) && !defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
560	/**
561	* Load a guest page into the ring-3 physical TLB.
562	*
563	* @returns VBox status code.
564	* @retval VINF_SUCCESS on success
565	* @retval VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid physical address.
566	* @param pPGM The PGM instance pointer.
567	* @param GCPhys The guest physical address in question.
568	*/
569	int pgmPhysPageLoadIntoTlb(PPGM pPGM, RTGCPHYS GCPhys)
570	{
571	STAM_COUNTER_INC(&pPGM->CTX_MID_Z(Stat,PageMapTlbMisses));
572
573	/*
574	* Find the ram range.
575	* 99.8% of requests are expected to be in the first range.
576	*/
577	PPGMRAMRANGE pRam = pPGM->CTX_SUFF(pRamRanges);
578	RTGCPHYS off = GCPhys - pRam->GCPhys;
579	if (RT_UNLIKELY(off >= pRam->cb))
580	{
581	do
582	{
583	pRam = pRam->CTX_SUFF(pNext);
584	if (!pRam)
585	return VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS;
586	off = GCPhys - pRam->GCPhys;
587	} while (off >= pRam->cb);
588	}
589
590	/*
591	* Map the page.
592	* Make a special case for the zero page as it is kind of special.
593	*/
594	PPGMPAGE pPage = &pRam->aPages[off >> PAGE_SHIFT];
595	PPGMPAGEMAPTLBE pTlbe = &pPGM->CTXSUFF(PhysTlb).aEntries[PGM_PAGEMAPTLB_IDX(GCPhys)];
596	if (!PGM_PAGE_IS_ZERO(pPage))
597	{
598	void *pv;
599	PPGMPAGEMAP pMap;
600	int rc = pgmPhysPageMap(PGM2VM(pPGM), pPage, GCPhys, &pMap, &pv);
601	if (VBOX_FAILURE(rc))
602	return rc;
603	pTlbe->pMap = pMap;
604	pTlbe->pv = pv;
605	}
606	else
607	{
608	Assert(PGM_PAGE_GET_HCPHYS(pPage) == pPGM->HCPhysZeroPg);
609	pTlbe->pMap = NULL;
610	pTlbe->pv = pPGM->CTXALLSUFF(pvZeroPg);
611	}
612	pTlbe->pPage = pPage;
613	return VINF_SUCCESS;
614	}
615	#endif /* !IN_GC && !VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0 */
616
617
618	/**
619	* Requests the mapping of a guest page into the current context.
620	*
621	* This API should only be used for very short term, as it will consume
622	* scarse resources (R0 and GC) in the mapping cache. When you're done
623	* with the page, call PGMPhysReleasePageMappingLock() ASAP to release it.
624	*
625	* This API will assume your intention is to write to the page, and will
626	* therefore replace shared and zero pages. If you do not intend to modify
627	* the page, use the PGMPhysGCPhys2CCPtrReadOnly() API.
628	*
629	* @returns VBox status code.
630	* @retval VINF_SUCCESS on success.
631	* @retval VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical backing.
632	* @retval VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid physical address.
633	*
634	* @param pVM The VM handle.
635	* @param GCPhys The guest physical address of the page that should be mapped.
636	* @param ppv Where to store the address corresponding to GCPhys.
637	* @param pLock Where to store the lock information that PGMPhysReleasePageMappingLock needs.
638	*
639	* @remark Avoid calling this API from within critical sections (other than
640	* the PGM one) because of the deadlock risk.
641	* @thread Any thread.
642	*/
643	VMMDECL(int) PGMPhysGCPhys2CCPtr(PVM pVM, RTGCPHYS GCPhys, void **ppv, PPGMPAGEMAPLOCK pLock)
644	{
645	#ifdef VBOX_WITH_NEW_PHYS_CODE
646	# if defined(IN_GC) \|\| defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
647	/** @todo this needs to be fixed, it really ain't right. */
648	/* Until a physical TLB is implemented for GC or/and R0-darwin, let PGMDynMapGCPageEx handle it. */
649	return PGMDynMapGCPageOff(pVM, GCPhys, ppv);
650
651	#else
652	int rc = pgmLock(pVM);
653	AssertRCReturn(rc);
654
655	/*
656	* Query the Physical TLB entry for the page (may fail).
657	*/
658	PGMPHYSTLBE pTlbe;
659	int rc = pgmPhysPageQueryTlbe(&pVM->pgm.s, GCPhys, &pTlbe);
660	if (RT_SUCCESS(rc))
661	{
662	/*
663	* If the page is shared, the zero page, or being write monitored
664	* it must be converted to an page that's writable if possible.
665	*/
666	PPGMPAGE pPage = pTlbe->pPage;
667	if (RT_UNLIKELY(PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED))
668	{
669	rc = pgmPhysPageMakeWritable(pVM, pPage, GCPhys);
670	/** @todo stuff is missing here! */
671	}
672	if (RT_SUCCESS(rc))
673	{
674	/*
675	* Now, just perform the locking and calculate the return address.
676	*/
677	PPGMPAGEMAP pMap = pTlbe->pMap;
678	pMap->cRefs++;
679	if (RT_LIKELY(pPage->cLocks != PGM_PAGE_MAX_LOCKS))
680	if (RT_UNLIKELY(++pPage->cLocks == PGM_PAGE_MAX_LOCKS))
681	{
682	AssertMsgFailed(("%VGp is entering permanent locked state!\n", GCPhys));
683	pMap->cRefs++; /* Extra ref to prevent it from going away. */
684	}
685
686	ppv = (void )((uintptr_t)pTlbe->pv \| (GCPhys & PAGE_OFFSET_MASK));
687	pLock->pvPage = pPage;
688	pLock->pvMap = pMap;
689	}
690	}
691
692	pgmUnlock(pVM);
693	return rc;
694
695	#endif /* IN_RING3 \|\| IN_RING0 */
696
697	#else
698	/*
699	* Temporary fallback code.
700	*/
701	# if defined(IN_GC) \|\| defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
702	/** @todo @bugref{3202}: check up this path. */
703	return PGMDynMapGCPageOff(pVM, GCPhys, ppv);
704	# else
705	return PGMPhysGCPhys2HCPtr(pVM, GCPhys, 1, ppv);
706	# endif
707	#endif
708	}
709
710
711	/**
712	* Requests the mapping of a guest page into the current context.
713	*
714	* This API should only be used for very short term, as it will consume
715	* scarse resources (R0 and GC) in the mapping cache. When you're done
716	* with the page, call PGMPhysReleasePageMappingLock() ASAP to release it.
717	*
718	* @returns VBox status code.
719	* @retval VINF_SUCCESS on success.
720	* @retval VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical backing.
721	* @retval VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid physical address.
722	*
723	* @param pVM The VM handle.
724	* @param GCPhys The guest physical address of the page that should be mapped.
725	* @param ppv Where to store the address corresponding to GCPhys.
726	* @param pLock Where to store the lock information that PGMPhysReleasePageMappingLock needs.
727	*
728	* @remark Avoid calling this API from within critical sections (other than
729	* the PGM one) because of the deadlock risk.
730	* @thread Any thread.
731	*/
732	VMMDECL(int) PGMPhysGCPhys2CCPtrReadOnly(PVM pVM, RTGCPHYS GCPhys, void const **ppv, PPGMPAGEMAPLOCK pLock)
733	{
734	/** @todo implement this */
735	return PGMPhysGCPhys2CCPtr(pVM, GCPhys, (void **)ppv, pLock);
736	}
737
738
739	/**
740	* Requests the mapping of a guest page given by virtual address into the current context.
741	*
742	* This API should only be used for very short term, as it will consume
743	* scarse resources (R0 and GC) in the mapping cache. When you're done
744	* with the page, call PGMPhysReleasePageMappingLock() ASAP to release it.
745	*
746	* This API will assume your intention is to write to the page, and will
747	* therefore replace shared and zero pages. If you do not intend to modify
748	* the page, use the PGMPhysGCPtr2CCPtrReadOnly() API.
749	*
750	* @returns VBox status code.
751	* @retval VINF_SUCCESS on success.
752	* @retval VERR_PAGE_TABLE_NOT_PRESENT if the page directory for the virtual address isn't present.
753	* @retval VERR_PAGE_NOT_PRESENT if the page at the virtual address isn't present.
754	* @retval VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical backing.
755	* @retval VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid physical address.
756	*
757	* @param pVM The VM handle.
758	* @param GCPhys The guest physical address of the page that should be mapped.
759	* @param ppv Where to store the address corresponding to GCPhys.
760	* @param pLock Where to store the lock information that PGMPhysReleasePageMappingLock needs.
761	*
762	* @remark Avoid calling this API from within critical sections (other than
763	* the PGM one) because of the deadlock risk.
764	* @thread EMT
765	*/
766	VMMDECL(int) PGMPhysGCPtr2CCPtr(PVM pVM, RTGCPTR GCPtr, void **ppv, PPGMPAGEMAPLOCK pLock)
767	{
768	RTGCPHYS GCPhys;
769	int rc = PGMPhysGCPtr2GCPhys(pVM, GCPtr, &GCPhys);
770	if (VBOX_SUCCESS(rc))
771	rc = PGMPhysGCPhys2CCPtr(pVM, GCPhys, ppv, pLock);
772	return rc;
773	}
774
775
776	/**
777	* Requests the mapping of a guest page given by virtual address into the current context.
778	*
779	* This API should only be used for very short term, as it will consume
780	* scarse resources (R0 and GC) in the mapping cache. When you're done
781	* with the page, call PGMPhysReleasePageMappingLock() ASAP to release it.
782	*
783	* @returns VBox status code.
784	* @retval VINF_SUCCESS on success.
785	* @retval VERR_PAGE_TABLE_NOT_PRESENT if the page directory for the virtual address isn't present.
786	* @retval VERR_PAGE_NOT_PRESENT if the page at the virtual address isn't present.
787	* @retval VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical backing.
788	* @retval VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid physical address.
789	*
790	* @param pVM The VM handle.
791	* @param GCPhys The guest physical address of the page that should be mapped.
792	* @param ppv Where to store the address corresponding to GCPhys.
793	* @param pLock Where to store the lock information that PGMPhysReleasePageMappingLock needs.
794	*
795	* @remark Avoid calling this API from within critical sections (other than
796	* the PGM one) because of the deadlock risk.
797	* @thread EMT
798	*/
799	VMMDECL(int) PGMPhysGCPtr2CCPtrReadOnly(PVM pVM, RTGCPTR GCPtr, void const **ppv, PPGMPAGEMAPLOCK pLock)
800	{
801	RTGCPHYS GCPhys;
802	int rc = PGMPhysGCPtr2GCPhys(pVM, GCPtr, &GCPhys);
803	if (VBOX_SUCCESS(rc))
804	rc = PGMPhysGCPhys2CCPtrReadOnly(pVM, GCPhys, ppv, pLock);
805	return rc;
806	}
807
808
809	/**
810	* Release the mapping of a guest page.
811	*
812	* This is the counter part of PGMPhysGCPhys2CCPtr, PGMPhysGCPhys2CCPtrReadOnly
813	* PGMPhysGCPtr2CCPtr and PGMPhysGCPtr2CCPtrReadOnly.
814	*
815	* @param pVM The VM handle.
816	* @param pLock The lock structure initialized by the mapping function.
817	*/
818	VMMDECL(void) PGMPhysReleasePageMappingLock(PVM pVM, PPGMPAGEMAPLOCK pLock)
819	{
820	#ifdef VBOX_WITH_NEW_PHYS_CODE
821	#if defined(IN_GC) \|\| defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
822	/* currently nothing to do here. */
823	/* --- postponed
824	#elif defined(IN_RING0)
825	*/
826
827	#else /* IN_RING3 */
828	pgmLock(pVM);
829
830	PPGMPAGE pPage = (PPGMPAGE)pLock->pvPage;
831	Assert(pPage->cLocks >= 1);
832	if (pPage->cLocks != PGM_PAGE_MAX_LOCKS)
833	pPage->cLocks--;
834
835	PPGMCHUNKR3MAP pChunk = (PPGMCHUNKR3MAP)pLock->pvChunk;
836	Assert(pChunk->cRefs >= 1);
837	pChunk->cRefs--;
838	pChunk->iAge = 0;
839
840	pgmUnlock(pVM);
841	#endif /* IN_RING3 */
842	#else
843	NOREF(pVM);
844	NOREF(pLock);
845	#endif
846	}
847
848
849	/**
850	* Converts a GC physical address to a HC pointer.
851	*
852	* @returns VINF_SUCCESS on success.
853	* @returns VERR_PGM_PHYS_PAGE_RESERVED it it's a valid GC physical
854	* page but has no physical backing.
855	* @returns VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid
856	* GC physical address.
857	* @returns VERR_PGM_GCPHYS_RANGE_CROSSES_BOUNDARY if the range crosses
858	* a dynamic ram chunk boundary
859	* @param pVM The VM handle.
860	* @param GCPhys The GC physical address to convert.
861	* @param cbRange Physical range
862	* @param pHCPtr Where to store the HC pointer on success.
863	*/
864	VMMDECL(int) PGMPhysGCPhys2HCPtr(PVM pVM, RTGCPHYS GCPhys, RTUINT cbRange, PRTHCPTR pHCPtr) /** @todo @bugref{1865}: HCPtr -> R3Ptr */
865	{
866	#ifdef VBOX_WITH_NEW_PHYS_CODE
867	VM_ASSERT_EMT(pVM); /* no longer safe for use outside the EMT thread! */
868	#endif
869
870	if ((GCPhys & PGM_DYNAMIC_CHUNK_BASE_MASK) != ((GCPhys+cbRange-1) & PGM_DYNAMIC_CHUNK_BASE_MASK))
871	{
872	AssertMsgFailed(("%VGp - %VGp crosses a chunk boundary!!\n", GCPhys, GCPhys+cbRange));
873	LogRel(("PGMPhysGCPhys2HCPtr %VGp - %VGp crosses a chunk boundary!!\n", GCPhys, GCPhys+cbRange));
874	return VERR_PGM_GCPHYS_RANGE_CROSSES_BOUNDARY;
875	}
876
877	PPGMRAMRANGE pRam;
878	PPGMPAGE pPage;
879	int rc = pgmPhysGetPageAndRangeEx(&pVM->pgm.s, GCPhys, &pPage, &pRam);
880	if (VBOX_FAILURE(rc))
881	return rc;
882
883	#ifndef PGM_IGNORE_RAM_FLAGS_RESERVED
884	if (RT_UNLIKELY(PGM_PAGE_IS_RESERVED(pPage)))
885	return VERR_PGM_PHYS_PAGE_RESERVED;
886	#endif
887
888	RTGCPHYS off = GCPhys - pRam->GCPhys;
889	if (RT_UNLIKELY(off + cbRange > pRam->cb))
890	{
891	AssertMsgFailed(("%VGp - %VGp crosses a chunk boundary!!\n", GCPhys, GCPhys + cbRange));
892	return VERR_PGM_GCPHYS_RANGE_CROSSES_BOUNDARY;
893	}
894
895	if (pRam->fFlags & MM_RAM_FLAGS_DYNAMIC_ALLOC)
896	{
897	unsigned iChunk = (off >> PGM_DYNAMIC_CHUNK_SHIFT);
898	#if defined(IN_GC) \|\| defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0) /* ASSUMES this is a rare occurence */
899	PRTR3UINTPTR paChunkR3Ptrs = (PRTR3UINTPTR)MMHyperR3ToCC(pVM, pRam->paChunkR3Ptrs);
900	*pHCPtr = (RTHCPTR)(paChunkR3Ptrs[iChunk] + (off & PGM_DYNAMIC_CHUNK_OFFSET_MASK));
901	#else
902	*pHCPtr = (RTHCPTR)(pRam->paChunkR3Ptrs[iChunk] + (off & PGM_DYNAMIC_CHUNK_OFFSET_MASK));
903	#endif
904	}
905	else if (RT_LIKELY(pRam->pvR3))
906	*pHCPtr = (RTHCPTR)((RTR3UINTPTR)pRam->pvR3 + off);
907	else
908	return VERR_PGM_PHYS_PAGE_RESERVED;
909	return VINF_SUCCESS;
910	}
911
912
913	/**
914	* PGMPhysGCPhys2HCPtr convenience for use with assertions.
915	*
916	* @returns The HCPtr, NIL_RTHCPTR on failure.
917	* @param pVM The VM handle.
918	* @param GCPhys The GC Physical addresss.
919	* @param cbRange Physical range.
920	*/
921	VMMDECL(RTHCPTR) PGMPhysGCPhys2HCPtrAssert(PVM pVM, RTGCPHYS GCPhys, RTUINT cbRange) /** @todo @bugref{1865}: HCPtr -> R3Ptr */
922	{
923	RTHCPTR HCPtr;
924	int rc = PGMPhysGCPhys2HCPtr(pVM, GCPhys, cbRange, &HCPtr);
925	if (VBOX_SUCCESS(rc))
926	return HCPtr;
927	return NIL_RTHCPTR;
928	}
929
930
931	/**
932	* Converts a guest pointer to a GC physical address.
933	*
934	* This uses the current CR3/CR0/CR4 of the guest.
935	*
936	* @returns VBox status code.
937	* @param pVM The VM Handle
938	* @param GCPtr The guest pointer to convert.
939	* @param pGCPhys Where to store the GC physical address.
940	*/
941	VMMDECL(int) PGMPhysGCPtr2GCPhys(PVM pVM, RTGCPTR GCPtr, PRTGCPHYS pGCPhys)
942	{
943	int rc = PGM_GST_PFN(GetPage,pVM)(pVM, (RTGCUINTPTR)GCPtr, NULL, pGCPhys);
944	if (pGCPhys && VBOX_SUCCESS(rc))
945	*pGCPhys \|= (RTGCUINTPTR)GCPtr & PAGE_OFFSET_MASK;
946	return rc;
947	}
948
949
950	/**
951	* Converts a guest pointer to a HC physical address.
952	*
953	* This uses the current CR3/CR0/CR4 of the guest.
954	*
955	* @returns VBox status code.
956	* @param pVM The VM Handle
957	* @param GCPtr The guest pointer to convert.
958	* @param pHCPhys Where to store the HC physical address.
959	*/
960	VMMDECL(int) PGMPhysGCPtr2HCPhys(PVM pVM, RTGCPTR GCPtr, PRTHCPHYS pHCPhys)
961	{
962	RTGCPHYS GCPhys;
963	int rc = PGM_GST_PFN(GetPage,pVM)(pVM, (RTGCUINTPTR)GCPtr, NULL, &GCPhys);
964	if (VBOX_SUCCESS(rc))
965	rc = PGMPhysGCPhys2HCPhys(pVM, GCPhys \| ((RTGCUINTPTR)GCPtr & PAGE_OFFSET_MASK), pHCPhys);
966	return rc;
967	}
968
969
970	/**
971	* Converts a guest pointer to a HC pointer.
972	*
973	* This uses the current CR3/CR0/CR4 of the guest.
974	*
975	* @returns VBox status code.
976	* @param pVM The VM Handle
977	* @param GCPtr The guest pointer to convert.
978	* @param pHCPtr Where to store the HC virtual address.
979	*/
980	VMMDECL(int) PGMPhysGCPtr2HCPtr(PVM pVM, RTGCPTR GCPtr, PRTHCPTR pHCPtr) /** @todo @bugref{1865}: HCPtr -> R3Ptr */
981	{
982	#ifdef VBOX_WITH_NEW_PHYS_CODE
983	VM_ASSERT_EMT(pVM); /* no longer safe for use outside the EMT thread! */
984	#endif
985
986	RTGCPHYS GCPhys;
987	int rc = PGM_GST_PFN(GetPage,pVM)(pVM, (RTGCUINTPTR)GCPtr, NULL, &GCPhys);
988	if (VBOX_SUCCESS(rc))
989	rc = PGMPhysGCPhys2HCPtr(pVM, GCPhys \| ((RTGCUINTPTR)GCPtr & PAGE_OFFSET_MASK), 1 /* we always stay within one page */, pHCPtr);
990	return rc;
991	}
992
993
994	/**
995	* Converts a guest virtual address to a HC pointer by specfied CR3 and flags.
996	*
997	* @returns VBox status code.
998	* @param pVM The VM Handle
999	* @param GCPtr The guest pointer to convert.
1000	* @param cr3 The guest CR3.
1001	* @param fFlags Flags used for interpreting the PD correctly: X86_CR4_PSE and X86_CR4_PAE
1002	* @param pHCPtr Where to store the HC pointer.
1003	*
1004	* @remark This function is used by the REM at a time where PGM could
1005	* potentially not be in sync. It could also be used by a
1006	* future DBGF API to cpu state independent conversions.
1007	*/
1008	VMMDECL(int) PGMPhysGCPtr2HCPtrByGstCR3(PVM pVM, RTGCPTR GCPtr, uint64_t cr3, unsigned fFlags, PRTHCPTR pHCPtr) /** @todo @bugref{1865}: HCPtr -> R3Ptr */
1009	{
1010	#ifdef VBOX_WITH_NEW_PHYS_CODE
1011	VM_ASSERT_EMT(pVM); /* no longer safe for use outside the EMT thread! */
1012	#endif
1013	/*
1014	* PAE or 32-bit?
1015	*/
1016	Assert(!CPUMIsGuestInLongMode(pVM));
1017
1018	int rc;
1019	if (!(fFlags & X86_CR4_PAE))
1020	{
1021	PX86PD pPD;
1022	rc = PGM_GCPHYS_2_PTR(pVM, cr3 & X86_CR3_PAGE_MASK, &pPD);
1023	if (VBOX_SUCCESS(rc))
1024	{
1025	X86PDE Pde = pPD->a[(RTGCUINTPTR)GCPtr >> X86_PD_SHIFT];
1026	if (Pde.n.u1Present)
1027	{
1028	if ((fFlags & X86_CR4_PSE) && Pde.b.u1Size)
1029	{ /* (big page) */
1030	rc = PGMPhysGCPhys2HCPtr(pVM, pgmGstGet4MBPhysPage(&pVM->pgm.s, Pde) \| ((RTGCUINTPTR)GCPtr & X86_PAGE_4M_OFFSET_MASK), 1 /* we always stay within one page */, pHCPtr);
1031	}
1032	else
1033	{ /* (normal page) */
1034	PX86PT pPT;
1035	rc = PGM_GCPHYS_2_PTR(pVM, Pde.u & X86_PDE_PG_MASK, &pPT);
1036	if (VBOX_SUCCESS(rc))
1037	{
1038	X86PTE Pte = pPT->a[((RTGCUINTPTR)GCPtr >> X86_PT_SHIFT) & X86_PT_MASK];
1039	if (Pte.n.u1Present)
1040	return PGMPhysGCPhys2HCPtr(pVM, (Pte.u & X86_PTE_PG_MASK) \| ((RTGCUINTPTR)GCPtr & PAGE_OFFSET_MASK), 1 /* we always stay within one page */, pHCPtr);
1041	rc = VERR_PAGE_NOT_PRESENT;
1042	}
1043	}
1044	}
1045	else
1046	rc = VERR_PAGE_TABLE_NOT_PRESENT;
1047	}
1048	}
1049	else
1050	{
1051	/** @todo long mode! */
1052	Assert(PGMGetGuestMode(pVM) < PGMMODE_AMD64);
1053
1054	PX86PDPT pPdpt;
1055	rc = PGM_GCPHYS_2_PTR(pVM, cr3 & X86_CR3_PAE_PAGE_MASK, &pPdpt);
1056	if (VBOX_SUCCESS(rc))
1057	{
1058	X86PDPE Pdpe = pPdpt->a[((RTGCUINTPTR)GCPtr >> X86_PDPT_SHIFT) & X86_PDPT_MASK_PAE];
1059	if (Pdpe.n.u1Present)
1060	{
1061	PX86PDPAE pPD;
1062	rc = PGM_GCPHYS_2_PTR(pVM, Pdpe.u & X86_PDPE_PG_MASK, &pPD);
1063	if (VBOX_SUCCESS(rc))
1064	{
1065	X86PDEPAE Pde = pPD->a[((RTGCUINTPTR)GCPtr >> X86_PD_PAE_SHIFT) & X86_PD_PAE_MASK];
1066	if (Pde.n.u1Present)
1067	{
1068	if ((fFlags & X86_CR4_PSE) && Pde.b.u1Size)
1069	{ /* (big page) */
1070	rc = PGMPhysGCPhys2HCPtr(pVM, (Pde.u & X86_PDE2M_PAE_PG_MASK) \| ((RTGCUINTPTR)GCPtr & X86_PAGE_2M_OFFSET_MASK), 1 /* we always stay within one page */, pHCPtr);
1071	}
1072	else
1073	{ /* (normal page) */
1074	PX86PTPAE pPT;
1075	rc = PGM_GCPHYS_2_PTR(pVM, (Pde.u & X86_PDE_PAE_PG_MASK), &pPT);
1076	if (VBOX_SUCCESS(rc))
1077	{
1078	X86PTEPAE Pte = pPT->a[((RTGCUINTPTR)GCPtr >> X86_PT_PAE_SHIFT) & X86_PT_PAE_MASK];
1079	if (Pte.n.u1Present)
1080	return PGMPhysGCPhys2HCPtr(pVM, (Pte.u & X86_PTE_PAE_PG_MASK) \| ((RTGCUINTPTR)GCPtr & PAGE_OFFSET_MASK), 1 /* we always stay within one page */, pHCPtr);
1081	rc = VERR_PAGE_NOT_PRESENT;
1082	}
1083	}
1084	}
1085	else
1086	rc = VERR_PAGE_TABLE_NOT_PRESENT;
1087	}
1088	}
1089	else
1090	rc = VERR_PAGE_TABLE_NOT_PRESENT;
1091	}
1092	}
1093	return rc;
1094	}
1095
1096
1097	#undef LOG_GROUP
1098	#define LOG_GROUP LOG_GROUP_PGM_PHYS_ACCESS
1099
1100
1101	#ifdef IN_RING3
1102	/**
1103	* Cache PGMPhys memory access
1104	*
1105	* @param pVM VM Handle.
1106	* @param pCache Cache structure pointer
1107	* @param GCPhys GC physical address
1108	* @param pbHC HC pointer corresponding to physical page
1109	*
1110	* @thread EMT.
1111	*/
1112	static void pgmPhysCacheAdd(PVM pVM, PGMPHYSCACHE pCache, RTGCPHYS GCPhys, uint8_t pbR3)
1113	{
1114	uint32_t iCacheIndex;
1115
1116	Assert(VM_IS_EMT(pVM));
1117
1118	GCPhys = PHYS_PAGE_ADDRESS(GCPhys);
1119	pbR3 = (uint8_t *)PAGE_ADDRESS(pbR3);
1120
1121	iCacheIndex = ((GCPhys >> PAGE_SHIFT) & PGM_MAX_PHYSCACHE_ENTRIES_MASK);
1122
1123	ASMBitSet(&pCache->aEntries, iCacheIndex);
1124
1125	pCache->Entry[iCacheIndex].GCPhys = GCPhys;
1126	pCache->Entry[iCacheIndex].pbR3 = pbR3;
1127	}
1128	#endif
1129
1130	/**
1131	* Read physical memory.
1132	*
1133	* This API respects access handlers and MMIO. Use PGMPhysSimpleReadGCPhys() if you
1134	* want to ignore those.
1135	*
1136	* @param pVM VM Handle.
1137	* @param GCPhys Physical address start reading from.
1138	* @param pvBuf Where to put the read bits.
1139	* @param cbRead How many bytes to read.
1140	*/
1141	VMMDECL(void) PGMPhysRead(PVM pVM, RTGCPHYS GCPhys, void *pvBuf, size_t cbRead)
1142	{
1143	#ifdef IN_RING3
1144	bool fGrabbedLock = false;
1145	#endif
1146
1147	AssertMsg(cbRead > 0, ("don't even think about reading zero bytes!\n"));
1148	if (cbRead == 0)
1149	return;
1150
1151	LogFlow(("PGMPhysRead: %VGp %d\n", GCPhys, cbRead));
1152
1153	#ifdef IN_RING3
1154	if (!VM_IS_EMT(pVM))
1155	{
1156	pgmLock(pVM);
1157	fGrabbedLock = true;
1158	}
1159	#endif
1160
1161	/*
1162	* Copy loop on ram ranges.
1163	*/
1164	PPGMRAMRANGE pRam = pVM->pgm.s.CTX_SUFF(pRamRanges);
1165	for (;;)
1166	{
1167	/* Find range. */
1168	while (pRam && GCPhys > pRam->GCPhysLast)
1169	pRam = pRam->CTX_SUFF(pNext);
1170	/* Inside range or not? */
1171	if (pRam && GCPhys >= pRam->GCPhys)
1172	{
1173	/*
1174	* Must work our way thru this page by page.
1175	*/
1176	RTGCPHYS off = GCPhys - pRam->GCPhys;
1177	while (off < pRam->cb)
1178	{
1179	unsigned iPage = off >> PAGE_SHIFT;
1180	PPGMPAGE pPage = &pRam->aPages[iPage];
1181	size_t cb;
1182
1183	/* Physical chunk in dynamically allocated range not present? */
1184	if (RT_UNLIKELY(!PGM_PAGE_GET_HCPHYS(pPage)))
1185	{
1186	/* Treat it as reserved; return zeros */
1187	cb = PAGE_SIZE - (off & PAGE_OFFSET_MASK);
1188	if (cb >= cbRead)
1189	{
1190	memset(pvBuf, 0, cbRead);
1191	goto end;
1192	}
1193	memset(pvBuf, 0, cb);
1194	}
1195	/* temp hacks, will be reorganized. */
1196	/*
1197	* Physical handler.
1198	*/
1199	else if ( RT_UNLIKELY(PGM_PAGE_GET_HNDL_PHYS_STATE(pPage) >= PGM_PAGE_HNDL_PHYS_STATE_ALL)
1200	&& !(pPage->HCPhys & MM_RAM_FLAGS_MMIO)) /// @todo PAGE FLAGS
1201	{
1202	int rc = VINF_PGM_HANDLER_DO_DEFAULT;
1203	cb = PAGE_SIZE - (off & PAGE_OFFSET_MASK);
1204
1205	#ifdef IN_RING3 /** @todo deal with this in GC and R0! */
1206	/* find and call the handler */
1207	PPGMPHYSHANDLER pNode = (PPGMPHYSHANDLER)RTAvlroGCPhysRangeGet(&pVM->pgm.s.pTreesR3->PhysHandlers, GCPhys);
1208	if (pNode && pNode->pfnHandlerR3)
1209	{
1210	size_t cbRange = pNode->Core.KeyLast - GCPhys + 1;
1211	if (cbRange < cb)
1212	cb = cbRange;
1213	if (cb > cbRead)
1214	cb = cbRead;
1215
1216	void *pvSrc = PGMRAMRANGE_GETHCPTR(pRam, off)
1217
1218	/** @note Dangerous assumption that HC handlers don't do anything that really requires an EMT lock! */
1219	rc = pNode->pfnHandlerR3(pVM, GCPhys, pvSrc, pvBuf, cb, PGMACCESSTYPE_READ, pNode->pvUserR3);
1220	}
1221	#endif /* IN_RING3 */
1222	if (rc == VINF_PGM_HANDLER_DO_DEFAULT)
1223	{
1224	#if defined(IN_GC) \|\| defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
1225	void *pvSrc = NULL;
1226	PGMDynMapHCPageOff(pVM, PGM_PAGE_GET_HCPHYS(pPage) + (off & PAGE_OFFSET_MASK), &pvSrc);
1227	#else
1228	void *pvSrc = PGMRAMRANGE_GETHCPTR(pRam, off)
1229	#endif
1230
1231	if (cb >= cbRead)
1232	{
1233	memcpy(pvBuf, pvSrc, cbRead);
1234	goto end;
1235	}
1236	memcpy(pvBuf, pvSrc, cb);
1237	}
1238	else if (cb >= cbRead)
1239	goto end;
1240	}
1241	/*
1242	* Virtual handlers.
1243	*/
1244	else if ( RT_UNLIKELY(PGM_PAGE_GET_HNDL_VIRT_STATE(pPage) >= PGM_PAGE_HNDL_VIRT_STATE_ALL)
1245	&& !(pPage->HCPhys & MM_RAM_FLAGS_MMIO)) /// @todo PAGE FLAGS
1246	{
1247	int rc = VINF_PGM_HANDLER_DO_DEFAULT;
1248	cb = PAGE_SIZE - (off & PAGE_OFFSET_MASK);
1249	#ifdef IN_RING3 /** @todo deal with this in GC and R0! */
1250	/* Search the whole tree for matching physical addresses (rather expensive!) */
1251	PPGMVIRTHANDLER pNode;
1252	unsigned iPage;
1253	int rc2 = pgmHandlerVirtualFindByPhysAddr(pVM, GCPhys, &pNode, &iPage);
1254	if (VBOX_SUCCESS(rc2) && pNode->pfnHandlerR3)
1255	{
1256	size_t cbRange = pNode->Core.KeyLast - GCPhys + 1;
1257	if (cbRange < cb)
1258	cb = cbRange;
1259	if (cb > cbRead)
1260	cb = cbRead;
1261	RTGCUINTPTR GCPtr = ((RTGCUINTPTR)pNode->Core.Key & PAGE_BASE_GC_MASK)
1262	+ (iPage << PAGE_SHIFT) + (off & PAGE_OFFSET_MASK);
1263
1264	void *pvSrc = PGMRAMRANGE_GETHCPTR(pRam, off)
1265
1266	/* Note: Dangerous assumption that HC handlers don't do anything that really requires an EMT lock! */
1267	rc = pNode->pfnHandlerR3(pVM, (RTGCPTR)GCPtr, pvSrc, pvBuf, cb, PGMACCESSTYPE_READ, 0);
1268	}
1269	#endif /* IN_RING3 */
1270	if (rc == VINF_PGM_HANDLER_DO_DEFAULT)
1271	{
1272	#if defined(IN_GC) \|\| defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
1273	void *pvSrc = NULL;
1274	PGMDynMapHCPageOff(pVM, PGM_PAGE_GET_HCPHYS(pPage) + (off & PAGE_OFFSET_MASK), &pvSrc);
1275	#else
1276	void *pvSrc = PGMRAMRANGE_GETHCPTR(pRam, off)
1277	#endif
1278	if (cb >= cbRead)
1279	{
1280	memcpy(pvBuf, pvSrc, cbRead);
1281	goto end;
1282	}
1283	memcpy(pvBuf, pvSrc, cb);
1284	}
1285	else if (cb >= cbRead)
1286	goto end;
1287	}
1288	else
1289	{
1290	switch (pPage->HCPhys & (MM_RAM_FLAGS_RESERVED \| MM_RAM_FLAGS_MMIO \| MM_RAM_FLAGS_ROM)) /** @todo PAGE FLAGS */
1291	{
1292	/*
1293	* Normal memory or ROM.
1294	*/
1295	case 0:
1296	case MM_RAM_FLAGS_ROM:
1297	case MM_RAM_FLAGS_ROM \| MM_RAM_FLAGS_RESERVED:
1298	//case MM_RAM_FLAGS_ROM \| MM_RAM_FLAGS_MMIO2: /* = shadow */ - //MMIO2 isn't in the mask.
1299	case MM_RAM_FLAGS_MMIO2: // MMIO2 isn't in the mask.
1300	{
1301	#if defined(IN_GC) \|\| defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
1302	void *pvSrc = NULL;
1303	PGMDynMapHCPageOff(pVM, PGM_PAGE_GET_HCPHYS(pPage) + (off & PAGE_OFFSET_MASK), &pvSrc);
1304	#else
1305	void *pvSrc = PGMRAMRANGE_GETHCPTR(pRam, off)
1306	#endif
1307	cb = PAGE_SIZE - (off & PAGE_OFFSET_MASK);
1308	if (cb >= cbRead)
1309	{
1310	#if defined(IN_RING3) && defined(PGM_PHYSMEMACCESS_CACHING)
1311	if (cbRead <= 4 && !fGrabbedLock /* i.e. EMT */)
1312	pgmPhysCacheAdd(pVM, &pVM->pgm.s.pgmphysreadcache, GCPhys, (uint8_t*)pvSrc);
1313	#endif /* IN_RING3 && PGM_PHYSMEMACCESS_CACHING */
1314	memcpy(pvBuf, pvSrc, cbRead);
1315	goto end;
1316	}
1317	memcpy(pvBuf, pvSrc, cb);
1318	break;
1319	}
1320
1321	/*
1322	* All reserved, nothing there.
1323	*/
1324	case MM_RAM_FLAGS_RESERVED:
1325	cb = PAGE_SIZE - (off & PAGE_OFFSET_MASK);
1326	if (cb >= cbRead)
1327	{
1328	memset(pvBuf, 0, cbRead);
1329	goto end;
1330	}
1331	memset(pvBuf, 0, cb);
1332	break;
1333
1334	/*
1335	* The rest needs to be taken more carefully.
1336	*/
1337	default:
1338	#if 1 /** @todo r=bird: Can you do this properly please. */
1339	/** @todo Try MMIO; quick hack */
1340	if (cbRead <= 8 && IOMMMIORead(pVM, GCPhys, (uint32_t *)pvBuf, cbRead) == VINF_SUCCESS)
1341	goto end;
1342	#endif
1343
1344	/** @todo fix me later. */
1345	AssertReleaseMsgFailed(("Unknown read at %VGp size %d implement the complex physical reading case %x\n",
1346	GCPhys, cbRead,
1347	pPage->HCPhys & (MM_RAM_FLAGS_RESERVED \| MM_RAM_FLAGS_MMIO \| MM_RAM_FLAGS_ROM))); /** @todo PAGE FLAGS */
1348	cb = PAGE_SIZE - (off & PAGE_OFFSET_MASK);
1349	break;
1350	}
1351	}
1352	cbRead -= cb;
1353	off += cb;
1354	pvBuf = (char *)pvBuf + cb;
1355	}
1356
1357	GCPhys = pRam->GCPhysLast + 1;
1358	}
1359	else
1360	{
1361	LogFlow(("PGMPhysRead: Unassigned %VGp size=%d\n", GCPhys, cbRead));
1362
1363	/*
1364	* Unassigned address space.
1365	*/
1366	size_t cb;
1367	if ( !pRam
1368	\|\| (cb = pRam->GCPhys - GCPhys) >= cbRead)
1369	{
1370	memset(pvBuf, 0, cbRead);
1371	goto end;
1372	}
1373
1374	memset(pvBuf, 0, cb);
1375	cbRead -= cb;
1376	pvBuf = (char *)pvBuf + cb;
1377	GCPhys += cb;
1378	}
1379	}
1380	end:
1381	#ifdef IN_RING3
1382	if (fGrabbedLock)
1383	pgmUnlock(pVM);
1384	#endif
1385	return;
1386	}
1387
1388	/**
1389	* Write to physical memory.
1390	*
1391	* This API respects access handlers and MMIO. Use PGMPhysSimpleReadGCPhys() if you
1392	* want to ignore those.
1393	*
1394	* @param pVM VM Handle.
1395	* @param GCPhys Physical address to write to.
1396	* @param pvBuf What to write.
1397	* @param cbWrite How many bytes to write.
1398	*/
1399	VMMDECL(void) PGMPhysWrite(PVM pVM, RTGCPHYS GCPhys, const void *pvBuf, size_t cbWrite)
1400	{
1401	#ifdef IN_RING3
1402	bool fGrabbedLock = false;
1403	#endif
1404
1405	AssertMsg(!pVM->pgm.s.fNoMorePhysWrites, ("Calling PGMPhysWrite after pgmR3Save()!\n"));
1406	AssertMsg(cbWrite > 0, ("don't even think about writing zero bytes!\n"));
1407	if (cbWrite == 0)
1408	return;
1409
1410	LogFlow(("PGMPhysWrite: %VGp %d\n", GCPhys, cbWrite));
1411
1412	#ifdef IN_RING3
1413	if (!VM_IS_EMT(pVM))
1414	{
1415	pgmLock(pVM);
1416	fGrabbedLock = true;
1417	}
1418	#endif
1419	/*
1420	* Copy loop on ram ranges.
1421	*/
1422	PPGMRAMRANGE pRam = pVM->pgm.s.CTX_SUFF(pRamRanges);
1423	for (;;)
1424	{
1425	/* Find range. */
1426	while (pRam && GCPhys > pRam->GCPhysLast)
1427	pRam = pRam->CTX_SUFF(pNext);
1428	/* Inside range or not? */
1429	if (pRam && GCPhys >= pRam->GCPhys)
1430	{
1431	/*
1432	* Must work our way thru this page by page.
1433	*/
1434	unsigned off = GCPhys - pRam->GCPhys;
1435	while (off < pRam->cb)
1436	{
1437	unsigned iPage = off >> PAGE_SHIFT;
1438	PPGMPAGE pPage = &pRam->aPages[iPage];
1439
1440	/* Physical chunk in dynamically allocated range not present? */
1441	if (RT_UNLIKELY(!PGM_PAGE_GET_HCPHYS(pPage)))
1442	{
1443	int rc;
1444	#ifdef IN_RING3
1445	if (fGrabbedLock)
1446	{
1447	pgmUnlock(pVM);
1448	rc = pgmr3PhysGrowRange(pVM, GCPhys);
1449	if (rc == VINF_SUCCESS)
1450	PGMPhysWrite(pVM, GCPhys, pvBuf, cbWrite); /* try again; can't assume pRam is still valid (paranoia) */
1451	return;
1452	}
1453	rc = pgmr3PhysGrowRange(pVM, GCPhys);
1454	#else
1455	rc = CTXALLMID(VMM, CallHost)(pVM, VMMCALLHOST_PGM_RAM_GROW_RANGE, GCPhys);
1456	#endif
1457	if (rc != VINF_SUCCESS)
1458	goto end;
1459	}
1460
1461	size_t cb;
1462	/* temporary hack, will reogranize is later. */
1463	/*
1464	* Virtual handlers
1465	*/
1466	if ( PGM_PAGE_HAS_ACTIVE_VIRTUAL_HANDLERS(pPage)
1467	&& !(pPage->HCPhys & MM_RAM_FLAGS_MMIO)) /// @todo PAGE FLAGS
1468	{
1469	if (PGM_PAGE_HAS_ACTIVE_PHYSICAL_HANDLERS(pPage))
1470	{
1471	/*
1472	* Physical write handler + virtual write handler.
1473	* Consider this a quick workaround for the CSAM + shadow caching problem.
1474	*
1475	* We hand it to the shadow caching first since it requires the unchanged
1476	* data. CSAM will have to put up with it already being changed.
1477	*/
1478	int rc = VINF_PGM_HANDLER_DO_DEFAULT;
1479	cb = PAGE_SIZE - (off & PAGE_OFFSET_MASK);
1480	#ifdef IN_RING3 /** @todo deal with this in GC and R0! */
1481	/* 1. The physical handler */
1482	PPGMPHYSHANDLER pPhysNode = (PPGMPHYSHANDLER)RTAvlroGCPhysRangeGet(&pVM->pgm.s.pTreesR3->PhysHandlers, GCPhys);
1483	if (pPhysNode && pPhysNode->pfnHandlerR3)
1484	{
1485	size_t cbRange = pPhysNode->Core.KeyLast - GCPhys + 1;
1486	if (cbRange < cb)
1487	cb = cbRange;
1488	if (cb > cbWrite)
1489	cb = cbWrite;
1490
1491	void *pvDst = PGMRAMRANGE_GETHCPTR(pRam, off)
1492
1493	/* Note! Dangerous assumption that R3 handlers don't do anything that really requires an EMT lock! */
1494	rc = pPhysNode->pfnHandlerR3(pVM, GCPhys, pvDst, (void *)pvBuf, cb, PGMACCESSTYPE_WRITE, pPhysNode->pvUserR3);
1495	}
1496
1497	/* 2. The virtual handler (will see incorrect data) */
1498	PPGMVIRTHANDLER pVirtNode;
1499	unsigned iPage;
1500	int rc2 = pgmHandlerVirtualFindByPhysAddr(pVM, GCPhys, &pVirtNode, &iPage);
1501	if (VBOX_SUCCESS(rc2) && pVirtNode->pfnHandlerR3)
1502	{
1503	size_t cbRange = pVirtNode->Core.KeyLast - GCPhys + 1;
1504	if (cbRange < cb)
1505	cb = cbRange;
1506	if (cb > cbWrite)
1507	cb = cbWrite;
1508	RTGCUINTPTR GCPtr = ((RTGCUINTPTR)pVirtNode->Core.Key & PAGE_BASE_GC_MASK)
1509	+ (iPage << PAGE_SHIFT) + (off & PAGE_OFFSET_MASK);
1510
1511	void *pvDst = PGMRAMRANGE_GETHCPTR(pRam, off)
1512
1513	/* Note! Dangerous assumption that R3 handlers don't do anything that really requires an EMT lock! */
1514	rc2 = pVirtNode->pfnHandlerR3(pVM, (RTGCPTR)GCPtr, pvDst, (void *)pvBuf, cb, PGMACCESSTYPE_WRITE, 0);
1515	if ( ( rc2 != VINF_PGM_HANDLER_DO_DEFAULT
1516	&& rc == VINF_PGM_HANDLER_DO_DEFAULT)
1517	\|\| ( VBOX_FAILURE(rc2)
1518	&& VBOX_SUCCESS(rc)))
1519	rc = rc2;
1520	}
1521	#endif /* IN_RING3 */
1522	if (rc == VINF_PGM_HANDLER_DO_DEFAULT)
1523	{
1524	#if defined(IN_GC) \|\| defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
1525	void *pvDst = NULL;
1526	PGMDynMapHCPageOff(pVM, PGM_PAGE_GET_HCPHYS(pPage) + (off & PAGE_OFFSET_MASK), &pvDst);
1527	#else
1528	void *pvDst = PGMRAMRANGE_GETHCPTR(pRam, off)
1529	#endif
1530	if (cb >= cbWrite)
1531	{
1532	memcpy(pvDst, pvBuf, cbWrite);
1533	goto end;
1534	}
1535	memcpy(pvDst, pvBuf, cb);
1536	}
1537	else if (cb >= cbWrite)
1538	goto end;
1539	}
1540	else
1541	{
1542	int rc = VINF_PGM_HANDLER_DO_DEFAULT;
1543	cb = PAGE_SIZE - (off & PAGE_OFFSET_MASK);
1544	#ifdef IN_RING3
1545	/** @todo deal with this in GC and R0! */
1546	/* Search the whole tree for matching physical addresses (rather expensive!) */
1547	PPGMVIRTHANDLER pNode;
1548	unsigned iPage;
1549	int rc2 = pgmHandlerVirtualFindByPhysAddr(pVM, GCPhys, &pNode, &iPage);
1550	if (VBOX_SUCCESS(rc2) && pNode->pfnHandlerR3)
1551	{
1552	size_t cbRange = pNode->Core.KeyLast - GCPhys + 1;
1553	if (cbRange < cb)
1554	cb = cbRange;
1555	if (cb > cbWrite)
1556	cb = cbWrite;
1557	RTGCUINTPTR GCPtr = ((RTGCUINTPTR)pNode->Core.Key & PAGE_BASE_GC_MASK)
1558	+ (iPage << PAGE_SHIFT) + (off & PAGE_OFFSET_MASK);
1559
1560	void *pvDst = PGMRAMRANGE_GETHCPTR(pRam, off)
1561
1562	/* Note! Dangerous assumption that R3 handlers don't do anything that really requires an EMT lock! */
1563	rc = pNode->pfnHandlerR3(pVM, (RTGCPTR)GCPtr, pvDst, (void *)pvBuf, cb, PGMACCESSTYPE_WRITE, 0);
1564	}
1565	#endif /* IN_RING3 */
1566	if (rc == VINF_PGM_HANDLER_DO_DEFAULT)
1567	{
1568	#if defined(IN_GC) \|\| defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
1569	void *pvDst = NULL;
1570	PGMDynMapHCPageOff(pVM, PGM_PAGE_GET_HCPHYS(pPage) + (off & PAGE_OFFSET_MASK), &pvDst);
1571	#else
1572	void *pvDst = PGMRAMRANGE_GETHCPTR(pRam, off)
1573	#endif
1574	if (cb >= cbWrite)
1575	{
1576	memcpy(pvDst, pvBuf, cbWrite);
1577	goto end;
1578	}
1579	memcpy(pvDst, pvBuf, cb);
1580	}
1581	else if (cb >= cbWrite)
1582	goto end;
1583	}
1584	}
1585	/*
1586	* Physical handler.
1587	*/
1588	else if ( RT_UNLIKELY(PGM_PAGE_GET_HNDL_PHYS_STATE(pPage) >= PGM_PAGE_HNDL_PHYS_STATE_WRITE)
1589	&& !(pPage->HCPhys & MM_RAM_FLAGS_MMIO)) /// @todo PAGE FLAGS
1590	{
1591	int rc = VINF_PGM_HANDLER_DO_DEFAULT;
1592	cb = PAGE_SIZE - (off & PAGE_OFFSET_MASK);
1593	#ifdef IN_RING3 /** @todo deal with this in GC and R0! */
1594	/* find and call the handler */
1595	PPGMPHYSHANDLER pNode = (PPGMPHYSHANDLER)RTAvlroGCPhysRangeGet(&pVM->pgm.s.pTreesR3->PhysHandlers, GCPhys);
1596	if (pNode && pNode->pfnHandlerR3)
1597	{
1598	size_t cbRange = pNode->Core.KeyLast - GCPhys + 1;
1599	if (cbRange < cb)
1600	cb = cbRange;
1601	if (cb > cbWrite)
1602	cb = cbWrite;
1603
1604	void *pvDst = PGMRAMRANGE_GETHCPTR(pRam, off)
1605
1606	/** @todo Dangerous assumption that HC handlers don't do anything that really requires an EMT lock! */
1607	rc = pNode->pfnHandlerR3(pVM, GCPhys, pvDst, (void *)pvBuf, cb, PGMACCESSTYPE_WRITE, pNode->pvUserR3);
1608	}
1609	#endif /* IN_RING3 */
1610	if (rc == VINF_PGM_HANDLER_DO_DEFAULT)
1611	{
1612	#if defined(IN_GC) \|\| defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
1613	void *pvDst = NULL;
1614	PGMDynMapHCPageOff(pVM, PGM_PAGE_GET_HCPHYS(pPage) + (off & PAGE_OFFSET_MASK), &pvDst);
1615	#else
1616	void *pvDst = PGMRAMRANGE_GETHCPTR(pRam, off)
1617	#endif
1618	if (cb >= cbWrite)
1619	{
1620	memcpy(pvDst, pvBuf, cbWrite);
1621	goto end;
1622	}
1623	memcpy(pvDst, pvBuf, cb);
1624	}
1625	else if (cb >= cbWrite)
1626	goto end;
1627	}
1628	else
1629	{
1630	/** @todo r=bird: missing MM_RAM_FLAGS_ROM here, we shall not allow anyone to overwrite the ROM! */
1631	switch (pPage->HCPhys & (MM_RAM_FLAGS_RESERVED \| MM_RAM_FLAGS_MMIO \| MM_RAM_FLAGS_MMIO2)) /** @todo PAGE FLAGS */
1632	{
1633	/*
1634	* Normal memory, MMIO2 or writable shadow ROM.
1635	*/
1636	case 0:
1637	case MM_RAM_FLAGS_MMIO2:
1638	case MM_RAM_FLAGS_ROM \| MM_RAM_FLAGS_MMIO2: /* shadow rom */
1639	{
1640	#if defined(IN_GC) \|\| defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
1641	void *pvDst = NULL;
1642	PGMDynMapHCPageOff(pVM, PGM_PAGE_GET_HCPHYS(pPage) + (off & PAGE_OFFSET_MASK), &pvDst);
1643	#else
1644	void *pvDst = PGMRAMRANGE_GETHCPTR(pRam, off)
1645	#endif
1646	cb = PAGE_SIZE - (off & PAGE_OFFSET_MASK);
1647	if (cb >= cbWrite)
1648	{
1649	#if defined(IN_RING3) && defined(PGM_PHYSMEMACCESS_CACHING)
1650	if (cbWrite <= 4 && !fGrabbedLock /* i.e. EMT */)
1651	pgmPhysCacheAdd(pVM, &pVM->pgm.s.pgmphyswritecache, GCPhys, (uint8_t*)pvDst);
1652	#endif /* IN_RING3 && PGM_PHYSMEMACCESS_CACHING */
1653	memcpy(pvDst, pvBuf, cbWrite);
1654	goto end;
1655	}
1656	memcpy(pvDst, pvBuf, cb);
1657	break;
1658	}
1659
1660	/*
1661	* All reserved, nothing there.
1662	*/
1663	case MM_RAM_FLAGS_RESERVED:
1664	case MM_RAM_FLAGS_RESERVED \| MM_RAM_FLAGS_MMIO2:
1665	cb = PAGE_SIZE - (off & PAGE_OFFSET_MASK);
1666	if (cb >= cbWrite)
1667	goto end;
1668	break;
1669
1670
1671	/*
1672	* The rest needs to be taken more carefully.
1673	*/
1674	default:
1675	#if 1 /** @todo r=bird: Can you do this properly please. */
1676	/** @todo Try MMIO; quick hack */
1677	if (cbWrite <= 8 && IOMMMIOWrite(pVM, GCPhys, (uint32_t )pvBuf, cbWrite) == VINF_SUCCESS)
1678	goto end;
1679	#endif
1680
1681	/** @todo fix me later. */
1682	AssertReleaseMsgFailed(("Unknown write at %VGp size %d implement the complex physical writing case %x\n",
1683	GCPhys, cbWrite,
1684	(pPage->HCPhys & (MM_RAM_FLAGS_RESERVED \| MM_RAM_FLAGS_MMIO \| MM_RAM_FLAGS_MMIO2)))); /** @todo PAGE FLAGS */
1685	/* skip the write */
1686	cb = cbWrite;
1687	break;
1688	}
1689	}
1690
1691	cbWrite -= cb;
1692	off += cb;
1693	pvBuf = (const char *)pvBuf + cb;
1694	}
1695
1696	GCPhys = pRam->GCPhysLast + 1;
1697	}
1698	else
1699	{
1700	/*
1701	* Unassigned address space.
1702	*/
1703	size_t cb;
1704	if ( !pRam
1705	\|\| (cb = pRam->GCPhys - GCPhys) >= cbWrite)
1706	goto end;
1707
1708	cbWrite -= cb;
1709	pvBuf = (const char *)pvBuf + cb;
1710	GCPhys += cb;
1711	}
1712	}
1713	end:
1714	#ifdef IN_RING3
1715	if (fGrabbedLock)
1716	pgmUnlock(pVM);
1717	#endif
1718	return;
1719	}
1720
1721	#ifndef IN_GC /* Ring 0 & 3 only. (Just not needed in GC.) */
1722
1723	/**
1724	* Read from guest physical memory by GC physical address, bypassing
1725	* MMIO and access handlers.
1726	*
1727	* @returns VBox status.
1728	* @param pVM VM handle.
1729	* @param pvDst The destination address.
1730	* @param GCPhysSrc The source address (GC physical address).
1731	* @param cb The number of bytes to read.
1732	*/
1733	VMMDECL(int) PGMPhysSimpleReadGCPhys(PVM pVM, void *pvDst, RTGCPHYS GCPhysSrc, size_t cb)
1734	{
1735	/*
1736	* Treat the first page as a special case.
1737	*/
1738	if (!cb)
1739	return VINF_SUCCESS;
1740
1741	/* map the 1st page */
1742	void const *pvSrc;
1743	PGMPAGEMAPLOCK Lock;
1744	int rc = PGMPhysGCPhys2CCPtrReadOnly(pVM, GCPhysSrc, &pvSrc, &Lock);
1745	if (RT_FAILURE(rc))
1746	return rc;
1747
1748	/* optimize for the case where access is completely within the first page. */
1749	size_t cbPage = PAGE_SIZE - (GCPhysSrc & PAGE_OFFSET_MASK);
1750	if (RT_LIKELY(cb <= cbPage))
1751	{
1752	memcpy(pvDst, pvSrc, cb);
1753	PGMPhysReleasePageMappingLock(pVM, &Lock);
1754	return VINF_SUCCESS;
1755	}
1756
1757	/* copy to the end of the page. */
1758	memcpy(pvDst, pvSrc, cbPage);
1759	PGMPhysReleasePageMappingLock(pVM, &Lock);
1760	GCPhysSrc += cbPage;
1761	pvDst = (uint8_t *)pvDst + cbPage;
1762	cb -= cbPage;
1763
1764	/*
1765	* Page by page.
1766	*/
1767	for (;;)
1768	{
1769	/* map the page */
1770	rc = PGMPhysGCPhys2CCPtrReadOnly(pVM, GCPhysSrc, &pvSrc, &Lock);
1771	if (RT_FAILURE(rc))
1772	return rc;
1773
1774	/* last page? */
1775	if (cb <= PAGE_SIZE)
1776	{
1777	memcpy(pvDst, pvSrc, cb);
1778	PGMPhysReleasePageMappingLock(pVM, &Lock);
1779	return VINF_SUCCESS;
1780	}
1781
1782	/* copy the entire page and advance */
1783	memcpy(pvDst, pvSrc, PAGE_SIZE);
1784	PGMPhysReleasePageMappingLock(pVM, &Lock);
1785	GCPhysSrc += PAGE_SIZE;
1786	pvDst = (uint8_t *)pvDst + PAGE_SIZE;
1787	cb -= PAGE_SIZE;
1788	}
1789	/* won't ever get here. */
1790	}
1791
1792
1793	/**
1794	* Write to guest physical memory referenced by GC pointer.
1795	* Write memory to GC physical address in guest physical memory.
1796	*
1797	* This will bypass MMIO and access handlers.
1798	*
1799	* @returns VBox status.
1800	* @param pVM VM handle.
1801	* @param GCPhysDst The GC physical address of the destination.
1802	* @param pvSrc The source buffer.
1803	* @param cb The number of bytes to write.
1804	*/
1805	VMMDECL(int) PGMPhysSimpleWriteGCPhys(PVM pVM, RTGCPHYS GCPhysDst, const void *pvSrc, size_t cb)
1806	{
1807	LogFlow(("PGMPhysSimpleWriteGCPhys: %RGp %zu\n", GCPhysDst, cb));
1808
1809	/*
1810	* Treat the first page as a special case.
1811	*/
1812	if (!cb)
1813	return VINF_SUCCESS;
1814
1815	/* map the 1st page */
1816	void *pvDst;
1817	PGMPAGEMAPLOCK Lock;
1818	int rc = PGMPhysGCPhys2CCPtr(pVM, GCPhysDst, &pvDst, &Lock);
1819	if (RT_FAILURE(rc))
1820	return rc;
1821
1822	/* optimize for the case where access is completely within the first page. */
1823	size_t cbPage = PAGE_SIZE - (GCPhysDst & PAGE_OFFSET_MASK);
1824	if (RT_LIKELY(cb <= cbPage))
1825	{
1826	memcpy(pvDst, pvSrc, cb);
1827	PGMPhysReleasePageMappingLock(pVM, &Lock);
1828	return VINF_SUCCESS;
1829	}
1830
1831	/* copy to the end of the page. */
1832	memcpy(pvDst, pvSrc, cbPage);
1833	PGMPhysReleasePageMappingLock(pVM, &Lock);
1834	GCPhysDst += cbPage;
1835	pvSrc = (const uint8_t *)pvSrc + cbPage;
1836	cb -= cbPage;
1837
1838	/*
1839	* Page by page.
1840	*/
1841	for (;;)
1842	{
1843	/* map the page */
1844	rc = PGMPhysGCPhys2CCPtr(pVM, GCPhysDst, &pvDst, &Lock);
1845	if (RT_FAILURE(rc))
1846	return rc;
1847
1848	/* last page? */
1849	if (cb <= PAGE_SIZE)
1850	{
1851	memcpy(pvDst, pvSrc, cb);
1852	PGMPhysReleasePageMappingLock(pVM, &Lock);
1853	return VINF_SUCCESS;
1854	}
1855
1856	/* copy the entire page and advance */
1857	memcpy(pvDst, pvSrc, PAGE_SIZE);
1858	PGMPhysReleasePageMappingLock(pVM, &Lock);
1859	GCPhysDst += PAGE_SIZE;
1860	pvSrc = (const uint8_t *)pvSrc + PAGE_SIZE;
1861	cb -= PAGE_SIZE;
1862	}
1863	/* won't ever get here. */
1864	}
1865
1866
1867	/**
1868	* Read from guest physical memory referenced by GC pointer.
1869	*
1870	* This function uses the current CR3/CR0/CR4 of the guest and will
1871	* bypass access handlers and not set any accessed bits.
1872	*
1873	* @returns VBox status.
1874	* @param pVM VM handle.
1875	* @param pvDst The destination address.
1876	* @param GCPtrSrc The source address (GC pointer).
1877	* @param cb The number of bytes to read.
1878	*/
1879	VMMDECL(int) PGMPhysSimpleReadGCPtr(PVM pVM, void *pvDst, RTGCPTR GCPtrSrc, size_t cb)
1880	{
1881	/*
1882	* Treat the first page as a special case.
1883	*/
1884	if (!cb)
1885	return VINF_SUCCESS;
1886
1887	/* map the 1st page */
1888	void const *pvSrc;
1889	PGMPAGEMAPLOCK Lock;
1890	int rc = PGMPhysGCPtr2CCPtrReadOnly(pVM, GCPtrSrc, &pvSrc, &Lock);
1891	if (RT_FAILURE(rc))
1892	return rc;
1893
1894	/* optimize for the case where access is completely within the first page. */
1895	size_t cbPage = PAGE_SIZE - ((RTGCUINTPTR)GCPtrSrc & PAGE_OFFSET_MASK);
1896	if (RT_LIKELY(cb <= cbPage))
1897	{
1898	memcpy(pvDst, pvSrc, cb);
1899	PGMPhysReleasePageMappingLock(pVM, &Lock);
1900	return VINF_SUCCESS;
1901	}
1902
1903	/* copy to the end of the page. */
1904	memcpy(pvDst, pvSrc, cbPage);
1905	PGMPhysReleasePageMappingLock(pVM, &Lock);
1906	GCPtrSrc = (RTGCPTR)((RTGCUINTPTR)GCPtrSrc + cbPage);
1907	pvDst = (uint8_t *)pvDst + cbPage;
1908	cb -= cbPage;
1909
1910	/*
1911	* Page by page.
1912	*/
1913	for (;;)
1914	{
1915	/* map the page */
1916	rc = PGMPhysGCPtr2CCPtrReadOnly(pVM, GCPtrSrc, &pvSrc, &Lock);
1917	if (RT_FAILURE(rc))
1918	return rc;
1919
1920	/* last page? */
1921	if (cb <= PAGE_SIZE)
1922	{
1923	memcpy(pvDst, pvSrc, cb);
1924	PGMPhysReleasePageMappingLock(pVM, &Lock);
1925	return VINF_SUCCESS;
1926	}
1927
1928	/* copy the entire page and advance */
1929	memcpy(pvDst, pvSrc, PAGE_SIZE);
1930	PGMPhysReleasePageMappingLock(pVM, &Lock);
1931	GCPtrSrc = (RTGCPTR)((RTGCUINTPTR)GCPtrSrc + PAGE_SIZE);
1932	pvDst = (uint8_t *)pvDst + PAGE_SIZE;
1933	cb -= PAGE_SIZE;
1934	}
1935	/* won't ever get here. */
1936	}
1937
1938
1939	/**
1940	* Write to guest physical memory referenced by GC pointer.
1941	*
1942	* This function uses the current CR3/CR0/CR4 of the guest and will
1943	* bypass access handlers and not set dirty or accessed bits.
1944	*
1945	* @returns VBox status.
1946	* @param pVM VM handle.
1947	* @param GCPtrDst The destination address (GC pointer).
1948	* @param pvSrc The source address.
1949	* @param cb The number of bytes to write.
1950	*/
1951	VMMDECL(int) PGMPhysSimpleWriteGCPtr(PVM pVM, RTGCPTR GCPtrDst, const void *pvSrc, size_t cb)
1952	{
1953	/*
1954	* Treat the first page as a special case.
1955	*/
1956	if (!cb)
1957	return VINF_SUCCESS;
1958
1959	/* map the 1st page */
1960	void *pvDst;
1961	PGMPAGEMAPLOCK Lock;
1962	int rc = PGMPhysGCPtr2CCPtr(pVM, GCPtrDst, &pvDst, &Lock);
1963	if (RT_FAILURE(rc))
1964	return rc;
1965
1966	/* optimize for the case where access is completely within the first page. */
1967	size_t cbPage = PAGE_SIZE - ((RTGCUINTPTR)GCPtrDst & PAGE_OFFSET_MASK);
1968	if (RT_LIKELY(cb <= cbPage))
1969	{
1970	memcpy(pvDst, pvSrc, cb);
1971	PGMPhysReleasePageMappingLock(pVM, &Lock);
1972	return VINF_SUCCESS;
1973	}
1974
1975	/* copy to the end of the page. */
1976	memcpy(pvDst, pvSrc, cbPage);
1977	PGMPhysReleasePageMappingLock(pVM, &Lock);
1978	GCPtrDst = (RTGCPTR)((RTGCUINTPTR)GCPtrDst + cbPage);
1979	pvSrc = (const uint8_t *)pvSrc + cbPage;
1980	cb -= cbPage;
1981
1982	/*
1983	* Page by page.
1984	*/
1985	for (;;)
1986	{
1987	/* map the page */
1988	rc = PGMPhysGCPtr2CCPtr(pVM, GCPtrDst, &pvDst, &Lock);
1989	if (RT_FAILURE(rc))
1990	return rc;
1991
1992	/* last page? */
1993	if (cb <= PAGE_SIZE)
1994	{
1995	memcpy(pvDst, pvSrc, cb);
1996	PGMPhysReleasePageMappingLock(pVM, &Lock);
1997	return VINF_SUCCESS;
1998	}
1999
2000	/* copy the entire page and advance */
2001	memcpy(pvDst, pvSrc, PAGE_SIZE);
2002	PGMPhysReleasePageMappingLock(pVM, &Lock);
2003	GCPtrDst = (RTGCPTR)((RTGCUINTPTR)GCPtrDst + PAGE_SIZE);
2004	pvSrc = (const uint8_t *)pvSrc + PAGE_SIZE;
2005	cb -= PAGE_SIZE;
2006	}
2007	/* won't ever get here. */
2008	}
2009
2010
2011	/**
2012	* Write to guest physical memory referenced by GC pointer and update the PTE.
2013	*
2014	* This function uses the current CR3/CR0/CR4 of the guest and will
2015	* bypass access handlers but will set any dirty and accessed bits in the PTE.
2016	*
2017	* If you don't want to set the dirty bit, use PGMPhysSimpleWriteGCPtr().
2018	*
2019	* @returns VBox status.
2020	* @param pVM VM handle.
2021	* @param GCPtrDst The destination address (GC pointer).
2022	* @param pvSrc The source address.
2023	* @param cb The number of bytes to write.
2024	*/
2025	VMMDECL(int) PGMPhysSimpleDirtyWriteGCPtr(PVM pVM, RTGCPTR GCPtrDst, const void *pvSrc, size_t cb)
2026	{
2027	/*
2028	* Treat the first page as a special case.
2029	* Btw. this is the same code as in PGMPhyssimpleWriteGCPtr excep for the PGMGstModifyPage.
2030	*/
2031	if (!cb)
2032	return VINF_SUCCESS;
2033
2034	/* map the 1st page */
2035	void *pvDst;
2036	PGMPAGEMAPLOCK Lock;
2037	int rc = PGMPhysGCPtr2CCPtr(pVM, GCPtrDst, &pvDst, &Lock);
2038	if (RT_FAILURE(rc))
2039	return rc;
2040
2041	/* optimize for the case where access is completely within the first page. */
2042	size_t cbPage = PAGE_SIZE - ((RTGCUINTPTR)GCPtrDst & PAGE_OFFSET_MASK);
2043	if (RT_LIKELY(cb <= cbPage))
2044	{
2045	memcpy(pvDst, pvSrc, cb);
2046	PGMPhysReleasePageMappingLock(pVM, &Lock);
2047	rc = PGMGstModifyPage(pVM, GCPtrDst, 1, X86_PTE_A \| X86_PTE_D, ~(uint64_t)(X86_PTE_A \| X86_PTE_D)); AssertRC(rc);
2048	return VINF_SUCCESS;
2049	}
2050
2051	/* copy to the end of the page. */
2052	memcpy(pvDst, pvSrc, cbPage);
2053	PGMPhysReleasePageMappingLock(pVM, &Lock);
2054	rc = PGMGstModifyPage(pVM, GCPtrDst, 1, X86_PTE_A \| X86_PTE_D, ~(uint64_t)(X86_PTE_A \| X86_PTE_D)); AssertRC(rc);
2055	GCPtrDst = (RTGCPTR)((RTGCUINTPTR)GCPtrDst + cbPage);
2056	pvSrc = (const uint8_t *)pvSrc + cbPage;
2057	cb -= cbPage;
2058
2059	/*
2060	* Page by page.
2061	*/
2062	for (;;)
2063	{
2064	/* map the page */
2065	rc = PGMPhysGCPtr2CCPtr(pVM, GCPtrDst, &pvDst, &Lock);
2066	if (RT_FAILURE(rc))
2067	return rc;
2068
2069	/* last page? */
2070	if (cb <= PAGE_SIZE)
2071	{
2072	memcpy(pvDst, pvSrc, cb);
2073	PGMPhysReleasePageMappingLock(pVM, &Lock);
2074	rc = PGMGstModifyPage(pVM, GCPtrDst, 1, X86_PTE_A \| X86_PTE_D, ~(uint64_t)(X86_PTE_A \| X86_PTE_D)); AssertRC(rc);
2075	return VINF_SUCCESS;
2076	}
2077
2078	/* copy the entire page and advance */
2079	memcpy(pvDst, pvSrc, PAGE_SIZE);
2080	PGMPhysReleasePageMappingLock(pVM, &Lock);
2081	rc = PGMGstModifyPage(pVM, GCPtrDst, 1, X86_PTE_A \| X86_PTE_D, ~(uint64_t)(X86_PTE_A \| X86_PTE_D)); AssertRC(rc);
2082	GCPtrDst = (RTGCPTR)((RTGCUINTPTR)GCPtrDst + PAGE_SIZE);
2083	pvSrc = (const uint8_t *)pvSrc + PAGE_SIZE;
2084	cb -= PAGE_SIZE;
2085	}
2086	/* won't ever get here. */
2087	}
2088
2089
2090	/**
2091	* Read from guest physical memory referenced by GC pointer.
2092	*
2093	* This function uses the current CR3/CR0/CR4 of the guest and will
2094	* respect access handlers and set accessed bits.
2095	*
2096	* @returns VBox status.
2097	* @param pVM VM handle.
2098	* @param pvDst The destination address.
2099	* @param GCPtrSrc The source address (GC pointer).
2100	* @param cb The number of bytes to read.
2101	*/
2102	VMMDECL(int) PGMPhysReadGCPtr(PVM pVM, void *pvDst, RTGCPTR GCPtrSrc, size_t cb)
2103	{
2104	RTGCPHYS GCPhys;
2105	int rc;
2106
2107	/*
2108	* Anything to do?
2109	*/
2110	if (!cb)
2111	return VINF_SUCCESS;
2112
2113	LogFlow(("PGMPhysReadGCPtr: %VGv %d\n", GCPtrSrc, cb));
2114
2115	/*
2116	* Optimize reads within a single page.
2117	*/
2118	if (((RTGCUINTPTR)GCPtrSrc & PAGE_OFFSET_MASK) + cb <= PAGE_SIZE)
2119	{
2120	/* Convert virtual to physical address */
2121	rc = PGMPhysGCPtr2GCPhys(pVM, GCPtrSrc, &GCPhys);
2122	AssertRCReturn(rc, rc);
2123
2124	/* mark the guest page as accessed. */
2125	rc = PGMGstModifyPage(pVM, GCPtrSrc, 1, X86_PTE_A, ~(uint64_t)(X86_PTE_A));
2126	AssertRC(rc);
2127
2128	PGMPhysRead(pVM, GCPhys, pvDst, cb);
2129	return VINF_SUCCESS;
2130	}
2131
2132	/*
2133	* Page by page.
2134	*/
2135	for (;;)
2136	{
2137	/* Convert virtual to physical address */
2138	rc = PGMPhysGCPtr2GCPhys(pVM, GCPtrSrc, &GCPhys);
2139	AssertRCReturn(rc, rc);
2140
2141	/* mark the guest page as accessed. */
2142	int rc = PGMGstModifyPage(pVM, GCPtrSrc, 1, X86_PTE_A, ~(uint64_t)(X86_PTE_A));
2143	AssertRC(rc);
2144
2145	/* copy */
2146	size_t cbRead = PAGE_SIZE - ((RTGCUINTPTR)GCPtrSrc & PAGE_OFFSET_MASK);
2147	if (cbRead >= cb)
2148	{
2149	PGMPhysRead(pVM, GCPhys, pvDst, cb);
2150	return VINF_SUCCESS;
2151	}
2152	PGMPhysRead(pVM, GCPhys, pvDst, cbRead);
2153
2154	/* next */
2155	cb -= cbRead;
2156	pvDst = (uint8_t *)pvDst + cbRead;
2157	GCPtrSrc += cbRead;
2158	}
2159	}
2160
2161
2162	/**
2163	* Write to guest physical memory referenced by GC pointer.
2164	*
2165	* This function uses the current CR3/CR0/CR4 of the guest and will
2166	* respect access handlers and set dirty and accessed bits.
2167	*
2168	* @returns VBox status.
2169	* @param pVM VM handle.
2170	* @param GCPtrDst The destination address (GC pointer).
2171	* @param pvSrc The source address.
2172	* @param cb The number of bytes to write.
2173	*/
2174	VMMDECL(int) PGMPhysWriteGCPtr(PVM pVM, RTGCPTR GCPtrDst, const void *pvSrc, size_t cb)
2175	{
2176	RTGCPHYS GCPhys;
2177	int rc;
2178
2179	/*
2180	* Anything to do?
2181	*/
2182	if (!cb)
2183	return VINF_SUCCESS;
2184
2185	LogFlow(("PGMPhysWriteGCPtr: %VGv %d\n", GCPtrDst, cb));
2186
2187	/*
2188	* Optimize writes within a single page.
2189	*/
2190	if (((RTGCUINTPTR)GCPtrDst & PAGE_OFFSET_MASK) + cb <= PAGE_SIZE)
2191	{
2192	/* Convert virtual to physical address */
2193	rc = PGMPhysGCPtr2GCPhys(pVM, GCPtrDst, &GCPhys);
2194	AssertRCReturn(rc, rc);
2195
2196	/* mark the guest page as accessed and dirty. */
2197	rc = PGMGstModifyPage(pVM, GCPtrDst, 1, X86_PTE_A \| X86_PTE_D, ~(uint64_t)(X86_PTE_A \| X86_PTE_D));
2198	AssertRC(rc);
2199
2200	PGMPhysWrite(pVM, GCPhys, pvSrc, cb);
2201	return VINF_SUCCESS;
2202	}
2203
2204	/*
2205	* Page by page.
2206	*/
2207	for (;;)
2208	{
2209	/* Convert virtual to physical address */
2210	rc = PGMPhysGCPtr2GCPhys(pVM, GCPtrDst, &GCPhys);
2211	AssertRCReturn(rc, rc);
2212
2213	/* mark the guest page as accessed and dirty. */
2214	rc = PGMGstModifyPage(pVM, GCPtrDst, 1, X86_PTE_A \| X86_PTE_D, ~(uint64_t)(X86_PTE_A \| X86_PTE_D));
2215	AssertRC(rc);
2216
2217	/* copy */
2218	size_t cbWrite = PAGE_SIZE - ((RTGCUINTPTR)GCPtrDst & PAGE_OFFSET_MASK);
2219	if (cbWrite >= cb)
2220	{
2221	PGMPhysWrite(pVM, GCPhys, pvSrc, cb);
2222	return VINF_SUCCESS;
2223	}
2224	PGMPhysWrite(pVM, GCPhys, pvSrc, cbWrite);
2225
2226	/* next */
2227	cb -= cbWrite;
2228	pvSrc = (uint8_t *)pvSrc + cbWrite;
2229	GCPtrDst += cbWrite;
2230	}
2231	}
2232
2233	#endif /* !IN_GC */
2234
2235	/**
2236	* Performs a read of guest virtual memory for instruction emulation.
2237	*
2238	* This will check permissions, raise exceptions and update the access bits.
2239	*
2240	* The current implementation will bypass all access handlers. It may later be
2241	* changed to at least respect MMIO.
2242	*
2243	*
2244	* @returns VBox status code suitable to scheduling.
2245	* @retval VINF_SUCCESS if the read was performed successfully.
2246	* @retval VINF_EM_RAW_GUEST_TRAP if an exception was raised but not dispatched yet.
2247	* @retval VINF_TRPM_XCPT_DISPATCHED if an exception was raised and dispatched.
2248	*
2249	* @param pVM The VM handle.
2250	* @param pCtxCore The context core.
2251	* @param pvDst Where to put the bytes we've read.
2252	* @param GCPtrSrc The source address.
2253	* @param cb The number of bytes to read. Not more than a page.
2254	*
2255	* @remark This function will dynamically map physical pages in GC. This may unmap
2256	* mappings done by the caller. Be careful!
2257	*/
2258	VMMDECL(int) PGMPhysInterpretedRead(PVM pVM, PCPUMCTXCORE pCtxCore, void *pvDst, RTGCUINTPTR GCPtrSrc, size_t cb)
2259	{
2260	Assert(cb <= PAGE_SIZE);
2261
2262	/** @todo r=bird: This isn't perfect!
2263	* -# It's not checking for reserved bits being 1.
2264	* -# It's not correctly dealing with the access bit.
2265	* -# It's not respecting MMIO memory or any other access handlers.
2266	*/
2267	/*
2268	* 1. Translate virtual to physical. This may fault.
2269	* 2. Map the physical address.
2270	* 3. Do the read operation.
2271	* 4. Set access bits if required.
2272	*/
2273	int rc;
2274	unsigned cb1 = PAGE_SIZE - (GCPtrSrc & PAGE_OFFSET_MASK);
2275	if (cb <= cb1)
2276	{
2277	/*
2278	* Not crossing pages.
2279	*/
2280	RTGCPHYS GCPhys;
2281	uint64_t fFlags;
2282	rc = PGM_GST_PFN(GetPage,pVM)(pVM, GCPtrSrc, &fFlags, &GCPhys);
2283	if (VBOX_SUCCESS(rc))
2284	{
2285	/** @todo we should check reserved bits ... */
2286	void *pvSrc;
2287	rc = PGM_GCPHYS_2_PTR(pVM, GCPhys, &pvSrc);
2288	switch (rc)
2289	{
2290	case VINF_SUCCESS:
2291	Log(("PGMPhysInterpretedRead: pvDst=%p pvSrc=%p cb=%d\n", pvDst, (uint8_t *)pvSrc + (GCPtrSrc & PAGE_OFFSET_MASK), cb));
2292	memcpy(pvDst, (uint8_t *)pvSrc + (GCPtrSrc & PAGE_OFFSET_MASK), cb);
2293	break;
2294	case VERR_PGM_PHYS_PAGE_RESERVED:
2295	case VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS:
2296	memset(pvDst, 0, cb); /** @todo this is wrong, it should be 0xff */
2297	break;
2298	default:
2299	return rc;
2300	}
2301
2302	/** @todo access bit emulation isn't 100% correct. */
2303	if (!(fFlags & X86_PTE_A))
2304	{
2305	rc = PGM_GST_PFN(ModifyPage,pVM)(pVM, GCPtrSrc, 1, X86_PTE_A, ~(uint64_t)X86_PTE_A);
2306	AssertRC(rc);
2307	}
2308	return VINF_SUCCESS;
2309	}
2310	}
2311	else
2312	{
2313	/*
2314	* Crosses pages.
2315	*/
2316	unsigned cb2 = cb - cb1;
2317	uint64_t fFlags1;
2318	RTGCPHYS GCPhys1;
2319	uint64_t fFlags2;
2320	RTGCPHYS GCPhys2;
2321	rc = PGM_GST_PFN(GetPage,pVM)(pVM, GCPtrSrc, &fFlags1, &GCPhys1);
2322	if (VBOX_SUCCESS(rc))
2323	rc = PGM_GST_PFN(GetPage,pVM)(pVM, GCPtrSrc + cb1, &fFlags2, &GCPhys2);
2324	if (VBOX_SUCCESS(rc))
2325	{
2326	/** @todo we should check reserved bits ... */
2327	AssertMsgFailed(("cb=%d cb1=%d cb2=%d GCPtrSrc=%VGv\n", cb, cb1, cb2, GCPtrSrc));
2328	void *pvSrc1;
2329	rc = PGM_GCPHYS_2_PTR(pVM, GCPhys1, &pvSrc1);
2330	switch (rc)
2331	{
2332	case VINF_SUCCESS:
2333	memcpy(pvDst, (uint8_t *)pvSrc1 + (GCPtrSrc & PAGE_OFFSET_MASK), cb1);
2334	break;
2335	case VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS:
2336	memset(pvDst, 0, cb1); /** @todo this is wrong, it should be 0xff */
2337	break;
2338	default:
2339	return rc;
2340	}
2341
2342	void *pvSrc2;
2343	rc = PGM_GCPHYS_2_PTR(pVM, GCPhys2, &pvSrc2);
2344	switch (rc)
2345	{
2346	case VINF_SUCCESS:
2347	memcpy((uint8_t *)pvDst + cb1, pvSrc2, cb2);
2348	break;
2349	case VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS:
2350	memset((uint8_t )pvDst + cb1, 0, cb2); /* @todo this is wrong, it should be 0xff */
2351	break;
2352	default:
2353	return rc;
2354	}
2355
2356	if (!(fFlags1 & X86_PTE_A))
2357	{
2358	rc = PGM_GST_PFN(ModifyPage,pVM)(pVM, GCPtrSrc, 1, X86_PTE_A, ~(uint64_t)X86_PTE_A);
2359	AssertRC(rc);
2360	}
2361	if (!(fFlags2 & X86_PTE_A))
2362	{
2363	rc = PGM_GST_PFN(ModifyPage,pVM)(pVM, GCPtrSrc + cb1, 1, X86_PTE_A, ~(uint64_t)X86_PTE_A);
2364	AssertRC(rc);
2365	}
2366	return VINF_SUCCESS;
2367	}
2368	}
2369
2370	/*
2371	* Raise a #PF.
2372	*/
2373	uint32_t uErr;
2374
2375	/* Get the current privilege level. */
2376	uint32_t cpl = CPUMGetGuestCPL(pVM, pCtxCore);
2377	switch (rc)
2378	{
2379	case VINF_SUCCESS:
2380	uErr = (cpl >= 2) ? X86_TRAP_PF_RSVD \| X86_TRAP_PF_US : X86_TRAP_PF_RSVD;
2381	break;
2382
2383	case VERR_PAGE_NOT_PRESENT:
2384	case VERR_PAGE_TABLE_NOT_PRESENT:
2385	uErr = (cpl >= 2) ? X86_TRAP_PF_US : 0;
2386	break;
2387
2388	default:
2389	AssertMsgFailed(("rc=%Vrc GCPtrSrc=%VGv cb=%#x\n", rc, GCPtrSrc, cb));
2390	return rc;
2391	}
2392	Log(("PGMPhysInterpretedRead: GCPtrSrc=%VGv cb=%#x -> #PF(%#x)\n", GCPtrSrc, cb, uErr));
2393	return TRPMRaiseXcptErrCR2(pVM, pCtxCore, X86_XCPT_PF, uErr, GCPtrSrc);
2394	}
2395
2396	/// @todo VMMDECL(int) PGMPhysInterpretedWrite(PVM pVM, PCPUMCTXCORE pCtxCore, RTGCPTR GCPtrDst, const void *pvSrc, size_t cb)
2397
2398

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp@ 13532

Download in other formats: