VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp@ 66920

Last change on this file since 66920 was 65919, checked in by vboxsync, 8 years ago

gcc 7: fall thru

  • Property svn:eol-style set to native
  • Property svn:keywords set to Id Revision
File size: 171.2 KB
Line 
1/* $Id: PGMAllPhys.cpp 65919 2017-03-01 18:24:27Z vboxsync $ */
2/** @file
3 * PGM - Page Manager and Monitor, Physical Memory Addressing.
4 */
5
6/*
7 * Copyright (C) 2006-2016 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*********************************************************************************************************************************
20* Header Files *
21*********************************************************************************************************************************/
22#define LOG_GROUP LOG_GROUP_PGM_PHYS
23#include <VBox/vmm/pgm.h>
24#include <VBox/vmm/trpm.h>
25#include <VBox/vmm/vmm.h>
26#include <VBox/vmm/iom.h>
27#include <VBox/vmm/em.h>
28#ifdef VBOX_WITH_REM
29# include <VBox/vmm/rem.h>
30#endif
31#include "PGMInternal.h"
32#include <VBox/vmm/vm.h>
33#include "PGMInline.h"
34#include <VBox/param.h>
35#include <VBox/err.h>
36#include <iprt/assert.h>
37#include <iprt/string.h>
38#include <iprt/asm-amd64-x86.h>
39#include <VBox/log.h>
40#ifdef IN_RING3
41# include <iprt/thread.h>
42#endif
43
44
45/*********************************************************************************************************************************
46* Defined Constants And Macros *
47*********************************************************************************************************************************/
48/** Enable the physical TLB. */
49#define PGM_WITH_PHYS_TLB
50
51/** @def PGM_HANDLER_PHYS_IS_VALID_STATUS
52 * Checks if valid physical access handler return code (normal handler, not PF).
53 *
54 * Checks if the given strict status code is one of the expected ones for a
55 * physical access handler in the current context.
56 *
57 * @returns true or false.
58 * @param a_rcStrict The status code.
59 * @param a_fWrite Whether it is a write or read being serviced.
60 *
61 * @remarks We wish to keep the list of statuses here as short as possible.
62 * When changing, please make sure to update the PGMPhysRead,
63 * PGMPhysWrite, PGMPhysReadGCPtr and PGMPhysWriteGCPtr docs too.
64 */
65#ifdef IN_RING3
66# define PGM_HANDLER_PHYS_IS_VALID_STATUS(a_rcStrict, a_fWrite) \
67 ( (a_rcStrict) == VINF_SUCCESS \
68 || (a_rcStrict) == VINF_PGM_HANDLER_DO_DEFAULT)
69#elif defined(IN_RING0) || defined(IN_RC)
70#define PGM_HANDLER_PHYS_IS_VALID_STATUS(a_rcStrict, a_fWrite) \
71 ( (a_rcStrict) == VINF_SUCCESS \
72 || (a_rcStrict) == VINF_PGM_HANDLER_DO_DEFAULT \
73 \
74 || (a_rcStrict) == ((a_fWrite) ? VINF_IOM_R3_MMIO_WRITE : VINF_IOM_R3_MMIO_READ) \
75 || (a_rcStrict) == VINF_IOM_R3_MMIO_READ_WRITE \
76 || ((a_rcStrict) == VINF_IOM_R3_MMIO_COMMIT_WRITE && (a_fWrite)) \
77 \
78 || ((a_fWrite) ? (a_rcStrict) == VINF_EM_RAW_EMULATE_IO_BLOCK : false) \
79 \
80 || (a_rcStrict) == VINF_EM_RAW_EMULATE_INSTR \
81 || (a_rcStrict) == VINF_EM_DBG_STOP \
82 || (a_rcStrict) == VINF_EM_DBG_EVENT \
83 || (a_rcStrict) == VINF_EM_DBG_BREAKPOINT \
84 || (a_rcStrict) == VINF_EM_OFF \
85 || (a_rcStrict) == VINF_EM_SUSPEND \
86 || (a_rcStrict) == VINF_EM_RESET \
87 )
88#else
89# error "Context?"
90#endif
91
92/** @def PGM_HANDLER_VIRT_IS_VALID_STATUS
93 * Checks if valid virtual access handler return code (normal handler, not PF).
94 *
95 * Checks if the given strict status code is one of the expected ones for a
96 * virtual access handler in the current context.
97 *
98 * @returns true or false.
99 * @param a_rcStrict The status code.
100 * @param a_fWrite Whether it is a write or read being serviced.
101 *
102 * @remarks We wish to keep the list of statuses here as short as possible.
103 * When changing, please make sure to update the PGMPhysRead,
104 * PGMPhysWrite, PGMPhysReadGCPtr and PGMPhysWriteGCPtr docs too.
105 */
106#ifdef IN_RING3
107# define PGM_HANDLER_VIRT_IS_VALID_STATUS(a_rcStrict, a_fWrite) \
108 ( (a_rcStrict) == VINF_SUCCESS \
109 || (a_rcStrict) == VINF_PGM_HANDLER_DO_DEFAULT)
110#elif defined(IN_RING0)
111# define PGM_HANDLER_VIRT_IS_VALID_STATUS(a_rcStrict, a_fWrite) \
112 (false /* no virtual handlers in ring-0! */ )
113#elif defined(IN_RC)
114# define PGM_HANDLER_VIRT_IS_VALID_STATUS(a_rcStrict, a_fWrite) \
115 ( (a_rcStrict) == VINF_SUCCESS \
116 || (a_rcStrict) == VINF_PGM_HANDLER_DO_DEFAULT \
117 \
118 || ((a_fWrite) ? (a_rcStrict) == VINF_EM_RAW_EMULATE_INSTR_GDT_FAULT : 0) \
119 || ((a_fWrite) ? (a_rcStrict) == VINF_EM_RAW_EMULATE_INSTR_LDT_FAULT : 0) \
120 || ((a_fWrite) ? (a_rcStrict) == VINF_EM_RAW_EMULATE_INSTR_TSS_FAULT : 0) \
121 || ((a_fWrite) ? (a_rcStrict) == VINF_EM_RAW_EMULATE_INSTR_IDT_FAULT : 0) \
122 || ((a_fWrite) ? (a_rcStrict) == VINF_SELM_SYNC_GDT : 0) \
123 || ((a_fWrite) ? (a_rcStrict) == VINF_CSAM_PENDING_ACTION : 0) \
124 || (a_rcStrict) == VINF_PATM_CHECK_PATCH_PAGE \
125 \
126 || (a_rcStrict) == VINF_EM_RAW_EMULATE_INSTR \
127 || (a_rcStrict) == VINF_EM_DBG_STOP \
128 || (a_rcStrict) == VINF_EM_DBG_EVENT \
129 || (a_rcStrict) == VINF_EM_DBG_BREAKPOINT \
130 )
131#else
132# error "Context?"
133#endif
134
135
136
137#ifndef IN_RING3
138
139/**
140 * @callback_method_impl{FNPGMPHYSHANDLER,
141 * Dummy for forcing ring-3 handling of the access.}
142 */
143DECLEXPORT(VBOXSTRICTRC)
144pgmPhysHandlerRedirectToHC(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys, void *pvPhys, void *pvBuf, size_t cbBuf,
145 PGMACCESSTYPE enmAccessType, PGMACCESSORIGIN enmOrigin, void *pvUser)
146{
147 NOREF(pVM); NOREF(pVCpu); NOREF(GCPhys); NOREF(pvPhys); NOREF(pvBuf); NOREF(cbBuf);
148 NOREF(enmAccessType); NOREF(enmOrigin); NOREF(pvUser);
149 return VINF_EM_RAW_EMULATE_INSTR;
150}
151
152
153/**
154 * @callback_method_impl{FNPGMRZPHYSPFHANDLER,
155 * Dummy for forcing ring-3 handling of the access.}
156 */
157VMMDECL(VBOXSTRICTRC) pgmPhysPfHandlerRedirectToHC(PVM pVM, PVMCPU pVCpu, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame,
158 RTGCPTR pvFault, RTGCPHYS GCPhysFault, void *pvUser)
159{
160 NOREF(pVM); NOREF(pVCpu); NOREF(uErrorCode); NOREF(pRegFrame); NOREF(pvFault); NOREF(GCPhysFault); NOREF(pvUser);
161 return VINF_EM_RAW_EMULATE_INSTR;
162}
163
164
165/**
166 * @callback_method_impl{FNPGMRZPHYSPFHANDLER,
167 * \#PF access handler callback for guest ROM range write access.}
168 *
169 * @remarks The @a pvUser argument points to the PGMROMRANGE.
170 */
171DECLEXPORT(VBOXSTRICTRC) pgmPhysRomWritePfHandler(PVM pVM, PVMCPU pVCpu, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame,
172 RTGCPTR pvFault, RTGCPHYS GCPhysFault, void *pvUser)
173{
174 int rc;
175 PPGMROMRANGE pRom = (PPGMROMRANGE)pvUser;
176 uint32_t iPage = (GCPhysFault - pRom->GCPhys) >> PAGE_SHIFT;
177 NOREF(uErrorCode); NOREF(pvFault);
178
179 Assert(uErrorCode & X86_TRAP_PF_RW); /* This shall not be used for read access! */
180
181 Assert(iPage < (pRom->cb >> PAGE_SHIFT));
182 switch (pRom->aPages[iPage].enmProt)
183 {
184 case PGMROMPROT_READ_ROM_WRITE_IGNORE:
185 case PGMROMPROT_READ_RAM_WRITE_IGNORE:
186 {
187 /*
188 * If it's a simple instruction which doesn't change the cpu state
189 * we will simply skip it. Otherwise we'll have to defer it to REM.
190 */
191 uint32_t cbOp;
192 PDISCPUSTATE pDis = &pVCpu->pgm.s.DisState;
193 rc = EMInterpretDisasCurrent(pVM, pVCpu, pDis, &cbOp);
194 if ( RT_SUCCESS(rc)
195 && pDis->uCpuMode == DISCPUMODE_32BIT /** @todo why does this matter? */
196 && !(pDis->fPrefix & (DISPREFIX_REPNE | DISPREFIX_REP | DISPREFIX_SEG)))
197 {
198 switch (pDis->bOpCode)
199 {
200 /** @todo Find other instructions we can safely skip, possibly
201 * adding this kind of detection to DIS or EM. */
202 case OP_MOV:
203 pRegFrame->rip += cbOp;
204 STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_SUFF(pStats)->StatRZGuestROMWriteHandled);
205 return VINF_SUCCESS;
206 }
207 }
208 break;
209 }
210
211 case PGMROMPROT_READ_RAM_WRITE_RAM:
212 pRom->aPages[iPage].LiveSave.fWrittenTo = true;
213 rc = PGMHandlerPhysicalPageTempOff(pVM, pRom->GCPhys, GCPhysFault & X86_PTE_PG_MASK);
214 AssertRC(rc);
215 break; /** @todo Must edit the shadow PT and restart the instruction, not use the interpreter! */
216
217 case PGMROMPROT_READ_ROM_WRITE_RAM:
218 /* Handle it in ring-3 because it's *way* easier there. */
219 pRom->aPages[iPage].LiveSave.fWrittenTo = true;
220 break;
221
222 default:
223 AssertMsgFailedReturn(("enmProt=%d iPage=%d GCPhysFault=%RGp\n",
224 pRom->aPages[iPage].enmProt, iPage, GCPhysFault),
225 VERR_IPE_NOT_REACHED_DEFAULT_CASE);
226 }
227
228 STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_SUFF(pStats)->StatRZGuestROMWriteUnhandled);
229 return VINF_EM_RAW_EMULATE_INSTR;
230}
231
232#endif /* !IN_RING3 */
233
234
235/**
236 * @callback_method_impl{FNPGMPHYSHANDLER,
237 * Access handler callback for ROM write accesses.}
238 *
239 * @remarks The @a pvUser argument points to the PGMROMRANGE.
240 */
241PGM_ALL_CB2_DECL(VBOXSTRICTRC)
242pgmPhysRomWriteHandler(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys, void *pvPhys, void *pvBuf, size_t cbBuf,
243 PGMACCESSTYPE enmAccessType, PGMACCESSORIGIN enmOrigin, void *pvUser)
244{
245 PPGMROMRANGE pRom = (PPGMROMRANGE)pvUser;
246 const uint32_t iPage = (GCPhys - pRom->GCPhys) >> PAGE_SHIFT;
247 Assert(iPage < (pRom->cb >> PAGE_SHIFT));
248 PPGMROMPAGE pRomPage = &pRom->aPages[iPage];
249 Log5(("pgmPhysRomWriteHandler: %d %c %#08RGp %#04zx\n", pRomPage->enmProt, enmAccessType == PGMACCESSTYPE_READ ? 'R' : 'W', GCPhys, cbBuf));
250 NOREF(pVCpu); NOREF(pvPhys); NOREF(enmOrigin);
251
252 if (enmAccessType == PGMACCESSTYPE_READ)
253 {
254 switch (pRomPage->enmProt)
255 {
256 /*
257 * Take the default action.
258 */
259 case PGMROMPROT_READ_ROM_WRITE_IGNORE:
260 case PGMROMPROT_READ_RAM_WRITE_IGNORE:
261 case PGMROMPROT_READ_ROM_WRITE_RAM:
262 case PGMROMPROT_READ_RAM_WRITE_RAM:
263 return VINF_PGM_HANDLER_DO_DEFAULT;
264
265 default:
266 AssertMsgFailedReturn(("enmProt=%d iPage=%d GCPhys=%RGp\n",
267 pRom->aPages[iPage].enmProt, iPage, GCPhys),
268 VERR_IPE_NOT_REACHED_DEFAULT_CASE);
269 }
270 }
271 else
272 {
273 Assert(enmAccessType == PGMACCESSTYPE_WRITE);
274 switch (pRomPage->enmProt)
275 {
276 /*
277 * Ignore writes.
278 */
279 case PGMROMPROT_READ_ROM_WRITE_IGNORE:
280 case PGMROMPROT_READ_RAM_WRITE_IGNORE:
281 return VINF_SUCCESS;
282
283 /*
284 * Write to the RAM page.
285 */
286 case PGMROMPROT_READ_ROM_WRITE_RAM:
287 case PGMROMPROT_READ_RAM_WRITE_RAM: /* yes this will get here too, it's *way* simpler that way. */
288 {
289 /* This should be impossible now, pvPhys doesn't work cross page anylonger. */
290 Assert(((GCPhys - pRom->GCPhys + cbBuf - 1) >> PAGE_SHIFT) == iPage);
291
292 /*
293 * Take the lock, do lazy allocation, map the page and copy the data.
294 *
295 * Note that we have to bypass the mapping TLB since it works on
296 * guest physical addresses and entering the shadow page would
297 * kind of screw things up...
298 */
299 int rc = pgmLock(pVM);
300 AssertRC(rc);
301
302 PPGMPAGE pShadowPage = &pRomPage->Shadow;
303 if (!PGMROMPROT_IS_ROM(pRomPage->enmProt))
304 {
305 pShadowPage = pgmPhysGetPage(pVM, GCPhys);
306 AssertLogRelReturn(pShadowPage, VERR_PGM_PHYS_PAGE_GET_IPE);
307 }
308
309 void *pvDstPage;
310 rc = pgmPhysPageMakeWritableAndMap(pVM, pShadowPage, GCPhys & X86_PTE_PG_MASK, &pvDstPage);
311 if (RT_SUCCESS(rc))
312 {
313 memcpy((uint8_t *)pvDstPage + (GCPhys & PAGE_OFFSET_MASK), pvBuf, cbBuf);
314 pRomPage->LiveSave.fWrittenTo = true;
315
316 AssertMsg( rc == VINF_SUCCESS
317 || ( rc == VINF_PGM_SYNC_CR3
318 && VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL))
319 , ("%Rrc\n", rc));
320 rc = VINF_SUCCESS;
321 }
322
323 pgmUnlock(pVM);
324 return rc;
325 }
326
327 default:
328 AssertMsgFailedReturn(("enmProt=%d iPage=%d GCPhys=%RGp\n",
329 pRom->aPages[iPage].enmProt, iPage, GCPhys),
330 VERR_IPE_NOT_REACHED_DEFAULT_CASE);
331 }
332 }
333}
334
335
336/**
337 * Invalidates the RAM range TLBs.
338 *
339 * @param pVM The cross context VM structure.
340 */
341void pgmPhysInvalidRamRangeTlbs(PVM pVM)
342{
343 pgmLock(pVM);
344 for (uint32_t i = 0; i < PGM_RAMRANGE_TLB_ENTRIES; i++)
345 {
346 pVM->pgm.s.apRamRangesTlbR3[i] = NIL_RTR3PTR;
347 pVM->pgm.s.apRamRangesTlbR0[i] = NIL_RTR0PTR;
348 pVM->pgm.s.apRamRangesTlbRC[i] = NIL_RTRCPTR;
349 }
350 pgmUnlock(pVM);
351}
352
353
354/**
355 * Tests if a value of type RTGCPHYS is negative if the type had been signed
356 * instead of unsigned.
357 *
358 * @returns @c true if negative, @c false if positive or zero.
359 * @param a_GCPhys The value to test.
360 * @todo Move me to iprt/types.h.
361 */
362#define RTGCPHYS_IS_NEGATIVE(a_GCPhys) ((a_GCPhys) & ((RTGCPHYS)1 << (sizeof(RTGCPHYS)*8 - 1)))
363
364
365/**
366 * Slow worker for pgmPhysGetRange.
367 *
368 * @copydoc pgmPhysGetRange
369 */
370PPGMRAMRANGE pgmPhysGetRangeSlow(PVM pVM, RTGCPHYS GCPhys)
371{
372 STAM_COUNTER_INC(&pVM->pgm.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,RamRangeTlbMisses));
373
374 PPGMRAMRANGE pRam = pVM->pgm.s.CTX_SUFF(pRamRangeTree);
375 while (pRam)
376 {
377 RTGCPHYS off = GCPhys - pRam->GCPhys;
378 if (off < pRam->cb)
379 {
380 pVM->pgm.s.CTX_SUFF(apRamRangesTlb)[PGM_RAMRANGE_TLB_IDX(GCPhys)] = pRam;
381 return pRam;
382 }
383 if (RTGCPHYS_IS_NEGATIVE(off))
384 pRam = pRam->CTX_SUFF(pLeft);
385 else
386 pRam = pRam->CTX_SUFF(pRight);
387 }
388 return NULL;
389}
390
391
392/**
393 * Slow worker for pgmPhysGetRangeAtOrAbove.
394 *
395 * @copydoc pgmPhysGetRangeAtOrAbove
396 */
397PPGMRAMRANGE pgmPhysGetRangeAtOrAboveSlow(PVM pVM, RTGCPHYS GCPhys)
398{
399 STAM_COUNTER_INC(&pVM->pgm.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,RamRangeTlbMisses));
400
401 PPGMRAMRANGE pLastLeft = NULL;
402 PPGMRAMRANGE pRam = pVM->pgm.s.CTX_SUFF(pRamRangeTree);
403 while (pRam)
404 {
405 RTGCPHYS off = GCPhys - pRam->GCPhys;
406 if (off < pRam->cb)
407 {
408 pVM->pgm.s.CTX_SUFF(apRamRangesTlb)[PGM_RAMRANGE_TLB_IDX(GCPhys)] = pRam;
409 return pRam;
410 }
411 if (RTGCPHYS_IS_NEGATIVE(off))
412 {
413 pLastLeft = pRam;
414 pRam = pRam->CTX_SUFF(pLeft);
415 }
416 else
417 pRam = pRam->CTX_SUFF(pRight);
418 }
419 return pLastLeft;
420}
421
422
423/**
424 * Slow worker for pgmPhysGetPage.
425 *
426 * @copydoc pgmPhysGetPage
427 */
428PPGMPAGE pgmPhysGetPageSlow(PVM pVM, RTGCPHYS GCPhys)
429{
430 STAM_COUNTER_INC(&pVM->pgm.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,RamRangeTlbMisses));
431
432 PPGMRAMRANGE pRam = pVM->pgm.s.CTX_SUFF(pRamRangeTree);
433 while (pRam)
434 {
435 RTGCPHYS off = GCPhys - pRam->GCPhys;
436 if (off < pRam->cb)
437 {
438 pVM->pgm.s.CTX_SUFF(apRamRangesTlb)[PGM_RAMRANGE_TLB_IDX(GCPhys)] = pRam;
439 return &pRam->aPages[off >> PAGE_SHIFT];
440 }
441
442 if (RTGCPHYS_IS_NEGATIVE(off))
443 pRam = pRam->CTX_SUFF(pLeft);
444 else
445 pRam = pRam->CTX_SUFF(pRight);
446 }
447 return NULL;
448}
449
450
451/**
452 * Slow worker for pgmPhysGetPageEx.
453 *
454 * @copydoc pgmPhysGetPageEx
455 */
456int pgmPhysGetPageExSlow(PVM pVM, RTGCPHYS GCPhys, PPPGMPAGE ppPage)
457{
458 STAM_COUNTER_INC(&pVM->pgm.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,RamRangeTlbMisses));
459
460 PPGMRAMRANGE pRam = pVM->pgm.s.CTX_SUFF(pRamRangeTree);
461 while (pRam)
462 {
463 RTGCPHYS off = GCPhys - pRam->GCPhys;
464 if (off < pRam->cb)
465 {
466 pVM->pgm.s.CTX_SUFF(apRamRangesTlb)[PGM_RAMRANGE_TLB_IDX(GCPhys)] = pRam;
467 *ppPage = &pRam->aPages[off >> PAGE_SHIFT];
468 return VINF_SUCCESS;
469 }
470
471 if (RTGCPHYS_IS_NEGATIVE(off))
472 pRam = pRam->CTX_SUFF(pLeft);
473 else
474 pRam = pRam->CTX_SUFF(pRight);
475 }
476
477 *ppPage = NULL;
478 return VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS;
479}
480
481
482/**
483 * Slow worker for pgmPhysGetPageAndRangeEx.
484 *
485 * @copydoc pgmPhysGetPageAndRangeEx
486 */
487int pgmPhysGetPageAndRangeExSlow(PVM pVM, RTGCPHYS GCPhys, PPPGMPAGE ppPage, PPGMRAMRANGE *ppRam)
488{
489 STAM_COUNTER_INC(&pVM->pgm.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,RamRangeTlbMisses));
490
491 PPGMRAMRANGE pRam = pVM->pgm.s.CTX_SUFF(pRamRangeTree);
492 while (pRam)
493 {
494 RTGCPHYS off = GCPhys - pRam->GCPhys;
495 if (off < pRam->cb)
496 {
497 pVM->pgm.s.CTX_SUFF(apRamRangesTlb)[PGM_RAMRANGE_TLB_IDX(GCPhys)] = pRam;
498 *ppRam = pRam;
499 *ppPage = &pRam->aPages[off >> PAGE_SHIFT];
500 return VINF_SUCCESS;
501 }
502
503 if (RTGCPHYS_IS_NEGATIVE(off))
504 pRam = pRam->CTX_SUFF(pLeft);
505 else
506 pRam = pRam->CTX_SUFF(pRight);
507 }
508
509 *ppRam = NULL;
510 *ppPage = NULL;
511 return VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS;
512}
513
514
515/**
516 * Checks if Address Gate 20 is enabled or not.
517 *
518 * @returns true if enabled.
519 * @returns false if disabled.
520 * @param pVCpu The cross context virtual CPU structure.
521 */
522VMMDECL(bool) PGMPhysIsA20Enabled(PVMCPU pVCpu)
523{
524 LogFlow(("PGMPhysIsA20Enabled %d\n", pVCpu->pgm.s.fA20Enabled));
525 return pVCpu->pgm.s.fA20Enabled;
526}
527
528
529/**
530 * Validates a GC physical address.
531 *
532 * @returns true if valid.
533 * @returns false if invalid.
534 * @param pVM The cross context VM structure.
535 * @param GCPhys The physical address to validate.
536 */
537VMMDECL(bool) PGMPhysIsGCPhysValid(PVM pVM, RTGCPHYS GCPhys)
538{
539 PPGMPAGE pPage = pgmPhysGetPage(pVM, GCPhys);
540 return pPage != NULL;
541}
542
543
544/**
545 * Checks if a GC physical address is a normal page,
546 * i.e. not ROM, MMIO or reserved.
547 *
548 * @returns true if normal.
549 * @returns false if invalid, ROM, MMIO or reserved page.
550 * @param pVM The cross context VM structure.
551 * @param GCPhys The physical address to check.
552 */
553VMMDECL(bool) PGMPhysIsGCPhysNormal(PVM pVM, RTGCPHYS GCPhys)
554{
555 PPGMPAGE pPage = pgmPhysGetPage(pVM, GCPhys);
556 return pPage
557 && PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_RAM;
558}
559
560
561/**
562 * Converts a GC physical address to a HC physical address.
563 *
564 * @returns VINF_SUCCESS on success.
565 * @returns VERR_PGM_PHYS_PAGE_RESERVED it it's a valid GC physical
566 * page but has no physical backing.
567 * @returns VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid
568 * GC physical address.
569 *
570 * @param pVM The cross context VM structure.
571 * @param GCPhys The GC physical address to convert.
572 * @param pHCPhys Where to store the HC physical address on success.
573 */
574VMM_INT_DECL(int) PGMPhysGCPhys2HCPhys(PVM pVM, RTGCPHYS GCPhys, PRTHCPHYS pHCPhys)
575{
576 pgmLock(pVM);
577 PPGMPAGE pPage;
578 int rc = pgmPhysGetPageEx(pVM, GCPhys, &pPage);
579 if (RT_SUCCESS(rc))
580 *pHCPhys = PGM_PAGE_GET_HCPHYS(pPage) | (GCPhys & PAGE_OFFSET_MASK);
581 pgmUnlock(pVM);
582 return rc;
583}
584
585
586/**
587 * Invalidates all page mapping TLBs.
588 *
589 * @param pVM The cross context VM structure.
590 */
591void pgmPhysInvalidatePageMapTLB(PVM pVM)
592{
593 pgmLock(pVM);
594 STAM_COUNTER_INC(&pVM->pgm.s.CTX_SUFF(pStats)->StatPageMapTlbFlushes);
595
596 /* Clear the shared R0/R3 TLB completely. */
597 for (unsigned i = 0; i < RT_ELEMENTS(pVM->pgm.s.PhysTlbHC.aEntries); i++)
598 {
599 pVM->pgm.s.PhysTlbHC.aEntries[i].GCPhys = NIL_RTGCPHYS;
600 pVM->pgm.s.PhysTlbHC.aEntries[i].pPage = 0;
601 pVM->pgm.s.PhysTlbHC.aEntries[i].pMap = 0;
602 pVM->pgm.s.PhysTlbHC.aEntries[i].pv = 0;
603 }
604
605 /** @todo clear the RC TLB whenever we add it. */
606
607 pgmUnlock(pVM);
608}
609
610
611/**
612 * Invalidates a page mapping TLB entry
613 *
614 * @param pVM The cross context VM structure.
615 * @param GCPhys GCPhys entry to flush
616 */
617void pgmPhysInvalidatePageMapTLBEntry(PVM pVM, RTGCPHYS GCPhys)
618{
619 PGM_LOCK_ASSERT_OWNER(pVM);
620
621 STAM_COUNTER_INC(&pVM->pgm.s.CTX_SUFF(pStats)->StatPageMapTlbFlushEntry);
622
623#ifdef IN_RC
624 unsigned idx = PGM_PAGER3MAPTLB_IDX(GCPhys);
625 pVM->pgm.s.PhysTlbHC.aEntries[idx].GCPhys = NIL_RTGCPHYS;
626 pVM->pgm.s.PhysTlbHC.aEntries[idx].pPage = 0;
627 pVM->pgm.s.PhysTlbHC.aEntries[idx].pMap = 0;
628 pVM->pgm.s.PhysTlbHC.aEntries[idx].pv = 0;
629#else
630 /* Clear the shared R0/R3 TLB entry. */
631 PPGMPAGEMAPTLBE pTlbe = &pVM->pgm.s.CTXSUFF(PhysTlb).aEntries[PGM_PAGEMAPTLB_IDX(GCPhys)];
632 pTlbe->GCPhys = NIL_RTGCPHYS;
633 pTlbe->pPage = 0;
634 pTlbe->pMap = 0;
635 pTlbe->pv = 0;
636#endif
637
638 /** @todo clear the RC TLB whenever we add it. */
639}
640
641/**
642 * Makes sure that there is at least one handy page ready for use.
643 *
644 * This will also take the appropriate actions when reaching water-marks.
645 *
646 * @returns VBox status code.
647 * @retval VINF_SUCCESS on success.
648 * @retval VERR_EM_NO_MEMORY if we're really out of memory.
649 *
650 * @param pVM The cross context VM structure.
651 *
652 * @remarks Must be called from within the PGM critical section. It may
653 * nip back to ring-3/0 in some cases.
654 */
655static int pgmPhysEnsureHandyPage(PVM pVM)
656{
657 AssertMsg(pVM->pgm.s.cHandyPages <= RT_ELEMENTS(pVM->pgm.s.aHandyPages), ("%d\n", pVM->pgm.s.cHandyPages));
658
659 /*
660 * Do we need to do anything special?
661 */
662#ifdef IN_RING3
663 if (pVM->pgm.s.cHandyPages <= RT_MAX(PGM_HANDY_PAGES_SET_FF, PGM_HANDY_PAGES_R3_ALLOC))
664#else
665 if (pVM->pgm.s.cHandyPages <= RT_MAX(PGM_HANDY_PAGES_SET_FF, PGM_HANDY_PAGES_RZ_TO_R3))
666#endif
667 {
668 /*
669 * Allocate pages only if we're out of them, or in ring-3, almost out.
670 */
671#ifdef IN_RING3
672 if (pVM->pgm.s.cHandyPages <= PGM_HANDY_PAGES_R3_ALLOC)
673#else
674 if (pVM->pgm.s.cHandyPages <= PGM_HANDY_PAGES_RZ_ALLOC)
675#endif
676 {
677 Log(("PGM: cHandyPages=%u out of %u -> allocate more; VM_FF_PGM_NO_MEMORY=%RTbool\n",
678 pVM->pgm.s.cHandyPages, RT_ELEMENTS(pVM->pgm.s.aHandyPages), VM_FF_IS_SET(pVM, VM_FF_PGM_NO_MEMORY) ));
679#ifdef IN_RING3
680 int rc = PGMR3PhysAllocateHandyPages(pVM);
681#else
682 int rc = VMMRZCallRing3NoCpu(pVM, VMMCALLRING3_PGM_ALLOCATE_HANDY_PAGES, 0);
683#endif
684 if (RT_UNLIKELY(rc != VINF_SUCCESS))
685 {
686 if (RT_FAILURE(rc))
687 return rc;
688 AssertMsgReturn(rc == VINF_EM_NO_MEMORY, ("%Rrc\n", rc), VERR_IPE_UNEXPECTED_INFO_STATUS);
689 if (!pVM->pgm.s.cHandyPages)
690 {
691 LogRel(("PGM: no more handy pages!\n"));
692 return VERR_EM_NO_MEMORY;
693 }
694 Assert(VM_FF_IS_SET(pVM, VM_FF_PGM_NEED_HANDY_PAGES));
695 Assert(VM_FF_IS_SET(pVM, VM_FF_PGM_NO_MEMORY));
696#ifdef IN_RING3
697# ifdef VBOX_WITH_REM
698 REMR3NotifyFF(pVM);
699# endif
700#else
701 VMCPU_FF_SET(VMMGetCpu(pVM), VMCPU_FF_TO_R3); /* paranoia */
702#endif
703 }
704 AssertMsgReturn( pVM->pgm.s.cHandyPages > 0
705 && pVM->pgm.s.cHandyPages <= RT_ELEMENTS(pVM->pgm.s.aHandyPages),
706 ("%u\n", pVM->pgm.s.cHandyPages),
707 VERR_PGM_HANDY_PAGE_IPE);
708 }
709 else
710 {
711 if (pVM->pgm.s.cHandyPages <= PGM_HANDY_PAGES_SET_FF)
712 VM_FF_SET(pVM, VM_FF_PGM_NEED_HANDY_PAGES);
713#ifndef IN_RING3
714 if (pVM->pgm.s.cHandyPages <= PGM_HANDY_PAGES_RZ_TO_R3)
715 {
716 Log(("PGM: VM_FF_TO_R3 - cHandyPages=%u out of %u\n", pVM->pgm.s.cHandyPages, RT_ELEMENTS(pVM->pgm.s.aHandyPages)));
717 VMCPU_FF_SET(VMMGetCpu(pVM), VMCPU_FF_TO_R3);
718 }
719#endif
720 }
721 }
722
723 return VINF_SUCCESS;
724}
725
726
727/**
728 * Replace a zero or shared page with new page that we can write to.
729 *
730 * @returns The following VBox status codes.
731 * @retval VINF_SUCCESS on success, pPage is modified.
732 * @retval VINF_PGM_SYNC_CR3 on success and a page pool flush is pending.
733 * @retval VERR_EM_NO_MEMORY if we're totally out of memory.
734 *
735 * @todo Propagate VERR_EM_NO_MEMORY up the call tree.
736 *
737 * @param pVM The cross context VM structure.
738 * @param pPage The physical page tracking structure. This will
739 * be modified on success.
740 * @param GCPhys The address of the page.
741 *
742 * @remarks Must be called from within the PGM critical section. It may
743 * nip back to ring-3/0 in some cases.
744 *
745 * @remarks This function shouldn't really fail, however if it does
746 * it probably means we've screwed up the size of handy pages and/or
747 * the low-water mark. Or, that some device I/O is causing a lot of
748 * pages to be allocated while while the host is in a low-memory
749 * condition. This latter should be handled elsewhere and in a more
750 * controlled manner, it's on the @bugref{3170} todo list...
751 */
752int pgmPhysAllocPage(PVM pVM, PPGMPAGE pPage, RTGCPHYS GCPhys)
753{
754 LogFlow(("pgmPhysAllocPage: %R[pgmpage] %RGp\n", pPage, GCPhys));
755
756 /*
757 * Prereqs.
758 */
759 PGM_LOCK_ASSERT_OWNER(pVM);
760 AssertMsg(PGM_PAGE_IS_ZERO(pPage) || PGM_PAGE_IS_SHARED(pPage), ("%R[pgmpage] %RGp\n", pPage, GCPhys));
761 Assert(!PGM_PAGE_IS_MMIO_OR_ALIAS(pPage));
762
763# ifdef PGM_WITH_LARGE_PAGES
764 /*
765 * Try allocate a large page if applicable.
766 */
767 if ( PGMIsUsingLargePages(pVM)
768 && PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_RAM)
769 {
770 RTGCPHYS GCPhysBase = GCPhys & X86_PDE2M_PAE_PG_MASK;
771 PPGMPAGE pBasePage;
772
773 int rc = pgmPhysGetPageEx(pVM, GCPhysBase, &pBasePage);
774 AssertRCReturn(rc, rc); /* paranoia; can't happen. */
775 if (PGM_PAGE_GET_PDE_TYPE(pBasePage) == PGM_PAGE_PDE_TYPE_DONTCARE)
776 {
777 rc = pgmPhysAllocLargePage(pVM, GCPhys);
778 if (rc == VINF_SUCCESS)
779 return rc;
780 }
781 /* Mark the base as type page table, so we don't check over and over again. */
782 PGM_PAGE_SET_PDE_TYPE(pVM, pBasePage, PGM_PAGE_PDE_TYPE_PT);
783
784 /* fall back to 4KB pages. */
785 }
786# endif
787
788 /*
789 * Flush any shadow page table mappings of the page.
790 * When VBOX_WITH_NEW_LAZY_PAGE_ALLOC isn't defined, there shouldn't be any.
791 */
792 bool fFlushTLBs = false;
793 int rc = pgmPoolTrackUpdateGCPhys(pVM, GCPhys, pPage, true /*fFlushTLBs*/, &fFlushTLBs);
794 AssertMsgReturn(rc == VINF_SUCCESS || rc == VINF_PGM_SYNC_CR3, ("%Rrc\n", rc), RT_FAILURE(rc) ? rc : VERR_IPE_UNEXPECTED_STATUS);
795
796 /*
797 * Ensure that we've got a page handy, take it and use it.
798 */
799 int rc2 = pgmPhysEnsureHandyPage(pVM);
800 if (RT_FAILURE(rc2))
801 {
802 if (fFlushTLBs)
803 PGM_INVL_ALL_VCPU_TLBS(pVM);
804 Assert(rc2 == VERR_EM_NO_MEMORY);
805 return rc2;
806 }
807 /* re-assert preconditions since pgmPhysEnsureHandyPage may do a context switch. */
808 PGM_LOCK_ASSERT_OWNER(pVM);
809 AssertMsg(PGM_PAGE_IS_ZERO(pPage) || PGM_PAGE_IS_SHARED(pPage), ("%R[pgmpage] %RGp\n", pPage, GCPhys));
810 Assert(!PGM_PAGE_IS_MMIO_OR_ALIAS(pPage));
811
812 uint32_t iHandyPage = --pVM->pgm.s.cHandyPages;
813 AssertMsg(iHandyPage < RT_ELEMENTS(pVM->pgm.s.aHandyPages), ("%d\n", iHandyPage));
814 Assert(pVM->pgm.s.aHandyPages[iHandyPage].HCPhysGCPhys != NIL_RTHCPHYS);
815 Assert(!(pVM->pgm.s.aHandyPages[iHandyPage].HCPhysGCPhys & ~X86_PTE_PAE_PG_MASK));
816 Assert(pVM->pgm.s.aHandyPages[iHandyPage].idPage != NIL_GMM_PAGEID);
817 Assert(pVM->pgm.s.aHandyPages[iHandyPage].idSharedPage == NIL_GMM_PAGEID);
818
819 /*
820 * There are one or two action to be taken the next time we allocate handy pages:
821 * - Tell the GMM (global memory manager) what the page is being used for.
822 * (Speeds up replacement operations - sharing and defragmenting.)
823 * - If the current backing is shared, it must be freed.
824 */
825 const RTHCPHYS HCPhys = pVM->pgm.s.aHandyPages[iHandyPage].HCPhysGCPhys;
826 pVM->pgm.s.aHandyPages[iHandyPage].HCPhysGCPhys = GCPhys & ~(RTGCPHYS)PAGE_OFFSET_MASK;
827
828 void const *pvSharedPage = NULL;
829 if (PGM_PAGE_IS_SHARED(pPage))
830 {
831 /* Mark this shared page for freeing/dereferencing. */
832 pVM->pgm.s.aHandyPages[iHandyPage].idSharedPage = PGM_PAGE_GET_PAGEID(pPage);
833 Assert(PGM_PAGE_GET_PAGEID(pPage) != NIL_GMM_PAGEID);
834
835 Log(("PGM: Replaced shared page %#x at %RGp with %#x / %RHp\n", PGM_PAGE_GET_PAGEID(pPage),
836 GCPhys, pVM->pgm.s.aHandyPages[iHandyPage].idPage, HCPhys));
837 STAM_COUNTER_INC(&pVM->pgm.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,PageReplaceShared));
838 pVM->pgm.s.cSharedPages--;
839
840 /* Grab the address of the page so we can make a copy later on. (safe) */
841 rc = pgmPhysPageMapReadOnly(pVM, pPage, GCPhys, &pvSharedPage);
842 AssertRC(rc);
843 }
844 else
845 {
846 Log2(("PGM: Replaced zero page %RGp with %#x / %RHp\n", GCPhys, pVM->pgm.s.aHandyPages[iHandyPage].idPage, HCPhys));
847 STAM_COUNTER_INC(&pVM->pgm.s.CTX_SUFF(pStats)->StatRZPageReplaceZero);
848 pVM->pgm.s.cZeroPages--;
849 }
850
851 /*
852 * Do the PGMPAGE modifications.
853 */
854 pVM->pgm.s.cPrivatePages++;
855 PGM_PAGE_SET_HCPHYS(pVM, pPage, HCPhys);
856 PGM_PAGE_SET_PAGEID(pVM, pPage, pVM->pgm.s.aHandyPages[iHandyPage].idPage);
857 PGM_PAGE_SET_STATE(pVM, pPage, PGM_PAGE_STATE_ALLOCATED);
858 PGM_PAGE_SET_PDE_TYPE(pVM, pPage, PGM_PAGE_PDE_TYPE_PT);
859 pgmPhysInvalidatePageMapTLBEntry(pVM, GCPhys);
860
861 /* Copy the shared page contents to the replacement page. */
862 if (pvSharedPage)
863 {
864 /* Get the virtual address of the new page. */
865 PGMPAGEMAPLOCK PgMpLck;
866 void *pvNewPage;
867 rc = pgmPhysGCPhys2CCPtrInternal(pVM, pPage, GCPhys, &pvNewPage, &PgMpLck); AssertRC(rc);
868 if (RT_SUCCESS(rc))
869 {
870 memcpy(pvNewPage, pvSharedPage, PAGE_SIZE); /** @todo todo write ASMMemCopyPage */
871 pgmPhysReleaseInternalPageMappingLock(pVM, &PgMpLck);
872 }
873 }
874
875 if ( fFlushTLBs
876 && rc != VINF_PGM_GCPHYS_ALIASED)
877 PGM_INVL_ALL_VCPU_TLBS(pVM);
878 return rc;
879}
880
881#ifdef PGM_WITH_LARGE_PAGES
882
883/**
884 * Replace a 2 MB range of zero pages with new pages that we can write to.
885 *
886 * @returns The following VBox status codes.
887 * @retval VINF_SUCCESS on success, pPage is modified.
888 * @retval VINF_PGM_SYNC_CR3 on success and a page pool flush is pending.
889 * @retval VERR_EM_NO_MEMORY if we're totally out of memory.
890 *
891 * @todo Propagate VERR_EM_NO_MEMORY up the call tree.
892 *
893 * @param pVM The cross context VM structure.
894 * @param GCPhys The address of the page.
895 *
896 * @remarks Must be called from within the PGM critical section. It may
897 * nip back to ring-3/0 in some cases.
898 */
899int pgmPhysAllocLargePage(PVM pVM, RTGCPHYS GCPhys)
900{
901 RTGCPHYS GCPhysBase = GCPhys & X86_PDE2M_PAE_PG_MASK;
902 LogFlow(("pgmPhysAllocLargePage: %RGp base %RGp\n", GCPhys, GCPhysBase));
903
904 /*
905 * Prereqs.
906 */
907 PGM_LOCK_ASSERT_OWNER(pVM);
908 Assert(PGMIsUsingLargePages(pVM));
909
910 PPGMPAGE pFirstPage;
911 int rc = pgmPhysGetPageEx(pVM, GCPhysBase, &pFirstPage);
912 if ( RT_SUCCESS(rc)
913 && PGM_PAGE_GET_TYPE(pFirstPage) == PGMPAGETYPE_RAM)
914 {
915 unsigned uPDEType = PGM_PAGE_GET_PDE_TYPE(pFirstPage);
916
917 /* Don't call this function for already allocated pages. */
918 Assert(uPDEType != PGM_PAGE_PDE_TYPE_PDE);
919
920 if ( uPDEType == PGM_PAGE_PDE_TYPE_DONTCARE
921 && PGM_PAGE_GET_STATE(pFirstPage) == PGM_PAGE_STATE_ZERO)
922 {
923 /* Lazy approach: check all pages in the 2 MB range.
924 * The whole range must be ram and unallocated. */
925 GCPhys = GCPhysBase;
926 unsigned iPage;
927 for (iPage = 0; iPage < _2M/PAGE_SIZE; iPage++)
928 {
929 PPGMPAGE pSubPage;
930 rc = pgmPhysGetPageEx(pVM, GCPhys, &pSubPage);
931 if ( RT_FAILURE(rc)
932 || PGM_PAGE_GET_TYPE(pSubPage) != PGMPAGETYPE_RAM /* Anything other than ram implies monitoring. */
933 || PGM_PAGE_GET_STATE(pSubPage) != PGM_PAGE_STATE_ZERO) /* Allocated, monitored or shared means we can't use a large page here */
934 {
935 LogFlow(("Found page %RGp with wrong attributes (type=%d; state=%d); cancel check. rc=%d\n", GCPhys, PGM_PAGE_GET_TYPE(pSubPage), PGM_PAGE_GET_STATE(pSubPage), rc));
936 break;
937 }
938 Assert(PGM_PAGE_GET_PDE_TYPE(pSubPage) == PGM_PAGE_PDE_TYPE_DONTCARE);
939 GCPhys += PAGE_SIZE;
940 }
941 if (iPage != _2M/PAGE_SIZE)
942 {
943 /* Failed. Mark as requiring a PT so we don't check the whole thing again in the future. */
944 STAM_REL_COUNTER_INC(&pVM->pgm.s.StatLargePageRefused);
945 PGM_PAGE_SET_PDE_TYPE(pVM, pFirstPage, PGM_PAGE_PDE_TYPE_PT);
946 return VERR_PGM_INVALID_LARGE_PAGE_RANGE;
947 }
948
949 /*
950 * Do the allocation.
951 */
952# ifdef IN_RING3
953 rc = PGMR3PhysAllocateLargeHandyPage(pVM, GCPhysBase);
954# else
955 rc = VMMRZCallRing3NoCpu(pVM, VMMCALLRING3_PGM_ALLOCATE_LARGE_HANDY_PAGE, GCPhysBase);
956# endif
957 if (RT_SUCCESS(rc))
958 {
959 Assert(PGM_PAGE_GET_STATE(pFirstPage) == PGM_PAGE_STATE_ALLOCATED);
960 pVM->pgm.s.cLargePages++;
961 return VINF_SUCCESS;
962 }
963
964 /* If we fail once, it most likely means the host's memory is too
965 fragmented; don't bother trying again. */
966 LogFlow(("pgmPhysAllocLargePage failed with %Rrc\n", rc));
967 PGMSetLargePageUsage(pVM, false);
968 return rc;
969 }
970 }
971 return VERR_PGM_INVALID_LARGE_PAGE_RANGE;
972}
973
974
975/**
976 * Recheck the entire 2 MB range to see if we can use it again as a large page.
977 *
978 * @returns The following VBox status codes.
979 * @retval VINF_SUCCESS on success, the large page can be used again
980 * @retval VERR_PGM_INVALID_LARGE_PAGE_RANGE if it can't be reused
981 *
982 * @param pVM The cross context VM structure.
983 * @param GCPhys The address of the page.
984 * @param pLargePage Page structure of the base page
985 */
986int pgmPhysRecheckLargePage(PVM pVM, RTGCPHYS GCPhys, PPGMPAGE pLargePage)
987{
988 STAM_REL_COUNTER_INC(&pVM->pgm.s.StatLargePageRecheck);
989
990 GCPhys &= X86_PDE2M_PAE_PG_MASK;
991
992 /* Check the base page. */
993 Assert(PGM_PAGE_GET_PDE_TYPE(pLargePage) == PGM_PAGE_PDE_TYPE_PDE_DISABLED);
994 if ( PGM_PAGE_GET_STATE(pLargePage) != PGM_PAGE_STATE_ALLOCATED
995 || PGM_PAGE_GET_TYPE(pLargePage) != PGMPAGETYPE_RAM
996 || PGM_PAGE_GET_HNDL_PHYS_STATE(pLargePage) != PGM_PAGE_HNDL_PHYS_STATE_NONE)
997 {
998 LogFlow(("pgmPhysRecheckLargePage: checks failed for base page %x %x %x\n", PGM_PAGE_GET_STATE(pLargePage), PGM_PAGE_GET_TYPE(pLargePage), PGM_PAGE_GET_HNDL_PHYS_STATE(pLargePage)));
999 return VERR_PGM_INVALID_LARGE_PAGE_RANGE;
1000 }
1001
1002 STAM_PROFILE_START(&pVM->pgm.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,IsValidLargePage), a);
1003 /* Check all remaining pages in the 2 MB range. */
1004 unsigned i;
1005 GCPhys += PAGE_SIZE;
1006 for (i = 1; i < _2M/PAGE_SIZE; i++)
1007 {
1008 PPGMPAGE pPage;
1009 int rc = pgmPhysGetPageEx(pVM, GCPhys, &pPage);
1010 AssertRCBreak(rc);
1011
1012 if ( PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED
1013 || PGM_PAGE_GET_PDE_TYPE(pPage) != PGM_PAGE_PDE_TYPE_PDE
1014 || PGM_PAGE_GET_TYPE(pPage) != PGMPAGETYPE_RAM
1015 || PGM_PAGE_GET_HNDL_PHYS_STATE(pPage) != PGM_PAGE_HNDL_PHYS_STATE_NONE)
1016 {
1017 LogFlow(("pgmPhysRecheckLargePage: checks failed for page %d; %x %x %x\n", i, PGM_PAGE_GET_STATE(pPage), PGM_PAGE_GET_TYPE(pPage), PGM_PAGE_GET_HNDL_PHYS_STATE(pPage)));
1018 break;
1019 }
1020
1021 GCPhys += PAGE_SIZE;
1022 }
1023 STAM_PROFILE_STOP(&pVM->pgm.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,IsValidLargePage), a);
1024
1025 if (i == _2M/PAGE_SIZE)
1026 {
1027 PGM_PAGE_SET_PDE_TYPE(pVM, pLargePage, PGM_PAGE_PDE_TYPE_PDE);
1028 pVM->pgm.s.cLargePagesDisabled--;
1029 Log(("pgmPhysRecheckLargePage: page %RGp can be reused!\n", GCPhys - _2M));
1030 return VINF_SUCCESS;
1031 }
1032
1033 return VERR_PGM_INVALID_LARGE_PAGE_RANGE;
1034}
1035
1036#endif /* PGM_WITH_LARGE_PAGES */
1037
1038/**
1039 * Deal with a write monitored page.
1040 *
1041 * @returns VBox strict status code.
1042 *
1043 * @param pVM The cross context VM structure.
1044 * @param pPage The physical page tracking structure.
1045 *
1046 * @remarks Called from within the PGM critical section.
1047 */
1048void pgmPhysPageMakeWriteMonitoredWritable(PVM pVM, PPGMPAGE pPage)
1049{
1050 Assert(PGM_PAGE_GET_STATE(pPage) == PGM_PAGE_STATE_WRITE_MONITORED);
1051 PGM_PAGE_SET_WRITTEN_TO(pVM, pPage);
1052 PGM_PAGE_SET_STATE(pVM, pPage, PGM_PAGE_STATE_ALLOCATED);
1053 Assert(pVM->pgm.s.cMonitoredPages > 0);
1054 pVM->pgm.s.cMonitoredPages--;
1055 pVM->pgm.s.cWrittenToPages++;
1056}
1057
1058
1059/**
1060 * Deal with pages that are not writable, i.e. not in the ALLOCATED state.
1061 *
1062 * @returns VBox strict status code.
1063 * @retval VINF_SUCCESS on success.
1064 * @retval VINF_PGM_SYNC_CR3 on success and a page pool flush is pending.
1065 * @retval VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical backing.
1066 *
1067 * @param pVM The cross context VM structure.
1068 * @param pPage The physical page tracking structure.
1069 * @param GCPhys The address of the page.
1070 *
1071 * @remarks Called from within the PGM critical section.
1072 */
1073int pgmPhysPageMakeWritable(PVM pVM, PPGMPAGE pPage, RTGCPHYS GCPhys)
1074{
1075 PGM_LOCK_ASSERT_OWNER(pVM);
1076 switch (PGM_PAGE_GET_STATE(pPage))
1077 {
1078 case PGM_PAGE_STATE_WRITE_MONITORED:
1079 pgmPhysPageMakeWriteMonitoredWritable(pVM, pPage);
1080 /* fall thru */
1081 default: /* to shut up GCC */
1082 case PGM_PAGE_STATE_ALLOCATED:
1083 return VINF_SUCCESS;
1084
1085 /*
1086 * Zero pages can be dummy pages for MMIO or reserved memory,
1087 * so we need to check the flags before joining cause with
1088 * shared page replacement.
1089 */
1090 case PGM_PAGE_STATE_ZERO:
1091 if (PGM_PAGE_IS_MMIO(pPage))
1092 return VERR_PGM_PHYS_PAGE_RESERVED;
1093 /* fall thru */
1094 case PGM_PAGE_STATE_SHARED:
1095 return pgmPhysAllocPage(pVM, pPage, GCPhys);
1096
1097 /* Not allowed to write to ballooned pages. */
1098 case PGM_PAGE_STATE_BALLOONED:
1099 return VERR_PGM_PHYS_PAGE_BALLOONED;
1100 }
1101}
1102
1103
1104/**
1105 * Internal usage: Map the page specified by its GMM ID.
1106 *
1107 * This is similar to pgmPhysPageMap
1108 *
1109 * @returns VBox status code.
1110 *
1111 * @param pVM The cross context VM structure.
1112 * @param idPage The Page ID.
1113 * @param HCPhys The physical address (for RC).
1114 * @param ppv Where to store the mapping address.
1115 *
1116 * @remarks Called from within the PGM critical section. The mapping is only
1117 * valid while you are inside this section.
1118 */
1119int pgmPhysPageMapByPageID(PVM pVM, uint32_t idPage, RTHCPHYS HCPhys, void **ppv)
1120{
1121 /*
1122 * Validation.
1123 */
1124 PGM_LOCK_ASSERT_OWNER(pVM);
1125 AssertReturn(HCPhys && !(HCPhys & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
1126 const uint32_t idChunk = idPage >> GMM_CHUNKID_SHIFT;
1127 AssertReturn(idChunk != NIL_GMM_CHUNKID, VERR_INVALID_PARAMETER);
1128
1129#if defined(IN_RC) || defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
1130 /*
1131 * Map it by HCPhys.
1132 */
1133 return pgmRZDynMapHCPageInlined(VMMGetCpu(pVM), HCPhys, ppv RTLOG_COMMA_SRC_POS);
1134
1135#else
1136 /*
1137 * Find/make Chunk TLB entry for the mapping chunk.
1138 */
1139 PPGMCHUNKR3MAP pMap;
1140 PPGMCHUNKR3MAPTLBE pTlbe = &pVM->pgm.s.ChunkR3Map.Tlb.aEntries[PGM_CHUNKR3MAPTLB_IDX(idChunk)];
1141 if (pTlbe->idChunk == idChunk)
1142 {
1143 STAM_COUNTER_INC(&pVM->pgm.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,ChunkR3MapTlbHits));
1144 pMap = pTlbe->pChunk;
1145 }
1146 else
1147 {
1148 STAM_COUNTER_INC(&pVM->pgm.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,ChunkR3MapTlbMisses));
1149
1150 /*
1151 * Find the chunk, map it if necessary.
1152 */
1153 pMap = (PPGMCHUNKR3MAP)RTAvlU32Get(&pVM->pgm.s.ChunkR3Map.pTree, idChunk);
1154 if (pMap)
1155 pMap->iLastUsed = pVM->pgm.s.ChunkR3Map.iNow;
1156 else
1157 {
1158# ifdef IN_RING0
1159 int rc = VMMRZCallRing3NoCpu(pVM, VMMCALLRING3_PGM_MAP_CHUNK, idChunk);
1160 AssertRCReturn(rc, rc);
1161 pMap = (PPGMCHUNKR3MAP)RTAvlU32Get(&pVM->pgm.s.ChunkR3Map.pTree, idChunk);
1162 Assert(pMap);
1163# else
1164 int rc = pgmR3PhysChunkMap(pVM, idChunk, &pMap);
1165 if (RT_FAILURE(rc))
1166 return rc;
1167# endif
1168 }
1169
1170 /*
1171 * Enter it into the Chunk TLB.
1172 */
1173 pTlbe->idChunk = idChunk;
1174 pTlbe->pChunk = pMap;
1175 }
1176
1177 *ppv = (uint8_t *)pMap->pv + ((idPage &GMM_PAGEID_IDX_MASK) << PAGE_SHIFT);
1178 return VINF_SUCCESS;
1179#endif
1180}
1181
1182
1183/**
1184 * Maps a page into the current virtual address space so it can be accessed.
1185 *
1186 * @returns VBox status code.
1187 * @retval VINF_SUCCESS on success.
1188 * @retval VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical backing.
1189 *
1190 * @param pVM The cross context VM structure.
1191 * @param pPage The physical page tracking structure.
1192 * @param GCPhys The address of the page.
1193 * @param ppMap Where to store the address of the mapping tracking structure.
1194 * @param ppv Where to store the mapping address of the page. The page
1195 * offset is masked off!
1196 *
1197 * @remarks Called from within the PGM critical section.
1198 */
1199static int pgmPhysPageMapCommon(PVM pVM, PPGMPAGE pPage, RTGCPHYS GCPhys, PPPGMPAGEMAP ppMap, void **ppv)
1200{
1201 PGM_LOCK_ASSERT_OWNER(pVM);
1202 NOREF(GCPhys);
1203
1204#if defined(IN_RC) || defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
1205 /*
1206 * Just some sketchy GC/R0-darwin code.
1207 */
1208 *ppMap = NULL;
1209 RTHCPHYS HCPhys = PGM_PAGE_GET_HCPHYS(pPage);
1210 Assert(HCPhys != pVM->pgm.s.HCPhysZeroPg);
1211 pgmRZDynMapHCPageInlined(VMMGetCpu(pVM), HCPhys, ppv RTLOG_COMMA_SRC_POS);
1212 return VINF_SUCCESS;
1213
1214#else /* IN_RING3 || IN_RING0 */
1215
1216
1217 /*
1218 * Special cases: MMIO2, ZERO and specially aliased MMIO pages.
1219 */
1220 if ( PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_MMIO2
1221 || PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_MMIO2_ALIAS_MMIO)
1222 {
1223 /* Decode the page id to a page in a MMIO2 ram range. */
1224 uint8_t idMmio2 = PGM_MMIO2_PAGEID_GET_MMIO2_ID(PGM_PAGE_GET_PAGEID(pPage));
1225 uint32_t iPage = PGM_MMIO2_PAGEID_GET_IDX(PGM_PAGE_GET_PAGEID(pPage));
1226 AssertLogRelMsgReturn((uint8_t)(idMmio2 - 1U) < RT_ELEMENTS(pVM->pgm.s.CTX_SUFF(apMmio2Ranges)),
1227 ("idMmio2=%u size=%u type=%u GCPHys=%#RGp Id=%u State=%u", idMmio2,
1228 RT_ELEMENTS(pVM->pgm.s.CTX_SUFF(apMmio2Ranges)), PGM_PAGE_GET_TYPE(pPage), GCPhys,
1229 pPage->s.idPage, pPage->s.uStateY),
1230 VERR_PGM_PHYS_PAGE_MAP_MMIO2_IPE);
1231 PPGMREGMMIORANGE pMmio2Range = pVM->pgm.s.CTX_SUFF(apMmio2Ranges)[idMmio2 - 1];
1232 AssertLogRelReturn(pMmio2Range, VERR_PGM_PHYS_PAGE_MAP_MMIO2_IPE);
1233 AssertLogRelReturn(pMmio2Range->idMmio2 == idMmio2, VERR_PGM_PHYS_PAGE_MAP_MMIO2_IPE);
1234 AssertLogRelReturn(iPage < (pMmio2Range->RamRange.cb >> PAGE_SHIFT), VERR_PGM_PHYS_PAGE_MAP_MMIO2_IPE);
1235 *ppv = (uint8_t *)pMmio2Range->RamRange.pvR3 + ((uintptr_t)iPage << PAGE_SHIFT);
1236 *ppMap = NULL;
1237 return VINF_SUCCESS;
1238 }
1239
1240 const uint32_t idChunk = PGM_PAGE_GET_CHUNKID(pPage);
1241 if (idChunk == NIL_GMM_CHUNKID)
1242 {
1243 AssertMsgReturn(PGM_PAGE_GET_PAGEID(pPage) == NIL_GMM_PAGEID, ("pPage=%R[pgmpage]\n", pPage),
1244 VERR_PGM_PHYS_PAGE_MAP_IPE_1);
1245 if (!PGM_PAGE_IS_SPECIAL_ALIAS_MMIO(pPage))
1246 {
1247 AssertMsgReturn(PGM_PAGE_IS_ZERO(pPage), ("pPage=%R[pgmpage]\n", pPage),
1248 VERR_PGM_PHYS_PAGE_MAP_IPE_3);
1249 AssertMsgReturn(PGM_PAGE_GET_HCPHYS(pPage)== pVM->pgm.s.HCPhysZeroPg, ("pPage=%R[pgmpage]\n", pPage),
1250 VERR_PGM_PHYS_PAGE_MAP_IPE_4);
1251 *ppv = pVM->pgm.s.CTXALLSUFF(pvZeroPg);
1252 }
1253 else
1254# ifdef VBOX_WITH_2ND_IEM_STEP
1255 *ppv = pVM->pgm.s.CTXALLSUFF(pvZeroPg);
1256# else
1257 {
1258 /* This kind of screws up the TLB entry if accessed from a different section afterwards. */
1259 static uint8_t s_abPlayItSafe[0x1000*2]; /* I don't dare return the zero page at the moment. */
1260 *ppv = (uint8_t *)((uintptr_t)&s_abPlayItSafe[0x1000] & ~(uintptr_t)0xfff);
1261 }
1262# endif
1263 *ppMap = NULL;
1264 return VINF_SUCCESS;
1265 }
1266
1267 /*
1268 * Find/make Chunk TLB entry for the mapping chunk.
1269 */
1270 PPGMCHUNKR3MAP pMap;
1271 PPGMCHUNKR3MAPTLBE pTlbe = &pVM->pgm.s.ChunkR3Map.Tlb.aEntries[PGM_CHUNKR3MAPTLB_IDX(idChunk)];
1272 if (pTlbe->idChunk == idChunk)
1273 {
1274 STAM_COUNTER_INC(&pVM->pgm.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,ChunkR3MapTlbHits));
1275 pMap = pTlbe->pChunk;
1276 AssertPtr(pMap->pv);
1277 }
1278 else
1279 {
1280 STAM_COUNTER_INC(&pVM->pgm.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,ChunkR3MapTlbMisses));
1281
1282 /*
1283 * Find the chunk, map it if necessary.
1284 */
1285 pMap = (PPGMCHUNKR3MAP)RTAvlU32Get(&pVM->pgm.s.ChunkR3Map.pTree, idChunk);
1286 if (pMap)
1287 {
1288 AssertPtr(pMap->pv);
1289 pMap->iLastUsed = pVM->pgm.s.ChunkR3Map.iNow;
1290 }
1291 else
1292 {
1293#ifdef IN_RING0
1294 int rc = VMMRZCallRing3NoCpu(pVM, VMMCALLRING3_PGM_MAP_CHUNK, idChunk);
1295 AssertRCReturn(rc, rc);
1296 pMap = (PPGMCHUNKR3MAP)RTAvlU32Get(&pVM->pgm.s.ChunkR3Map.pTree, idChunk);
1297 Assert(pMap);
1298#else
1299 int rc = pgmR3PhysChunkMap(pVM, idChunk, &pMap);
1300 if (RT_FAILURE(rc))
1301 return rc;
1302#endif
1303 AssertPtr(pMap->pv);
1304 }
1305
1306 /*
1307 * Enter it into the Chunk TLB.
1308 */
1309 pTlbe->idChunk = idChunk;
1310 pTlbe->pChunk = pMap;
1311 }
1312
1313 *ppv = (uint8_t *)pMap->pv + (PGM_PAGE_GET_PAGE_IN_CHUNK(pPage) << PAGE_SHIFT);
1314 *ppMap = pMap;
1315 return VINF_SUCCESS;
1316#endif /* IN_RING3 */
1317}
1318
1319
1320/**
1321 * Combination of pgmPhysPageMakeWritable and pgmPhysPageMapWritable.
1322 *
1323 * This is typically used is paths where we cannot use the TLB methods (like ROM
1324 * pages) or where there is no point in using them since we won't get many hits.
1325 *
1326 * @returns VBox strict status code.
1327 * @retval VINF_SUCCESS on success.
1328 * @retval VINF_PGM_SYNC_CR3 on success and a page pool flush is pending.
1329 * @retval VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical backing.
1330 *
1331 * @param pVM The cross context VM structure.
1332 * @param pPage The physical page tracking structure.
1333 * @param GCPhys The address of the page.
1334 * @param ppv Where to store the mapping address of the page. The page
1335 * offset is masked off!
1336 *
1337 * @remarks Called from within the PGM critical section. The mapping is only
1338 * valid while you are inside section.
1339 */
1340int pgmPhysPageMakeWritableAndMap(PVM pVM, PPGMPAGE pPage, RTGCPHYS GCPhys, void **ppv)
1341{
1342 int rc = pgmPhysPageMakeWritable(pVM, pPage, GCPhys);
1343 if (RT_SUCCESS(rc))
1344 {
1345 AssertMsg(rc == VINF_SUCCESS || rc == VINF_PGM_SYNC_CR3 /* returned */, ("%Rrc\n", rc));
1346 PPGMPAGEMAP pMapIgnore;
1347 int rc2 = pgmPhysPageMapCommon(pVM, pPage, GCPhys, &pMapIgnore, ppv);
1348 if (RT_FAILURE(rc2)) /* preserve rc */
1349 rc = rc2;
1350 }
1351 return rc;
1352}
1353
1354
1355/**
1356 * Maps a page into the current virtual address space so it can be accessed for
1357 * both writing and reading.
1358 *
1359 * This is typically used is paths where we cannot use the TLB methods (like ROM
1360 * pages) or where there is no point in using them since we won't get many hits.
1361 *
1362 * @returns VBox status code.
1363 * @retval VINF_SUCCESS on success.
1364 * @retval VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical backing.
1365 *
1366 * @param pVM The cross context VM structure.
1367 * @param pPage The physical page tracking structure. Must be in the
1368 * allocated state.
1369 * @param GCPhys The address of the page.
1370 * @param ppv Where to store the mapping address of the page. The page
1371 * offset is masked off!
1372 *
1373 * @remarks Called from within the PGM critical section. The mapping is only
1374 * valid while you are inside section.
1375 */
1376int pgmPhysPageMap(PVM pVM, PPGMPAGE pPage, RTGCPHYS GCPhys, void **ppv)
1377{
1378 Assert(PGM_PAGE_GET_STATE(pPage) == PGM_PAGE_STATE_ALLOCATED);
1379 PPGMPAGEMAP pMapIgnore;
1380 return pgmPhysPageMapCommon(pVM, pPage, GCPhys, &pMapIgnore, ppv);
1381}
1382
1383
1384/**
1385 * Maps a page into the current virtual address space so it can be accessed for
1386 * reading.
1387 *
1388 * This is typically used is paths where we cannot use the TLB methods (like ROM
1389 * pages) or where there is no point in using them since we won't get many hits.
1390 *
1391 * @returns VBox status code.
1392 * @retval VINF_SUCCESS on success.
1393 * @retval VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical backing.
1394 *
1395 * @param pVM The cross context VM structure.
1396 * @param pPage The physical page tracking structure.
1397 * @param GCPhys The address of the page.
1398 * @param ppv Where to store the mapping address of the page. The page
1399 * offset is masked off!
1400 *
1401 * @remarks Called from within the PGM critical section. The mapping is only
1402 * valid while you are inside this section.
1403 */
1404int pgmPhysPageMapReadOnly(PVM pVM, PPGMPAGE pPage, RTGCPHYS GCPhys, void const **ppv)
1405{
1406 PPGMPAGEMAP pMapIgnore;
1407 return pgmPhysPageMapCommon(pVM, pPage, GCPhys, &pMapIgnore, (void **)ppv);
1408}
1409
1410#if !defined(IN_RC) && !defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
1411
1412/**
1413 * Load a guest page into the ring-3 physical TLB.
1414 *
1415 * @returns VBox status code.
1416 * @retval VINF_SUCCESS on success
1417 * @retval VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid physical address.
1418 * @param pPGM The PGM instance pointer.
1419 * @param GCPhys The guest physical address in question.
1420 */
1421int pgmPhysPageLoadIntoTlb(PVM pVM, RTGCPHYS GCPhys)
1422{
1423 PGM_LOCK_ASSERT_OWNER(pVM);
1424
1425 /*
1426 * Find the ram range and page and hand it over to the with-page function.
1427 * 99.8% of requests are expected to be in the first range.
1428 */
1429 PPGMPAGE pPage = pgmPhysGetPage(pVM, GCPhys);
1430 if (!pPage)
1431 {
1432 STAM_COUNTER_INC(&pVM->pgm.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,PageMapTlbMisses));
1433 return VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS;
1434 }
1435
1436 return pgmPhysPageLoadIntoTlbWithPage(pVM, pPage, GCPhys);
1437}
1438
1439
1440/**
1441 * Load a guest page into the ring-3 physical TLB.
1442 *
1443 * @returns VBox status code.
1444 * @retval VINF_SUCCESS on success
1445 * @retval VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid physical address.
1446 *
1447 * @param pVM The cross context VM structure.
1448 * @param pPage Pointer to the PGMPAGE structure corresponding to
1449 * GCPhys.
1450 * @param GCPhys The guest physical address in question.
1451 */
1452int pgmPhysPageLoadIntoTlbWithPage(PVM pVM, PPGMPAGE pPage, RTGCPHYS GCPhys)
1453{
1454 PGM_LOCK_ASSERT_OWNER(pVM);
1455 STAM_COUNTER_INC(&pVM->pgm.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,PageMapTlbMisses));
1456
1457 /*
1458 * Map the page.
1459 * Make a special case for the zero page as it is kind of special.
1460 */
1461 PPGMPAGEMAPTLBE pTlbe = &pVM->pgm.s.CTXSUFF(PhysTlb).aEntries[PGM_PAGEMAPTLB_IDX(GCPhys)];
1462 if ( !PGM_PAGE_IS_ZERO(pPage)
1463 && !PGM_PAGE_IS_BALLOONED(pPage))
1464 {
1465 void *pv;
1466 PPGMPAGEMAP pMap;
1467 int rc = pgmPhysPageMapCommon(pVM, pPage, GCPhys, &pMap, &pv);
1468 if (RT_FAILURE(rc))
1469 return rc;
1470 pTlbe->pMap = pMap;
1471 pTlbe->pv = pv;
1472 Assert(!((uintptr_t)pTlbe->pv & PAGE_OFFSET_MASK));
1473 }
1474 else
1475 {
1476 AssertMsg(PGM_PAGE_GET_HCPHYS(pPage) == pVM->pgm.s.HCPhysZeroPg, ("%RGp/%R[pgmpage]\n", GCPhys, pPage));
1477 pTlbe->pMap = NULL;
1478 pTlbe->pv = pVM->pgm.s.CTXALLSUFF(pvZeroPg);
1479 }
1480#ifdef PGM_WITH_PHYS_TLB
1481 if ( PGM_PAGE_GET_TYPE(pPage) < PGMPAGETYPE_ROM_SHADOW
1482 || PGM_PAGE_GET_TYPE(pPage) > PGMPAGETYPE_ROM)
1483 pTlbe->GCPhys = GCPhys & X86_PTE_PAE_PG_MASK;
1484 else
1485 pTlbe->GCPhys = NIL_RTGCPHYS; /* ROM: Problematic because of the two pages. :-/ */
1486#else
1487 pTlbe->GCPhys = NIL_RTGCPHYS;
1488#endif
1489 pTlbe->pPage = pPage;
1490 return VINF_SUCCESS;
1491}
1492
1493#endif /* !IN_RC && !VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0 */
1494
1495/**
1496 * Internal version of PGMPhysGCPhys2CCPtr that expects the caller to
1497 * own the PGM lock and therefore not need to lock the mapped page.
1498 *
1499 * @returns VBox status code.
1500 * @retval VINF_SUCCESS on success.
1501 * @retval VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical backing.
1502 * @retval VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid physical address.
1503 *
1504 * @param pVM The cross context VM structure.
1505 * @param GCPhys The guest physical address of the page that should be mapped.
1506 * @param pPage Pointer to the PGMPAGE structure for the page.
1507 * @param ppv Where to store the address corresponding to GCPhys.
1508 *
1509 * @internal
1510 * @deprecated Use pgmPhysGCPhys2CCPtrInternalEx.
1511 */
1512int pgmPhysGCPhys2CCPtrInternalDepr(PVM pVM, PPGMPAGE pPage, RTGCPHYS GCPhys, void **ppv)
1513{
1514 int rc;
1515 AssertReturn(pPage, VERR_PGM_PHYS_NULL_PAGE_PARAM);
1516 PGM_LOCK_ASSERT_OWNER(pVM);
1517 pVM->pgm.s.cDeprecatedPageLocks++;
1518
1519 /*
1520 * Make sure the page is writable.
1521 */
1522 if (RT_UNLIKELY(PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED))
1523 {
1524 rc = pgmPhysPageMakeWritable(pVM, pPage, GCPhys);
1525 if (RT_FAILURE(rc))
1526 return rc;
1527 AssertMsg(rc == VINF_SUCCESS || rc == VINF_PGM_SYNC_CR3 /* not returned */, ("%Rrc\n", rc));
1528 }
1529 Assert(PGM_PAGE_GET_HCPHYS(pPage) != 0);
1530
1531 /*
1532 * Get the mapping address.
1533 */
1534#if defined(IN_RC) || defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
1535 void *pv;
1536 rc = pgmRZDynMapHCPageInlined(VMMGetCpu(pVM),
1537 PGM_PAGE_GET_HCPHYS(pPage),
1538 &pv
1539 RTLOG_COMMA_SRC_POS);
1540 if (RT_FAILURE(rc))
1541 return rc;
1542 *ppv = (void *)((uintptr_t)pv | (uintptr_t)(GCPhys & PAGE_OFFSET_MASK));
1543#else
1544 PPGMPAGEMAPTLBE pTlbe;
1545 rc = pgmPhysPageQueryTlbeWithPage(pVM, pPage, GCPhys, &pTlbe);
1546 if (RT_FAILURE(rc))
1547 return rc;
1548 *ppv = (void *)((uintptr_t)pTlbe->pv | (uintptr_t)(GCPhys & PAGE_OFFSET_MASK));
1549#endif
1550 return VINF_SUCCESS;
1551}
1552
1553#if !defined(IN_RC) && !defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
1554
1555/**
1556 * Locks a page mapping for writing.
1557 *
1558 * @param pVM The cross context VM structure.
1559 * @param pPage The page.
1560 * @param pTlbe The mapping TLB entry for the page.
1561 * @param pLock The lock structure (output).
1562 */
1563DECLINLINE(void) pgmPhysPageMapLockForWriting(PVM pVM, PPGMPAGE pPage, PPGMPAGEMAPTLBE pTlbe, PPGMPAGEMAPLOCK pLock)
1564{
1565 PPGMPAGEMAP pMap = pTlbe->pMap;
1566 if (pMap)
1567 pMap->cRefs++;
1568
1569 unsigned cLocks = PGM_PAGE_GET_WRITE_LOCKS(pPage);
1570 if (RT_LIKELY(cLocks < PGM_PAGE_MAX_LOCKS - 1))
1571 {
1572 if (cLocks == 0)
1573 pVM->pgm.s.cWriteLockedPages++;
1574 PGM_PAGE_INC_WRITE_LOCKS(pPage);
1575 }
1576 else if (cLocks != PGM_PAGE_MAX_LOCKS)
1577 {
1578 PGM_PAGE_INC_WRITE_LOCKS(pPage);
1579 AssertMsgFailed(("%R[pgmpage] is entering permanent write locked state!\n", pPage));
1580 if (pMap)
1581 pMap->cRefs++; /* Extra ref to prevent it from going away. */
1582 }
1583
1584 pLock->uPageAndType = (uintptr_t)pPage | PGMPAGEMAPLOCK_TYPE_WRITE;
1585 pLock->pvMap = pMap;
1586}
1587
1588/**
1589 * Locks a page mapping for reading.
1590 *
1591 * @param pVM The cross context VM structure.
1592 * @param pPage The page.
1593 * @param pTlbe The mapping TLB entry for the page.
1594 * @param pLock The lock structure (output).
1595 */
1596DECLINLINE(void) pgmPhysPageMapLockForReading(PVM pVM, PPGMPAGE pPage, PPGMPAGEMAPTLBE pTlbe, PPGMPAGEMAPLOCK pLock)
1597{
1598 PPGMPAGEMAP pMap = pTlbe->pMap;
1599 if (pMap)
1600 pMap->cRefs++;
1601
1602 unsigned cLocks = PGM_PAGE_GET_READ_LOCKS(pPage);
1603 if (RT_LIKELY(cLocks < PGM_PAGE_MAX_LOCKS - 1))
1604 {
1605 if (cLocks == 0)
1606 pVM->pgm.s.cReadLockedPages++;
1607 PGM_PAGE_INC_READ_LOCKS(pPage);
1608 }
1609 else if (cLocks != PGM_PAGE_MAX_LOCKS)
1610 {
1611 PGM_PAGE_INC_READ_LOCKS(pPage);
1612 AssertMsgFailed(("%R[pgmpage] is entering permanent read locked state!\n", pPage));
1613 if (pMap)
1614 pMap->cRefs++; /* Extra ref to prevent it from going away. */
1615 }
1616
1617 pLock->uPageAndType = (uintptr_t)pPage | PGMPAGEMAPLOCK_TYPE_READ;
1618 pLock->pvMap = pMap;
1619}
1620
1621#endif /* !IN_RC && !VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0 */
1622
1623
1624/**
1625 * Internal version of PGMPhysGCPhys2CCPtr that expects the caller to
1626 * own the PGM lock and have access to the page structure.
1627 *
1628 * @returns VBox status code.
1629 * @retval VINF_SUCCESS on success.
1630 * @retval VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical backing.
1631 * @retval VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid physical address.
1632 *
1633 * @param pVM The cross context VM structure.
1634 * @param GCPhys The guest physical address of the page that should be mapped.
1635 * @param pPage Pointer to the PGMPAGE structure for the page.
1636 * @param ppv Where to store the address corresponding to GCPhys.
1637 * @param pLock Where to store the lock information that
1638 * pgmPhysReleaseInternalPageMappingLock needs.
1639 *
1640 * @internal
1641 */
1642int pgmPhysGCPhys2CCPtrInternal(PVM pVM, PPGMPAGE pPage, RTGCPHYS GCPhys, void **ppv, PPGMPAGEMAPLOCK pLock)
1643{
1644 int rc;
1645 AssertReturn(pPage, VERR_PGM_PHYS_NULL_PAGE_PARAM);
1646 PGM_LOCK_ASSERT_OWNER(pVM);
1647
1648 /*
1649 * Make sure the page is writable.
1650 */
1651 if (RT_UNLIKELY(PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED))
1652 {
1653 rc = pgmPhysPageMakeWritable(pVM, pPage, GCPhys);
1654 if (RT_FAILURE(rc))
1655 return rc;
1656 AssertMsg(rc == VINF_SUCCESS || rc == VINF_PGM_SYNC_CR3 /* not returned */, ("%Rrc\n", rc));
1657 }
1658 Assert(PGM_PAGE_GET_HCPHYS(pPage) != 0);
1659
1660 /*
1661 * Do the job.
1662 */
1663#if defined(IN_RC) || defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
1664 void *pv;
1665 PVMCPU pVCpu = VMMGetCpu(pVM);
1666 rc = pgmRZDynMapHCPageInlined(pVCpu,
1667 PGM_PAGE_GET_HCPHYS(pPage),
1668 &pv
1669 RTLOG_COMMA_SRC_POS);
1670 if (RT_FAILURE(rc))
1671 return rc;
1672 *ppv = (void *)((uintptr_t)pv | (uintptr_t)(GCPhys & PAGE_OFFSET_MASK));
1673 pLock->pvPage = pv;
1674 pLock->pVCpu = pVCpu;
1675
1676#else
1677 PPGMPAGEMAPTLBE pTlbe;
1678 rc = pgmPhysPageQueryTlbeWithPage(pVM, pPage, GCPhys, &pTlbe);
1679 if (RT_FAILURE(rc))
1680 return rc;
1681 pgmPhysPageMapLockForWriting(pVM, pPage, pTlbe, pLock);
1682 *ppv = (void *)((uintptr_t)pTlbe->pv | (uintptr_t)(GCPhys & PAGE_OFFSET_MASK));
1683#endif
1684 return VINF_SUCCESS;
1685}
1686
1687
1688/**
1689 * Internal version of PGMPhysGCPhys2CCPtrReadOnly that expects the caller to
1690 * own the PGM lock and have access to the page structure.
1691 *
1692 * @returns VBox status code.
1693 * @retval VINF_SUCCESS on success.
1694 * @retval VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical backing.
1695 * @retval VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid physical address.
1696 *
1697 * @param pVM The cross context VM structure.
1698 * @param GCPhys The guest physical address of the page that should be mapped.
1699 * @param pPage Pointer to the PGMPAGE structure for the page.
1700 * @param ppv Where to store the address corresponding to GCPhys.
1701 * @param pLock Where to store the lock information that
1702 * pgmPhysReleaseInternalPageMappingLock needs.
1703 *
1704 * @internal
1705 */
1706int pgmPhysGCPhys2CCPtrInternalReadOnly(PVM pVM, PPGMPAGE pPage, RTGCPHYS GCPhys, const void **ppv, PPGMPAGEMAPLOCK pLock)
1707{
1708 AssertReturn(pPage, VERR_PGM_PHYS_NULL_PAGE_PARAM);
1709 PGM_LOCK_ASSERT_OWNER(pVM);
1710 Assert(PGM_PAGE_GET_HCPHYS(pPage) != 0);
1711
1712 /*
1713 * Do the job.
1714 */
1715#if defined(IN_RC) || defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
1716 void *pv;
1717 PVMCPU pVCpu = VMMGetCpu(pVM);
1718 int rc = pgmRZDynMapHCPageInlined(pVCpu,
1719 PGM_PAGE_GET_HCPHYS(pPage),
1720 &pv
1721 RTLOG_COMMA_SRC_POS); /** @todo add a read only flag? */
1722 if (RT_FAILURE(rc))
1723 return rc;
1724 *ppv = (void *)((uintptr_t)pv | (uintptr_t)(GCPhys & PAGE_OFFSET_MASK));
1725 pLock->pvPage = pv;
1726 pLock->pVCpu = pVCpu;
1727
1728#else
1729 PPGMPAGEMAPTLBE pTlbe;
1730 int rc = pgmPhysPageQueryTlbeWithPage(pVM, pPage, GCPhys, &pTlbe);
1731 if (RT_FAILURE(rc))
1732 return rc;
1733 pgmPhysPageMapLockForReading(pVM, pPage, pTlbe, pLock);
1734 *ppv = (void *)((uintptr_t)pTlbe->pv | (uintptr_t)(GCPhys & PAGE_OFFSET_MASK));
1735#endif
1736 return VINF_SUCCESS;
1737}
1738
1739
1740/**
1741 * Requests the mapping of a guest page into the current context.
1742 *
1743 * This API should only be used for very short term, as it will consume scarse
1744 * resources (R0 and GC) in the mapping cache. When you're done with the page,
1745 * call PGMPhysReleasePageMappingLock() ASAP to release it.
1746 *
1747 * This API will assume your intention is to write to the page, and will
1748 * therefore replace shared and zero pages. If you do not intend to modify
1749 * the page, use the PGMPhysGCPhys2CCPtrReadOnly() API.
1750 *
1751 * @returns VBox status code.
1752 * @retval VINF_SUCCESS on success.
1753 * @retval VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical backing.
1754 * @retval VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid physical address.
1755 *
1756 * @param pVM The cross context VM structure.
1757 * @param GCPhys The guest physical address of the page that should be
1758 * mapped.
1759 * @param ppv Where to store the address corresponding to GCPhys.
1760 * @param pLock Where to store the lock information that
1761 * PGMPhysReleasePageMappingLock needs.
1762 *
1763 * @remarks The caller is responsible for dealing with access handlers.
1764 * @todo Add an informational return code for pages with access handlers?
1765 *
1766 * @remark Avoid calling this API from within critical sections (other than
1767 * the PGM one) because of the deadlock risk. External threads may
1768 * need to delegate jobs to the EMTs.
1769 * @remarks Only one page is mapped! Make no assumption about what's after or
1770 * before the returned page!
1771 * @thread Any thread.
1772 */
1773VMM_INT_DECL(int) PGMPhysGCPhys2CCPtr(PVM pVM, RTGCPHYS GCPhys, void **ppv, PPGMPAGEMAPLOCK pLock)
1774{
1775 int rc = pgmLock(pVM);
1776 AssertRCReturn(rc, rc);
1777
1778#if defined(IN_RC) || defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
1779 /*
1780 * Find the page and make sure it's writable.
1781 */
1782 PPGMPAGE pPage;
1783 rc = pgmPhysGetPageEx(pVM, GCPhys, &pPage);
1784 if (RT_SUCCESS(rc))
1785 {
1786 if (RT_UNLIKELY(PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED))
1787 rc = pgmPhysPageMakeWritable(pVM, pPage, GCPhys);
1788 if (RT_SUCCESS(rc))
1789 {
1790 AssertMsg(rc == VINF_SUCCESS || rc == VINF_PGM_SYNC_CR3 /* not returned */, ("%Rrc\n", rc));
1791
1792 PVMCPU pVCpu = VMMGetCpu(pVM);
1793 void *pv;
1794 rc = pgmRZDynMapHCPageInlined(pVCpu,
1795 PGM_PAGE_GET_HCPHYS(pPage),
1796 &pv
1797 RTLOG_COMMA_SRC_POS);
1798 if (RT_SUCCESS(rc))
1799 {
1800 AssertRCSuccess(rc);
1801
1802 pv = (void *)((uintptr_t)pv | (uintptr_t)(GCPhys & PAGE_OFFSET_MASK));
1803 *ppv = pv;
1804 pLock->pvPage = pv;
1805 pLock->pVCpu = pVCpu;
1806 }
1807 }
1808 }
1809
1810#else /* IN_RING3 || IN_RING0 */
1811 /*
1812 * Query the Physical TLB entry for the page (may fail).
1813 */
1814 PPGMPAGEMAPTLBE pTlbe;
1815 rc = pgmPhysPageQueryTlbe(pVM, GCPhys, &pTlbe);
1816 if (RT_SUCCESS(rc))
1817 {
1818 /*
1819 * If the page is shared, the zero page, or being write monitored
1820 * it must be converted to a page that's writable if possible.
1821 */
1822 PPGMPAGE pPage = pTlbe->pPage;
1823 if (RT_UNLIKELY(PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED))
1824 {
1825 rc = pgmPhysPageMakeWritable(pVM, pPage, GCPhys);
1826 if (RT_SUCCESS(rc))
1827 {
1828 AssertMsg(rc == VINF_SUCCESS || rc == VINF_PGM_SYNC_CR3 /* not returned */, ("%Rrc\n", rc));
1829 rc = pgmPhysPageQueryTlbeWithPage(pVM, pPage, GCPhys, &pTlbe);
1830 }
1831 }
1832 if (RT_SUCCESS(rc))
1833 {
1834 /*
1835 * Now, just perform the locking and calculate the return address.
1836 */
1837 pgmPhysPageMapLockForWriting(pVM, pPage, pTlbe, pLock);
1838 *ppv = (void *)((uintptr_t)pTlbe->pv | (uintptr_t)(GCPhys & PAGE_OFFSET_MASK));
1839 }
1840 }
1841
1842#endif /* IN_RING3 || IN_RING0 */
1843 pgmUnlock(pVM);
1844 return rc;
1845}
1846
1847
1848/**
1849 * Requests the mapping of a guest page into the current context.
1850 *
1851 * This API should only be used for very short term, as it will consume scarse
1852 * resources (R0 and GC) in the mapping cache. When you're done with the page,
1853 * call PGMPhysReleasePageMappingLock() ASAP to release it.
1854 *
1855 * @returns VBox status code.
1856 * @retval VINF_SUCCESS on success.
1857 * @retval VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical backing.
1858 * @retval VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid physical address.
1859 *
1860 * @param pVM The cross context VM structure.
1861 * @param GCPhys The guest physical address of the page that should be
1862 * mapped.
1863 * @param ppv Where to store the address corresponding to GCPhys.
1864 * @param pLock Where to store the lock information that
1865 * PGMPhysReleasePageMappingLock needs.
1866 *
1867 * @remarks The caller is responsible for dealing with access handlers.
1868 * @todo Add an informational return code for pages with access handlers?
1869 *
1870 * @remarks Avoid calling this API from within critical sections (other than
1871 * the PGM one) because of the deadlock risk.
1872 * @remarks Only one page is mapped! Make no assumption about what's after or
1873 * before the returned page!
1874 * @thread Any thread.
1875 */
1876VMM_INT_DECL(int) PGMPhysGCPhys2CCPtrReadOnly(PVM pVM, RTGCPHYS GCPhys, void const **ppv, PPGMPAGEMAPLOCK pLock)
1877{
1878 int rc = pgmLock(pVM);
1879 AssertRCReturn(rc, rc);
1880
1881#if defined(IN_RC) || defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
1882 /*
1883 * Find the page and make sure it's readable.
1884 */
1885 PPGMPAGE pPage;
1886 rc = pgmPhysGetPageEx(pVM, GCPhys, &pPage);
1887 if (RT_SUCCESS(rc))
1888 {
1889 if (RT_UNLIKELY(PGM_PAGE_IS_MMIO_OR_SPECIAL_ALIAS(pPage)))
1890 rc = VERR_PGM_PHYS_PAGE_RESERVED;
1891 else
1892 {
1893 PVMCPU pVCpu = VMMGetCpu(pVM);
1894 void *pv;
1895 rc = pgmRZDynMapHCPageInlined(pVCpu,
1896 PGM_PAGE_GET_HCPHYS(pPage),
1897 &pv
1898 RTLOG_COMMA_SRC_POS); /** @todo add a read only flag? */
1899 if (RT_SUCCESS(rc))
1900 {
1901 AssertRCSuccess(rc);
1902
1903 pv = (void *)((uintptr_t)pv | (uintptr_t)(GCPhys & PAGE_OFFSET_MASK));
1904 *ppv = pv;
1905 pLock->pvPage = pv;
1906 pLock->pVCpu = pVCpu;
1907 }
1908 }
1909 }
1910
1911#else /* IN_RING3 || IN_RING0 */
1912 /*
1913 * Query the Physical TLB entry for the page (may fail).
1914 */
1915 PPGMPAGEMAPTLBE pTlbe;
1916 rc = pgmPhysPageQueryTlbe(pVM, GCPhys, &pTlbe);
1917 if (RT_SUCCESS(rc))
1918 {
1919 /* MMIO pages doesn't have any readable backing. */
1920 PPGMPAGE pPage = pTlbe->pPage;
1921 if (RT_UNLIKELY(PGM_PAGE_IS_MMIO_OR_SPECIAL_ALIAS(pPage)))
1922 rc = VERR_PGM_PHYS_PAGE_RESERVED;
1923 else
1924 {
1925 /*
1926 * Now, just perform the locking and calculate the return address.
1927 */
1928 pgmPhysPageMapLockForReading(pVM, pPage, pTlbe, pLock);
1929 *ppv = (void *)((uintptr_t)pTlbe->pv | (uintptr_t)(GCPhys & PAGE_OFFSET_MASK));
1930 }
1931 }
1932
1933#endif /* IN_RING3 || IN_RING0 */
1934 pgmUnlock(pVM);
1935 return rc;
1936}
1937
1938
1939/**
1940 * Requests the mapping of a guest page given by virtual address into the current context.
1941 *
1942 * This API should only be used for very short term, as it will consume
1943 * scarse resources (R0 and GC) in the mapping cache. When you're done
1944 * with the page, call PGMPhysReleasePageMappingLock() ASAP to release it.
1945 *
1946 * This API will assume your intention is to write to the page, and will
1947 * therefore replace shared and zero pages. If you do not intend to modify
1948 * the page, use the PGMPhysGCPtr2CCPtrReadOnly() API.
1949 *
1950 * @returns VBox status code.
1951 * @retval VINF_SUCCESS on success.
1952 * @retval VERR_PAGE_TABLE_NOT_PRESENT if the page directory for the virtual address isn't present.
1953 * @retval VERR_PAGE_NOT_PRESENT if the page at the virtual address isn't present.
1954 * @retval VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical backing.
1955 * @retval VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid physical address.
1956 *
1957 * @param pVCpu The cross context virtual CPU structure.
1958 * @param GCPtr The guest physical address of the page that should be
1959 * mapped.
1960 * @param ppv Where to store the address corresponding to GCPhys.
1961 * @param pLock Where to store the lock information that PGMPhysReleasePageMappingLock needs.
1962 *
1963 * @remark Avoid calling this API from within critical sections (other than
1964 * the PGM one) because of the deadlock risk.
1965 * @thread EMT
1966 */
1967VMM_INT_DECL(int) PGMPhysGCPtr2CCPtr(PVMCPU pVCpu, RTGCPTR GCPtr, void **ppv, PPGMPAGEMAPLOCK pLock)
1968{
1969 VM_ASSERT_EMT(pVCpu->CTX_SUFF(pVM));
1970 RTGCPHYS GCPhys;
1971 int rc = PGMPhysGCPtr2GCPhys(pVCpu, GCPtr, &GCPhys);
1972 if (RT_SUCCESS(rc))
1973 rc = PGMPhysGCPhys2CCPtr(pVCpu->CTX_SUFF(pVM), GCPhys, ppv, pLock);
1974 return rc;
1975}
1976
1977
1978/**
1979 * Requests the mapping of a guest page given by virtual address into the current context.
1980 *
1981 * This API should only be used for very short term, as it will consume
1982 * scarse resources (R0 and GC) in the mapping cache. When you're done
1983 * with the page, call PGMPhysReleasePageMappingLock() ASAP to release it.
1984 *
1985 * @returns VBox status code.
1986 * @retval VINF_SUCCESS on success.
1987 * @retval VERR_PAGE_TABLE_NOT_PRESENT if the page directory for the virtual address isn't present.
1988 * @retval VERR_PAGE_NOT_PRESENT if the page at the virtual address isn't present.
1989 * @retval VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical backing.
1990 * @retval VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid physical address.
1991 *
1992 * @param pVCpu The cross context virtual CPU structure.
1993 * @param GCPtr The guest physical address of the page that should be
1994 * mapped.
1995 * @param ppv Where to store the address corresponding to GCPtr.
1996 * @param pLock Where to store the lock information that PGMPhysReleasePageMappingLock needs.
1997 *
1998 * @remark Avoid calling this API from within critical sections (other than
1999 * the PGM one) because of the deadlock risk.
2000 * @thread EMT
2001 */
2002VMM_INT_DECL(int) PGMPhysGCPtr2CCPtrReadOnly(PVMCPU pVCpu, RTGCPTR GCPtr, void const **ppv, PPGMPAGEMAPLOCK pLock)
2003{
2004 VM_ASSERT_EMT(pVCpu->CTX_SUFF(pVM));
2005 RTGCPHYS GCPhys;
2006 int rc = PGMPhysGCPtr2GCPhys(pVCpu, GCPtr, &GCPhys);
2007 if (RT_SUCCESS(rc))
2008 rc = PGMPhysGCPhys2CCPtrReadOnly(pVCpu->CTX_SUFF(pVM), GCPhys, ppv, pLock);
2009 return rc;
2010}
2011
2012
2013/**
2014 * Release the mapping of a guest page.
2015 *
2016 * This is the counter part of PGMPhysGCPhys2CCPtr, PGMPhysGCPhys2CCPtrReadOnly
2017 * PGMPhysGCPtr2CCPtr and PGMPhysGCPtr2CCPtrReadOnly.
2018 *
2019 * @param pVM The cross context VM structure.
2020 * @param pLock The lock structure initialized by the mapping function.
2021 */
2022VMMDECL(void) PGMPhysReleasePageMappingLock(PVM pVM, PPGMPAGEMAPLOCK pLock)
2023{
2024#if defined(IN_RC) || defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
2025 Assert(pLock->pvPage != NULL);
2026 Assert(pLock->pVCpu == VMMGetCpu(pVM)); RT_NOREF_PV(pVM);
2027 PGM_DYNMAP_UNUSED_HINT(pLock->pVCpu, pLock->pvPage);
2028 pLock->pVCpu = NULL;
2029 pLock->pvPage = NULL;
2030
2031#else
2032 PPGMPAGEMAP pMap = (PPGMPAGEMAP)pLock->pvMap;
2033 PPGMPAGE pPage = (PPGMPAGE)(pLock->uPageAndType & ~PGMPAGEMAPLOCK_TYPE_MASK);
2034 bool fWriteLock = (pLock->uPageAndType & PGMPAGEMAPLOCK_TYPE_MASK) == PGMPAGEMAPLOCK_TYPE_WRITE;
2035
2036 pLock->uPageAndType = 0;
2037 pLock->pvMap = NULL;
2038
2039 pgmLock(pVM);
2040 if (fWriteLock)
2041 {
2042 unsigned cLocks = PGM_PAGE_GET_WRITE_LOCKS(pPage);
2043 Assert(cLocks > 0);
2044 if (RT_LIKELY(cLocks > 0 && cLocks < PGM_PAGE_MAX_LOCKS))
2045 {
2046 if (cLocks == 1)
2047 {
2048 Assert(pVM->pgm.s.cWriteLockedPages > 0);
2049 pVM->pgm.s.cWriteLockedPages--;
2050 }
2051 PGM_PAGE_DEC_WRITE_LOCKS(pPage);
2052 }
2053
2054 if (PGM_PAGE_GET_STATE(pPage) == PGM_PAGE_STATE_WRITE_MONITORED)
2055 {
2056 PGM_PAGE_SET_WRITTEN_TO(pVM, pPage);
2057 PGM_PAGE_SET_STATE(pVM, pPage, PGM_PAGE_STATE_ALLOCATED);
2058 Assert(pVM->pgm.s.cMonitoredPages > 0);
2059 pVM->pgm.s.cMonitoredPages--;
2060 pVM->pgm.s.cWrittenToPages++;
2061 }
2062 }
2063 else
2064 {
2065 unsigned cLocks = PGM_PAGE_GET_READ_LOCKS(pPage);
2066 Assert(cLocks > 0);
2067 if (RT_LIKELY(cLocks > 0 && cLocks < PGM_PAGE_MAX_LOCKS))
2068 {
2069 if (cLocks == 1)
2070 {
2071 Assert(pVM->pgm.s.cReadLockedPages > 0);
2072 pVM->pgm.s.cReadLockedPages--;
2073 }
2074 PGM_PAGE_DEC_READ_LOCKS(pPage);
2075 }
2076 }
2077
2078 if (pMap)
2079 {
2080 Assert(pMap->cRefs >= 1);
2081 pMap->cRefs--;
2082 }
2083 pgmUnlock(pVM);
2084#endif /* IN_RING3 */
2085}
2086
2087
2088/**
2089 * Release the internal mapping of a guest page.
2090 *
2091 * This is the counter part of pgmPhysGCPhys2CCPtrInternalEx and
2092 * pgmPhysGCPhys2CCPtrInternalReadOnly.
2093 *
2094 * @param pVM The cross context VM structure.
2095 * @param pLock The lock structure initialized by the mapping function.
2096 *
2097 * @remarks Caller must hold the PGM lock.
2098 */
2099void pgmPhysReleaseInternalPageMappingLock(PVM pVM, PPGMPAGEMAPLOCK pLock)
2100{
2101 PGM_LOCK_ASSERT_OWNER(pVM);
2102 PGMPhysReleasePageMappingLock(pVM, pLock); /* lazy for now */
2103}
2104
2105
2106/**
2107 * Converts a GC physical address to a HC ring-3 pointer.
2108 *
2109 * @returns VINF_SUCCESS on success.
2110 * @returns VERR_PGM_PHYS_PAGE_RESERVED it it's a valid GC physical
2111 * page but has no physical backing.
2112 * @returns VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid
2113 * GC physical address.
2114 * @returns VERR_PGM_GCPHYS_RANGE_CROSSES_BOUNDARY if the range crosses
2115 * a dynamic ram chunk boundary
2116 *
2117 * @param pVM The cross context VM structure.
2118 * @param GCPhys The GC physical address to convert.
2119 * @param pR3Ptr Where to store the R3 pointer on success.
2120 *
2121 * @deprecated Avoid when possible!
2122 */
2123int pgmPhysGCPhys2R3Ptr(PVM pVM, RTGCPHYS GCPhys, PRTR3PTR pR3Ptr)
2124{
2125/** @todo this is kind of hacky and needs some more work. */
2126#ifndef DEBUG_sandervl
2127 VM_ASSERT_EMT(pVM); /* no longer safe for use outside the EMT thread! */
2128#endif
2129
2130 Log(("pgmPhysGCPhys2R3Ptr(,%RGp,): dont use this API!\n", GCPhys)); /** @todo eliminate this API! */
2131#if defined(IN_RC) || defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
2132 NOREF(pVM); NOREF(pR3Ptr); RT_NOREF_PV(GCPhys);
2133 AssertFailedReturn(VERR_NOT_IMPLEMENTED);
2134#else
2135 pgmLock(pVM);
2136
2137 PPGMRAMRANGE pRam;
2138 PPGMPAGE pPage;
2139 int rc = pgmPhysGetPageAndRangeEx(pVM, GCPhys, &pPage, &pRam);
2140 if (RT_SUCCESS(rc))
2141 rc = pgmPhysGCPhys2CCPtrInternalDepr(pVM, pPage, GCPhys, (void **)pR3Ptr);
2142
2143 pgmUnlock(pVM);
2144 Assert(rc <= VINF_SUCCESS);
2145 return rc;
2146#endif
2147}
2148
2149#if 0 /*defined(IN_RC) || defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)*/
2150
2151/**
2152 * Maps and locks a guest CR3 or PD (PAE) page.
2153 *
2154 * @returns VINF_SUCCESS on success.
2155 * @returns VERR_PGM_PHYS_PAGE_RESERVED it it's a valid GC physical
2156 * page but has no physical backing.
2157 * @returns VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid
2158 * GC physical address.
2159 * @returns VERR_PGM_GCPHYS_RANGE_CROSSES_BOUNDARY if the range crosses
2160 * a dynamic ram chunk boundary
2161 *
2162 * @param pVM The cross context VM structure.
2163 * @param GCPhys The GC physical address to convert.
2164 * @param pR3Ptr Where to store the R3 pointer on success. This may or
2165 * may not be valid in ring-0 depending on the
2166 * VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0 build option.
2167 *
2168 * @remarks The caller must own the PGM lock.
2169 */
2170int pgmPhysCr3ToHCPtr(PVM pVM, RTGCPHYS GCPhys, PRTR3PTR pR3Ptr)
2171{
2172
2173 PPGMRAMRANGE pRam;
2174 PPGMPAGE pPage;
2175 int rc = pgmPhysGetPageAndRangeEx(pVM, GCPhys, &pPage, &pRam);
2176 if (RT_SUCCESS(rc))
2177 rc = pgmPhysGCPhys2CCPtrInternalDepr(pVM, pPage, GCPhys, (void **)pR3Ptr);
2178 Assert(rc <= VINF_SUCCESS);
2179 return rc;
2180}
2181
2182
2183int pgmPhysCr3ToHCPtr(PVM pVM, RTGCPHYS GCPhys, PRTR3PTR pR3Ptr)
2184{
2185
2186}
2187
2188#endif
2189
2190/**
2191 * Converts a guest pointer to a GC physical address.
2192 *
2193 * This uses the current CR3/CR0/CR4 of the guest.
2194 *
2195 * @returns VBox status code.
2196 * @param pVCpu The cross context virtual CPU structure.
2197 * @param GCPtr The guest pointer to convert.
2198 * @param pGCPhys Where to store the GC physical address.
2199 */
2200VMMDECL(int) PGMPhysGCPtr2GCPhys(PVMCPU pVCpu, RTGCPTR GCPtr, PRTGCPHYS pGCPhys)
2201{
2202 int rc = PGM_GST_PFN(GetPage,pVCpu)(pVCpu, (RTGCUINTPTR)GCPtr, NULL, pGCPhys);
2203 if (pGCPhys && RT_SUCCESS(rc))
2204 *pGCPhys |= (RTGCUINTPTR)GCPtr & PAGE_OFFSET_MASK;
2205 return rc;
2206}
2207
2208
2209/**
2210 * Converts a guest pointer to a HC physical address.
2211 *
2212 * This uses the current CR3/CR0/CR4 of the guest.
2213 *
2214 * @returns VBox status code.
2215 * @param pVCpu The cross context virtual CPU structure.
2216 * @param GCPtr The guest pointer to convert.
2217 * @param pHCPhys Where to store the HC physical address.
2218 */
2219VMM_INT_DECL(int) PGMPhysGCPtr2HCPhys(PVMCPU pVCpu, RTGCPTR GCPtr, PRTHCPHYS pHCPhys)
2220{
2221 PVM pVM = pVCpu->CTX_SUFF(pVM);
2222 RTGCPHYS GCPhys;
2223 int rc = PGM_GST_PFN(GetPage,pVCpu)(pVCpu, (RTGCUINTPTR)GCPtr, NULL, &GCPhys);
2224 if (RT_SUCCESS(rc))
2225 rc = PGMPhysGCPhys2HCPhys(pVM, GCPhys | ((RTGCUINTPTR)GCPtr & PAGE_OFFSET_MASK), pHCPhys);
2226 return rc;
2227}
2228
2229
2230
2231#undef LOG_GROUP
2232#define LOG_GROUP LOG_GROUP_PGM_PHYS_ACCESS
2233
2234
2235#if defined(IN_RING3) && defined(SOME_UNUSED_FUNCTION)
2236/**
2237 * Cache PGMPhys memory access
2238 *
2239 * @param pVM The cross context VM structure.
2240 * @param pCache Cache structure pointer
2241 * @param GCPhys GC physical address
2242 * @param pbHC HC pointer corresponding to physical page
2243 *
2244 * @thread EMT.
2245 */
2246static void pgmPhysCacheAdd(PVM pVM, PGMPHYSCACHE *pCache, RTGCPHYS GCPhys, uint8_t *pbR3)
2247{
2248 uint32_t iCacheIndex;
2249
2250 Assert(VM_IS_EMT(pVM));
2251
2252 GCPhys = PHYS_PAGE_ADDRESS(GCPhys);
2253 pbR3 = (uint8_t *)PAGE_ADDRESS(pbR3);
2254
2255 iCacheIndex = ((GCPhys >> PAGE_SHIFT) & PGM_MAX_PHYSCACHE_ENTRIES_MASK);
2256
2257 ASMBitSet(&pCache->aEntries, iCacheIndex);
2258
2259 pCache->Entry[iCacheIndex].GCPhys = GCPhys;
2260 pCache->Entry[iCacheIndex].pbR3 = pbR3;
2261}
2262#endif /* IN_RING3 */
2263
2264
2265/**
2266 * Deals with reading from a page with one or more ALL access handlers.
2267 *
2268 * @returns Strict VBox status code in ring-0 and raw-mode, ignorable in ring-3.
2269 * See PGM_HANDLER_PHYS_IS_VALID_STATUS and
2270 * PGM_HANDLER_VIRT_IS_VALID_STATUS for details.
2271 *
2272 * @param pVM The cross context VM structure.
2273 * @param pPage The page descriptor.
2274 * @param GCPhys The physical address to start reading at.
2275 * @param pvBuf Where to put the bits we read.
2276 * @param cb How much to read - less or equal to a page.
2277 * @param enmOrigin The origin of this call.
2278 */
2279static VBOXSTRICTRC pgmPhysReadHandler(PVM pVM, PPGMPAGE pPage, RTGCPHYS GCPhys, void *pvBuf, size_t cb,
2280 PGMACCESSORIGIN enmOrigin)
2281{
2282 /*
2283 * The most frequent access here is MMIO and shadowed ROM.
2284 * The current code ASSUMES all these access handlers covers full pages!
2285 */
2286
2287 /*
2288 * Whatever we do we need the source page, map it first.
2289 */
2290 PGMPAGEMAPLOCK PgMpLck;
2291 const void *pvSrc = NULL;
2292 int rc = pgmPhysGCPhys2CCPtrInternalReadOnly(pVM, pPage, GCPhys, &pvSrc, &PgMpLck);
2293/** @todo Check how this can work for MMIO pages? */
2294 if (RT_FAILURE(rc))
2295 {
2296 AssertLogRelMsgFailed(("pgmPhysGCPhys2CCPtrInternalReadOnly failed on %RGp / %R[pgmpage] -> %Rrc\n",
2297 GCPhys, pPage, rc));
2298 memset(pvBuf, 0xff, cb);
2299 return VINF_SUCCESS;
2300 }
2301
2302 VBOXSTRICTRC rcStrict = VINF_PGM_HANDLER_DO_DEFAULT;
2303
2304 /*
2305 * Deal with any physical handlers.
2306 */
2307 PVMCPU pVCpu = VMMGetCpu(pVM);
2308 PPGMPHYSHANDLER pPhys = NULL;
2309 if ( PGM_PAGE_GET_HNDL_PHYS_STATE(pPage) == PGM_PAGE_HNDL_PHYS_STATE_ALL
2310 || PGM_PAGE_IS_MMIO_OR_SPECIAL_ALIAS(pPage))
2311 {
2312 pPhys = pgmHandlerPhysicalLookup(pVM, GCPhys);
2313 AssertReleaseMsg(pPhys, ("GCPhys=%RGp cb=%#x\n", GCPhys, cb));
2314 Assert(GCPhys >= pPhys->Core.Key && GCPhys <= pPhys->Core.KeyLast);
2315 Assert((pPhys->Core.Key & PAGE_OFFSET_MASK) == 0);
2316 Assert((pPhys->Core.KeyLast & PAGE_OFFSET_MASK) == PAGE_OFFSET_MASK);
2317#ifndef IN_RING3
2318 if (enmOrigin != PGMACCESSORIGIN_IEM)
2319 {
2320 /* Cannot reliably handle informational status codes in this context */
2321 pgmPhysReleaseInternalPageMappingLock(pVM, &PgMpLck);
2322 return VERR_PGM_PHYS_WR_HIT_HANDLER;
2323 }
2324#endif
2325 PFNPGMPHYSHANDLER pfnHandler = PGMPHYSHANDLER_GET_TYPE(pVM, pPhys)->CTX_SUFF(pfnHandler); Assert(pfnHandler);
2326 void *pvUser = pPhys->CTX_SUFF(pvUser);
2327
2328 Log5(("pgmPhysReadHandler: GCPhys=%RGp cb=%#x pPage=%R[pgmpage] phys %s\n", GCPhys, cb, pPage, R3STRING(pPhys->pszDesc) ));
2329 STAM_PROFILE_START(&pPhys->Stat, h);
2330 PGM_LOCK_ASSERT_OWNER(pVM);
2331
2332 /* Release the PGM lock as MMIO handlers take the IOM lock. (deadlock prevention) */
2333 pgmUnlock(pVM);
2334 rcStrict = pfnHandler(pVM, pVCpu, GCPhys, (void *)pvSrc, pvBuf, cb, PGMACCESSTYPE_READ, enmOrigin, pvUser);
2335 pgmLock(pVM);
2336
2337#ifdef VBOX_WITH_STATISTICS
2338 pPhys = pgmHandlerPhysicalLookup(pVM, GCPhys);
2339 if (pPhys)
2340 STAM_PROFILE_STOP(&pPhys->Stat, h);
2341#else
2342 pPhys = NULL; /* might not be valid anymore. */
2343#endif
2344 AssertLogRelMsg(PGM_HANDLER_PHYS_IS_VALID_STATUS(rcStrict, false),
2345 ("rcStrict=%Rrc GCPhys=%RGp\n", VBOXSTRICTRC_VAL(rcStrict), GCPhys));
2346 if ( rcStrict != VINF_PGM_HANDLER_DO_DEFAULT
2347 && !PGM_PHYS_RW_IS_SUCCESS(rcStrict))
2348 {
2349 pgmPhysReleaseInternalPageMappingLock(pVM, &PgMpLck);
2350 return rcStrict;
2351 }
2352 }
2353
2354#if !defined(IN_RING0) && defined(VBOX_WITH_RAW_MODE)
2355 /*
2356 * Deal with any virtual handlers.
2357 */
2358 if (PGM_PAGE_GET_HNDL_VIRT_STATE(pPage) == PGM_PAGE_HNDL_VIRT_STATE_ALL)
2359 {
2360 unsigned iPage;
2361 PPGMVIRTHANDLER pVirt = pgmHandlerVirtualFindByPhysAddr(pVM, GCPhys, &iPage);
2362 AssertReleaseMsg(pVirt, ("GCPhys=%RGp cb=%#x\n", GCPhys, cb));
2363 Assert((pVirt->Core.Key & PAGE_OFFSET_MASK) == 0);
2364 Assert((pVirt->Core.KeyLast & PAGE_OFFSET_MASK) == PAGE_OFFSET_MASK);
2365 Assert(GCPhys >= pVirt->aPhysToVirt[iPage].Core.Key && GCPhys <= pVirt->aPhysToVirt[iPage].Core.KeyLast);
2366
2367# ifndef IN_RING3
2368 if (enmOrigin != PGMACCESSORIGIN_IEM)
2369 {
2370 /* Cannot reliably handle informational status codes in this context */
2371 pgmPhysReleaseInternalPageMappingLock(pVM, &PgMpLck);
2372 return VERR_PGM_PHYS_WR_HIT_HANDLER;
2373 }
2374# endif
2375 PPGMVIRTHANDLERTYPEINT pVirtType = PGMVIRTANDLER_GET_TYPE(pVM, pVirt);
2376 if (!pPhys)
2377 Log5(("pgmPhysReadHandler: GCPhys=%RGp cb=%#x pPage=%R[pgmpage] virt %s\n", GCPhys, cb, pPage, R3STRING(pVirt->pszDesc) ));
2378 else
2379 Log(("pgmPhysReadHandler: GCPhys=%RGp cb=%#x pPage=%R[pgmpage] phys/virt %s/%s\n", GCPhys, cb, pPage, R3STRING(pVirt->pszDesc), R3STRING(pPhys->pszDesc) ));
2380 RTGCUINTPTR GCPtr = ((RTGCUINTPTR)pVirt->Core.Key & PAGE_BASE_GC_MASK)
2381 + (iPage << PAGE_SHIFT)
2382 + (GCPhys & PAGE_OFFSET_MASK);
2383
2384 STAM_PROFILE_START(&pVirt->Stat, h);
2385 VBOXSTRICTRC rcStrict2 = pVirtType->CTX_SUFF(pfnHandler)(pVM, pVCpu, GCPtr, (void *)pvSrc, pvBuf, cb,
2386 PGMACCESSTYPE_READ, enmOrigin, pVirt->CTX_SUFF(pvUser));
2387 STAM_PROFILE_STOP(&pVirt->Stat, h);
2388
2389 /* Merge status codes. */
2390 if (rcStrict2 == VINF_SUCCESS)
2391 {
2392 if (rcStrict == VINF_PGM_HANDLER_DO_DEFAULT)
2393 rcStrict = VINF_SUCCESS;
2394 }
2395 else if (rcStrict2 != VINF_PGM_HANDLER_DO_DEFAULT)
2396 {
2397 AssertLogRelMsg(PGM_HANDLER_VIRT_IS_VALID_STATUS(rcStrict2, false),
2398 ("rcStrict2=%Rrc (rcStrict=%Rrc) GCPhys=%RGp pPage=%R[pgmpage] %s\n",
2399 VBOXSTRICTRC_VAL(rcStrict2), VBOXSTRICTRC_VAL(rcStrict), GCPhys, pPage, pVirt->pszDesc));
2400 if (!PGM_PHYS_RW_IS_SUCCESS(rcStrict2))
2401 {
2402 pgmPhysReleaseInternalPageMappingLock(pVM, &PgMpLck);
2403 return rcStrict2;
2404 }
2405 if (rcStrict == VINF_PGM_HANDLER_DO_DEFAULT)
2406 rcStrict = rcStrict2;
2407 else
2408 PGM_PHYS_RW_DO_UPDATE_STRICT_RC(rcStrict, rcStrict2);
2409 }
2410 }
2411#endif /* !IN_RING0 && VBOX_WITH_RAW_MODE */
2412
2413 /*
2414 * Take the default action.
2415 */
2416 if (rcStrict == VINF_PGM_HANDLER_DO_DEFAULT)
2417 {
2418 memcpy(pvBuf, pvSrc, cb);
2419 rcStrict = VINF_SUCCESS;
2420 }
2421 pgmPhysReleaseInternalPageMappingLock(pVM, &PgMpLck);
2422 return rcStrict;
2423}
2424
2425
2426/**
2427 * Read physical memory.
2428 *
2429 * This API respects access handlers and MMIO. Use PGMPhysSimpleReadGCPhys() if you
2430 * want to ignore those.
2431 *
2432 * @returns Strict VBox status code in raw-mode and ring-0, normal VBox status
2433 * code in ring-3. Use PGM_PHYS_RW_IS_SUCCESS to check.
2434 * @retval VINF_SUCCESS in all context - read completed.
2435 *
2436 * @retval VINF_EM_OFF in RC and R0 - read completed.
2437 * @retval VINF_EM_SUSPEND in RC and R0 - read completed.
2438 * @retval VINF_EM_RESET in RC and R0 - read completed.
2439 * @retval VINF_EM_HALT in RC and R0 - read completed.
2440 * @retval VINF_SELM_SYNC_GDT in RC only - read completed.
2441 *
2442 * @retval VINF_EM_DBG_STOP in RC and R0 - read completed.
2443 * @retval VINF_EM_DBG_BREAKPOINT in RC and R0 - read completed.
2444 * @retval VINF_EM_RAW_EMULATE_INSTR in RC and R0 only.
2445 *
2446 * @retval VINF_IOM_R3_MMIO_READ in RC and R0.
2447 * @retval VINF_IOM_R3_MMIO_READ_WRITE in RC and R0.
2448 *
2449 * @retval VINF_PATM_CHECK_PATCH_PAGE in RC only.
2450 *
2451 * @retval VERR_PGM_PHYS_WR_HIT_HANDLER in RC and R0 for access origins that
2452 * haven't been cleared for strict status codes yet.
2453 *
2454 * @param pVM The cross context VM structure.
2455 * @param GCPhys Physical address start reading from.
2456 * @param pvBuf Where to put the read bits.
2457 * @param cbRead How many bytes to read.
2458 * @param enmOrigin The origin of this call.
2459 */
2460VMMDECL(VBOXSTRICTRC) PGMPhysRead(PVM pVM, RTGCPHYS GCPhys, void *pvBuf, size_t cbRead, PGMACCESSORIGIN enmOrigin)
2461{
2462 AssertMsgReturn(cbRead > 0, ("don't even think about reading zero bytes!\n"), VINF_SUCCESS);
2463 LogFlow(("PGMPhysRead: %RGp %d\n", GCPhys, cbRead));
2464
2465 STAM_COUNTER_INC(&pVM->pgm.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,PhysRead));
2466 STAM_COUNTER_ADD(&pVM->pgm.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,PhysReadBytes), cbRead);
2467
2468 pgmLock(pVM);
2469
2470 /*
2471 * Copy loop on ram ranges.
2472 */
2473 VBOXSTRICTRC rcStrict = VINF_SUCCESS;
2474 PPGMRAMRANGE pRam = pgmPhysGetRangeAtOrAbove(pVM, GCPhys);
2475 for (;;)
2476 {
2477 /* Inside range or not? */
2478 if (pRam && GCPhys >= pRam->GCPhys)
2479 {
2480 /*
2481 * Must work our way thru this page by page.
2482 */
2483 RTGCPHYS off = GCPhys - pRam->GCPhys;
2484 while (off < pRam->cb)
2485 {
2486 unsigned iPage = off >> PAGE_SHIFT;
2487 PPGMPAGE pPage = &pRam->aPages[iPage];
2488 size_t cb = PAGE_SIZE - (off & PAGE_OFFSET_MASK);
2489 if (cb > cbRead)
2490 cb = cbRead;
2491
2492 /*
2493 * Normal page? Get the pointer to it.
2494 */
2495 if ( !PGM_PAGE_HAS_ACTIVE_ALL_HANDLERS(pPage)
2496 && !PGM_PAGE_IS_SPECIAL_ALIAS_MMIO(pPage))
2497 {
2498 /*
2499 * Get the pointer to the page.
2500 */
2501 PGMPAGEMAPLOCK PgMpLck;
2502 const void *pvSrc;
2503 int rc = pgmPhysGCPhys2CCPtrInternalReadOnly(pVM, pPage, pRam->GCPhys + off, &pvSrc, &PgMpLck);
2504 if (RT_SUCCESS(rc))
2505 {
2506 memcpy(pvBuf, pvSrc, cb);
2507 pgmPhysReleaseInternalPageMappingLock(pVM, &PgMpLck);
2508 }
2509 else
2510 {
2511 AssertLogRelMsgFailed(("pgmPhysGCPhys2CCPtrInternalReadOnly failed on %RGp / %R[pgmpage] -> %Rrc\n",
2512 pRam->GCPhys + off, pPage, rc));
2513 memset(pvBuf, 0xff, cb);
2514 }
2515 }
2516 /*
2517 * Have ALL/MMIO access handlers.
2518 */
2519 else
2520 {
2521 VBOXSTRICTRC rcStrict2 = pgmPhysReadHandler(pVM, pPage, pRam->GCPhys + off, pvBuf, cb, enmOrigin);
2522 if (PGM_PHYS_RW_IS_SUCCESS(rcStrict2))
2523 PGM_PHYS_RW_DO_UPDATE_STRICT_RC(rcStrict, rcStrict2);
2524 else
2525 {
2526 pgmUnlock(pVM);
2527 return rcStrict2;
2528 }
2529 }
2530
2531 /* next page */
2532 if (cb >= cbRead)
2533 {
2534 pgmUnlock(pVM);
2535 return rcStrict;
2536 }
2537 cbRead -= cb;
2538 off += cb;
2539 pvBuf = (char *)pvBuf + cb;
2540 } /* walk pages in ram range. */
2541
2542 GCPhys = pRam->GCPhysLast + 1;
2543 }
2544 else
2545 {
2546 LogFlow(("PGMPhysRead: Unassigned %RGp size=%u\n", GCPhys, cbRead));
2547
2548 /*
2549 * Unassigned address space.
2550 */
2551 size_t cb = pRam ? pRam->GCPhys - GCPhys : ~(size_t)0;
2552 if (cb >= cbRead)
2553 {
2554 memset(pvBuf, 0xff, cbRead);
2555 break;
2556 }
2557 memset(pvBuf, 0xff, cb);
2558
2559 cbRead -= cb;
2560 pvBuf = (char *)pvBuf + cb;
2561 GCPhys += cb;
2562 }
2563
2564 /* Advance range if necessary. */
2565 while (pRam && GCPhys > pRam->GCPhysLast)
2566 pRam = pRam->CTX_SUFF(pNext);
2567 } /* Ram range walk */
2568
2569 pgmUnlock(pVM);
2570 return rcStrict;
2571}
2572
2573
2574/**
2575 * Deals with writing to a page with one or more WRITE or ALL access handlers.
2576 *
2577 * @returns Strict VBox status code in ring-0 and raw-mode, ignorable in ring-3.
2578 * See PGM_HANDLER_PHYS_IS_VALID_STATUS and
2579 * PGM_HANDLER_VIRT_IS_VALID_STATUS for details.
2580 *
2581 * @param pVM The cross context VM structure.
2582 * @param pPage The page descriptor.
2583 * @param GCPhys The physical address to start writing at.
2584 * @param pvBuf What to write.
2585 * @param cbWrite How much to write - less or equal to a page.
2586 * @param enmOrigin The origin of this call.
2587 */
2588static VBOXSTRICTRC pgmPhysWriteHandler(PVM pVM, PPGMPAGE pPage, RTGCPHYS GCPhys, void const *pvBuf, size_t cbWrite,
2589 PGMACCESSORIGIN enmOrigin)
2590{
2591 PGMPAGEMAPLOCK PgMpLck;
2592 void *pvDst = NULL;
2593 VBOXSTRICTRC rcStrict;
2594
2595 /*
2596 * Give priority to physical handlers (like #PF does).
2597 *
2598 * Hope for a lonely physical handler first that covers the whole
2599 * write area. This should be a pretty frequent case with MMIO and
2600 * the heavy usage of full page handlers in the page pool.
2601 */
2602 PVMCPU pVCpu = VMMGetCpu(pVM);
2603 if ( !PGM_PAGE_HAS_ACTIVE_VIRTUAL_HANDLERS(pPage)
2604 || PGM_PAGE_IS_MMIO_OR_SPECIAL_ALIAS(pPage) /* screw virtual handlers on MMIO pages */)
2605 {
2606 PPGMPHYSHANDLER pCur = pgmHandlerPhysicalLookup(pVM, GCPhys);
2607 if (pCur)
2608 {
2609 Assert(GCPhys >= pCur->Core.Key && GCPhys <= pCur->Core.KeyLast);
2610#ifndef IN_RING3
2611 if (enmOrigin != PGMACCESSORIGIN_IEM)
2612 /* Cannot reliably handle informational status codes in this context */
2613 return VERR_PGM_PHYS_WR_HIT_HANDLER;
2614#endif
2615 size_t cbRange = pCur->Core.KeyLast - GCPhys + 1;
2616 if (cbRange > cbWrite)
2617 cbRange = cbWrite;
2618
2619 Assert(PGMPHYSHANDLER_GET_TYPE(pVM, pCur)->CTX_SUFF(pfnHandler));
2620 Log5(("pgmPhysWriteHandler: GCPhys=%RGp cbRange=%#x pPage=%R[pgmpage] phys %s\n",
2621 GCPhys, cbRange, pPage, R3STRING(pCur->pszDesc) ));
2622 if (!PGM_PAGE_IS_MMIO_OR_SPECIAL_ALIAS(pPage))
2623 rcStrict = pgmPhysGCPhys2CCPtrInternal(pVM, pPage, GCPhys, &pvDst, &PgMpLck);
2624 else
2625 rcStrict = VINF_SUCCESS;
2626 if (RT_SUCCESS(rcStrict))
2627 {
2628 PFNPGMPHYSHANDLER pfnHandler = PGMPHYSHANDLER_GET_TYPE(pVM, pCur)->CTX_SUFF(pfnHandler);
2629 void *pvUser = pCur->CTX_SUFF(pvUser);
2630 STAM_PROFILE_START(&pCur->Stat, h);
2631
2632 /* Release the PGM lock as MMIO handlers take the IOM lock. (deadlock prevention) */
2633 PGM_LOCK_ASSERT_OWNER(pVM);
2634 pgmUnlock(pVM);
2635 rcStrict = pfnHandler(pVM, pVCpu, GCPhys, pvDst, (void *)pvBuf, cbRange, PGMACCESSTYPE_WRITE, enmOrigin, pvUser);
2636 pgmLock(pVM);
2637
2638#ifdef VBOX_WITH_STATISTICS
2639 pCur = pgmHandlerPhysicalLookup(pVM, GCPhys);
2640 if (pCur)
2641 STAM_PROFILE_STOP(&pCur->Stat, h);
2642#else
2643 pCur = NULL; /* might not be valid anymore. */
2644#endif
2645 if (rcStrict == VINF_PGM_HANDLER_DO_DEFAULT)
2646 {
2647 if (pvDst)
2648 memcpy(pvDst, pvBuf, cbRange);
2649 rcStrict = VINF_SUCCESS;
2650 }
2651 else
2652 AssertLogRelMsg(PGM_HANDLER_PHYS_IS_VALID_STATUS(rcStrict, true),
2653 ("rcStrict=%Rrc GCPhys=%RGp pPage=%R[pgmpage] %s\n",
2654 VBOXSTRICTRC_VAL(rcStrict), GCPhys, pPage, pCur ? R3STRING(pCur->pszDesc) : ""));
2655 }
2656 else
2657 AssertLogRelMsgFailedReturn(("pgmPhysGCPhys2CCPtrInternal failed on %RGp / %R[pgmpage] -> %Rrc\n",
2658 GCPhys, pPage, VBOXSTRICTRC_VAL(rcStrict)), rcStrict);
2659 if (RT_LIKELY(cbRange == cbWrite) || !PGM_PHYS_RW_IS_SUCCESS(rcStrict))
2660 {
2661 if (pvDst)
2662 pgmPhysReleaseInternalPageMappingLock(pVM, &PgMpLck);
2663 return rcStrict;
2664 }
2665
2666 /* more fun to be had below */
2667 cbWrite -= cbRange;
2668 GCPhys += cbRange;
2669 pvBuf = (uint8_t *)pvBuf + cbRange;
2670 pvDst = (uint8_t *)pvDst + cbRange;
2671 }
2672 else /* The handler is somewhere else in the page, deal with it below. */
2673 rcStrict = VINF_SUCCESS;
2674 Assert(!PGM_PAGE_IS_MMIO_OR_ALIAS(pPage)); /* MMIO handlers are all PAGE_SIZEed! */
2675 }
2676#if !defined(IN_RING0) && defined(VBOX_WITH_RAW_MODE)
2677 /*
2678 * A virtual handler without any interfering physical handlers.
2679 * Hopefully it'll cover the whole write.
2680 */
2681 else if (!PGM_PAGE_HAS_ACTIVE_PHYSICAL_HANDLERS(pPage))
2682 {
2683 unsigned iPage;
2684 PPGMVIRTHANDLER pVirt = pgmHandlerVirtualFindByPhysAddr(pVM, GCPhys, &iPage);
2685 if (pVirt)
2686 {
2687# ifndef IN_RING3
2688 if (enmOrigin != PGMACCESSORIGIN_IEM)
2689 /* Cannot reliably handle informational status codes in this context */
2690 return VERR_PGM_PHYS_WR_HIT_HANDLER;
2691# endif
2692 PPGMVIRTHANDLERTYPEINT pVirtType = PGMVIRTANDLER_GET_TYPE(pVM, pVirt);
2693 size_t cbRange = (PAGE_OFFSET_MASK & pVirt->Core.KeyLast) - (PAGE_OFFSET_MASK & GCPhys) + 1;
2694 if (cbRange > cbWrite)
2695 cbRange = cbWrite;
2696
2697 Log5(("pgmPhysWriteHandler: GCPhys=%RGp cbRange=%#x pPage=%R[pgmpage] virt %s\n",
2698 GCPhys, cbRange, pPage, R3STRING(pVirt->pszDesc) ));
2699 rcStrict = pgmPhysGCPhys2CCPtrInternal(pVM, pPage, GCPhys, &pvDst, &PgMpLck);
2700 if (RT_SUCCESS(rcStrict))
2701 {
2702 Assert(pVirtType->CTX_SUFF(pfnHandler));
2703 RTGCUINTPTR GCPtr = ((RTGCUINTPTR)pVirt->Core.Key & PAGE_BASE_GC_MASK)
2704 + (iPage << PAGE_SHIFT)
2705 + (GCPhys & PAGE_OFFSET_MASK);
2706
2707 STAM_PROFILE_START(&pVirt->Stat, h);
2708 rcStrict = pVirtType->CTX_SUFF(pfnHandler)(pVM, pVCpu, GCPtr, pvDst, (void *)pvBuf, cbRange,
2709 PGMACCESSTYPE_WRITE, enmOrigin, pVirt->CTX_SUFF(pvUser));
2710 STAM_PROFILE_STOP(&pVirt->Stat, h);
2711 if (rcStrict == VINF_PGM_HANDLER_DO_DEFAULT)
2712 {
2713 memcpy(pvDst, pvBuf, cbRange);
2714 rcStrict = VINF_SUCCESS;
2715 }
2716 else
2717 AssertLogRelMsg(PGM_HANDLER_VIRT_IS_VALID_STATUS(rcStrict, true),
2718 ("rcStrict=%Rrc GCPhys=%RGp pPage=%R[pgmpage] %s\n",
2719 VBOXSTRICTRC_VAL(rcStrict), GCPhys, pPage, R3STRING(pVirt->pszDesc)));
2720 }
2721 else
2722 AssertLogRelMsgFailedReturn(("pgmPhysGCPhys2CCPtrInternal failed on %RGp / %R[pgmpage] -> %Rrc\n",
2723 GCPhys, pPage, VBOXSTRICTRC_VAL(rcStrict)), rcStrict);
2724 if (RT_LIKELY(cbRange == cbWrite) || !PGM_PHYS_RW_IS_SUCCESS(rcStrict))
2725 {
2726 pgmPhysReleaseInternalPageMappingLock(pVM, &PgMpLck);
2727 return rcStrict;
2728 }
2729
2730 /* more fun to be had below */
2731 cbWrite -= cbRange;
2732 GCPhys += cbRange;
2733 pvBuf = (uint8_t *)pvBuf + cbRange;
2734 pvDst = (uint8_t *)pvDst + cbRange;
2735 }
2736 else /* The handler is somewhere else in the page, deal with it below. */
2737 rcStrict = VINF_SUCCESS;
2738 }
2739#endif /* !IN_RING0 && VBOX_WITH_RAW_MODE */
2740 else
2741 rcStrict = VINF_SUCCESS;
2742
2743
2744 /*
2745 * Deal with all the odd ends.
2746 */
2747 Assert(rcStrict != VINF_PGM_HANDLER_DO_DEFAULT);
2748
2749 /* We need a writable destination page. */
2750 if (!pvDst)
2751 {
2752 int rc2 = pgmPhysGCPhys2CCPtrInternal(pVM, pPage, GCPhys, &pvDst, &PgMpLck);
2753 AssertLogRelMsgReturn(RT_SUCCESS(rc2),
2754 ("pgmPhysGCPhys2CCPtrInternal failed on %RGp / %R[pgmpage] -> %Rrc\n", GCPhys, pPage, rc2),
2755 rc2);
2756 }
2757
2758 /* The loop state (big + ugly). */
2759#if !defined(IN_RING0) && defined(VBOX_WITH_RAW_MODE)
2760 unsigned iVirtPage = 0;
2761 PPGMVIRTHANDLER pVirt = NULL;
2762 uint32_t offVirt = PAGE_SIZE;
2763 uint32_t offVirtLast = PAGE_SIZE;
2764 bool fMoreVirt = PGM_PAGE_HAS_ACTIVE_VIRTUAL_HANDLERS(pPage);
2765#else
2766 uint32_t const offVirt = UINT32_MAX;
2767#endif
2768
2769 PPGMPHYSHANDLER pPhys = NULL;
2770 uint32_t offPhys = PAGE_SIZE;
2771 uint32_t offPhysLast = PAGE_SIZE;
2772 bool fMorePhys = PGM_PAGE_HAS_ACTIVE_PHYSICAL_HANDLERS(pPage);
2773
2774 /* The loop. */
2775 for (;;)
2776 {
2777#if !defined(IN_RING0) && defined(VBOX_WITH_RAW_MODE)
2778 /*
2779 * Find the closest handler at or above GCPhys.
2780 */
2781 if (fMoreVirt && !pVirt)
2782 {
2783 pVirt = pgmHandlerVirtualFindByPhysAddr(pVM, GCPhys, &iVirtPage);
2784 if (pVirt)
2785 {
2786 offVirt = 0;
2787 offVirtLast = (pVirt->aPhysToVirt[iVirtPage].Core.KeyLast & PAGE_OFFSET_MASK) - (GCPhys & PAGE_OFFSET_MASK);
2788 }
2789 else
2790 {
2791 PPGMPHYS2VIRTHANDLER pVirtPhys;
2792 pVirtPhys = (PPGMPHYS2VIRTHANDLER)RTAvlroGCPhysGetBestFit(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysToVirtHandlers,
2793 GCPhys, true /* fAbove */);
2794 if ( pVirtPhys
2795 && (pVirtPhys->Core.Key >> PAGE_SHIFT) == (GCPhys >> PAGE_SHIFT))
2796 {
2797 /* ASSUME that pVirtPhys only covers one page. */
2798 Assert((pVirtPhys->Core.Key >> PAGE_SHIFT) == (pVirtPhys->Core.KeyLast >> PAGE_SHIFT));
2799 Assert(pVirtPhys->Core.Key > GCPhys);
2800
2801 pVirt = (PPGMVIRTHANDLER)((uintptr_t)pVirtPhys + pVirtPhys->offVirtHandler);
2802 iVirtPage = pVirtPhys - &pVirt->aPhysToVirt[0]; Assert(iVirtPage == 0);
2803 offVirt = (pVirtPhys->Core.Key & PAGE_OFFSET_MASK) - (GCPhys & PAGE_OFFSET_MASK);
2804 offVirtLast = (pVirtPhys->Core.KeyLast & PAGE_OFFSET_MASK) - (GCPhys & PAGE_OFFSET_MASK);
2805 }
2806 else
2807 {
2808 pVirt = NULL;
2809 fMoreVirt = false;
2810 offVirt = offVirtLast = PAGE_SIZE;
2811 }
2812 }
2813 }
2814#endif
2815
2816 if (fMorePhys && !pPhys)
2817 {
2818 pPhys = pgmHandlerPhysicalLookup(pVM, GCPhys);
2819 if (pPhys)
2820 {
2821 offPhys = 0;
2822 offPhysLast = pPhys->Core.KeyLast - GCPhys; /* ASSUMES < 4GB handlers... */
2823 }
2824 else
2825 {
2826 pPhys = (PPGMPHYSHANDLER)RTAvlroGCPhysGetBestFit(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers,
2827 GCPhys, true /* fAbove */);
2828 if ( pPhys
2829 && pPhys->Core.Key <= GCPhys + (cbWrite - 1))
2830 {
2831 offPhys = pPhys->Core.Key - GCPhys;
2832 offPhysLast = pPhys->Core.KeyLast - GCPhys; /* ASSUMES < 4GB handlers... */
2833 }
2834 else
2835 {
2836 pPhys = NULL;
2837 fMorePhys = false;
2838 offPhys = offPhysLast = PAGE_SIZE;
2839 }
2840 }
2841 }
2842
2843 /*
2844 * Handle access to space without handlers (that's easy).
2845 */
2846 VBOXSTRICTRC rcStrict2 = VINF_PGM_HANDLER_DO_DEFAULT;
2847 uint32_t cbRange = (uint32_t)cbWrite;
2848 if (offPhys != 0 && offVirt != 0)
2849 {
2850 if (cbRange > offPhys)
2851 cbRange = offPhys;
2852 if (cbRange > offVirt)
2853 cbRange = offVirt;
2854 Log5(("pgmPhysWriteHandler: GCPhys=%RGp cbRange=%#x pPage=%R[pgmpage] miss\n", GCPhys, cbRange, pPage));
2855 }
2856 /*
2857 * Physical handler.
2858 */
2859 else if (!offPhys && offVirt)
2860 {
2861#ifndef IN_RING3
2862 if (enmOrigin != PGMACCESSORIGIN_IEM)
2863 /* Cannot reliably handle informational status codes in this context */
2864 return VERR_PGM_PHYS_WR_HIT_HANDLER;
2865#endif
2866 if (cbRange > offPhysLast + 1)
2867 cbRange = offPhysLast + 1;
2868 if (cbRange > offVirt)
2869 cbRange = offVirt;
2870
2871 PFNPGMPHYSHANDLER pfnHandler = PGMPHYSHANDLER_GET_TYPE(pVM, pPhys)->CTX_SUFF(pfnHandler);
2872 void *pvUser = pPhys->CTX_SUFF(pvUser);
2873
2874 Log5(("pgmPhysWriteHandler: GCPhys=%RGp cbRange=%#x pPage=%R[pgmpage] phys %s\n", GCPhys, cbRange, pPage, R3STRING(pPhys->pszDesc) ));
2875 STAM_PROFILE_START(&pPhys->Stat, h);
2876
2877 /* Release the PGM lock as MMIO handlers take the IOM lock. (deadlock prevention) */
2878 PGM_LOCK_ASSERT_OWNER(pVM);
2879 pgmUnlock(pVM);
2880 rcStrict2 = pfnHandler(pVM, pVCpu, GCPhys, pvDst, (void *)pvBuf, cbRange, PGMACCESSTYPE_WRITE, enmOrigin, pvUser);
2881 pgmLock(pVM);
2882
2883#ifdef VBOX_WITH_STATISTICS
2884 pPhys = pgmHandlerPhysicalLookup(pVM, GCPhys);
2885 if (pPhys)
2886 STAM_PROFILE_STOP(&pPhys->Stat, h);
2887#else
2888 pPhys = NULL; /* might not be valid anymore. */
2889#endif
2890 AssertLogRelMsg(PGM_HANDLER_PHYS_IS_VALID_STATUS(rcStrict2, true),
2891 ("rcStrict2=%Rrc (rcStrict=%Rrc) GCPhys=%RGp pPage=%R[pgmpage] %s\n", VBOXSTRICTRC_VAL(rcStrict2),
2892 VBOXSTRICTRC_VAL(rcStrict), GCPhys, pPage, pPhys ? R3STRING(pPhys->pszDesc) : ""));
2893 }
2894#if !defined(IN_RING0) && defined(VBOX_WITH_RAW_MODE)
2895 /*
2896 * Virtual handler.
2897 */
2898 else if (offPhys && !offVirt)
2899 {
2900# ifndef IN_RING3
2901 if (enmOrigin != PGMACCESSORIGIN_IEM)
2902 /* Cannot reliably handle informational status codes in this context */
2903 return VERR_PGM_PHYS_WR_HIT_HANDLER;
2904# endif
2905 if (cbRange > offVirtLast + 1)
2906 cbRange = offVirtLast + 1;
2907 if (cbRange > offPhys)
2908 cbRange = offPhys;
2909
2910 PPGMVIRTHANDLERTYPEINT pVirtType = PGMVIRTANDLER_GET_TYPE(pVM, pVirt);
2911 Log5(("pgmPhysWriteHandler: GCPhys=%RGp cbRange=%#x pPage=%R[pgmpage] phys %s\n", GCPhys, cbRange, pPage, R3STRING(pVirt->pszDesc) ));
2912 Assert(pVirtType->CTX_SUFF(pfnHandler));
2913 RTGCUINTPTR GCPtr = ((RTGCUINTPTR)pVirt->Core.Key & PAGE_BASE_GC_MASK)
2914 + (iVirtPage << PAGE_SHIFT)
2915 + (GCPhys & PAGE_OFFSET_MASK);
2916 STAM_PROFILE_START(&pVirt->Stat, h);
2917 rcStrict2 = pVirtType->CTX_SUFF(pfnHandler)(pVM, pVCpu, GCPtr, pvDst, (void *)pvBuf, cbRange, PGMACCESSTYPE_WRITE,
2918 enmOrigin, pVirt->CTX_SUFF(pvUser));
2919 STAM_PROFILE_STOP(&pVirt->Stat, h);
2920 AssertLogRelMsg(PGM_HANDLER_VIRT_IS_VALID_STATUS(rcStrict2, true),
2921 ("rcStrict2=%Rrc (rcStrict=%Rrc) GCPhys=%RGp pPage=%R[pgmpage] %s\n", VBOXSTRICTRC_VAL(rcStrict2),
2922 VBOXSTRICTRC_VAL(rcStrict), GCPhys, pPage, pPhys ? R3STRING(pPhys->pszDesc) : ""));
2923 pVirt = NULL;
2924 }
2925 /*
2926 * Both... give the physical one priority.
2927 */
2928 else
2929 {
2930# ifndef IN_RING3
2931 if (enmOrigin != PGMACCESSORIGIN_IEM)
2932 /* Cannot reliably handle informational status codes in this context */
2933 return VERR_PGM_PHYS_WR_HIT_HANDLER;
2934# endif
2935 Assert(!offPhys && !offVirt);
2936 if (cbRange > offVirtLast + 1)
2937 cbRange = offVirtLast + 1;
2938 if (cbRange > offPhysLast + 1)
2939 cbRange = offPhysLast + 1;
2940
2941 PPGMVIRTHANDLERTYPEINT pVirtType = PGMVIRTANDLER_GET_TYPE(pVM, pVirt);
2942 if (pVirtType->pfnHandlerR3)
2943 Log(("pgmPhysWriteHandler: overlapping phys and virt handlers at %RGp %R[pgmpage]; cbRange=%#x\n", GCPhys, pPage, cbRange));
2944 Log5(("pgmPhysWriteHandler: GCPhys=%RGp cbRange=%#x pPage=%R[pgmpage] phys/virt %s/%s\n", GCPhys, cbRange, pPage, R3STRING(pPhys->pszDesc), R3STRING(pVirt->pszDesc) ));
2945
2946 PFNPGMPHYSHANDLER pfnHandler = PGMPHYSHANDLER_GET_TYPE(pVM, pPhys)->CTX_SUFF(pfnHandler);
2947 void *pvUser = pPhys->CTX_SUFF(pvUser);
2948 STAM_PROFILE_START(&pPhys->Stat, h);
2949
2950 /* Release the PGM lock as MMIO handlers take the IOM lock. (deadlock prevention) */
2951 PGM_LOCK_ASSERT_OWNER(pVM);
2952 pgmUnlock(pVM);
2953 rcStrict2 = pfnHandler(pVM, pVCpu, GCPhys, pvDst, (void *)pvBuf, cbRange, PGMACCESSTYPE_WRITE, enmOrigin, pvUser);
2954 pgmLock(pVM);
2955
2956# ifdef VBOX_WITH_STATISTICS
2957 pPhys = pgmHandlerPhysicalLookup(pVM, GCPhys);
2958 if (pPhys)
2959 STAM_PROFILE_STOP(&pPhys->Stat, h);
2960# else
2961 pPhys = NULL; /* might not be valid anymore. */
2962# endif
2963 AssertLogRelMsg(PGM_HANDLER_PHYS_IS_VALID_STATUS(rcStrict2, true),
2964 ("rcStrict2=%Rrc (rcStrict=%Rrc) GCPhys=%RGp pPage=%R[pgmpage] %s\n", VBOXSTRICTRC_VAL(rcStrict2),
2965 VBOXSTRICTRC_VAL(rcStrict), GCPhys, pPage, pPhys ? R3STRING(pPhys->pszDesc) : ""));
2966 if (rcStrict2 == VINF_PGM_HANDLER_DO_DEFAULT || PGM_PHYS_RW_IS_SUCCESS(rcStrict2))
2967 {
2968 Assert(pVirtType->CTX_SUFF(pfnHandler));
2969 RTGCUINTPTR GCPtr = ((RTGCUINTPTR)pVirt->Core.Key & PAGE_BASE_GC_MASK)
2970 + (iVirtPage << PAGE_SHIFT)
2971 + (GCPhys & PAGE_OFFSET_MASK);
2972 pvUser = pVirt->CTX_SUFF(pvUser);
2973
2974 STAM_PROFILE_START(&pVirt->Stat, h2);
2975 VBOXSTRICTRC rcStrict3 = pVirtType->CTX_SUFF(pfnHandler)(pVM, pVCpu, GCPtr, pvDst, (void *)pvBuf, cbRange,
2976 PGMACCESSTYPE_WRITE, enmOrigin, pvUser);
2977 STAM_PROFILE_STOP(&pVirt->Stat, h2);
2978
2979 /* Merge the 3rd status into the 2nd. */
2980 if (rcStrict3 == VINF_SUCCESS)
2981 {
2982 if (rcStrict2 == VINF_PGM_HANDLER_DO_DEFAULT)
2983 rcStrict2 = VINF_SUCCESS;
2984 }
2985 else if (rcStrict3 != VINF_PGM_HANDLER_DO_DEFAULT)
2986 {
2987 AssertLogRelMsg(PGM_HANDLER_VIRT_IS_VALID_STATUS(rcStrict3, true),
2988 ("rcStrict3=%Rrc (rcStrict2=%Rrc) (rcStrict=%Rrc) GCPhys=%RGp pPage=%R[pgmpage] %s\n",
2989 VBOXSTRICTRC_VAL(rcStrict3), VBOXSTRICTRC_VAL(rcStrict2), VBOXSTRICTRC_VAL(rcStrict),
2990 GCPhys, pPage, R3STRING(pVirt->pszDesc) ));
2991 if (rcStrict2 == VINF_PGM_HANDLER_DO_DEFAULT)
2992 rcStrict2 = rcStrict3;
2993 else if (!PGM_PHYS_RW_IS_SUCCESS(rcStrict3))
2994 rcStrict2 = rcStrict3;
2995 else
2996 PGM_PHYS_RW_DO_UPDATE_STRICT_RC(rcStrict2, rcStrict3);
2997 }
2998 }
2999 pPhys = NULL;
3000 pVirt = NULL;
3001 }
3002#endif /* !IN_RING0 && VBOX_WITH_RAW_MODE */
3003
3004
3005 /*
3006 * Execute the default action and merge the status codes.
3007 */
3008 if (rcStrict2 == VINF_PGM_HANDLER_DO_DEFAULT)
3009 {
3010 memcpy(pvDst, pvBuf, cbRange);
3011 rcStrict2 = VINF_SUCCESS;
3012 }
3013 else if (!PGM_PHYS_RW_IS_SUCCESS(rcStrict2))
3014 {
3015 pgmPhysReleaseInternalPageMappingLock(pVM, &PgMpLck);
3016 return rcStrict2;
3017 }
3018 else
3019 PGM_PHYS_RW_DO_UPDATE_STRICT_RC(rcStrict, rcStrict2);
3020
3021 /*
3022 * Advance if we've got more stuff to do.
3023 */
3024 if (cbRange >= cbWrite)
3025 {
3026 pgmPhysReleaseInternalPageMappingLock(pVM, &PgMpLck);
3027 return rcStrict;
3028 }
3029
3030
3031 cbWrite -= cbRange;
3032 GCPhys += cbRange;
3033 pvBuf = (uint8_t *)pvBuf + cbRange;
3034 pvDst = (uint8_t *)pvDst + cbRange;
3035
3036 offPhys -= cbRange;
3037 offPhysLast -= cbRange;
3038#if !defined(IN_RING0) && defined(VBOX_WITH_RAW_MODE)
3039 offVirt -= cbRange;
3040 offVirtLast -= cbRange;
3041#endif
3042 }
3043}
3044
3045
3046/**
3047 * Write to physical memory.
3048 *
3049 * This API respects access handlers and MMIO. Use PGMPhysSimpleWriteGCPhys() if you
3050 * want to ignore those.
3051 *
3052 * @returns Strict VBox status code in raw-mode and ring-0, normal VBox status
3053 * code in ring-3. Use PGM_PHYS_RW_IS_SUCCESS to check.
3054 * @retval VINF_SUCCESS in all context - write completed.
3055 *
3056 * @retval VINF_EM_OFF in RC and R0 - write completed.
3057 * @retval VINF_EM_SUSPEND in RC and R0 - write completed.
3058 * @retval VINF_EM_RESET in RC and R0 - write completed.
3059 * @retval VINF_EM_HALT in RC and R0 - write completed.
3060 * @retval VINF_SELM_SYNC_GDT in RC only - write completed.
3061 *
3062 * @retval VINF_EM_DBG_STOP in RC and R0 - write completed.
3063 * @retval VINF_EM_DBG_BREAKPOINT in RC and R0 - write completed.
3064 * @retval VINF_EM_RAW_EMULATE_INSTR in RC and R0 only.
3065 *
3066 * @retval VINF_IOM_R3_MMIO_WRITE in RC and R0.
3067 * @retval VINF_IOM_R3_MMIO_READ_WRITE in RC and R0.
3068 * @retval VINF_IOM_R3_MMIO_COMMIT_WRITE in RC and R0.
3069 *
3070 * @retval VINF_EM_RAW_EMULATE_IO_BLOCK in R0 only.
3071 *
3072 * @retval VINF_EM_RAW_EMULATE_INSTR_GDT_FAULT in RC only - write completed.
3073 * @retval VINF_EM_RAW_EMULATE_INSTR_LDT_FAULT in RC only.
3074 * @retval VINF_EM_RAW_EMULATE_INSTR_TSS_FAULT in RC only.
3075 * @retval VINF_EM_RAW_EMULATE_INSTR_IDT_FAULT in RC only.
3076 * @retval VINF_CSAM_PENDING_ACTION in RC only.
3077 * @retval VINF_PATM_CHECK_PATCH_PAGE in RC only.
3078 *
3079 * @retval VERR_PGM_PHYS_WR_HIT_HANDLER in RC and R0 for access origins that
3080 * haven't been cleared for strict status codes yet.
3081 *
3082 *
3083 * @param pVM The cross context VM structure.
3084 * @param GCPhys Physical address to write to.
3085 * @param pvBuf What to write.
3086 * @param cbWrite How many bytes to write.
3087 * @param enmOrigin Who is calling.
3088 */
3089VMMDECL(VBOXSTRICTRC) PGMPhysWrite(PVM pVM, RTGCPHYS GCPhys, const void *pvBuf, size_t cbWrite, PGMACCESSORIGIN enmOrigin)
3090{
3091 AssertMsg(!pVM->pgm.s.fNoMorePhysWrites, ("Calling PGMPhysWrite after pgmR3Save()! enmOrigin=%d\n", enmOrigin));
3092 AssertMsgReturn(cbWrite > 0, ("don't even think about writing zero bytes!\n"), VINF_SUCCESS);
3093 LogFlow(("PGMPhysWrite: %RGp %d\n", GCPhys, cbWrite));
3094
3095 STAM_COUNTER_INC(&pVM->pgm.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,PhysWrite));
3096 STAM_COUNTER_ADD(&pVM->pgm.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,PhysWriteBytes), cbWrite);
3097
3098 pgmLock(pVM);
3099
3100 /*
3101 * Copy loop on ram ranges.
3102 */
3103 VBOXSTRICTRC rcStrict = VINF_SUCCESS;
3104 PPGMRAMRANGE pRam = pgmPhysGetRangeAtOrAbove(pVM, GCPhys);
3105 for (;;)
3106 {
3107 /* Inside range or not? */
3108 if (pRam && GCPhys >= pRam->GCPhys)
3109 {
3110 /*
3111 * Must work our way thru this page by page.
3112 */
3113 RTGCPTR off = GCPhys - pRam->GCPhys;
3114 while (off < pRam->cb)
3115 {
3116 RTGCPTR iPage = off >> PAGE_SHIFT;
3117 PPGMPAGE pPage = &pRam->aPages[iPage];
3118 size_t cb = PAGE_SIZE - (off & PAGE_OFFSET_MASK);
3119 if (cb > cbWrite)
3120 cb = cbWrite;
3121
3122 /*
3123 * Normal page? Get the pointer to it.
3124 */
3125 if ( !PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage)
3126 && !PGM_PAGE_IS_SPECIAL_ALIAS_MMIO(pPage))
3127 {
3128 PGMPAGEMAPLOCK PgMpLck;
3129 void *pvDst;
3130 int rc = pgmPhysGCPhys2CCPtrInternal(pVM, pPage, pRam->GCPhys + off, &pvDst, &PgMpLck);
3131 if (RT_SUCCESS(rc))
3132 {
3133 Assert(!PGM_PAGE_IS_BALLOONED(pPage));
3134 memcpy(pvDst, pvBuf, cb);
3135 pgmPhysReleaseInternalPageMappingLock(pVM, &PgMpLck);
3136 }
3137 /* Ignore writes to ballooned pages. */
3138 else if (!PGM_PAGE_IS_BALLOONED(pPage))
3139 AssertLogRelMsgFailed(("pgmPhysGCPhys2CCPtrInternal failed on %RGp / %R[pgmpage] -> %Rrc\n",
3140 pRam->GCPhys + off, pPage, rc));
3141 }
3142 /*
3143 * Active WRITE or ALL access handlers.
3144 */
3145 else
3146 {
3147 VBOXSTRICTRC rcStrict2 = pgmPhysWriteHandler(pVM, pPage, pRam->GCPhys + off, pvBuf, cb, enmOrigin);
3148 if (PGM_PHYS_RW_IS_SUCCESS(rcStrict2))
3149 PGM_PHYS_RW_DO_UPDATE_STRICT_RC(rcStrict, rcStrict2);
3150 else
3151 {
3152 pgmUnlock(pVM);
3153 return rcStrict2;
3154 }
3155 }
3156
3157 /* next page */
3158 if (cb >= cbWrite)
3159 {
3160 pgmUnlock(pVM);
3161 return rcStrict;
3162 }
3163
3164 cbWrite -= cb;
3165 off += cb;
3166 pvBuf = (const char *)pvBuf + cb;
3167 } /* walk pages in ram range */
3168
3169 GCPhys = pRam->GCPhysLast + 1;
3170 }
3171 else
3172 {
3173 /*
3174 * Unassigned address space, skip it.
3175 */
3176 if (!pRam)
3177 break;
3178 size_t cb = pRam->GCPhys - GCPhys;
3179 if (cb >= cbWrite)
3180 break;
3181 cbWrite -= cb;
3182 pvBuf = (const char *)pvBuf + cb;
3183 GCPhys += cb;
3184 }
3185
3186 /* Advance range if necessary. */
3187 while (pRam && GCPhys > pRam->GCPhysLast)
3188 pRam = pRam->CTX_SUFF(pNext);
3189 } /* Ram range walk */
3190
3191 pgmUnlock(pVM);
3192 return rcStrict;
3193}
3194
3195
3196/**
3197 * Read from guest physical memory by GC physical address, bypassing
3198 * MMIO and access handlers.
3199 *
3200 * @returns VBox status code.
3201 * @param pVM The cross context VM structure.
3202 * @param pvDst The destination address.
3203 * @param GCPhysSrc The source address (GC physical address).
3204 * @param cb The number of bytes to read.
3205 */
3206VMMDECL(int) PGMPhysSimpleReadGCPhys(PVM pVM, void *pvDst, RTGCPHYS GCPhysSrc, size_t cb)
3207{
3208 /*
3209 * Treat the first page as a special case.
3210 */
3211 if (!cb)
3212 return VINF_SUCCESS;
3213
3214 /* map the 1st page */
3215 void const *pvSrc;
3216 PGMPAGEMAPLOCK Lock;
3217 int rc = PGMPhysGCPhys2CCPtrReadOnly(pVM, GCPhysSrc, &pvSrc, &Lock);
3218 if (RT_FAILURE(rc))
3219 return rc;
3220
3221 /* optimize for the case where access is completely within the first page. */
3222 size_t cbPage = PAGE_SIZE - (GCPhysSrc & PAGE_OFFSET_MASK);
3223 if (RT_LIKELY(cb <= cbPage))
3224 {
3225 memcpy(pvDst, pvSrc, cb);
3226 PGMPhysReleasePageMappingLock(pVM, &Lock);
3227 return VINF_SUCCESS;
3228 }
3229
3230 /* copy to the end of the page. */
3231 memcpy(pvDst, pvSrc, cbPage);
3232 PGMPhysReleasePageMappingLock(pVM, &Lock);
3233 GCPhysSrc += cbPage;
3234 pvDst = (uint8_t *)pvDst + cbPage;
3235 cb -= cbPage;
3236
3237 /*
3238 * Page by page.
3239 */
3240 for (;;)
3241 {
3242 /* map the page */
3243 rc = PGMPhysGCPhys2CCPtrReadOnly(pVM, GCPhysSrc, &pvSrc, &Lock);
3244 if (RT_FAILURE(rc))
3245 return rc;
3246
3247 /* last page? */
3248 if (cb <= PAGE_SIZE)
3249 {
3250 memcpy(pvDst, pvSrc, cb);
3251 PGMPhysReleasePageMappingLock(pVM, &Lock);
3252 return VINF_SUCCESS;
3253 }
3254
3255 /* copy the entire page and advance */
3256 memcpy(pvDst, pvSrc, PAGE_SIZE);
3257 PGMPhysReleasePageMappingLock(pVM, &Lock);
3258 GCPhysSrc += PAGE_SIZE;
3259 pvDst = (uint8_t *)pvDst + PAGE_SIZE;
3260 cb -= PAGE_SIZE;
3261 }
3262 /* won't ever get here. */
3263}
3264
3265
3266/**
3267 * Write to guest physical memory referenced by GC pointer.
3268 * Write memory to GC physical address in guest physical memory.
3269 *
3270 * This will bypass MMIO and access handlers.
3271 *
3272 * @returns VBox status code.
3273 * @param pVM The cross context VM structure.
3274 * @param GCPhysDst The GC physical address of the destination.
3275 * @param pvSrc The source buffer.
3276 * @param cb The number of bytes to write.
3277 */
3278VMMDECL(int) PGMPhysSimpleWriteGCPhys(PVM pVM, RTGCPHYS GCPhysDst, const void *pvSrc, size_t cb)
3279{
3280 LogFlow(("PGMPhysSimpleWriteGCPhys: %RGp %zu\n", GCPhysDst, cb));
3281
3282 /*
3283 * Treat the first page as a special case.
3284 */
3285 if (!cb)
3286 return VINF_SUCCESS;
3287
3288 /* map the 1st page */
3289 void *pvDst;
3290 PGMPAGEMAPLOCK Lock;
3291 int rc = PGMPhysGCPhys2CCPtr(pVM, GCPhysDst, &pvDst, &Lock);
3292 if (RT_FAILURE(rc))
3293 return rc;
3294
3295 /* optimize for the case where access is completely within the first page. */
3296 size_t cbPage = PAGE_SIZE - (GCPhysDst & PAGE_OFFSET_MASK);
3297 if (RT_LIKELY(cb <= cbPage))
3298 {
3299 memcpy(pvDst, pvSrc, cb);
3300 PGMPhysReleasePageMappingLock(pVM, &Lock);
3301 return VINF_SUCCESS;
3302 }
3303
3304 /* copy to the end of the page. */
3305 memcpy(pvDst, pvSrc, cbPage);
3306 PGMPhysReleasePageMappingLock(pVM, &Lock);
3307 GCPhysDst += cbPage;
3308 pvSrc = (const uint8_t *)pvSrc + cbPage;
3309 cb -= cbPage;
3310
3311 /*
3312 * Page by page.
3313 */
3314 for (;;)
3315 {
3316 /* map the page */
3317 rc = PGMPhysGCPhys2CCPtr(pVM, GCPhysDst, &pvDst, &Lock);
3318 if (RT_FAILURE(rc))
3319 return rc;
3320
3321 /* last page? */
3322 if (cb <= PAGE_SIZE)
3323 {
3324 memcpy(pvDst, pvSrc, cb);
3325 PGMPhysReleasePageMappingLock(pVM, &Lock);
3326 return VINF_SUCCESS;
3327 }
3328
3329 /* copy the entire page and advance */
3330 memcpy(pvDst, pvSrc, PAGE_SIZE);
3331 PGMPhysReleasePageMappingLock(pVM, &Lock);
3332 GCPhysDst += PAGE_SIZE;
3333 pvSrc = (const uint8_t *)pvSrc + PAGE_SIZE;
3334 cb -= PAGE_SIZE;
3335 }
3336 /* won't ever get here. */
3337}
3338
3339
3340/**
3341 * Read from guest physical memory referenced by GC pointer.
3342 *
3343 * This function uses the current CR3/CR0/CR4 of the guest and will
3344 * bypass access handlers and not set any accessed bits.
3345 *
3346 * @returns VBox status code.
3347 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
3348 * @param pvDst The destination address.
3349 * @param GCPtrSrc The source address (GC pointer).
3350 * @param cb The number of bytes to read.
3351 */
3352VMMDECL(int) PGMPhysSimpleReadGCPtr(PVMCPU pVCpu, void *pvDst, RTGCPTR GCPtrSrc, size_t cb)
3353{
3354 PVM pVM = pVCpu->CTX_SUFF(pVM);
3355/** @todo fix the macro / state handling: VMCPU_ASSERT_EMT_OR_GURU(pVCpu); */
3356
3357 /*
3358 * Treat the first page as a special case.
3359 */
3360 if (!cb)
3361 return VINF_SUCCESS;
3362
3363 STAM_COUNTER_INC(&pVM->pgm.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,PhysSimpleRead));
3364 STAM_COUNTER_ADD(&pVM->pgm.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,PhysSimpleReadBytes), cb);
3365
3366 /* Take the PGM lock here, because many called functions take the lock for a very short period. That's counter-productive
3367 * when many VCPUs are fighting for the lock.
3368 */
3369 pgmLock(pVM);
3370
3371 /* map the 1st page */
3372 void const *pvSrc;
3373 PGMPAGEMAPLOCK Lock;
3374 int rc = PGMPhysGCPtr2CCPtrReadOnly(pVCpu, GCPtrSrc, &pvSrc, &Lock);
3375 if (RT_FAILURE(rc))
3376 {
3377 pgmUnlock(pVM);
3378 return rc;
3379 }
3380
3381 /* optimize for the case where access is completely within the first page. */
3382 size_t cbPage = PAGE_SIZE - ((RTGCUINTPTR)GCPtrSrc & PAGE_OFFSET_MASK);
3383 if (RT_LIKELY(cb <= cbPage))
3384 {
3385 memcpy(pvDst, pvSrc, cb);
3386 PGMPhysReleasePageMappingLock(pVM, &Lock);
3387 pgmUnlock(pVM);
3388 return VINF_SUCCESS;
3389 }
3390
3391 /* copy to the end of the page. */
3392 memcpy(pvDst, pvSrc, cbPage);
3393 PGMPhysReleasePageMappingLock(pVM, &Lock);
3394 GCPtrSrc = (RTGCPTR)((RTGCUINTPTR)GCPtrSrc + cbPage);
3395 pvDst = (uint8_t *)pvDst + cbPage;
3396 cb -= cbPage;
3397
3398 /*
3399 * Page by page.
3400 */
3401 for (;;)
3402 {
3403 /* map the page */
3404 rc = PGMPhysGCPtr2CCPtrReadOnly(pVCpu, GCPtrSrc, &pvSrc, &Lock);
3405 if (RT_FAILURE(rc))
3406 {
3407 pgmUnlock(pVM);
3408 return rc;
3409 }
3410
3411 /* last page? */
3412 if (cb <= PAGE_SIZE)
3413 {
3414 memcpy(pvDst, pvSrc, cb);
3415 PGMPhysReleasePageMappingLock(pVM, &Lock);
3416 pgmUnlock(pVM);
3417 return VINF_SUCCESS;
3418 }
3419
3420 /* copy the entire page and advance */
3421 memcpy(pvDst, pvSrc, PAGE_SIZE);
3422 PGMPhysReleasePageMappingLock(pVM, &Lock);
3423 GCPtrSrc = (RTGCPTR)((RTGCUINTPTR)GCPtrSrc + PAGE_SIZE);
3424 pvDst = (uint8_t *)pvDst + PAGE_SIZE;
3425 cb -= PAGE_SIZE;
3426 }
3427 /* won't ever get here. */
3428}
3429
3430
3431/**
3432 * Write to guest physical memory referenced by GC pointer.
3433 *
3434 * This function uses the current CR3/CR0/CR4 of the guest and will
3435 * bypass access handlers and not set dirty or accessed bits.
3436 *
3437 * @returns VBox status code.
3438 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
3439 * @param GCPtrDst The destination address (GC pointer).
3440 * @param pvSrc The source address.
3441 * @param cb The number of bytes to write.
3442 */
3443VMMDECL(int) PGMPhysSimpleWriteGCPtr(PVMCPU pVCpu, RTGCPTR GCPtrDst, const void *pvSrc, size_t cb)
3444{
3445 PVM pVM = pVCpu->CTX_SUFF(pVM);
3446 VMCPU_ASSERT_EMT(pVCpu);
3447
3448 /*
3449 * Treat the first page as a special case.
3450 */
3451 if (!cb)
3452 return VINF_SUCCESS;
3453
3454 STAM_COUNTER_INC(&pVM->pgm.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,PhysSimpleWrite));
3455 STAM_COUNTER_ADD(&pVM->pgm.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,PhysSimpleWriteBytes), cb);
3456
3457 /* map the 1st page */
3458 void *pvDst;
3459 PGMPAGEMAPLOCK Lock;
3460 int rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrDst, &pvDst, &Lock);
3461 if (RT_FAILURE(rc))
3462 return rc;
3463
3464 /* optimize for the case where access is completely within the first page. */
3465 size_t cbPage = PAGE_SIZE - ((RTGCUINTPTR)GCPtrDst & PAGE_OFFSET_MASK);
3466 if (RT_LIKELY(cb <= cbPage))
3467 {
3468 memcpy(pvDst, pvSrc, cb);
3469 PGMPhysReleasePageMappingLock(pVM, &Lock);
3470 return VINF_SUCCESS;
3471 }
3472
3473 /* copy to the end of the page. */
3474 memcpy(pvDst, pvSrc, cbPage);
3475 PGMPhysReleasePageMappingLock(pVM, &Lock);
3476 GCPtrDst = (RTGCPTR)((RTGCUINTPTR)GCPtrDst + cbPage);
3477 pvSrc = (const uint8_t *)pvSrc + cbPage;
3478 cb -= cbPage;
3479
3480 /*
3481 * Page by page.
3482 */
3483 for (;;)
3484 {
3485 /* map the page */
3486 rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrDst, &pvDst, &Lock);
3487 if (RT_FAILURE(rc))
3488 return rc;
3489
3490 /* last page? */
3491 if (cb <= PAGE_SIZE)
3492 {
3493 memcpy(pvDst, pvSrc, cb);
3494 PGMPhysReleasePageMappingLock(pVM, &Lock);
3495 return VINF_SUCCESS;
3496 }
3497
3498 /* copy the entire page and advance */
3499 memcpy(pvDst, pvSrc, PAGE_SIZE);
3500 PGMPhysReleasePageMappingLock(pVM, &Lock);
3501 GCPtrDst = (RTGCPTR)((RTGCUINTPTR)GCPtrDst + PAGE_SIZE);
3502 pvSrc = (const uint8_t *)pvSrc + PAGE_SIZE;
3503 cb -= PAGE_SIZE;
3504 }
3505 /* won't ever get here. */
3506}
3507
3508
3509/**
3510 * Write to guest physical memory referenced by GC pointer and update the PTE.
3511 *
3512 * This function uses the current CR3/CR0/CR4 of the guest and will
3513 * bypass access handlers but will set any dirty and accessed bits in the PTE.
3514 *
3515 * If you don't want to set the dirty bit, use PGMPhysSimpleWriteGCPtr().
3516 *
3517 * @returns VBox status code.
3518 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
3519 * @param GCPtrDst The destination address (GC pointer).
3520 * @param pvSrc The source address.
3521 * @param cb The number of bytes to write.
3522 */
3523VMMDECL(int) PGMPhysSimpleDirtyWriteGCPtr(PVMCPU pVCpu, RTGCPTR GCPtrDst, const void *pvSrc, size_t cb)
3524{
3525 PVM pVM = pVCpu->CTX_SUFF(pVM);
3526 VMCPU_ASSERT_EMT(pVCpu);
3527
3528 /*
3529 * Treat the first page as a special case.
3530 * Btw. this is the same code as in PGMPhyssimpleWriteGCPtr excep for the PGMGstModifyPage.
3531 */
3532 if (!cb)
3533 return VINF_SUCCESS;
3534
3535 /* map the 1st page */
3536 void *pvDst;
3537 PGMPAGEMAPLOCK Lock;
3538 int rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrDst, &pvDst, &Lock);
3539 if (RT_FAILURE(rc))
3540 return rc;
3541
3542 /* optimize for the case where access is completely within the first page. */
3543 size_t cbPage = PAGE_SIZE - ((RTGCUINTPTR)GCPtrDst & PAGE_OFFSET_MASK);
3544 if (RT_LIKELY(cb <= cbPage))
3545 {
3546 memcpy(pvDst, pvSrc, cb);
3547 PGMPhysReleasePageMappingLock(pVM, &Lock);
3548 rc = PGMGstModifyPage(pVCpu, GCPtrDst, 1, X86_PTE_A | X86_PTE_D, ~(uint64_t)(X86_PTE_A | X86_PTE_D)); AssertRC(rc);
3549 return VINF_SUCCESS;
3550 }
3551
3552 /* copy to the end of the page. */
3553 memcpy(pvDst, pvSrc, cbPage);
3554 PGMPhysReleasePageMappingLock(pVM, &Lock);
3555 rc = PGMGstModifyPage(pVCpu, GCPtrDst, 1, X86_PTE_A | X86_PTE_D, ~(uint64_t)(X86_PTE_A | X86_PTE_D)); AssertRC(rc);
3556 GCPtrDst = (RTGCPTR)((RTGCUINTPTR)GCPtrDst + cbPage);
3557 pvSrc = (const uint8_t *)pvSrc + cbPage;
3558 cb -= cbPage;
3559
3560 /*
3561 * Page by page.
3562 */
3563 for (;;)
3564 {
3565 /* map the page */
3566 rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrDst, &pvDst, &Lock);
3567 if (RT_FAILURE(rc))
3568 return rc;
3569
3570 /* last page? */
3571 if (cb <= PAGE_SIZE)
3572 {
3573 memcpy(pvDst, pvSrc, cb);
3574 PGMPhysReleasePageMappingLock(pVM, &Lock);
3575 rc = PGMGstModifyPage(pVCpu, GCPtrDst, 1, X86_PTE_A | X86_PTE_D, ~(uint64_t)(X86_PTE_A | X86_PTE_D)); AssertRC(rc);
3576 return VINF_SUCCESS;
3577 }
3578
3579 /* copy the entire page and advance */
3580 memcpy(pvDst, pvSrc, PAGE_SIZE);
3581 PGMPhysReleasePageMappingLock(pVM, &Lock);
3582 rc = PGMGstModifyPage(pVCpu, GCPtrDst, 1, X86_PTE_A | X86_PTE_D, ~(uint64_t)(X86_PTE_A | X86_PTE_D)); AssertRC(rc);
3583 GCPtrDst = (RTGCPTR)((RTGCUINTPTR)GCPtrDst + PAGE_SIZE);
3584 pvSrc = (const uint8_t *)pvSrc + PAGE_SIZE;
3585 cb -= PAGE_SIZE;
3586 }
3587 /* won't ever get here. */
3588}
3589
3590
3591/**
3592 * Read from guest physical memory referenced by GC pointer.
3593 *
3594 * This function uses the current CR3/CR0/CR4 of the guest and will
3595 * respect access handlers and set accessed bits.
3596 *
3597 * @returns Strict VBox status, see PGMPhysRead for details.
3598 * @retval VERR_PAGE_TABLE_NOT_PRESENT if there is no page mapped at the
3599 * specified virtual address.
3600 *
3601 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
3602 * @param pvDst The destination address.
3603 * @param GCPtrSrc The source address (GC pointer).
3604 * @param cb The number of bytes to read.
3605 * @param enmOrigin Who is calling.
3606 * @thread EMT(pVCpu)
3607 */
3608VMMDECL(VBOXSTRICTRC) PGMPhysReadGCPtr(PVMCPU pVCpu, void *pvDst, RTGCPTR GCPtrSrc, size_t cb, PGMACCESSORIGIN enmOrigin)
3609{
3610 RTGCPHYS GCPhys;
3611 uint64_t fFlags;
3612 int rc;
3613 PVM pVM = pVCpu->CTX_SUFF(pVM);
3614 VMCPU_ASSERT_EMT(pVCpu);
3615
3616 /*
3617 * Anything to do?
3618 */
3619 if (!cb)
3620 return VINF_SUCCESS;
3621
3622 LogFlow(("PGMPhysReadGCPtr: %RGv %zu\n", GCPtrSrc, cb));
3623
3624 /*
3625 * Optimize reads within a single page.
3626 */
3627 if (((RTGCUINTPTR)GCPtrSrc & PAGE_OFFSET_MASK) + cb <= PAGE_SIZE)
3628 {
3629 /* Convert virtual to physical address + flags */
3630 rc = PGM_GST_PFN(GetPage,pVCpu)(pVCpu, (RTGCUINTPTR)GCPtrSrc, &fFlags, &GCPhys);
3631 AssertMsgRCReturn(rc, ("GetPage failed with %Rrc for %RGv\n", rc, GCPtrSrc), rc);
3632 GCPhys |= (RTGCUINTPTR)GCPtrSrc & PAGE_OFFSET_MASK;
3633
3634 /* mark the guest page as accessed. */
3635 if (!(fFlags & X86_PTE_A))
3636 {
3637 rc = PGMGstModifyPage(pVCpu, GCPtrSrc, 1, X86_PTE_A, ~(uint64_t)(X86_PTE_A));
3638 AssertRC(rc);
3639 }
3640
3641 return PGMPhysRead(pVM, GCPhys, pvDst, cb, enmOrigin);
3642 }
3643
3644 /*
3645 * Page by page.
3646 */
3647 for (;;)
3648 {
3649 /* Convert virtual to physical address + flags */
3650 rc = PGM_GST_PFN(GetPage,pVCpu)(pVCpu, (RTGCUINTPTR)GCPtrSrc, &fFlags, &GCPhys);
3651 AssertMsgRCReturn(rc, ("GetPage failed with %Rrc for %RGv\n", rc, GCPtrSrc), rc);
3652 GCPhys |= (RTGCUINTPTR)GCPtrSrc & PAGE_OFFSET_MASK;
3653
3654 /* mark the guest page as accessed. */
3655 if (!(fFlags & X86_PTE_A))
3656 {
3657 rc = PGMGstModifyPage(pVCpu, GCPtrSrc, 1, X86_PTE_A, ~(uint64_t)(X86_PTE_A));
3658 AssertRC(rc);
3659 }
3660
3661 /* copy */
3662 size_t cbRead = PAGE_SIZE - ((RTGCUINTPTR)GCPtrSrc & PAGE_OFFSET_MASK);
3663 if (cbRead < cb)
3664 {
3665 VBOXSTRICTRC rcStrict = PGMPhysRead(pVM, GCPhys, pvDst, cbRead, enmOrigin);
3666 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3667 { /* likely */ }
3668 else
3669 return rcStrict;
3670 }
3671 else /* Last page (cbRead is PAGE_SIZE, we only need cb!) */
3672 return PGMPhysRead(pVM, GCPhys, pvDst, cb, enmOrigin);
3673
3674 /* next */
3675 Assert(cb > cbRead);
3676 cb -= cbRead;
3677 pvDst = (uint8_t *)pvDst + cbRead;
3678 GCPtrSrc += cbRead;
3679 }
3680}
3681
3682
3683/**
3684 * Write to guest physical memory referenced by GC pointer.
3685 *
3686 * This function uses the current CR3/CR0/CR4 of the guest and will
3687 * respect access handlers and set dirty and accessed bits.
3688 *
3689 * @returns Strict VBox status, see PGMPhysWrite for details.
3690 * @retval VERR_PAGE_TABLE_NOT_PRESENT if there is no page mapped at the
3691 * specified virtual address.
3692 *
3693 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
3694 * @param GCPtrDst The destination address (GC pointer).
3695 * @param pvSrc The source address.
3696 * @param cb The number of bytes to write.
3697 * @param enmOrigin Who is calling.
3698 */
3699VMMDECL(VBOXSTRICTRC) PGMPhysWriteGCPtr(PVMCPU pVCpu, RTGCPTR GCPtrDst, const void *pvSrc, size_t cb, PGMACCESSORIGIN enmOrigin)
3700{
3701 RTGCPHYS GCPhys;
3702 uint64_t fFlags;
3703 int rc;
3704 PVM pVM = pVCpu->CTX_SUFF(pVM);
3705 VMCPU_ASSERT_EMT(pVCpu);
3706
3707 /*
3708 * Anything to do?
3709 */
3710 if (!cb)
3711 return VINF_SUCCESS;
3712
3713 LogFlow(("PGMPhysWriteGCPtr: %RGv %zu\n", GCPtrDst, cb));
3714
3715 /*
3716 * Optimize writes within a single page.
3717 */
3718 if (((RTGCUINTPTR)GCPtrDst & PAGE_OFFSET_MASK) + cb <= PAGE_SIZE)
3719 {
3720 /* Convert virtual to physical address + flags */
3721 rc = PGM_GST_PFN(GetPage,pVCpu)(pVCpu, (RTGCUINTPTR)GCPtrDst, &fFlags, &GCPhys);
3722 AssertMsgRCReturn(rc, ("GetPage failed with %Rrc for %RGv\n", rc, GCPtrDst), rc);
3723 GCPhys |= (RTGCUINTPTR)GCPtrDst & PAGE_OFFSET_MASK;
3724
3725 /* Mention when we ignore X86_PTE_RW... */
3726 if (!(fFlags & X86_PTE_RW))
3727 Log(("PGMPhysWriteGCPtr: Writing to RO page %RGv %#x\n", GCPtrDst, cb));
3728
3729 /* Mark the guest page as accessed and dirty if necessary. */
3730 if ((fFlags & (X86_PTE_A | X86_PTE_D)) != (X86_PTE_A | X86_PTE_D))
3731 {
3732 rc = PGMGstModifyPage(pVCpu, GCPtrDst, 1, X86_PTE_A | X86_PTE_D, ~(uint64_t)(X86_PTE_A | X86_PTE_D));
3733 AssertRC(rc);
3734 }
3735
3736 return PGMPhysWrite(pVM, GCPhys, pvSrc, cb, enmOrigin);
3737 }
3738
3739 /*
3740 * Page by page.
3741 */
3742 for (;;)
3743 {
3744 /* Convert virtual to physical address + flags */
3745 rc = PGM_GST_PFN(GetPage,pVCpu)(pVCpu, (RTGCUINTPTR)GCPtrDst, &fFlags, &GCPhys);
3746 AssertMsgRCReturn(rc, ("GetPage failed with %Rrc for %RGv\n", rc, GCPtrDst), rc);
3747 GCPhys |= (RTGCUINTPTR)GCPtrDst & PAGE_OFFSET_MASK;
3748
3749 /* Mention when we ignore X86_PTE_RW... */
3750 if (!(fFlags & X86_PTE_RW))
3751 Log(("PGMPhysWriteGCPtr: Writing to RO page %RGv %#x\n", GCPtrDst, cb));
3752
3753 /* Mark the guest page as accessed and dirty if necessary. */
3754 if ((fFlags & (X86_PTE_A | X86_PTE_D)) != (X86_PTE_A | X86_PTE_D))
3755 {
3756 rc = PGMGstModifyPage(pVCpu, GCPtrDst, 1, X86_PTE_A | X86_PTE_D, ~(uint64_t)(X86_PTE_A | X86_PTE_D));
3757 AssertRC(rc);
3758 }
3759
3760 /* copy */
3761 size_t cbWrite = PAGE_SIZE - ((RTGCUINTPTR)GCPtrDst & PAGE_OFFSET_MASK);
3762 if (cbWrite < cb)
3763 {
3764 VBOXSTRICTRC rcStrict = PGMPhysWrite(pVM, GCPhys, pvSrc, cbWrite, enmOrigin);
3765 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3766 { /* likely */ }
3767 else
3768 return rcStrict;
3769 }
3770 else /* Last page (cbWrite is PAGE_SIZE, we only need cb!) */
3771 return PGMPhysWrite(pVM, GCPhys, pvSrc, cb, enmOrigin);
3772
3773 /* next */
3774 Assert(cb > cbWrite);
3775 cb -= cbWrite;
3776 pvSrc = (uint8_t *)pvSrc + cbWrite;
3777 GCPtrDst += cbWrite;
3778 }
3779}
3780
3781
3782/**
3783 * Performs a read of guest virtual memory for instruction emulation.
3784 *
3785 * This will check permissions, raise exceptions and update the access bits.
3786 *
3787 * The current implementation will bypass all access handlers. It may later be
3788 * changed to at least respect MMIO.
3789 *
3790 *
3791 * @returns VBox status code suitable to scheduling.
3792 * @retval VINF_SUCCESS if the read was performed successfully.
3793 * @retval VINF_EM_RAW_GUEST_TRAP if an exception was raised but not dispatched yet.
3794 * @retval VINF_TRPM_XCPT_DISPATCHED if an exception was raised and dispatched.
3795 *
3796 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
3797 * @param pCtxCore The context core.
3798 * @param pvDst Where to put the bytes we've read.
3799 * @param GCPtrSrc The source address.
3800 * @param cb The number of bytes to read. Not more than a page.
3801 *
3802 * @remark This function will dynamically map physical pages in GC. This may unmap
3803 * mappings done by the caller. Be careful!
3804 */
3805VMMDECL(int) PGMPhysInterpretedRead(PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, void *pvDst, RTGCUINTPTR GCPtrSrc, size_t cb)
3806{
3807 PVM pVM = pVCpu->CTX_SUFF(pVM);
3808 Assert(cb <= PAGE_SIZE);
3809 VMCPU_ASSERT_EMT(pVCpu);
3810
3811/** @todo r=bird: This isn't perfect!
3812 * -# It's not checking for reserved bits being 1.
3813 * -# It's not correctly dealing with the access bit.
3814 * -# It's not respecting MMIO memory or any other access handlers.
3815 */
3816 /*
3817 * 1. Translate virtual to physical. This may fault.
3818 * 2. Map the physical address.
3819 * 3. Do the read operation.
3820 * 4. Set access bits if required.
3821 */
3822 int rc;
3823 unsigned cb1 = PAGE_SIZE - (GCPtrSrc & PAGE_OFFSET_MASK);
3824 if (cb <= cb1)
3825 {
3826 /*
3827 * Not crossing pages.
3828 */
3829 RTGCPHYS GCPhys;
3830 uint64_t fFlags;
3831 rc = PGM_GST_PFN(GetPage,pVCpu)(pVCpu, GCPtrSrc, &fFlags, &GCPhys);
3832 if (RT_SUCCESS(rc))
3833 {
3834 /** @todo we should check reserved bits ... */
3835 PGMPAGEMAPLOCK PgMpLck;
3836 void const *pvSrc;
3837 rc = PGMPhysGCPhys2CCPtrReadOnly(pVM, GCPhys, &pvSrc, &PgMpLck);
3838 switch (rc)
3839 {
3840 case VINF_SUCCESS:
3841 Log(("PGMPhysInterpretedRead: pvDst=%p pvSrc=%p cb=%d\n", pvDst, (uint8_t *)pvSrc + (GCPtrSrc & PAGE_OFFSET_MASK), cb));
3842 memcpy(pvDst, (uint8_t *)pvSrc + (GCPtrSrc & PAGE_OFFSET_MASK), cb);
3843 PGMPhysReleasePageMappingLock(pVM, &PgMpLck);
3844 break;
3845 case VERR_PGM_PHYS_PAGE_RESERVED:
3846 case VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS:
3847 memset(pvDst, 0xff, cb);
3848 break;
3849 default:
3850 Assert(RT_FAILURE_NP(rc));
3851 return rc;
3852 }
3853
3854 /** @todo access bit emulation isn't 100% correct. */
3855 if (!(fFlags & X86_PTE_A))
3856 {
3857 rc = PGMGstModifyPage(pVCpu, GCPtrSrc, 1, X86_PTE_A, ~(uint64_t)X86_PTE_A);
3858 AssertRC(rc);
3859 }
3860 return VINF_SUCCESS;
3861 }
3862 }
3863 else
3864 {
3865 /*
3866 * Crosses pages.
3867 */
3868 size_t cb2 = cb - cb1;
3869 uint64_t fFlags1;
3870 RTGCPHYS GCPhys1;
3871 uint64_t fFlags2;
3872 RTGCPHYS GCPhys2;
3873 rc = PGM_GST_PFN(GetPage,pVCpu)(pVCpu, GCPtrSrc, &fFlags1, &GCPhys1);
3874 if (RT_SUCCESS(rc))
3875 {
3876 rc = PGM_GST_PFN(GetPage,pVCpu)(pVCpu, GCPtrSrc + cb1, &fFlags2, &GCPhys2);
3877 if (RT_SUCCESS(rc))
3878 {
3879 /** @todo we should check reserved bits ... */
3880 AssertMsgFailed(("cb=%d cb1=%d cb2=%d GCPtrSrc=%RGv\n", cb, cb1, cb2, GCPtrSrc));
3881 PGMPAGEMAPLOCK PgMpLck;
3882 void const *pvSrc1;
3883 rc = PGMPhysGCPhys2CCPtrReadOnly(pVM, GCPhys1, &pvSrc1, &PgMpLck);
3884 switch (rc)
3885 {
3886 case VINF_SUCCESS:
3887 memcpy(pvDst, (uint8_t *)pvSrc1 + (GCPtrSrc & PAGE_OFFSET_MASK), cb1);
3888 PGMPhysReleasePageMappingLock(pVM, &PgMpLck);
3889 break;
3890 case VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS:
3891 memset(pvDst, 0xff, cb1);
3892 break;
3893 default:
3894 Assert(RT_FAILURE_NP(rc));
3895 return rc;
3896 }
3897
3898 void const *pvSrc2;
3899 rc = PGMPhysGCPhys2CCPtrReadOnly(pVM, GCPhys2, &pvSrc2, &PgMpLck);
3900 switch (rc)
3901 {
3902 case VINF_SUCCESS:
3903 memcpy((uint8_t *)pvDst + cb1, pvSrc2, cb2);
3904 PGMPhysReleasePageMappingLock(pVM, &PgMpLck);
3905 break;
3906 case VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS:
3907 memset((uint8_t *)pvDst + cb1, 0xff, cb2);
3908 break;
3909 default:
3910 Assert(RT_FAILURE_NP(rc));
3911 return rc;
3912 }
3913
3914 if (!(fFlags1 & X86_PTE_A))
3915 {
3916 rc = PGMGstModifyPage(pVCpu, GCPtrSrc, 1, X86_PTE_A, ~(uint64_t)X86_PTE_A);
3917 AssertRC(rc);
3918 }
3919 if (!(fFlags2 & X86_PTE_A))
3920 {
3921 rc = PGMGstModifyPage(pVCpu, GCPtrSrc + cb1, 1, X86_PTE_A, ~(uint64_t)X86_PTE_A);
3922 AssertRC(rc);
3923 }
3924 return VINF_SUCCESS;
3925 }
3926 }
3927 }
3928
3929 /*
3930 * Raise a #PF.
3931 */
3932 uint32_t uErr;
3933
3934 /* Get the current privilege level. */
3935 uint32_t cpl = CPUMGetGuestCPL(pVCpu);
3936 switch (rc)
3937 {
3938 case VINF_SUCCESS:
3939 uErr = (cpl >= 2) ? X86_TRAP_PF_RSVD | X86_TRAP_PF_US : X86_TRAP_PF_RSVD;
3940 break;
3941
3942 case VERR_PAGE_NOT_PRESENT:
3943 case VERR_PAGE_TABLE_NOT_PRESENT:
3944 uErr = (cpl >= 2) ? X86_TRAP_PF_US : 0;
3945 break;
3946
3947 default:
3948 AssertMsgFailed(("rc=%Rrc GCPtrSrc=%RGv cb=%#x\n", rc, GCPtrSrc, cb));
3949 return rc;
3950 }
3951 Log(("PGMPhysInterpretedRead: GCPtrSrc=%RGv cb=%#x -> #PF(%#x)\n", GCPtrSrc, cb, uErr));
3952 return TRPMRaiseXcptErrCR2(pVCpu, pCtxCore, X86_XCPT_PF, uErr, GCPtrSrc);
3953}
3954
3955
3956/**
3957 * Performs a read of guest virtual memory for instruction emulation.
3958 *
3959 * This will check permissions, raise exceptions and update the access bits.
3960 *
3961 * The current implementation will bypass all access handlers. It may later be
3962 * changed to at least respect MMIO.
3963 *
3964 *
3965 * @returns VBox status code suitable to scheduling.
3966 * @retval VINF_SUCCESS if the read was performed successfully.
3967 * @retval VINF_EM_RAW_GUEST_TRAP if an exception was raised but not dispatched yet.
3968 * @retval VINF_TRPM_XCPT_DISPATCHED if an exception was raised and dispatched.
3969 *
3970 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
3971 * @param pCtxCore The context core.
3972 * @param pvDst Where to put the bytes we've read.
3973 * @param GCPtrSrc The source address.
3974 * @param cb The number of bytes to read. Not more than a page.
3975 * @param fRaiseTrap If set the trap will be raised on as per spec, if clear
3976 * an appropriate error status will be returned (no
3977 * informational at all).
3978 *
3979 *
3980 * @remarks Takes the PGM lock.
3981 * @remarks A page fault on the 2nd page of the access will be raised without
3982 * writing the bits on the first page since we're ASSUMING that the
3983 * caller is emulating an instruction access.
3984 * @remarks This function will dynamically map physical pages in GC. This may
3985 * unmap mappings done by the caller. Be careful!
3986 */
3987VMMDECL(int) PGMPhysInterpretedReadNoHandlers(PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, void *pvDst, RTGCUINTPTR GCPtrSrc, size_t cb,
3988 bool fRaiseTrap)
3989{
3990 PVM pVM = pVCpu->CTX_SUFF(pVM);
3991 Assert(cb <= PAGE_SIZE);
3992 VMCPU_ASSERT_EMT(pVCpu);
3993
3994 /*
3995 * 1. Translate virtual to physical. This may fault.
3996 * 2. Map the physical address.
3997 * 3. Do the read operation.
3998 * 4. Set access bits if required.
3999 */
4000 int rc;
4001 unsigned cb1 = PAGE_SIZE - (GCPtrSrc & PAGE_OFFSET_MASK);
4002 if (cb <= cb1)
4003 {
4004 /*
4005 * Not crossing pages.
4006 */
4007 RTGCPHYS GCPhys;
4008 uint64_t fFlags;
4009 rc = PGM_GST_PFN(GetPage,pVCpu)(pVCpu, GCPtrSrc, &fFlags, &GCPhys);
4010 if (RT_SUCCESS(rc))
4011 {
4012 if (1) /** @todo we should check reserved bits ... */
4013 {
4014 const void *pvSrc;
4015 PGMPAGEMAPLOCK Lock;
4016 rc = PGMPhysGCPhys2CCPtrReadOnly(pVM, GCPhys, &pvSrc, &Lock);
4017 switch (rc)
4018 {
4019 case VINF_SUCCESS:
4020 Log(("PGMPhysInterpretedReadNoHandlers: pvDst=%p pvSrc=%p (%RGv) cb=%d\n",
4021 pvDst, (const uint8_t *)pvSrc + (GCPtrSrc & PAGE_OFFSET_MASK), GCPtrSrc, cb));
4022 memcpy(pvDst, (const uint8_t *)pvSrc + (GCPtrSrc & PAGE_OFFSET_MASK), cb);
4023 PGMPhysReleasePageMappingLock(pVM, &Lock);
4024 break;
4025 case VERR_PGM_PHYS_PAGE_RESERVED:
4026 case VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS:
4027 memset(pvDst, 0xff, cb);
4028 break;
4029 default:
4030 AssertMsgFailed(("%Rrc\n", rc));
4031 AssertReturn(RT_FAILURE(rc), VERR_IPE_UNEXPECTED_INFO_STATUS);
4032 return rc;
4033 }
4034
4035 if (!(fFlags & X86_PTE_A))
4036 {
4037 /** @todo access bit emulation isn't 100% correct. */
4038 rc = PGMGstModifyPage(pVCpu, GCPtrSrc, 1, X86_PTE_A, ~(uint64_t)X86_PTE_A);
4039 AssertRC(rc);
4040 }
4041 return VINF_SUCCESS;
4042 }
4043 }
4044 }
4045 else
4046 {
4047 /*
4048 * Crosses pages.
4049 */
4050 size_t cb2 = cb - cb1;
4051 uint64_t fFlags1;
4052 RTGCPHYS GCPhys1;
4053 uint64_t fFlags2;
4054 RTGCPHYS GCPhys2;
4055 rc = PGM_GST_PFN(GetPage,pVCpu)(pVCpu, GCPtrSrc, &fFlags1, &GCPhys1);
4056 if (RT_SUCCESS(rc))
4057 {
4058 rc = PGM_GST_PFN(GetPage,pVCpu)(pVCpu, GCPtrSrc + cb1, &fFlags2, &GCPhys2);
4059 if (RT_SUCCESS(rc))
4060 {
4061 if (1) /** @todo we should check reserved bits ... */
4062 {
4063 const void *pvSrc;
4064 PGMPAGEMAPLOCK Lock;
4065 rc = PGMPhysGCPhys2CCPtrReadOnly(pVM, GCPhys1, &pvSrc, &Lock);
4066 switch (rc)
4067 {
4068 case VINF_SUCCESS:
4069 Log(("PGMPhysInterpretedReadNoHandlers: pvDst=%p pvSrc=%p (%RGv) cb=%d [2]\n",
4070 pvDst, (const uint8_t *)pvSrc + (GCPtrSrc & PAGE_OFFSET_MASK), GCPtrSrc, cb1));
4071 memcpy(pvDst, (const uint8_t *)pvSrc + (GCPtrSrc & PAGE_OFFSET_MASK), cb1);
4072 PGMPhysReleasePageMappingLock(pVM, &Lock);
4073 break;
4074 case VERR_PGM_PHYS_PAGE_RESERVED:
4075 case VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS:
4076 memset(pvDst, 0xff, cb1);
4077 break;
4078 default:
4079 AssertMsgFailed(("%Rrc\n", rc));
4080 AssertReturn(RT_FAILURE(rc), VERR_IPE_UNEXPECTED_INFO_STATUS);
4081 return rc;
4082 }
4083
4084 rc = PGMPhysGCPhys2CCPtrReadOnly(pVM, GCPhys2, &pvSrc, &Lock);
4085 switch (rc)
4086 {
4087 case VINF_SUCCESS:
4088 memcpy((uint8_t *)pvDst + cb1, pvSrc, cb2);
4089 PGMPhysReleasePageMappingLock(pVM, &Lock);
4090 break;
4091 case VERR_PGM_PHYS_PAGE_RESERVED:
4092 case VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS:
4093 memset((uint8_t *)pvDst + cb1, 0xff, cb2);
4094 break;
4095 default:
4096 AssertMsgFailed(("%Rrc\n", rc));
4097 AssertReturn(RT_FAILURE(rc), VERR_IPE_UNEXPECTED_INFO_STATUS);
4098 return rc;
4099 }
4100
4101 if (!(fFlags1 & X86_PTE_A))
4102 {
4103 rc = PGMGstModifyPage(pVCpu, GCPtrSrc, 1, X86_PTE_A, ~(uint64_t)X86_PTE_A);
4104 AssertRC(rc);
4105 }
4106 if (!(fFlags2 & X86_PTE_A))
4107 {
4108 rc = PGMGstModifyPage(pVCpu, GCPtrSrc + cb1, 1, X86_PTE_A, ~(uint64_t)X86_PTE_A);
4109 AssertRC(rc);
4110 }
4111 return VINF_SUCCESS;
4112 }
4113 /* sort out which page */
4114 }
4115 else
4116 GCPtrSrc += cb1; /* fault on 2nd page */
4117 }
4118 }
4119
4120 /*
4121 * Raise a #PF if we're allowed to do that.
4122 */
4123 /* Calc the error bits. */
4124 uint32_t cpl = CPUMGetGuestCPL(pVCpu);
4125 uint32_t uErr;
4126 switch (rc)
4127 {
4128 case VINF_SUCCESS:
4129 uErr = (cpl >= 2) ? X86_TRAP_PF_RSVD | X86_TRAP_PF_US : X86_TRAP_PF_RSVD;
4130 rc = VERR_ACCESS_DENIED;
4131 break;
4132
4133 case VERR_PAGE_NOT_PRESENT:
4134 case VERR_PAGE_TABLE_NOT_PRESENT:
4135 uErr = (cpl >= 2) ? X86_TRAP_PF_US : 0;
4136 break;
4137
4138 default:
4139 AssertMsgFailed(("rc=%Rrc GCPtrSrc=%RGv cb=%#x\n", rc, GCPtrSrc, cb));
4140 AssertReturn(RT_FAILURE(rc), VERR_IPE_UNEXPECTED_INFO_STATUS);
4141 return rc;
4142 }
4143 if (fRaiseTrap)
4144 {
4145 Log(("PGMPhysInterpretedReadNoHandlers: GCPtrSrc=%RGv cb=%#x -> Raised #PF(%#x)\n", GCPtrSrc, cb, uErr));
4146 return TRPMRaiseXcptErrCR2(pVCpu, pCtxCore, X86_XCPT_PF, uErr, GCPtrSrc);
4147 }
4148 Log(("PGMPhysInterpretedReadNoHandlers: GCPtrSrc=%RGv cb=%#x -> #PF(%#x) [!raised]\n", GCPtrSrc, cb, uErr));
4149 return rc;
4150}
4151
4152
4153/**
4154 * Performs a write to guest virtual memory for instruction emulation.
4155 *
4156 * This will check permissions, raise exceptions and update the dirty and access
4157 * bits.
4158 *
4159 * @returns VBox status code suitable to scheduling.
4160 * @retval VINF_SUCCESS if the read was performed successfully.
4161 * @retval VINF_EM_RAW_GUEST_TRAP if an exception was raised but not dispatched yet.
4162 * @retval VINF_TRPM_XCPT_DISPATCHED if an exception was raised and dispatched.
4163 *
4164 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
4165 * @param pCtxCore The context core.
4166 * @param GCPtrDst The destination address.
4167 * @param pvSrc What to write.
4168 * @param cb The number of bytes to write. Not more than a page.
4169 * @param fRaiseTrap If set the trap will be raised on as per spec, if clear
4170 * an appropriate error status will be returned (no
4171 * informational at all).
4172 *
4173 * @remarks Takes the PGM lock.
4174 * @remarks A page fault on the 2nd page of the access will be raised without
4175 * writing the bits on the first page since we're ASSUMING that the
4176 * caller is emulating an instruction access.
4177 * @remarks This function will dynamically map physical pages in GC. This may
4178 * unmap mappings done by the caller. Be careful!
4179 */
4180VMMDECL(int) PGMPhysInterpretedWriteNoHandlers(PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, RTGCPTR GCPtrDst, const void *pvSrc,
4181 size_t cb, bool fRaiseTrap)
4182{
4183 Assert(cb <= PAGE_SIZE);
4184 PVM pVM = pVCpu->CTX_SUFF(pVM);
4185 VMCPU_ASSERT_EMT(pVCpu);
4186
4187 /*
4188 * 1. Translate virtual to physical. This may fault.
4189 * 2. Map the physical address.
4190 * 3. Do the write operation.
4191 * 4. Set access bits if required.
4192 */
4193 /** @todo Since this method is frequently used by EMInterpret or IOM
4194 * upon a write fault to an write access monitored page, we can
4195 * reuse the guest page table walking from the \#PF code. */
4196 int rc;
4197 unsigned cb1 = PAGE_SIZE - (GCPtrDst & PAGE_OFFSET_MASK);
4198 if (cb <= cb1)
4199 {
4200 /*
4201 * Not crossing pages.
4202 */
4203 RTGCPHYS GCPhys;
4204 uint64_t fFlags;
4205 rc = PGM_GST_PFN(GetPage,pVCpu)(pVCpu, GCPtrDst, &fFlags, &GCPhys);
4206 if (RT_SUCCESS(rc))
4207 {
4208 if ( (fFlags & X86_PTE_RW) /** @todo Also check reserved bits. */
4209 || ( !(CPUMGetGuestCR0(pVCpu) & X86_CR0_WP)
4210 && CPUMGetGuestCPL(pVCpu) <= 2) ) /** @todo it's 2, right? Check cpl check below as well. */
4211 {
4212 void *pvDst;
4213 PGMPAGEMAPLOCK Lock;
4214 rc = PGMPhysGCPhys2CCPtr(pVM, GCPhys, &pvDst, &Lock);
4215 switch (rc)
4216 {
4217 case VINF_SUCCESS:
4218 Log(("PGMPhysInterpretedWriteNoHandlers: pvDst=%p (%RGv) pvSrc=%p cb=%d\n",
4219 (uint8_t *)pvDst + (GCPtrDst & PAGE_OFFSET_MASK), GCPtrDst, pvSrc, cb));
4220 memcpy((uint8_t *)pvDst + (GCPtrDst & PAGE_OFFSET_MASK), pvSrc, cb);
4221 PGMPhysReleasePageMappingLock(pVM, &Lock);
4222 break;
4223 case VERR_PGM_PHYS_PAGE_RESERVED:
4224 case VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS:
4225 /* bit bucket */
4226 break;
4227 default:
4228 AssertMsgFailed(("%Rrc\n", rc));
4229 AssertReturn(RT_FAILURE(rc), VERR_IPE_UNEXPECTED_INFO_STATUS);
4230 return rc;
4231 }
4232
4233 if (!(fFlags & (X86_PTE_A | X86_PTE_D)))
4234 {
4235 /** @todo dirty & access bit emulation isn't 100% correct. */
4236 rc = PGMGstModifyPage(pVCpu, GCPtrDst, 1, X86_PTE_A | X86_PTE_D, ~(uint64_t)(X86_PTE_A | X86_PTE_D));
4237 AssertRC(rc);
4238 }
4239 return VINF_SUCCESS;
4240 }
4241 rc = VERR_ACCESS_DENIED;
4242 }
4243 }
4244 else
4245 {
4246 /*
4247 * Crosses pages.
4248 */
4249 size_t cb2 = cb - cb1;
4250 uint64_t fFlags1;
4251 RTGCPHYS GCPhys1;
4252 uint64_t fFlags2;
4253 RTGCPHYS GCPhys2;
4254 rc = PGM_GST_PFN(GetPage,pVCpu)(pVCpu, GCPtrDst, &fFlags1, &GCPhys1);
4255 if (RT_SUCCESS(rc))
4256 {
4257 rc = PGM_GST_PFN(GetPage,pVCpu)(pVCpu, GCPtrDst + cb1, &fFlags2, &GCPhys2);
4258 if (RT_SUCCESS(rc))
4259 {
4260 if ( ( (fFlags1 & X86_PTE_RW) /** @todo Also check reserved bits. */
4261 && (fFlags2 & X86_PTE_RW))
4262 || ( !(CPUMGetGuestCR0(pVCpu) & X86_CR0_WP)
4263 && CPUMGetGuestCPL(pVCpu) <= 2) )
4264 {
4265 void *pvDst;
4266 PGMPAGEMAPLOCK Lock;
4267 rc = PGMPhysGCPhys2CCPtr(pVM, GCPhys1, &pvDst, &Lock);
4268 switch (rc)
4269 {
4270 case VINF_SUCCESS:
4271 Log(("PGMPhysInterpretedWriteNoHandlers: pvDst=%p (%RGv) pvSrc=%p cb=%d\n",
4272 (uint8_t *)pvDst + (GCPtrDst & PAGE_OFFSET_MASK), GCPtrDst, pvSrc, cb1));
4273 memcpy((uint8_t *)pvDst + (GCPtrDst & PAGE_OFFSET_MASK), pvSrc, cb1);
4274 PGMPhysReleasePageMappingLock(pVM, &Lock);
4275 break;
4276 case VERR_PGM_PHYS_PAGE_RESERVED:
4277 case VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS:
4278 /* bit bucket */
4279 break;
4280 default:
4281 AssertMsgFailed(("%Rrc\n", rc));
4282 AssertReturn(RT_FAILURE(rc), VERR_IPE_UNEXPECTED_INFO_STATUS);
4283 return rc;
4284 }
4285
4286 rc = PGMPhysGCPhys2CCPtr(pVM, GCPhys2, &pvDst, &Lock);
4287 switch (rc)
4288 {
4289 case VINF_SUCCESS:
4290 memcpy(pvDst, (const uint8_t *)pvSrc + cb1, cb2);
4291 PGMPhysReleasePageMappingLock(pVM, &Lock);
4292 break;
4293 case VERR_PGM_PHYS_PAGE_RESERVED:
4294 case VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS:
4295 /* bit bucket */
4296 break;
4297 default:
4298 AssertMsgFailed(("%Rrc\n", rc));
4299 AssertReturn(RT_FAILURE(rc), VERR_IPE_UNEXPECTED_INFO_STATUS);
4300 return rc;
4301 }
4302
4303 if (!(fFlags1 & (X86_PTE_A | X86_PTE_RW)))
4304 {
4305 rc = PGMGstModifyPage(pVCpu, GCPtrDst, 1, (X86_PTE_A | X86_PTE_RW), ~(uint64_t)(X86_PTE_A | X86_PTE_RW));
4306 AssertRC(rc);
4307 }
4308 if (!(fFlags2 & (X86_PTE_A | X86_PTE_RW)))
4309 {
4310 rc = PGMGstModifyPage(pVCpu, GCPtrDst + cb1, 1, (X86_PTE_A | X86_PTE_RW), ~(uint64_t)(X86_PTE_A | X86_PTE_RW));
4311 AssertRC(rc);
4312 }
4313 return VINF_SUCCESS;
4314 }
4315 if ((fFlags1 & (X86_PTE_RW)) == X86_PTE_RW)
4316 GCPtrDst += cb1; /* fault on the 2nd page. */
4317 rc = VERR_ACCESS_DENIED;
4318 }
4319 else
4320 GCPtrDst += cb1; /* fault on the 2nd page. */
4321 }
4322 }
4323
4324 /*
4325 * Raise a #PF if we're allowed to do that.
4326 */
4327 /* Calc the error bits. */
4328 uint32_t uErr;
4329 uint32_t cpl = CPUMGetGuestCPL(pVCpu);
4330 switch (rc)
4331 {
4332 case VINF_SUCCESS:
4333 uErr = (cpl >= 2) ? X86_TRAP_PF_RSVD | X86_TRAP_PF_US : X86_TRAP_PF_RSVD;
4334 rc = VERR_ACCESS_DENIED;
4335 break;
4336
4337 case VERR_ACCESS_DENIED:
4338 uErr = (cpl >= 2) ? X86_TRAP_PF_RW | X86_TRAP_PF_US : X86_TRAP_PF_RW;
4339 break;
4340
4341 case VERR_PAGE_NOT_PRESENT:
4342 case VERR_PAGE_TABLE_NOT_PRESENT:
4343 uErr = (cpl >= 2) ? X86_TRAP_PF_US : 0;
4344 break;
4345
4346 default:
4347 AssertMsgFailed(("rc=%Rrc GCPtrDst=%RGv cb=%#x\n", rc, GCPtrDst, cb));
4348 AssertReturn(RT_FAILURE(rc), VERR_IPE_UNEXPECTED_INFO_STATUS);
4349 return rc;
4350 }
4351 if (fRaiseTrap)
4352 {
4353 Log(("PGMPhysInterpretedWriteNoHandlers: GCPtrDst=%RGv cb=%#x -> Raised #PF(%#x)\n", GCPtrDst, cb, uErr));
4354 return TRPMRaiseXcptErrCR2(pVCpu, pCtxCore, X86_XCPT_PF, uErr, GCPtrDst);
4355 }
4356 Log(("PGMPhysInterpretedWriteNoHandlers: GCPtrDst=%RGv cb=%#x -> #PF(%#x) [!raised]\n", GCPtrDst, cb, uErr));
4357 return rc;
4358}
4359
4360
4361/**
4362 * Return the page type of the specified physical address.
4363 *
4364 * @returns The page type.
4365 * @param pVM The cross context VM structure.
4366 * @param GCPhys Guest physical address
4367 */
4368VMM_INT_DECL(PGMPAGETYPE) PGMPhysGetPageType(PVM pVM, RTGCPHYS GCPhys)
4369{
4370 pgmLock(pVM);
4371 PPGMPAGE pPage = pgmPhysGetPage(pVM, GCPhys);
4372 PGMPAGETYPE enmPgType = pPage ? (PGMPAGETYPE)PGM_PAGE_GET_TYPE(pPage) : PGMPAGETYPE_INVALID;
4373 pgmUnlock(pVM);
4374
4375 return enmPgType;
4376}
4377
4378
4379/**
4380 * Converts a GC physical address to a HC ring-3 pointer, with some
4381 * additional checks.
4382 *
4383 * @returns VBox status code (no informational statuses).
4384 *
4385 * @param pVM The cross context VM structure.
4386 * @param pVCpu The cross context virtual CPU structure of the
4387 * calling EMT.
4388 * @param GCPhys The GC physical address to convert. This API mask
4389 * the A20 line when necessary.
4390 * @param puTlbPhysRev Where to read the physical TLB revision. Needs to
4391 * be done while holding the PGM lock.
4392 * @param ppb Where to store the pointer corresponding to GCPhys
4393 * on success.
4394 * @param pfTlb The TLB flags and revision. We only add stuff.
4395 *
4396 * @remarks This is more or a less a copy of PGMR3PhysTlbGCPhys2Ptr and
4397 * PGMPhysIemGCPhys2Ptr.
4398 *
4399 * @thread EMT(pVCpu).
4400 */
4401VMM_INT_DECL(int) PGMPhysIemGCPhys2PtrNoLock(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys, uint64_t const volatile *puTlbPhysRev,
4402#if defined(IN_RC) || defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
4403 R3PTRTYPE(uint8_t *) *ppb,
4404#else
4405 R3R0PTRTYPE(uint8_t *) *ppb,
4406#endif
4407 uint64_t *pfTlb)
4408{
4409 PGM_A20_APPLY_TO_VAR(pVCpu, GCPhys);
4410 Assert(!(GCPhys & X86_PAGE_OFFSET_MASK));
4411
4412 pgmLock(pVM);
4413
4414 PPGMRAMRANGE pRam;
4415 PPGMPAGE pPage;
4416 int rc = pgmPhysGetPageAndRangeEx(pVM, GCPhys, &pPage, &pRam);
4417 if (RT_SUCCESS(rc))
4418 {
4419 if (!PGM_PAGE_IS_BALLOONED(pPage))
4420 {
4421 if (!PGM_PAGE_IS_SPECIAL_ALIAS_MMIO(pPage))
4422 {
4423 if (!PGM_PAGE_HAS_ANY_HANDLERS(pPage))
4424 {
4425 /*
4426 * No access handler.
4427 */
4428 switch (PGM_PAGE_GET_STATE(pPage))
4429 {
4430 case PGM_PAGE_STATE_ALLOCATED:
4431 *pfTlb |= *puTlbPhysRev;
4432 break;
4433 case PGM_PAGE_STATE_BALLOONED:
4434 AssertFailed();
4435 /* fall thru */
4436 case PGM_PAGE_STATE_ZERO:
4437 case PGM_PAGE_STATE_SHARED:
4438 case PGM_PAGE_STATE_WRITE_MONITORED:
4439 *pfTlb |= *puTlbPhysRev | PGMIEMGCPHYS2PTR_F_NO_WRITE;
4440 break;
4441 }
4442#if defined(IN_RC) || defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
4443 *pfTlb |= PGMIEMGCPHYS2PTR_F_NO_MAPPINGR3;
4444 *ppb = NULL;
4445#else
4446 PPGMPAGER3MAPTLBE pTlbe;
4447 rc = pgmPhysPageQueryTlbeWithPage(pVM, pPage, GCPhys, &pTlbe);
4448 AssertLogRelRCReturn(rc, rc);
4449 *ppb = (uint8_t *)pTlbe->pv;
4450#endif
4451 }
4452 else if (PGM_PAGE_HAS_ACTIVE_ALL_HANDLERS(pPage))
4453 {
4454 /*
4455 * MMIO or similar all access handler: Catch all access.
4456 */
4457 *pfTlb |= *puTlbPhysRev
4458 | PGMIEMGCPHYS2PTR_F_NO_WRITE | PGMIEMGCPHYS2PTR_F_NO_READ | PGMIEMGCPHYS2PTR_F_NO_MAPPINGR3;
4459 *ppb = NULL;
4460 }
4461 else
4462 {
4463 /*
4464 * Write access handler: Catch write accesses if active.
4465 */
4466 if (PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage))
4467 *pfTlb |= *puTlbPhysRev | PGMIEMGCPHYS2PTR_F_NO_WRITE;
4468 else
4469 switch (PGM_PAGE_GET_STATE(pPage))
4470 {
4471 case PGM_PAGE_STATE_ALLOCATED:
4472 *pfTlb |= *puTlbPhysRev;
4473 break;
4474 case PGM_PAGE_STATE_BALLOONED:
4475 AssertFailed();
4476 /* fall thru */
4477 case PGM_PAGE_STATE_ZERO:
4478 case PGM_PAGE_STATE_SHARED:
4479 case PGM_PAGE_STATE_WRITE_MONITORED:
4480 *pfTlb |= *puTlbPhysRev | PGMIEMGCPHYS2PTR_F_NO_WRITE;
4481 break;
4482 }
4483#if defined(IN_RC) || defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
4484 *pfTlb |= PGMIEMGCPHYS2PTR_F_NO_MAPPINGR3;
4485 *ppb = NULL;
4486#else
4487 PPGMPAGER3MAPTLBE pTlbe;
4488 rc = pgmPhysPageQueryTlbeWithPage(pVM, pPage, GCPhys, &pTlbe);
4489 AssertLogRelRCReturn(rc, rc);
4490 *ppb = (uint8_t *)pTlbe->pv;
4491#endif
4492 }
4493 }
4494 else
4495 {
4496 /* Alias MMIO: For now, we catch all access. */
4497 *pfTlb |= *puTlbPhysRev
4498 | PGMIEMGCPHYS2PTR_F_NO_WRITE | PGMIEMGCPHYS2PTR_F_NO_READ | PGMIEMGCPHYS2PTR_F_NO_MAPPINGR3;
4499 *ppb = NULL;
4500 }
4501 }
4502 else
4503 {
4504 /* Ballooned: Shouldn't get here, but we read zero page via PGMPhysRead and writes goes to /dev/null. */
4505 *pfTlb |= *puTlbPhysRev | PGMIEMGCPHYS2PTR_F_NO_WRITE | PGMIEMGCPHYS2PTR_F_NO_READ | PGMIEMGCPHYS2PTR_F_NO_MAPPINGR3;
4506 *ppb = NULL;
4507 }
4508 Log6(("PGMPhysIemGCPhys2PtrNoLock: GCPhys=%RGp *ppb=%p *pfTlb=%#RX64 pPage=%R[pgmpage]\n", GCPhys, *ppb, *pfTlb, pPage));
4509 }
4510 else
4511 {
4512 *pfTlb |= *puTlbPhysRev | PGMIEMGCPHYS2PTR_F_NO_WRITE | PGMIEMGCPHYS2PTR_F_NO_READ | PGMIEMGCPHYS2PTR_F_NO_MAPPINGR3;
4513 *ppb = NULL;
4514 Log6(("PGMPhysIemGCPhys2PtrNoLock: GCPhys=%RGp *ppb=%p *pfTlb=%#RX64 (rc=%Rrc)\n", GCPhys, *ppb, *pfTlb, rc));
4515 }
4516
4517 pgmUnlock(pVM);
4518 return VINF_SUCCESS;
4519}
4520
4521
4522/**
4523 * Converts a GC physical address to a HC ring-3 pointer, with some
4524 * additional checks.
4525 *
4526 * @returns VBox status code (no informational statuses).
4527 * @retval VINF_SUCCESS on success.
4528 * @retval VERR_PGM_PHYS_TLB_CATCH_WRITE and *ppv set if the page has a write
4529 * access handler of some kind.
4530 * @retval VERR_PGM_PHYS_TLB_CATCH_ALL if the page has a handler catching all
4531 * accesses or is odd in any way.
4532 * @retval VERR_PGM_PHYS_TLB_UNASSIGNED if the page doesn't exist.
4533 *
4534 * @param pVM The cross context VM structure.
4535 * @param pVCpu The cross context virtual CPU structure of the
4536 * calling EMT.
4537 * @param GCPhys The GC physical address to convert. This API mask
4538 * the A20 line when necessary.
4539 * @param fWritable Whether write access is required.
4540 * @param fByPassHandlers Whether to bypass access handlers.
4541 * @param ppv Where to store the pointer corresponding to GCPhys
4542 * on success.
4543 * @param pLock
4544 *
4545 * @remarks This is more or a less a copy of PGMR3PhysTlbGCPhys2Ptr.
4546 * @thread EMT(pVCpu).
4547 */
4548VMM_INT_DECL(int) PGMPhysIemGCPhys2Ptr(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys, bool fWritable, bool fByPassHandlers,
4549 void **ppv, PPGMPAGEMAPLOCK pLock)
4550{
4551 PGM_A20_APPLY_TO_VAR(pVCpu, GCPhys);
4552
4553 pgmLock(pVM);
4554
4555 PPGMRAMRANGE pRam;
4556 PPGMPAGE pPage;
4557 int rc = pgmPhysGetPageAndRangeEx(pVM, GCPhys, &pPage, &pRam);
4558 if (RT_SUCCESS(rc))
4559 {
4560 if (PGM_PAGE_IS_BALLOONED(pPage))
4561 rc = VERR_PGM_PHYS_TLB_CATCH_WRITE;
4562 else if (PGM_PAGE_IS_SPECIAL_ALIAS_MMIO(pPage))
4563 rc = VERR_PGM_PHYS_TLB_CATCH_ALL;
4564 else if ( !PGM_PAGE_HAS_ANY_HANDLERS(pPage)
4565 || (fByPassHandlers && !PGM_PAGE_IS_MMIO(pPage)) )
4566 rc = VINF_SUCCESS;
4567 else
4568 {
4569 if (PGM_PAGE_HAS_ACTIVE_ALL_HANDLERS(pPage)) /* catches MMIO */
4570 {
4571 Assert(!fByPassHandlers || PGM_PAGE_IS_MMIO(pPage));
4572 rc = VERR_PGM_PHYS_TLB_CATCH_ALL;
4573 }
4574 else if (PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage) && fWritable)
4575 {
4576 Assert(!fByPassHandlers);
4577 rc = VERR_PGM_PHYS_TLB_CATCH_WRITE;
4578 }
4579 }
4580 if (RT_SUCCESS(rc))
4581 {
4582 int rc2;
4583
4584 /* Make sure what we return is writable. */
4585 if (fWritable)
4586 switch (PGM_PAGE_GET_STATE(pPage))
4587 {
4588 case PGM_PAGE_STATE_ALLOCATED:
4589 break;
4590 case PGM_PAGE_STATE_BALLOONED:
4591 AssertFailed();
4592 break;
4593 case PGM_PAGE_STATE_ZERO:
4594 case PGM_PAGE_STATE_SHARED:
4595 case PGM_PAGE_STATE_WRITE_MONITORED:
4596 rc2 = pgmPhysPageMakeWritable(pVM, pPage, GCPhys & ~(RTGCPHYS)PAGE_OFFSET_MASK);
4597 AssertLogRelRCReturn(rc2, rc2);
4598 break;
4599 }
4600
4601#if defined(IN_RC) || defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
4602 void *pv;
4603 rc = pgmRZDynMapHCPageInlined(pVCpu,
4604 PGM_PAGE_GET_HCPHYS(pPage),
4605 &pv
4606 RTLOG_COMMA_SRC_POS);
4607 if (RT_FAILURE(rc))
4608 return rc;
4609 *ppv = (void *)((uintptr_t)pv | (uintptr_t)(GCPhys & PAGE_OFFSET_MASK));
4610 pLock->pvPage = pv;
4611 pLock->pVCpu = pVCpu;
4612
4613#else
4614 /* Get a ring-3 mapping of the address. */
4615 PPGMPAGER3MAPTLBE pTlbe;
4616 rc2 = pgmPhysPageQueryTlbeWithPage(pVM, pPage, GCPhys, &pTlbe);
4617 AssertLogRelRCReturn(rc2, rc2);
4618
4619 /* Lock it and calculate the address. */
4620 if (fWritable)
4621 pgmPhysPageMapLockForWriting(pVM, pPage, pTlbe, pLock);
4622 else
4623 pgmPhysPageMapLockForReading(pVM, pPage, pTlbe, pLock);
4624 *ppv = (void *)((uintptr_t)pTlbe->pv | (uintptr_t)(GCPhys & PAGE_OFFSET_MASK));
4625#endif
4626
4627 Log6(("PGMPhysIemGCPhys2Ptr: GCPhys=%RGp rc=%Rrc pPage=%R[pgmpage] *ppv=%p\n", GCPhys, rc, pPage, *ppv));
4628 }
4629 else
4630 Log6(("PGMPhysIemGCPhys2Ptr: GCPhys=%RGp rc=%Rrc pPage=%R[pgmpage]\n", GCPhys, rc, pPage));
4631
4632 /* else: handler catching all access, no pointer returned. */
4633 }
4634 else
4635 rc = VERR_PGM_PHYS_TLB_UNASSIGNED;
4636
4637 pgmUnlock(pVM);
4638 return rc;
4639}
4640
4641
4642/**
4643 * Checks if the give GCPhys page requires special handling for the given access
4644 * because it's MMIO or otherwise monitored.
4645 *
4646 * @returns VBox status code (no informational statuses).
4647 * @retval VINF_SUCCESS on success.
4648 * @retval VERR_PGM_PHYS_TLB_CATCH_WRITE and *ppv set if the page has a write
4649 * access handler of some kind.
4650 * @retval VERR_PGM_PHYS_TLB_CATCH_ALL if the page has a handler catching all
4651 * accesses or is odd in any way.
4652 * @retval VERR_PGM_PHYS_TLB_UNASSIGNED if the page doesn't exist.
4653 *
4654 * @param pVM The cross context VM structure.
4655 * @param GCPhys The GC physical address to convert. Since this is
4656 * only used for filling the REM TLB, the A20 mask must
4657 * be applied before calling this API.
4658 * @param fWritable Whether write access is required.
4659 * @param fByPassHandlers Whether to bypass access handlers.
4660 *
4661 * @remarks This is a watered down version PGMPhysIemGCPhys2Ptr and really just
4662 * a stop gap thing that should be removed once there is a better TLB
4663 * for virtual address accesses.
4664 */
4665VMM_INT_DECL(int) PGMPhysIemQueryAccess(PVM pVM, RTGCPHYS GCPhys, bool fWritable, bool fByPassHandlers)
4666{
4667 pgmLock(pVM);
4668 PGM_A20_ASSERT_MASKED(VMMGetCpu(pVM), GCPhys);
4669
4670 PPGMRAMRANGE pRam;
4671 PPGMPAGE pPage;
4672 int rc = pgmPhysGetPageAndRangeEx(pVM, GCPhys, &pPage, &pRam);
4673 if (RT_SUCCESS(rc))
4674 {
4675 if (PGM_PAGE_IS_BALLOONED(pPage))
4676 rc = VERR_PGM_PHYS_TLB_CATCH_WRITE;
4677 else if (PGM_PAGE_IS_SPECIAL_ALIAS_MMIO(pPage))
4678 rc = VERR_PGM_PHYS_TLB_CATCH_ALL;
4679 else if ( !PGM_PAGE_HAS_ANY_HANDLERS(pPage)
4680 || (fByPassHandlers && !PGM_PAGE_IS_MMIO(pPage)) )
4681 rc = VINF_SUCCESS;
4682 else
4683 {
4684 if (PGM_PAGE_HAS_ACTIVE_ALL_HANDLERS(pPage)) /* catches MMIO */
4685 {
4686 Assert(!fByPassHandlers || PGM_PAGE_IS_MMIO(pPage));
4687 rc = VERR_PGM_PHYS_TLB_CATCH_ALL;
4688 }
4689 else if (PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage) && fWritable)
4690 {
4691 Assert(!fByPassHandlers);
4692 rc = VERR_PGM_PHYS_TLB_CATCH_WRITE;
4693 }
4694 }
4695 }
4696
4697 pgmUnlock(pVM);
4698 return rc;
4699}
4700
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette