PGMAllPool.cpp@ 60380

Last change on this file since 60380 was 58157, checked in by vboxsync, 9 years ago
Doxygen: @todo fixes
Property svn:eol-style set to `native` Property svn:keywords set to `Id Revision`
File size: 213.5 KB

Line
1	/* $Id: PGMAllPool.cpp 58157 2015-10-09 16:56:08Z vboxsync $ */
2	/** @file
3	* PGM Shadow Page Pool.
4	*/
5
6	/*
7	* Copyright (C) 2006-2015 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Header Files *
21	*********************************************************************************************************************************/
22	#define LOG_GROUP LOG_GROUP_PGM_POOL
23	#include <VBox/vmm/pgm.h>
24	#include <VBox/vmm/mm.h>
25	#include <VBox/vmm/em.h>
26	#include <VBox/vmm/cpum.h>
27	#ifdef IN_RC
28	# include <VBox/vmm/patm.h>
29	#endif
30	#include "PGMInternal.h"
31	#include <VBox/vmm/vm.h>
32	#include "PGMInline.h"
33	#include <VBox/disopcode.h>
34	#include <VBox/vmm/hm_vmx.h>
35
36	#include <VBox/log.h>
37	#include <VBox/err.h>
38	#include <iprt/asm.h>
39	#include <iprt/asm-amd64-x86.h>
40	#include <iprt/string.h>
41
42
43	/*********************************************************************************************************************************
44	* Internal Functions *
45	*********************************************************************************************************************************/
46	RT_C_DECLS_BEGIN
47	DECLINLINE(unsigned) pgmPoolTrackGetShadowEntrySize(PGMPOOLKIND enmKind);
48	DECLINLINE(unsigned) pgmPoolTrackGetGuestEntrySize(PGMPOOLKIND enmKind);
49	static void pgmPoolTrackClearPageUsers(PPGMPOOL pPool, PPGMPOOLPAGE pPage);
50	static void pgmPoolTrackDeref(PPGMPOOL pPool, PPGMPOOLPAGE pPage);
51	static int pgmPoolTrackAddUser(PPGMPOOL pPool, PPGMPOOLPAGE pPage, uint16_t iUser, uint32_t iUserTable);
52	static void pgmPoolMonitorModifiedRemove(PPGMPOOL pPool, PPGMPOOLPAGE pPage);
53	#if defined(LOG_ENABLED) \|\| defined(VBOX_STRICT)
54	static const char *pgmPoolPoolKindToStr(uint8_t enmKind);
55	#endif
56	#if 0 /defined(VBOX_STRICT) && defined(PGMPOOL_WITH_OPTIMIZED_DIRTY_PT)/
57	static void pgmPoolTrackCheckPTPaePae(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PPGMSHWPTPAE pShwPT, PCX86PTPAE pGstPT);
58	#endif
59
60	int pgmPoolTrackFlushGCPhysPTsSlow(PVM pVM, PPGMPAGE pPhysPage);
61	PPGMPOOLPHYSEXT pgmPoolTrackPhysExtAlloc(PVM pVM, uint16_t *piPhysExt);
62	void pgmPoolTrackPhysExtFree(PVM pVM, uint16_t iPhysExt);
63	void pgmPoolTrackPhysExtFreeList(PVM pVM, uint16_t iPhysExt);
64
65	RT_C_DECLS_END
66
67
68	/**
69	* Checks if the specified page pool kind is for a 4MB or 2MB guest page.
70	*
71	* @returns true if it's the shadow of a 4MB or 2MB guest page, otherwise false.
72	* @param enmKind The page kind.
73	*/
74	DECLINLINE(bool) pgmPoolIsBigPage(PGMPOOLKIND enmKind)
75	{
76	switch (enmKind)
77	{
78	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_4MB:
79	case PGMPOOLKIND_PAE_PT_FOR_32BIT_4MB:
80	case PGMPOOLKIND_PAE_PT_FOR_PAE_2MB:
81	return true;
82	default:
83	return false;
84	}
85	}
86
87
88	/**
89	* Flushes a chain of pages sharing the same access monitor.
90	*
91	* @returns VBox status code suitable for scheduling.
92	* @param pPool The pool.
93	* @param pPage A page in the chain.
94	* @todo VBOXSTRICTRC
95	*/
96	int pgmPoolMonitorChainFlush(PPGMPOOL pPool, PPGMPOOLPAGE pPage)
97	{
98	LogFlow(("pgmPoolMonitorChainFlush: Flush page %RGp type=%d\n", pPage->GCPhys, pPage->enmKind));
99
100	/*
101	* Find the list head.
102	*/
103	uint16_t idx = pPage->idx;
104	if (pPage->iMonitoredPrev != NIL_PGMPOOL_IDX)
105	{
106	while (pPage->iMonitoredPrev != NIL_PGMPOOL_IDX)
107	{
108	idx = pPage->iMonitoredPrev;
109	Assert(idx != pPage->idx);
110	pPage = &pPool->aPages[idx];
111	}
112	}
113
114	/*
115	* Iterate the list flushing each shadow page.
116	*/
117	int rc = VINF_SUCCESS;
118	for (;;)
119	{
120	idx = pPage->iMonitoredNext;
121	Assert(idx != pPage->idx);
122	if (pPage->idx >= PGMPOOL_IDX_FIRST)
123	{
124	int rc2 = pgmPoolFlushPage(pPool, pPage);
125	AssertRC(rc2);
126	}
127	/* next */
128	if (idx == NIL_PGMPOOL_IDX)
129	break;
130	pPage = &pPool->aPages[idx];
131	}
132	return rc;
133	}
134
135
136	/**
137	* Wrapper for getting the current context pointer to the entry being modified.
138	*
139	* @returns VBox status code suitable for scheduling.
140	* @param pVM The cross context VM structure.
141	* @param pvDst Destination address
142	* @param pvSrc Pointer to the mapping of @a GCPhysSrc or NULL depending
143	* on the context (e.g. \#PF in R0 & RC).
144	* @param GCPhysSrc The source guest physical address.
145	* @param cb Size of data to read
146	*/
147	DECLINLINE(int) pgmPoolPhysSimpleReadGCPhys(PVM pVM, void pvDst, void const pvSrc, RTGCPHYS GCPhysSrc, size_t cb)
148	{
149	#if defined(IN_RING3)
150	NOREF(pVM); NOREF(GCPhysSrc);
151	memcpy(pvDst, (RTHCPTR)((uintptr_t)pvSrc & ~(RTHCUINTPTR)(cb - 1)), cb);
152	return VINF_SUCCESS;
153	#else
154	/* @todo in RC we could attempt to use the virtual address, although this can cause many faults (PAE Windows XP guest). */
155	NOREF(pvSrc);
156	return PGMPhysSimpleReadGCPhys(pVM, pvDst, GCPhysSrc & ~(RTGCPHYS)(cb - 1), cb);
157	#endif
158	}
159
160
161	/**
162	* Process shadow entries before they are changed by the guest.
163	*
164	* For PT entries we will clear them. For PD entries, we'll simply check
165	* for mapping conflicts and set the SyncCR3 FF if found.
166	*
167	* @param pVCpu The cross context virtual CPU structure.
168	* @param pPool The pool.
169	* @param pPage The head page.
170	* @param GCPhysFault The guest physical fault address.
171	* @param pvAddress Pointer to the mapping of @a GCPhysFault or NULL
172	* depending on the context (e.g. \#PF in R0 & RC).
173	* @param cbWrite Write size; might be zero if the caller knows we're not crossing entry boundaries
174	*/
175	static void pgmPoolMonitorChainChanging(PVMCPU pVCpu, PPGMPOOL pPool, PPGMPOOLPAGE pPage, RTGCPHYS GCPhysFault,
176	void const *pvAddress, unsigned cbWrite)
177	{
178	AssertMsg(pPage->iMonitoredPrev == NIL_PGMPOOL_IDX, ("%u (idx=%u)\n", pPage->iMonitoredPrev, pPage->idx));
179	const unsigned off = GCPhysFault & PAGE_OFFSET_MASK;
180	PVM pVM = pPool->CTX_SUFF(pVM);
181	NOREF(pVCpu);
182
183	LogFlow(("pgmPoolMonitorChainChanging: %RGv phys=%RGp cbWrite=%d\n", (RTGCPTR)(CTXTYPE(RTGCPTR, uintptr_t, RTGCPTR))pvAddress, GCPhysFault, cbWrite));
184
185	for (;;)
186	{
187	union
188	{
189	void *pv;
190	PX86PT pPT;
191	PPGMSHWPTPAE pPTPae;
192	PX86PD pPD;
193	PX86PDPAE pPDPae;
194	PX86PDPT pPDPT;
195	PX86PML4 pPML4;
196	} uShw;
197
198	LogFlow(("pgmPoolMonitorChainChanging: page idx=%d phys=%RGp (next=%d) kind=%s write=%#x\n",
199	pPage->idx, pPage->GCPhys, pPage->iMonitoredNext, pgmPoolPoolKindToStr(pPage->enmKind), cbWrite));
200
201	uShw.pv = NULL;
202	switch (pPage->enmKind)
203	{
204	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_PT:
205	{
206	STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPT));
207	uShw.pv = PGMPOOL_PAGE_2_PTR(pVM, pPage);
208	const unsigned iShw = off / sizeof(X86PTE);
209	LogFlow(("PGMPOOLKIND_32BIT_PT_FOR_32BIT_PT iShw=%x\n", iShw));
210	if (uShw.pPT->a[iShw].n.u1Present)
211	{
212	X86PTE GstPte;
213
214	int rc = pgmPoolPhysSimpleReadGCPhys(pVM, &GstPte, pvAddress, GCPhysFault, sizeof(GstPte));
215	AssertRC(rc);
216	Log4(("pgmPoolMonitorChainChanging 32_32: deref %016RX64 GCPhys %08RX32\n", uShw.pPT->a[iShw].u & X86_PTE_PAE_PG_MASK, GstPte.u & X86_PTE_PG_MASK));
217	pgmPoolTracDerefGCPhysHint(pPool, pPage,
218	uShw.pPT->a[iShw].u & X86_PTE_PAE_PG_MASK,
219	GstPte.u & X86_PTE_PG_MASK,
220	iShw);
221	ASMAtomicWriteU32(&uShw.pPT->a[iShw].u, 0);
222	}
223	break;
224	}
225
226	/* page/2 sized */
227	case PGMPOOLKIND_PAE_PT_FOR_32BIT_PT:
228	{
229	STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPT));
230	uShw.pv = PGMPOOL_PAGE_2_PTR(pVM, pPage);
231	if (!((off ^ pPage->GCPhys) & (PAGE_SIZE / 2)))
232	{
233	const unsigned iShw = (off / sizeof(X86PTE)) & (X86_PG_PAE_ENTRIES - 1);
234	LogFlow(("PGMPOOLKIND_PAE_PT_FOR_32BIT_PT iShw=%x\n", iShw));
235	if (PGMSHWPTEPAE_IS_P(uShw.pPTPae->a[iShw]))
236	{
237	X86PTE GstPte;
238	int rc = pgmPoolPhysSimpleReadGCPhys(pVM, &GstPte, pvAddress, GCPhysFault, sizeof(GstPte));
239	AssertRC(rc);
240
241	Log4(("pgmPoolMonitorChainChanging pae_32: deref %016RX64 GCPhys %08RX32\n", uShw.pPT->a[iShw].u & X86_PTE_PAE_PG_MASK, GstPte.u & X86_PTE_PG_MASK));
242	pgmPoolTracDerefGCPhysHint(pPool, pPage,
243	PGMSHWPTEPAE_GET_HCPHYS(uShw.pPTPae->a[iShw]),
244	GstPte.u & X86_PTE_PG_MASK,
245	iShw);
246	PGMSHWPTEPAE_ATOMIC_SET(uShw.pPTPae->a[iShw], 0);
247	}
248	}
249	break;
250	}
251
252	case PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD:
253	case PGMPOOLKIND_PAE_PD1_FOR_32BIT_PD:
254	case PGMPOOLKIND_PAE_PD2_FOR_32BIT_PD:
255	case PGMPOOLKIND_PAE_PD3_FOR_32BIT_PD:
256	{
257	unsigned iGst = off / sizeof(X86PDE);
258	unsigned iShwPdpt = iGst / 256;
259	unsigned iShw = (iGst % 256) * 2;
260	uShw.pv = PGMPOOL_PAGE_2_PTR(pVM, pPage);
261
262	LogFlow(("pgmPoolMonitorChainChanging PAE for 32 bits: iGst=%x iShw=%x idx = %d page idx=%d\n", iGst, iShw, iShwPdpt, pPage->enmKind - PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD));
263	STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPD));
264	if (iShwPdpt == pPage->enmKind - (unsigned)PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD)
265	{
266	for (unsigned i = 0; i < 2; i++)
267	{
268	# ifdef VBOX_WITH_RAW_MODE_NOT_R0
269	if ((uShw.pPDPae->a[iShw + i].u & (PGM_PDFLAGS_MAPPING \| X86_PDE_P)) == (PGM_PDFLAGS_MAPPING \| X86_PDE_P))
270	{
271	Assert(pgmMapAreMappingsEnabled(pVM));
272	VMCPU_FF_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3);
273	LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShwPdpt=%#x iShw=%#x!\n", iShwPdpt, iShw+i));
274	break;
275	}
276	# endif /* VBOX_WITH_RAW_MODE_NOT_R0 */
277	if (uShw.pPDPae->a[iShw+i].n.u1Present)
278	{
279	LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw=%#x: %RX64 -> freeing it!\n", iShw+i, uShw.pPDPae->a[iShw+i].u));
280	pgmPoolFree(pVM,
281	uShw.pPDPae->a[iShw+i].u & X86_PDE_PAE_PG_MASK,
282	pPage->idx,
283	iShw + i);
284	ASMAtomicWriteU64(&uShw.pPDPae->a[iShw+i].u, 0);
285	}
286
287	/* paranoia / a bit assumptive. */
288	if ( (off & 3)
289	&& (off & 3) + cbWrite > 4)
290	{
291	const unsigned iShw2 = iShw + 2 + i;
292	if (iShw2 < RT_ELEMENTS(uShw.pPDPae->a))
293	{
294	# ifdef VBOX_WITH_RAW_MODE_NOT_R0
295	if ((uShw.pPDPae->a[iShw2].u & (PGM_PDFLAGS_MAPPING \| X86_PDE_P)) == (PGM_PDFLAGS_MAPPING \| X86_PDE_P))
296	{
297	Assert(pgmMapAreMappingsEnabled(pVM));
298	VMCPU_FF_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3);
299	LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShwPdpt=%#x iShw2=%#x!\n", iShwPdpt, iShw2));
300	break;
301	}
302	# endif /* VBOX_WITH_RAW_MODE_NOT_R0 */
303	if (uShw.pPDPae->a[iShw2].n.u1Present)
304	{
305	LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPDPae->a[iShw2].u));
306	pgmPoolFree(pVM,
307	uShw.pPDPae->a[iShw2].u & X86_PDE_PAE_PG_MASK,
308	pPage->idx,
309	iShw2);
310	ASMAtomicWriteU64(&uShw.pPDPae->a[iShw2].u, 0);
311	}
312	}
313	}
314	}
315	}
316	break;
317	}
318
319	case PGMPOOLKIND_PAE_PT_FOR_PAE_PT:
320	{
321	uShw.pv = PGMPOOL_PAGE_2_PTR(pVM, pPage);
322	const unsigned iShw = off / sizeof(X86PTEPAE);
323	STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPT));
324	if (PGMSHWPTEPAE_IS_P(uShw.pPTPae->a[iShw]))
325	{
326	X86PTEPAE GstPte;
327	int rc = pgmPoolPhysSimpleReadGCPhys(pVM, &GstPte, pvAddress, GCPhysFault, sizeof(GstPte));
328	AssertRC(rc);
329
330	Log4(("pgmPoolMonitorChainChanging pae: deref %016RX64 GCPhys %016RX64\n", PGMSHWPTEPAE_GET_HCPHYS(uShw.pPTPae->a[iShw]), GstPte.u & X86_PTE_PAE_PG_MASK));
331	pgmPoolTracDerefGCPhysHint(pPool, pPage,
332	PGMSHWPTEPAE_GET_HCPHYS(uShw.pPTPae->a[iShw]),
333	GstPte.u & X86_PTE_PAE_PG_MASK,
334	iShw);
335	PGMSHWPTEPAE_ATOMIC_SET(uShw.pPTPae->a[iShw], 0);
336	}
337
338	/* paranoia / a bit assumptive. */
339	if ( (off & 7)
340	&& (off & 7) + cbWrite > sizeof(X86PTEPAE))
341	{
342	const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PTEPAE);
343	AssertBreak(iShw2 < RT_ELEMENTS(uShw.pPTPae->a));
344
345	if (PGMSHWPTEPAE_IS_P(uShw.pPTPae->a[iShw2]))
346	{
347	X86PTEPAE GstPte;
348	int rc = pgmPoolPhysSimpleReadGCPhys(pVM, &GstPte,
349	pvAddress ? (uint8_t const *)pvAddress + sizeof(GstPte) : NULL,
350	GCPhysFault + sizeof(GstPte), sizeof(GstPte));
351	AssertRC(rc);
352	Log4(("pgmPoolMonitorChainChanging pae: deref %016RX64 GCPhys %016RX64\n", PGMSHWPTEPAE_GET_HCPHYS(uShw.pPTPae->a[iShw2]), GstPte.u & X86_PTE_PAE_PG_MASK));
353	pgmPoolTracDerefGCPhysHint(pPool, pPage,
354	PGMSHWPTEPAE_GET_HCPHYS(uShw.pPTPae->a[iShw2]),
355	GstPte.u & X86_PTE_PAE_PG_MASK,
356	iShw2);
357	PGMSHWPTEPAE_ATOMIC_SET(uShw.pPTPae->a[iShw2], 0);
358	}
359	}
360	break;
361	}
362
363	case PGMPOOLKIND_32BIT_PD:
364	{
365	uShw.pv = PGMPOOL_PAGE_2_PTR(pVM, pPage);
366	const unsigned iShw = off / sizeof(X86PTE); // ASSUMING 32-bit guest paging!
367
368	LogFlow(("pgmPoolMonitorChainChanging: PGMPOOLKIND_32BIT_PD %x\n", iShw));
369	STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPD));
370	# ifdef VBOX_WITH_RAW_MODE_NOT_R0
371	if (uShw.pPD->a[iShw].u & PGM_PDFLAGS_MAPPING)
372	{
373	Assert(pgmMapAreMappingsEnabled(pVM));
374	VMCPU_FF_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3);
375	STAM_COUNTER_INC(&(pVCpu->pgm.s.CTX_SUFF(pStats)->StatRZGuestCR3WriteConflict));
376	LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShw=%#x!\n", iShw));
377	break;
378	}
379	else
380	# endif /* VBOX_WITH_RAW_MODE_NOT_R0 */
381	{
382	if (uShw.pPD->a[iShw].n.u1Present)
383	{
384	LogFlow(("pgmPoolMonitorChainChanging: 32 bit pd iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPD->a[iShw].u));
385	pgmPoolFree(pVM,
386	uShw.pPD->a[iShw].u & X86_PDE_PAE_PG_MASK,
387	pPage->idx,
388	iShw);
389	ASMAtomicWriteU32(&uShw.pPD->a[iShw].u, 0);
390	}
391	}
392	/* paranoia / a bit assumptive. */
393	if ( (off & 3)
394	&& (off & 3) + cbWrite > sizeof(X86PTE))
395	{
396	const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PTE);
397	if ( iShw2 != iShw
398	&& iShw2 < RT_ELEMENTS(uShw.pPD->a))
399	{
400	# ifdef VBOX_WITH_RAW_MODE_NOT_R0
401	if (uShw.pPD->a[iShw2].u & PGM_PDFLAGS_MAPPING)
402	{
403	Assert(pgmMapAreMappingsEnabled(pVM));
404	STAM_COUNTER_INC(&(pVCpu->pgm.s.CTX_SUFF(pStats)->StatRZGuestCR3WriteConflict));
405	VMCPU_FF_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3);
406	LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShw2=%#x!\n", iShw2));
407	break;
408	}
409	# endif /* VBOX_WITH_RAW_MODE_NOT_R0 */
410	if (uShw.pPD->a[iShw2].n.u1Present)
411	{
412	LogFlow(("pgmPoolMonitorChainChanging: 32 bit pd iShw=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPD->a[iShw2].u));
413	pgmPoolFree(pVM,
414	uShw.pPD->a[iShw2].u & X86_PDE_PAE_PG_MASK,
415	pPage->idx,
416	iShw2);
417	ASMAtomicWriteU32(&uShw.pPD->a[iShw2].u, 0);
418	}
419	}
420	}
421	#if 0 /* useful when running PGMAssertCR3(), a bit too troublesome for general use (TLBs). - not working any longer... */
422	if ( uShw.pPD->a[iShw].n.u1Present
423	&& !VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3))
424	{
425	LogFlow(("pgmPoolMonitorChainChanging: iShw=%#x: %RX32 -> freeing it!\n", iShw, uShw.pPD->a[iShw].u));
426	# ifdef IN_RC /* TLB load - we're pushing things a bit... */
427	ASMProbeReadByte(pvAddress);
428	# endif
429	pgmPoolFree(pVM, uShw.pPD->a[iShw].u & X86_PDE_PG_MASK, pPage->idx, iShw);
430	ASMAtomicWriteU32(&uShw.pPD->a[iShw].u, 0);
431	}
432	#endif
433	break;
434	}
435
436	case PGMPOOLKIND_PAE_PD_FOR_PAE_PD:
437	{
438	uShw.pv = PGMPOOL_PAGE_2_PTR(pVM, pPage);
439	const unsigned iShw = off / sizeof(X86PDEPAE);
440	STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPD));
441	#ifdef VBOX_WITH_RAW_MODE_NOT_R0
442	if (uShw.pPDPae->a[iShw].u & PGM_PDFLAGS_MAPPING)
443	{
444	Assert(pgmMapAreMappingsEnabled(pVM));
445	VMCPU_FF_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3);
446	STAM_COUNTER_INC(&(pVCpu->pgm.s.CTX_SUFF(pStats)->StatRZGuestCR3WriteConflict));
447	LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShw=%#x!\n", iShw));
448	break;
449	}
450	#endif /* VBOX_WITH_RAW_MODE_NOT_R0 */
451	/*
452	* Causes trouble when the guest uses a PDE to refer to the whole page table level
453	* structure. (Invalidate here; faults later on when it tries to change the page
454	* table entries -> recheck; probably only applies to the RC case.)
455	*/
456	#ifdef VBOX_WITH_RAW_MODE_NOT_R0
457	else
458	#endif
459	{
460	if (uShw.pPDPae->a[iShw].n.u1Present)
461	{
462	LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPDPae->a[iShw].u));
463	pgmPoolFree(pVM,
464	uShw.pPDPae->a[iShw].u & X86_PDE_PAE_PG_MASK,
465	pPage->idx,
466	iShw);
467	ASMAtomicWriteU64(&uShw.pPDPae->a[iShw].u, 0);
468	}
469	}
470	/* paranoia / a bit assumptive. */
471	if ( (off & 7)
472	&& (off & 7) + cbWrite > sizeof(X86PDEPAE))
473	{
474	const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PDEPAE);
475	AssertBreak(iShw2 < RT_ELEMENTS(uShw.pPDPae->a));
476
477	#ifdef VBOX_WITH_RAW_MODE_NOT_R0
478	if ( iShw2 != iShw
479	&& uShw.pPDPae->a[iShw2].u & PGM_PDFLAGS_MAPPING)
480	{
481	Assert(pgmMapAreMappingsEnabled(pVM));
482	VMCPU_FF_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3);
483	STAM_COUNTER_INC(&(pVCpu->pgm.s.CTX_SUFF(pStats)->StatRZGuestCR3WriteConflict));
484	LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShw2=%#x!\n", iShw2));
485	break;
486	}
487	else
488	#endif /* VBOX_WITH_RAW_MODE_NOT_R0 */
489	if (uShw.pPDPae->a[iShw2].n.u1Present)
490	{
491	LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw2=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPDPae->a[iShw2].u));
492	pgmPoolFree(pVM,
493	uShw.pPDPae->a[iShw2].u & X86_PDE_PAE_PG_MASK,
494	pPage->idx,
495	iShw2);
496	ASMAtomicWriteU64(&uShw.pPDPae->a[iShw2].u, 0);
497	}
498	}
499	break;
500	}
501
502	case PGMPOOLKIND_PAE_PDPT:
503	{
504	STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPDPT));
505	/*
506	* Hopefully this doesn't happen very often:
507	* - touching unused parts of the page
508	* - messing with the bits of pd pointers without changing the physical address
509	*/
510	/* PDPT roots are not page aligned; 32 byte only! */
511	const unsigned offPdpt = GCPhysFault - pPage->GCPhys;
512
513	uShw.pv = PGMPOOL_PAGE_2_PTR(pVM, pPage);
514	const unsigned iShw = offPdpt / sizeof(X86PDPE);
515	if (iShw < X86_PG_PAE_PDPE_ENTRIES) /* don't use RT_ELEMENTS(uShw.pPDPT->a), because that's for long mode only */
516	{
517	# ifdef VBOX_WITH_RAW_MODE_NOT_R0
518	if (uShw.pPDPT->a[iShw].u & PGM_PLXFLAGS_MAPPING)
519	{
520	Assert(pgmMapAreMappingsEnabled(pVM));
521	STAM_COUNTER_INC(&(pVCpu->pgm.s.CTX_SUFF(pStats)->StatRZGuestCR3WriteConflict));
522	VMCPU_FF_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3);
523	LogFlow(("pgmPoolMonitorChainChanging: Detected pdpt conflict at iShw=%#x!\n", iShw));
524	break;
525	}
526	else
527	# endif /* VBOX_WITH_RAW_MODE_NOT_R0 */
528	if (uShw.pPDPT->a[iShw].n.u1Present)
529	{
530	LogFlow(("pgmPoolMonitorChainChanging: pae pdpt iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPDPT->a[iShw].u));
531	pgmPoolFree(pVM,
532	uShw.pPDPT->a[iShw].u & X86_PDPE_PG_MASK,
533	pPage->idx,
534	iShw);
535	ASMAtomicWriteU64(&uShw.pPDPT->a[iShw].u, 0);
536	}
537
538	/* paranoia / a bit assumptive. */
539	if ( (offPdpt & 7)
540	&& (offPdpt & 7) + cbWrite > sizeof(X86PDPE))
541	{
542	const unsigned iShw2 = (offPdpt + cbWrite - 1) / sizeof(X86PDPE);
543	if ( iShw2 != iShw
544	&& iShw2 < X86_PG_PAE_PDPE_ENTRIES)
545	{
546	# ifdef VBOX_WITH_RAW_MODE_NOT_R0
547	if (uShw.pPDPT->a[iShw2].u & PGM_PLXFLAGS_MAPPING)
548	{
549	Assert(pgmMapAreMappingsEnabled(pVM));
550	STAM_COUNTER_INC(&(pVCpu->pgm.s.CTX_SUFF(pStats)->StatRZGuestCR3WriteConflict));
551	VMCPU_FF_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3);
552	LogFlow(("pgmPoolMonitorChainChanging: Detected conflict at iShw2=%#x!\n", iShw2));
553	break;
554	}
555	else
556	# endif /* VBOX_WITH_RAW_MODE_NOT_R0 */
557	if (uShw.pPDPT->a[iShw2].n.u1Present)
558	{
559	LogFlow(("pgmPoolMonitorChainChanging: pae pdpt iShw=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPDPT->a[iShw2].u));
560	pgmPoolFree(pVM,
561	uShw.pPDPT->a[iShw2].u & X86_PDPE_PG_MASK,
562	pPage->idx,
563	iShw2);
564	ASMAtomicWriteU64(&uShw.pPDPT->a[iShw2].u, 0);
565	}
566	}
567	}
568	}
569	break;
570	}
571
572	#ifndef IN_RC
573	case PGMPOOLKIND_64BIT_PD_FOR_64BIT_PD:
574	{
575	STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPD));
576	uShw.pv = PGMPOOL_PAGE_2_PTR(pVM, pPage);
577	const unsigned iShw = off / sizeof(X86PDEPAE);
578	Assert(!(uShw.pPDPae->a[iShw].u & PGM_PDFLAGS_MAPPING));
579	if (uShw.pPDPae->a[iShw].n.u1Present)
580	{
581	LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPDPae->a[iShw].u));
582	pgmPoolFree(pVM,
583	uShw.pPDPae->a[iShw].u & X86_PDE_PAE_PG_MASK,
584	pPage->idx,
585	iShw);
586	ASMAtomicWriteU64(&uShw.pPDPae->a[iShw].u, 0);
587	}
588	/* paranoia / a bit assumptive. */
589	if ( (off & 7)
590	&& (off & 7) + cbWrite > sizeof(X86PDEPAE))
591	{
592	const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PDEPAE);
593	AssertBreak(iShw2 < RT_ELEMENTS(uShw.pPDPae->a));
594
595	Assert(!(uShw.pPDPae->a[iShw2].u & PGM_PDFLAGS_MAPPING));
596	if (uShw.pPDPae->a[iShw2].n.u1Present)
597	{
598	LogFlow(("pgmPoolMonitorChainChanging: pae pd iShw2=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPDPae->a[iShw2].u));
599	pgmPoolFree(pVM,
600	uShw.pPDPae->a[iShw2].u & X86_PDE_PAE_PG_MASK,
601	pPage->idx,
602	iShw2);
603	ASMAtomicWriteU64(&uShw.pPDPae->a[iShw2].u, 0);
604	}
605	}
606	break;
607	}
608
609	case PGMPOOLKIND_64BIT_PDPT_FOR_64BIT_PDPT:
610	{
611	STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPDPT));
612	/*
613	* Hopefully this doesn't happen very often:
614	* - messing with the bits of pd pointers without changing the physical address
615	*/
616	uShw.pv = PGMPOOL_PAGE_2_PTR(pVM, pPage);
617	const unsigned iShw = off / sizeof(X86PDPE);
618	if (uShw.pPDPT->a[iShw].n.u1Present)
619	{
620	LogFlow(("pgmPoolMonitorChainChanging: pdpt iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPDPT->a[iShw].u));
621	pgmPoolFree(pVM, uShw.pPDPT->a[iShw].u & X86_PDPE_PG_MASK, pPage->idx, iShw);
622	ASMAtomicWriteU64(&uShw.pPDPT->a[iShw].u, 0);
623	}
624	/* paranoia / a bit assumptive. */
625	if ( (off & 7)
626	&& (off & 7) + cbWrite > sizeof(X86PDPE))
627	{
628	const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PDPE);
629	if (uShw.pPDPT->a[iShw2].n.u1Present)
630	{
631	LogFlow(("pgmPoolMonitorChainChanging: pdpt iShw2=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPDPT->a[iShw2].u));
632	pgmPoolFree(pVM, uShw.pPDPT->a[iShw2].u & X86_PDPE_PG_MASK, pPage->idx, iShw2);
633	ASMAtomicWriteU64(&uShw.pPDPT->a[iShw2].u, 0);
634	}
635	}
636	break;
637	}
638
639	case PGMPOOLKIND_64BIT_PML4:
640	{
641	STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FaultPML4));
642	/*
643	* Hopefully this doesn't happen very often:
644	* - messing with the bits of pd pointers without changing the physical address
645	*/
646	uShw.pv = PGMPOOL_PAGE_2_PTR(pVM, pPage);
647	const unsigned iShw = off / sizeof(X86PDPE);
648	if (uShw.pPML4->a[iShw].n.u1Present)
649	{
650	LogFlow(("pgmPoolMonitorChainChanging: pml4 iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPML4->a[iShw].u));
651	pgmPoolFree(pVM, uShw.pPML4->a[iShw].u & X86_PML4E_PG_MASK, pPage->idx, iShw);
652	ASMAtomicWriteU64(&uShw.pPML4->a[iShw].u, 0);
653	}
654	/* paranoia / a bit assumptive. */
655	if ( (off & 7)
656	&& (off & 7) + cbWrite > sizeof(X86PDPE))
657	{
658	const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PML4E);
659	if (uShw.pPML4->a[iShw2].n.u1Present)
660	{
661	LogFlow(("pgmPoolMonitorChainChanging: pml4 iShw2=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPML4->a[iShw2].u));
662	pgmPoolFree(pVM, uShw.pPML4->a[iShw2].u & X86_PML4E_PG_MASK, pPage->idx, iShw2);
663	ASMAtomicWriteU64(&uShw.pPML4->a[iShw2].u, 0);
664	}
665	}
666	break;
667	}
668	#endif /* IN_RING0 */
669
670	default:
671	AssertFatalMsgFailed(("enmKind=%d\n", pPage->enmKind));
672	}
673	PGM_DYNMAP_UNUSED_HINT_VM(pVM, uShw.pv);
674
675	/* next */
676	if (pPage->iMonitoredNext == NIL_PGMPOOL_IDX)
677	return;
678	pPage = &pPool->aPages[pPage->iMonitoredNext];
679	}
680	}
681
682	# ifndef IN_RING3
683
684	/**
685	* Checks if a access could be a fork operation in progress.
686	*
687	* Meaning, that the guest is setting up the parent process for Copy-On-Write.
688	*
689	* @returns true if it's likely that we're forking, otherwise false.
690	* @param pPool The pool.
691	* @param pDis The disassembled instruction.
692	* @param offFault The access offset.
693	*/
694	DECLINLINE(bool) pgmPoolMonitorIsForking(PPGMPOOL pPool, PDISCPUSTATE pDis, unsigned offFault)
695	{
696	/*
697	* i386 linux is using btr to clear X86_PTE_RW.
698	* The functions involved are (2.6.16 source inspection):
699	* clear_bit
700	* ptep_set_wrprotect
701	* copy_one_pte
702	* copy_pte_range
703	* copy_pmd_range
704	* copy_pud_range
705	* copy_page_range
706	* dup_mmap
707	* dup_mm
708	* copy_mm
709	* copy_process
710	* do_fork
711	*/
712	if ( pDis->pCurInstr->uOpcode == OP_BTR
713	&& !(offFault & 4)
714	/** @todo Validate that the bit index is X86_PTE_RW. */
715	)
716	{
717	STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,Fork));
718	return true;
719	}
720	return false;
721	}
722
723
724	/**
725	* Determine whether the page is likely to have been reused.
726	*
727	* @returns true if we consider the page as being reused for a different purpose.
728	* @returns false if we consider it to still be a paging page.
729	* @param pVM The cross context VM structure.
730	* @param pVCpu The cross context virtual CPU structure.
731	* @param pRegFrame Trap register frame.
732	* @param pDis The disassembly info for the faulting instruction.
733	* @param pvFault The fault address.
734	*
735	* @remark The REP prefix check is left to the caller because of STOSD/W.
736	*/
737	DECLINLINE(bool) pgmPoolMonitorIsReused(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pDis, RTGCPTR pvFault)
738	{
739	#ifndef IN_RC
740	/** @todo could make this general, faulting close to rsp should be a safe reuse heuristic. */
741	if ( HMHasPendingIrq(pVM)
742	&& (pRegFrame->rsp - pvFault) < 32)
743	{
744	/* Fault caused by stack writes while trying to inject an interrupt event. */
745	Log(("pgmPoolMonitorIsReused: reused %RGv for interrupt stack (rsp=%RGv).\n", pvFault, pRegFrame->rsp));
746	return true;
747	}
748	#else
749	NOREF(pVM); NOREF(pvFault);
750	#endif
751
752	LogFlow(("Reused instr %RGv %d at %RGv param1.fUse=%llx param1.reg=%d\n", pRegFrame->rip, pDis->pCurInstr->uOpcode, pvFault, pDis->Param1.fUse, pDis->Param1.Base.idxGenReg));
753
754	/* Non-supervisor mode write means it's used for something else. */
755	if (CPUMGetGuestCPL(pVCpu) == 3)
756	return true;
757
758	switch (pDis->pCurInstr->uOpcode)
759	{
760	/* call implies the actual push of the return address faulted */
761	case OP_CALL:
762	Log4(("pgmPoolMonitorIsReused: CALL\n"));
763	return true;
764	case OP_PUSH:
765	Log4(("pgmPoolMonitorIsReused: PUSH\n"));
766	return true;
767	case OP_PUSHF:
768	Log4(("pgmPoolMonitorIsReused: PUSHF\n"));
769	return true;
770	case OP_PUSHA:
771	Log4(("pgmPoolMonitorIsReused: PUSHA\n"));
772	return true;
773	case OP_FXSAVE:
774	Log4(("pgmPoolMonitorIsReused: FXSAVE\n"));
775	return true;
776	case OP_MOVNTI: /* solaris - block_zero_no_xmm */
777	Log4(("pgmPoolMonitorIsReused: MOVNTI\n"));
778	return true;
779	case OP_MOVNTDQ: /* solaris - hwblkclr & hwblkpagecopy */
780	Log4(("pgmPoolMonitorIsReused: MOVNTDQ\n"));
781	return true;
782	case OP_MOVSWD:
783	case OP_STOSWD:
784	if ( pDis->fPrefix == (DISPREFIX_REP\|DISPREFIX_REX)
785	&& pRegFrame->rcx >= 0x40
786	)
787	{
788	Assert(pDis->uCpuMode == DISCPUMODE_64BIT);
789
790	Log(("pgmPoolMonitorIsReused: OP_STOSQ\n"));
791	return true;
792	}
793	return false;
794	}
795	if ( ( (pDis->Param1.fUse & DISUSE_REG_GEN32)
796	\|\| (pDis->Param1.fUse & DISUSE_REG_GEN64))
797	&& (pDis->Param1.Base.idxGenReg == DISGREG_ESP))
798	{
799	Log4(("pgmPoolMonitorIsReused: ESP\n"));
800	return true;
801	}
802
803	return false;
804	}
805
806
807	/**
808	* Flushes the page being accessed.
809	*
810	* @returns VBox status code suitable for scheduling.
811	* @param pVM The cross context VM structure.
812	* @param pVCpu The cross context virtual CPU structure.
813	* @param pPool The pool.
814	* @param pPage The pool page (head).
815	* @param pDis The disassembly of the write instruction.
816	* @param pRegFrame The trap register frame.
817	* @param GCPhysFault The fault address as guest physical address.
818	* @param pvFault The fault address.
819	* @todo VBOXSTRICTRC
820	*/
821	static int pgmPoolAccessPfHandlerFlush(PVM pVM, PVMCPU pVCpu, PPGMPOOL pPool, PPGMPOOLPAGE pPage, PDISCPUSTATE pDis,
822	PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, RTGCPTR pvFault)
823	{
824	NOREF(pVM); NOREF(GCPhysFault);
825
826	/*
827	* First, do the flushing.
828	*/
829	int rc = pgmPoolMonitorChainFlush(pPool, pPage);
830
831	/*
832	* Emulate the instruction (xp/w2k problem, requires pc/cr2/sp detection).
833	* Must do this in raw mode (!); XP boot will fail otherwise.
834	*/
835	VBOXSTRICTRC rc2 = EMInterpretInstructionDisasState(pVCpu, pDis, pRegFrame, pvFault, EMCODETYPE_ALL);
836	if (rc2 == VINF_SUCCESS)
837	{ /* do nothing */ }
838	#ifdef VBOX_WITH_IEM
839	else if (rc2 == VINF_EM_RESCHEDULE)
840	{
841	if (rc == VINF_SUCCESS)
842	rc = VBOXSTRICTRC_VAL(rc2);
843	# ifndef IN_RING3
844	VMCPU_FF_SET(pVCpu, VMCPU_FF_TO_R3);
845	# endif
846	}
847	#endif
848	else if (rc2 == VERR_EM_INTERPRETER)
849	{
850	#ifdef IN_RC
851	if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
852	{
853	LogFlow(("pgmPoolAccessPfHandlerPTWorker: Interpretation failed for patch code %04x:%RGv, ignoring.\n",
854	pRegFrame->cs.Sel, (RTGCPTR)pRegFrame->eip));
855	rc = VINF_SUCCESS;
856	STAM_COUNTER_INC(&pPool->StatMonitorRZIntrFailPatch2);
857	}
858	else
859	#endif
860	{
861	rc = VINF_EM_RAW_EMULATE_INSTR;
862	STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,EmulateInstr));
863	}
864	}
865	else if (RT_FAILURE_NP(rc2))
866	rc = VBOXSTRICTRC_VAL(rc2);
867	else
868	AssertMsgFailed(("%Rrc\n", VBOXSTRICTRC_VAL(rc2))); /* ASSUMES no complicated stuff here. */
869
870	LogFlow(("pgmPoolAccessPfHandlerPT: returns %Rrc (flushed)\n", rc));
871	return rc;
872	}
873
874
875	/**
876	* Handles the STOSD write accesses.
877	*
878	* @returns VBox status code suitable for scheduling.
879	* @param pVM The cross context VM structure.
880	* @param pPool The pool.
881	* @param pPage The pool page (head).
882	* @param pDis The disassembly of the write instruction.
883	* @param pRegFrame The trap register frame.
884	* @param GCPhysFault The fault address as guest physical address.
885	* @param pvFault The fault address.
886	*/
887	DECLINLINE(int) pgmPoolAccessPfHandlerSTOSD(PVM pVM, PPGMPOOL pPool, PPGMPOOLPAGE pPage, PDISCPUSTATE pDis,
888	PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, RTGCPTR pvFault)
889	{
890	unsigned uIncrement = pDis->Param1.cb;
891	NOREF(pVM);
892
893	Assert(pDis->uCpuMode == DISCPUMODE_32BIT \|\| pDis->uCpuMode == DISCPUMODE_64BIT);
894	Assert(pRegFrame->rcx <= 0x20);
895
896	#ifdef VBOX_STRICT
897	if (pDis->uOpMode == DISCPUMODE_32BIT)
898	Assert(uIncrement == 4);
899	else
900	Assert(uIncrement == 8);
901	#endif
902
903	Log3(("pgmPoolAccessPfHandlerSTOSD\n"));
904
905	/*
906	* Increment the modification counter and insert it into the list
907	* of modified pages the first time.
908	*/
909	if (!pPage->cModifications++)
910	pgmPoolMonitorModifiedInsert(pPool, pPage);
911
912	/*
913	* Execute REP STOSD.
914	*
915	* This ASSUMES that we're not invoked by Trap0e on in a out-of-sync
916	* write situation, meaning that it's safe to write here.
917	*/
918	PVMCPU pVCpu = VMMGetCpu(pPool->CTX_SUFF(pVM));
919	RTGCUINTPTR pu32 = (RTGCUINTPTR)pvFault;
920	while (pRegFrame->rcx)
921	{
922	#if defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0) \|\| defined(IN_RC)
923	uint32_t iPrevSubset = PGMRZDynMapPushAutoSubset(pVCpu);
924	pgmPoolMonitorChainChanging(pVCpu, pPool, pPage, GCPhysFault, NULL, uIncrement);
925	PGMRZDynMapPopAutoSubset(pVCpu, iPrevSubset);
926	#else
927	pgmPoolMonitorChainChanging(pVCpu, pPool, pPage, GCPhysFault, NULL, uIncrement);
928	#endif
929	#ifdef IN_RC
930	(uint32_t )(uintptr_t)pu32 = pRegFrame->eax;
931	#else
932	PGMPhysSimpleWriteGCPhys(pVM, GCPhysFault, &pRegFrame->rax, uIncrement);
933	#endif
934	pu32 += uIncrement;
935	GCPhysFault += uIncrement;
936	pRegFrame->rdi += uIncrement;
937	pRegFrame->rcx--;
938	}
939	pRegFrame->rip += pDis->cbInstr;
940
941	LogFlow(("pgmPoolAccessPfHandlerSTOSD: returns\n"));
942	return VINF_SUCCESS;
943	}
944
945
946	/**
947	* Handles the simple write accesses.
948	*
949	* @returns VBox status code suitable for scheduling.
950	* @param pVM The cross context VM structure.
951	* @param pVCpu The cross context virtual CPU structure.
952	* @param pPool The pool.
953	* @param pPage The pool page (head).
954	* @param pDis The disassembly of the write instruction.
955	* @param pRegFrame The trap register frame.
956	* @param GCPhysFault The fault address as guest physical address.
957	* @param pvFault The fault address.
958	* @param pfReused Reused state (in/out)
959	*/
960	DECLINLINE(int) pgmPoolAccessPfHandlerSimple(PVM pVM, PVMCPU pVCpu, PPGMPOOL pPool, PPGMPOOLPAGE pPage, PDISCPUSTATE pDis,
961	PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, RTGCPTR pvFault, bool *pfReused)
962	{
963	Log3(("pgmPoolAccessPfHandlerSimple\n"));
964	NOREF(pVM);
965	NOREF(pfReused); /* initialized by caller */
966
967	/*
968	* Increment the modification counter and insert it into the list
969	* of modified pages the first time.
970	*/
971	if (!pPage->cModifications++)
972	pgmPoolMonitorModifiedInsert(pPool, pPage);
973
974	/*
975	* Clear all the pages. ASSUMES that pvFault is readable.
976	*/
977	#if defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0) \|\| defined(IN_RC)
978	uint32_t iPrevSubset = PGMRZDynMapPushAutoSubset(pVCpu);
979	#endif
980
981	uint32_t cbWrite = DISGetParamSize(pDis, &pDis->Param1);
982	if (cbWrite <= 8)
983	pgmPoolMonitorChainChanging(pVCpu, pPool, pPage, GCPhysFault, NULL, cbWrite);
984	else
985	{
986	Assert(cbWrite <= 16);
987	pgmPoolMonitorChainChanging(pVCpu, pPool, pPage, GCPhysFault, NULL, 8);
988	pgmPoolMonitorChainChanging(pVCpu, pPool, pPage, GCPhysFault + 8, NULL, cbWrite - 8);
989	}
990
991	#if defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0) \|\| defined(IN_RC)
992	PGMRZDynMapPopAutoSubset(pVCpu, iPrevSubset);
993	#endif
994
995	/*
996	* Interpret the instruction.
997	*/
998	VBOXSTRICTRC rc = EMInterpretInstructionDisasState(pVCpu, pDis, pRegFrame, pvFault, EMCODETYPE_ALL);
999	if (RT_SUCCESS(rc))
1000	AssertMsg(rc == VINF_SUCCESS, ("%Rrc\n", VBOXSTRICTRC_VAL(rc))); /* ASSUMES no complicated stuff here. */
1001	else if (rc == VERR_EM_INTERPRETER)
1002	{
1003	LogFlow(("pgmPoolAccessPfHandlerPTWorker: Interpretation failed for %04x:%RGv - opcode=%d\n",
1004	pRegFrame->cs.Sel, (RTGCPTR)pRegFrame->rip, pDis->pCurInstr->uOpcode));
1005	rc = VINF_EM_RAW_EMULATE_INSTR;
1006	STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,EmulateInstr));
1007	}
1008
1009	#if 0 /* experimental code */
1010	if (rc == VINF_SUCCESS)
1011	{
1012	switch (pPage->enmKind)
1013	{
1014	case PGMPOOLKIND_PAE_PT_FOR_PAE_PT:
1015	{
1016	X86PTEPAE GstPte;
1017	int rc = pgmPoolPhysSimpleReadGCPhys(pVM, &GstPte, pvFault, GCPhysFault, sizeof(GstPte));
1018	AssertRC(rc);
1019
1020	/* Check the new value written by the guest. If present and with a bogus physical address, then
1021	* it's fairly safe to assume the guest is reusing the PT.
1022	*/
1023	if (GstPte.n.u1Present)
1024	{
1025	RTHCPHYS HCPhys = -1;
1026	int rc = PGMPhysGCPhys2HCPhys(pVM, GstPte.u & X86_PTE_PAE_PG_MASK, &HCPhys);
1027	if (rc != VINF_SUCCESS)
1028	{
1029	*pfReused = true;
1030	STAM_COUNTER_INC(&pPool->StatForceFlushReused);
1031	}
1032	}
1033	break;
1034	}
1035	}
1036	}
1037	#endif
1038
1039	LogFlow(("pgmPoolAccessPfHandlerSimple: returns %Rrc\n", VBOXSTRICTRC_VAL(rc)));
1040	return VBOXSTRICTRC_VAL(rc);
1041	}
1042
1043
1044	/**
1045	* @callback_method_impl{FNPGMRZPHYSPFHANDLER,
1046	* \#PF access handler callback for page table pages.}
1047	*
1048	* @remarks The @a pvUser argument points to the PGMPOOLPAGE.
1049	*/
1050	DECLEXPORT(VBOXSTRICTRC) pgmPoolAccessPfHandler(PVM pVM, PVMCPU pVCpu, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame,
1051	RTGCPTR pvFault, RTGCPHYS GCPhysFault, void *pvUser)
1052	{
1053	STAM_PROFILE_START(&pVM->pgm.s.CTX_SUFF(pPool)->CTX_SUFF_Z(StatMonitor), a);
1054	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
1055	PPGMPOOLPAGE pPage = (PPGMPOOLPAGE)pvUser;
1056	unsigned cMaxModifications;
1057	bool fForcedFlush = false;
1058	NOREF(uErrorCode);
1059
1060	LogFlow(("pgmPoolAccessPfHandler: pvFault=%RGv pPage=%p:{.idx=%d} GCPhysFault=%RGp\n", pvFault, pPage, pPage->idx, GCPhysFault));
1061
1062	pgmLock(pVM);
1063	if (PHYS_PAGE_ADDRESS(GCPhysFault) != PHYS_PAGE_ADDRESS(pPage->GCPhys))
1064	{
1065	/* Pool page changed while we were waiting for the lock; ignore. */
1066	Log(("CPU%d: pgmPoolAccessPfHandler pgm pool page for %RGp changed (to %RGp) while waiting!\n", pVCpu->idCpu, PHYS_PAGE_ADDRESS(GCPhysFault), PHYS_PAGE_ADDRESS(pPage->GCPhys)));
1067	STAM_PROFILE_STOP_EX(&pVM->pgm.s.CTX_SUFF(pPool)->CTX_SUFF_Z(StatMonitor), &pPool->CTX_MID_Z(StatMonitor,Handled), a);
1068	pgmUnlock(pVM);
1069	return VINF_SUCCESS;
1070	}
1071	#ifdef PGMPOOL_WITH_OPTIMIZED_DIRTY_PT
1072	if (pPage->fDirty)
1073	{
1074	Assert(VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_TLB_FLUSH));
1075	pgmUnlock(pVM);
1076	return VINF_SUCCESS; /* SMP guest case where we were blocking on the pgm lock while the same page was being marked dirty. */
1077	}
1078	#endif
1079
1080	#if 0 /* test code defined(VBOX_STRICT) && defined(PGMPOOL_WITH_OPTIMIZED_DIRTY_PT) */
1081	if (pPage->enmKind == PGMPOOLKIND_PAE_PT_FOR_PAE_PT)
1082	{
1083	void *pvShw = PGMPOOL_PAGE_2_PTR(pPool->CTX_SUFF(pVM), pPage);
1084	void *pvGst;
1085	int rc = PGM_GCPHYS_2_PTR(pPool->CTX_SUFF(pVM), pPage->GCPhys, &pvGst); AssertReleaseRC(rc);
1086	pgmPoolTrackCheckPTPaePae(pPool, pPage, (PPGMSHWPTPAE)pvShw, (PCX86PTPAE)pvGst);
1087	PGM_DYNMAP_UNUSED_HINT_VM(pVM, pvGst);
1088	PGM_DYNMAP_UNUSED_HINT_VM(pVM, pvShw);
1089	}
1090	#endif
1091
1092	/*
1093	* Disassemble the faulting instruction.
1094	*/
1095	PDISCPUSTATE pDis = &pVCpu->pgm.s.DisState;
1096	int rc = EMInterpretDisasCurrent(pVM, pVCpu, pDis, NULL);
1097	if (RT_UNLIKELY(rc != VINF_SUCCESS))
1098	{
1099	AssertMsg(rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT, ("Unexpected rc %d\n", rc));
1100	pgmUnlock(pVM);
1101	return rc;
1102	}
1103
1104	Assert(pPage->enmKind != PGMPOOLKIND_FREE);
1105
1106	/*
1107	* We should ALWAYS have the list head as user parameter. This
1108	* is because we use that page to record the changes.
1109	*/
1110	Assert(pPage->iMonitoredPrev == NIL_PGMPOOL_IDX);
1111
1112	#ifdef IN_RING0
1113	/* Maximum nr of modifications depends on the page type. */
1114	if ( pPage->enmKind == PGMPOOLKIND_PAE_PT_FOR_PAE_PT
1115	\|\| pPage->enmKind == PGMPOOLKIND_PAE_PT_FOR_32BIT_PT)
1116	cMaxModifications = 4;
1117	else
1118	cMaxModifications = 24;
1119	#else
1120	cMaxModifications = 48;
1121	#endif
1122
1123	/*
1124	* Incremental page table updates should weigh more than random ones.
1125	* (Only applies when started from offset 0)
1126	*/
1127	pVCpu->pgm.s.cPoolAccessHandler++;
1128	if ( pPage->GCPtrLastAccessHandlerRip >= pRegFrame->rip - 0x40 /* observed loops in Windows 7 x64 */
1129	&& pPage->GCPtrLastAccessHandlerRip < pRegFrame->rip + 0x40
1130	&& pvFault == (pPage->GCPtrLastAccessHandlerFault + pDis->Param1.cb)
1131	&& pVCpu->pgm.s.cPoolAccessHandler == pPage->cLastAccessHandler + 1)
1132	{
1133	Log(("Possible page reuse cMods=%d -> %d (locked=%d type=%s)\n", pPage->cModifications, pPage->cModifications * 2, pgmPoolIsPageLocked(pPage), pgmPoolPoolKindToStr(pPage->enmKind)));
1134	Assert(pPage->cModifications < 32000);
1135	pPage->cModifications = pPage->cModifications * 2;
1136	pPage->GCPtrLastAccessHandlerFault = pvFault;
1137	pPage->cLastAccessHandler = pVCpu->pgm.s.cPoolAccessHandler;
1138	if (pPage->cModifications >= cMaxModifications)
1139	{
1140	STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FlushReinit));
1141	fForcedFlush = true;
1142	}
1143	}
1144
1145	if (pPage->cModifications >= cMaxModifications)
1146	Log(("Mod overflow %RGv cMods=%d (locked=%d type=%s)\n", pvFault, pPage->cModifications, pgmPoolIsPageLocked(pPage), pgmPoolPoolKindToStr(pPage->enmKind)));
1147
1148	/*
1149	* Check if it's worth dealing with.
1150	*/
1151	bool fReused = false;
1152	bool fNotReusedNotForking = false;
1153	if ( ( pPage->cModifications < cMaxModifications /** @todo \#define / /* @todo need to check that it's not mapping EIP. / /* @todo adjust this! */
1154	\|\| pgmPoolIsPageLocked(pPage)
1155	)
1156	&& !(fReused = pgmPoolMonitorIsReused(pVM, pVCpu, pRegFrame, pDis, pvFault))
1157	&& !pgmPoolMonitorIsForking(pPool, pDis, GCPhysFault & PAGE_OFFSET_MASK))
1158	{
1159	/*
1160	* Simple instructions, no REP prefix.
1161	*/
1162	if (!(pDis->fPrefix & (DISPREFIX_REP \| DISPREFIX_REPNE)))
1163	{
1164	rc = pgmPoolAccessPfHandlerSimple(pVM, pVCpu, pPool, pPage, pDis, pRegFrame, GCPhysFault, pvFault, &fReused);
1165	if (fReused)
1166	goto flushPage;
1167
1168	/* A mov instruction to change the first page table entry will be remembered so we can detect
1169	* full page table changes early on. This will reduce the amount of unnecessary traps we'll take.
1170	*/
1171	if ( rc == VINF_SUCCESS
1172	&& !pPage->cLocked /* only applies to unlocked pages as we can't free locked ones (e.g. cr3 root). */
1173	&& pDis->pCurInstr->uOpcode == OP_MOV
1174	&& (pvFault & PAGE_OFFSET_MASK) == 0)
1175	{
1176	pPage->GCPtrLastAccessHandlerFault = pvFault;
1177	pPage->cLastAccessHandler = pVCpu->pgm.s.cPoolAccessHandler;
1178	pPage->GCPtrLastAccessHandlerRip = pRegFrame->rip;
1179	/* Make sure we don't kick out a page too quickly. */
1180	if (pPage->cModifications > 8)
1181	pPage->cModifications = 2;
1182	}
1183	else if (pPage->GCPtrLastAccessHandlerFault == pvFault)
1184	{
1185	/* ignore the 2nd write to this page table entry. */
1186	pPage->cLastAccessHandler = pVCpu->pgm.s.cPoolAccessHandler;
1187	}
1188	else
1189	{
1190	pPage->GCPtrLastAccessHandlerFault = NIL_RTGCPTR;
1191	pPage->GCPtrLastAccessHandlerRip = 0;
1192	}
1193
1194	STAM_PROFILE_STOP_EX(&pVM->pgm.s.CTX_SUFF(pPool)->CTX_SUFF_Z(StatMonitor), &pPool->CTX_MID_Z(StatMonitor,Handled), a);
1195	pgmUnlock(pVM);
1196	return rc;
1197	}
1198
1199	/*
1200	* Windows is frequently doing small memset() operations (netio test 4k+).
1201	* We have to deal with these or we'll kill the cache and performance.
1202	*/
1203	if ( pDis->pCurInstr->uOpcode == OP_STOSWD
1204	&& !pRegFrame->eflags.Bits.u1DF
1205	&& pDis->uOpMode == pDis->uCpuMode
1206	&& pDis->uAddrMode == pDis->uCpuMode)
1207	{
1208	bool fValidStosd = false;
1209
1210	if ( pDis->uCpuMode == DISCPUMODE_32BIT
1211	&& pDis->fPrefix == DISPREFIX_REP
1212	&& pRegFrame->ecx <= 0x20
1213	&& pRegFrame->ecx * 4 <= PAGE_SIZE - ((uintptr_t)pvFault & PAGE_OFFSET_MASK)
1214	&& !((uintptr_t)pvFault & 3)
1215	&& (pRegFrame->eax == 0 \|\| pRegFrame->eax == 0x80) /* the two values observed. */
1216	)
1217	{
1218	fValidStosd = true;
1219	pRegFrame->rcx &= 0xffffffff; /* paranoia */
1220	}
1221	else
1222	if ( pDis->uCpuMode == DISCPUMODE_64BIT
1223	&& pDis->fPrefix == (DISPREFIX_REP \| DISPREFIX_REX)
1224	&& pRegFrame->rcx <= 0x20
1225	&& pRegFrame->rcx * 8 <= PAGE_SIZE - ((uintptr_t)pvFault & PAGE_OFFSET_MASK)
1226	&& !((uintptr_t)pvFault & 7)
1227	&& (pRegFrame->rax == 0 \|\| pRegFrame->rax == 0x80) /* the two values observed. */
1228	)
1229	{
1230	fValidStosd = true;
1231	}
1232
1233	if (fValidStosd)
1234	{
1235	rc = pgmPoolAccessPfHandlerSTOSD(pVM, pPool, pPage, pDis, pRegFrame, GCPhysFault, pvFault);
1236	STAM_PROFILE_STOP_EX(&pVM->pgm.s.CTX_SUFF(pPool)->CTX_SUFF_Z(StatMonitor), &pPool->CTX_MID_Z(StatMonitor,RepStosd), a);
1237	pgmUnlock(pVM);
1238	return rc;
1239	}
1240	}
1241
1242	/* REP prefix, don't bother. */
1243	STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,RepPrefix));
1244	Log4(("pgmPoolAccessPfHandler: eax=%#x ecx=%#x edi=%#x esi=%#x rip=%RGv opcode=%d prefix=%#x\n",
1245	pRegFrame->eax, pRegFrame->ecx, pRegFrame->edi, pRegFrame->esi, (RTGCPTR)pRegFrame->rip, pDis->pCurInstr->uOpcode, pDis->fPrefix));
1246	fNotReusedNotForking = true;
1247	}
1248
1249	#if defined(PGMPOOL_WITH_OPTIMIZED_DIRTY_PT) && defined(IN_RING0)
1250	/* E.g. Windows 7 x64 initializes page tables and touches some pages in the table during the process. This
1251	* leads to pgm pool trashing and an excessive amount of write faults due to page monitoring.
1252	*/
1253	if ( pPage->cModifications >= cMaxModifications
1254	&& !fForcedFlush
1255	&& (pPage->enmKind == PGMPOOLKIND_PAE_PT_FOR_PAE_PT \|\| pPage->enmKind == PGMPOOLKIND_PAE_PT_FOR_32BIT_PT)
1256	&& ( fNotReusedNotForking
1257	\|\| ( !pgmPoolMonitorIsReused(pVM, pVCpu, pRegFrame, pDis, pvFault)
1258	&& !pgmPoolMonitorIsForking(pPool, pDis, GCPhysFault & PAGE_OFFSET_MASK))
1259	)
1260	)
1261	{
1262	Assert(!pgmPoolIsPageLocked(pPage));
1263	Assert(pPage->fDirty == false);
1264
1265	/* Flush any monitored duplicates as we will disable write protection. */
1266	if ( pPage->iMonitoredNext != NIL_PGMPOOL_IDX
1267	\|\| pPage->iMonitoredPrev != NIL_PGMPOOL_IDX)
1268	{
1269	PPGMPOOLPAGE pPageHead = pPage;
1270
1271	/* Find the monitor head. */
1272	while (pPageHead->iMonitoredPrev != NIL_PGMPOOL_IDX)
1273	pPageHead = &pPool->aPages[pPageHead->iMonitoredPrev];
1274
1275	while (pPageHead)
1276	{
1277	unsigned idxNext = pPageHead->iMonitoredNext;
1278
1279	if (pPageHead != pPage)
1280	{
1281	STAM_COUNTER_INC(&pPool->StatDirtyPageDupFlush);
1282	Log(("Flush duplicate page idx=%d GCPhys=%RGp type=%s\n", pPageHead->idx, pPageHead->GCPhys, pgmPoolPoolKindToStr(pPageHead->enmKind)));
1283	int rc2 = pgmPoolFlushPage(pPool, pPageHead);
1284	AssertRC(rc2);
1285	}
1286
1287	if (idxNext == NIL_PGMPOOL_IDX)
1288	break;
1289
1290	pPageHead = &pPool->aPages[idxNext];
1291	}
1292	}
1293
1294	/* The flushing above might fail for locked pages, so double check. */
1295	if ( pPage->iMonitoredNext == NIL_PGMPOOL_IDX
1296	&& pPage->iMonitoredPrev == NIL_PGMPOOL_IDX)
1297	{
1298	pgmPoolAddDirtyPage(pVM, pPool, pPage);
1299
1300	/* Temporarily allow write access to the page table again. */
1301	rc = PGMHandlerPhysicalPageTempOff(pVM, pPage->GCPhys & PAGE_BASE_GC_MASK, pPage->GCPhys & PAGE_BASE_GC_MASK);
1302	if (rc == VINF_SUCCESS)
1303	{
1304	rc = PGMShwMakePageWritable(pVCpu, pvFault, PGM_MK_PG_IS_WRITE_FAULT);
1305	AssertMsg(rc == VINF_SUCCESS
1306	/* In the SMP case the page table might be removed while we wait for the PGM lock in the trap handler. */
1307	\|\| rc == VERR_PAGE_TABLE_NOT_PRESENT
1308	\|\| rc == VERR_PAGE_NOT_PRESENT,
1309	("PGMShwModifyPage -> GCPtr=%RGv rc=%d\n", pvFault, rc));
1310	# ifdef VBOX_STRICT
1311	pPage->GCPtrDirtyFault = pvFault;
1312	# endif
1313
1314	STAM_PROFILE_STOP(&pVM->pgm.s.CTX_SUFF(pPool)->CTX_SUFF_Z(StatMonitor), a);
1315	pgmUnlock(pVM);
1316	return rc;
1317	}
1318	}
1319	}
1320	#endif /* PGMPOOL_WITH_OPTIMIZED_DIRTY_PT */
1321
1322	STAM_COUNTER_INC(&pPool->CTX_MID_Z(StatMonitor,FlushModOverflow));
1323	flushPage:
1324	/*
1325	* Not worth it, so flush it.
1326	*
1327	* If we considered it to be reused, don't go back to ring-3
1328	* to emulate failed instructions since we usually cannot
1329	* interpret then. This may be a bit risky, in which case
1330	* the reuse detection must be fixed.
1331	*/
1332	rc = pgmPoolAccessPfHandlerFlush(pVM, pVCpu, pPool, pPage, pDis, pRegFrame, GCPhysFault, pvFault);
1333	if ( rc == VINF_EM_RAW_EMULATE_INSTR
1334	&& fReused)
1335	{
1336	/* Make sure that the current instruction still has shadow page backing, otherwise we'll end up in a loop. */
1337	if (PGMShwGetPage(pVCpu, pRegFrame->rip, NULL, NULL) == VINF_SUCCESS)
1338	rc = VINF_SUCCESS; /* safe to restart the instruction. */
1339	}
1340	STAM_PROFILE_STOP_EX(&pVM->pgm.s.CTX_SUFF(pPool)->CTX_SUFF_Z(StatMonitor), &pPool->CTX_MID_Z(StatMonitor,FlushPage), a);
1341	pgmUnlock(pVM);
1342	return rc;
1343	}
1344
1345	# endif /* !IN_RING3 */
1346
1347	/**
1348	* @callback_method_impl{FNPGMPHYSHANDLER,
1349	* Access handler for shadowed page table pages.}
1350	*
1351	* @remarks Only uses the VINF_PGM_HANDLER_DO_DEFAULT status.
1352	*/
1353	PGM_ALL_CB2_DECL(VBOXSTRICTRC)
1354	pgmPoolAccessHandler(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys, void pvPhys, void pvBuf, size_t cbBuf,
1355	PGMACCESSTYPE enmAccessType, PGMACCESSORIGIN enmOrigin, void *pvUser)
1356	{
1357	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
1358	STAM_PROFILE_START(&pPool->StatMonitorR3, a);
1359	PPGMPOOLPAGE pPage = (PPGMPOOLPAGE)pvUser;
1360	LogFlow(("PGM_ALL_CB_DECL: GCPhys=%RGp %p:{.Core=%RHp, .idx=%d, .GCPhys=%RGp, .enmType=%d}\n",
1361	GCPhys, pPage, pPage->Core.Key, pPage->idx, pPage->GCPhys, pPage->enmKind));
1362
1363	NOREF(pvPhys); NOREF(pvBuf); NOREF(enmAccessType);
1364
1365	/*
1366	* Make sure the pool page wasn't modified by a different CPU.
1367	*/
1368	pgmLock(pVM);
1369	if (PHYS_PAGE_ADDRESS(GCPhys) == PHYS_PAGE_ADDRESS(pPage->GCPhys))
1370	{
1371	Assert(pPage->enmKind != PGMPOOLKIND_FREE);
1372
1373	/* The max modification count before flushing depends on the context and page type. */
1374	#ifdef IN_RING3
1375	uint16_t const cMaxModifications = 96; /* it's cheaper here, right? */
1376	#else
1377	uint16_t cMaxModifications;
1378	if ( pPage->enmKind == PGMPOOLKIND_PAE_PT_FOR_PAE_PT
1379	\|\| pPage->enmKind == PGMPOOLKIND_PAE_PT_FOR_32BIT_PT)
1380	cMaxModifications = 4;
1381	else
1382	cMaxModifications = 24;
1383	# ifdef IN_RC
1384	cMaxModifications = 2; / traps are cheaper than exists. */
1385	# endif
1386	#endif
1387
1388	/*
1389	* We don't have to be very sophisticated about this since there are relativly few calls here.
1390	* However, we must try our best to detect any non-cpu accesses (disk / networking).
1391	*/
1392	if ( ( pPage->cModifications < cMaxModifications
1393	\|\| pgmPoolIsPageLocked(pPage) )
1394	&& enmOrigin != PGMACCESSORIGIN_DEVICE
1395	&& cbBuf <= 16)
1396	{
1397	/* Clear the shadow entry. */
1398	if (!pPage->cModifications++)
1399	pgmPoolMonitorModifiedInsert(pPool, pPage);
1400
1401	if (cbBuf <= 8)
1402	pgmPoolMonitorChainChanging(pVCpu, pPool, pPage, GCPhys, pvBuf, (uint32_t)cbBuf);
1403	else
1404	{
1405	pgmPoolMonitorChainChanging(pVCpu, pPool, pPage, GCPhys, pvBuf, 8);
1406	pgmPoolMonitorChainChanging(pVCpu, pPool, pPage, GCPhys + 8, (uint8_t *)pvBuf + 8, (uint32_t)cbBuf - 8);
1407	}
1408	}
1409	else
1410	{
1411	/* ASSUME that VERR_PGM_POOL_CLEARED can be ignored here and that FFs will deal with it in due time. */
1412	pgmPoolMonitorChainFlush(pPool, pPage);
1413	}
1414
1415	STAM_PROFILE_STOP_EX(&pPool->StatMonitorR3, &pPool->StatMonitorR3FlushPage, a);
1416	}
1417	else
1418	Log(("CPU%d: PGM_ALL_CB_DECL pgm pool page for %RGp changed (to %RGp) while waiting!\n", pVCpu->idCpu, PHYS_PAGE_ADDRESS(GCPhys), PHYS_PAGE_ADDRESS(pPage->GCPhys)));
1419	pgmUnlock(pVM);
1420	return VINF_PGM_HANDLER_DO_DEFAULT;
1421	}
1422
1423
1424	# ifdef PGMPOOL_WITH_OPTIMIZED_DIRTY_PT
1425
1426	# if defined(VBOX_STRICT) && !defined(IN_RING3)
1427
1428	/**
1429	* Check references to guest physical memory in a PAE / PAE page table.
1430	*
1431	* @param pPool The pool.
1432	* @param pPage The page.
1433	* @param pShwPT The shadow page table (mapping of the page).
1434	* @param pGstPT The guest page table.
1435	*/
1436	static void pgmPoolTrackCheckPTPaePae(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PPGMSHWPTPAE pShwPT, PCX86PTPAE pGstPT)
1437	{
1438	unsigned cErrors = 0;
1439	int LastRc = -1; /* initialized to shut up gcc */
1440	unsigned LastPTE = ~0U; /* initialized to shut up gcc */
1441	RTHCPHYS LastHCPhys = NIL_RTHCPHYS; /* initialized to shut up gcc */
1442	PVM pVM = pPool->CTX_SUFF(pVM);
1443
1444	#ifdef VBOX_STRICT
1445	for (unsigned i = 0; i < RT_MIN(RT_ELEMENTS(pShwPT->a), pPage->iFirstPresent); i++)
1446	AssertMsg(!PGMSHWPTEPAE_IS_P(pShwPT->a[i]), ("Unexpected PTE: idx=%d %RX64 (first=%d)\n", i, PGMSHWPTEPAE_GET_LOG(pShwPT->a[i]), pPage->iFirstPresent));
1447	#endif
1448	for (unsigned i = pPage->iFirstPresent; i < RT_ELEMENTS(pShwPT->a); i++)
1449	{
1450	if (PGMSHWPTEPAE_IS_P(pShwPT->a[i]))
1451	{
1452	RTHCPHYS HCPhys = NIL_RTHCPHYS;
1453	int rc = PGMPhysGCPhys2HCPhys(pVM, pGstPT->a[i].u & X86_PTE_PAE_PG_MASK, &HCPhys);
1454	if ( rc != VINF_SUCCESS
1455	\|\| PGMSHWPTEPAE_GET_HCPHYS(pShwPT->a[i]) != HCPhys)
1456	{
1457	Log(("rc=%d idx=%d guest %RX64 shw=%RX64 vs %RHp\n", rc, i, pGstPT->a[i].u, PGMSHWPTEPAE_GET_LOG(pShwPT->a[i]), HCPhys));
1458	LastPTE = i;
1459	LastRc = rc;
1460	LastHCPhys = HCPhys;
1461	cErrors++;
1462
1463	RTHCPHYS HCPhysPT = NIL_RTHCPHYS;
1464	rc = PGMPhysGCPhys2HCPhys(pVM, pPage->GCPhys, &HCPhysPT);
1465	AssertRC(rc);
1466
1467	for (unsigned iPage = 0; iPage < pPool->cCurPages; iPage++)
1468	{
1469	PPGMPOOLPAGE pTempPage = &pPool->aPages[iPage];
1470
1471	if (pTempPage->enmKind == PGMPOOLKIND_PAE_PT_FOR_PAE_PT)
1472	{
1473	PPGMSHWPTPAE pShwPT2 = (PPGMSHWPTPAE)PGMPOOL_PAGE_2_PTR(pVM, pTempPage);
1474
1475	for (unsigned j = 0; j < RT_ELEMENTS(pShwPT->a); j++)
1476	{
1477	if ( PGMSHWPTEPAE_IS_P_RW(pShwPT2->a[j])
1478	&& PGMSHWPTEPAE_GET_HCPHYS(pShwPT2->a[j]) == HCPhysPT)
1479	{
1480	Log(("GCPhys=%RGp idx=%d %RX64 vs %RX64\n", pTempPage->GCPhys, j, PGMSHWPTEPAE_GET_LOG(pShwPT->a[j]), PGMSHWPTEPAE_GET_LOG(pShwPT2->a[j])));
1481	}
1482	}
1483
1484	PGM_DYNMAP_UNUSED_HINT_VM(pVM, pShwPT2);
1485	}
1486	}
1487	}
1488	}
1489	}
1490	AssertMsg(!cErrors, ("cErrors=%d: last rc=%d idx=%d guest %RX64 shw=%RX64 vs %RHp\n", cErrors, LastRc, LastPTE, pGstPT->a[LastPTE].u, PGMSHWPTEPAE_GET_LOG(pShwPT->a[LastPTE]), LastHCPhys));
1491	}
1492
1493
1494	/**
1495	* Check references to guest physical memory in a PAE / 32-bit page table.
1496	*
1497	* @param pPool The pool.
1498	* @param pPage The page.
1499	* @param pShwPT The shadow page table (mapping of the page).
1500	* @param pGstPT The guest page table.
1501	*/
1502	static void pgmPoolTrackCheckPTPae32Bit(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PPGMSHWPTPAE pShwPT, PCX86PT pGstPT)
1503	{
1504	unsigned cErrors = 0;
1505	int LastRc = -1; /* initialized to shut up gcc */
1506	unsigned LastPTE = ~0U; /* initialized to shut up gcc */
1507	RTHCPHYS LastHCPhys = NIL_RTHCPHYS; /* initialized to shut up gcc */
1508	PVM pVM = pPool->CTX_SUFF(pVM);
1509
1510	#ifdef VBOX_STRICT
1511	for (unsigned i = 0; i < RT_MIN(RT_ELEMENTS(pShwPT->a), pPage->iFirstPresent); i++)
1512	AssertMsg(!PGMSHWPTEPAE_IS_P(pShwPT->a[i]), ("Unexpected PTE: idx=%d %RX64 (first=%d)\n", i, PGMSHWPTEPAE_GET_LOG(pShwPT->a[i]), pPage->iFirstPresent));
1513	#endif
1514	for (unsigned i = pPage->iFirstPresent; i < RT_ELEMENTS(pShwPT->a); i++)
1515	{
1516	if (PGMSHWPTEPAE_IS_P(pShwPT->a[i]))
1517	{
1518	RTHCPHYS HCPhys = NIL_RTHCPHYS;
1519	int rc = PGMPhysGCPhys2HCPhys(pVM, pGstPT->a[i].u & X86_PTE_PG_MASK, &HCPhys);
1520	if ( rc != VINF_SUCCESS
1521	\|\| PGMSHWPTEPAE_GET_HCPHYS(pShwPT->a[i]) != HCPhys)
1522	{
1523	Log(("rc=%d idx=%d guest %x shw=%RX64 vs %RHp\n", rc, i, pGstPT->a[i].u, PGMSHWPTEPAE_GET_LOG(pShwPT->a[i]), HCPhys));
1524	LastPTE = i;
1525	LastRc = rc;
1526	LastHCPhys = HCPhys;
1527	cErrors++;
1528
1529	RTHCPHYS HCPhysPT = NIL_RTHCPHYS;
1530	rc = PGMPhysGCPhys2HCPhys(pVM, pPage->GCPhys, &HCPhysPT);
1531	AssertRC(rc);
1532
1533	for (unsigned iPage = 0; iPage < pPool->cCurPages; iPage++)
1534	{
1535	PPGMPOOLPAGE pTempPage = &pPool->aPages[iPage];
1536
1537	if (pTempPage->enmKind == PGMPOOLKIND_PAE_PT_FOR_32BIT_PT)
1538	{
1539	PPGMSHWPTPAE pShwPT2 = (PPGMSHWPTPAE)PGMPOOL_PAGE_2_PTR(pVM, pTempPage);
1540
1541	for (unsigned j = 0; j < RT_ELEMENTS(pShwPT->a); j++)
1542	{
1543	if ( PGMSHWPTEPAE_IS_P_RW(pShwPT2->a[j])
1544	&& PGMSHWPTEPAE_GET_HCPHYS(pShwPT2->a[j]) == HCPhysPT)
1545	{
1546	Log(("GCPhys=%RGp idx=%d %RX64 vs %RX64\n", pTempPage->GCPhys, j, PGMSHWPTEPAE_GET_LOG(pShwPT->a[j]), PGMSHWPTEPAE_GET_LOG(pShwPT2->a[j])));
1547	}
1548	}
1549
1550	PGM_DYNMAP_UNUSED_HINT_VM(pVM, pShwPT2);
1551	}
1552	}
1553	}
1554	}
1555	}
1556	AssertMsg(!cErrors, ("cErrors=%d: last rc=%d idx=%d guest %x shw=%RX64 vs %RHp\n", cErrors, LastRc, LastPTE, pGstPT->a[LastPTE].u, PGMSHWPTEPAE_GET_LOG(pShwPT->a[LastPTE]), LastHCPhys));
1557	}
1558
1559	# endif /* VBOX_STRICT && !IN_RING3 */
1560
1561	/**
1562	* Clear references to guest physical memory in a PAE / PAE page table.
1563	*
1564	* @returns nr of changed PTEs
1565	* @param pPool The pool.
1566	* @param pPage The page.
1567	* @param pShwPT The shadow page table (mapping of the page).
1568	* @param pGstPT The guest page table.
1569	* @param pOldGstPT The old cached guest page table.
1570	* @param fAllowRemoval Bail out as soon as we encounter an invalid PTE
1571	* @param pfFlush Flush reused page table (out)
1572	*/
1573	DECLINLINE(unsigned) pgmPoolTrackFlushPTPaePae(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PPGMSHWPTPAE pShwPT, PCX86PTPAE pGstPT,
1574	PCX86PTPAE pOldGstPT, bool fAllowRemoval, bool *pfFlush)
1575	{
1576	unsigned cChanged = 0;
1577
1578	#ifdef VBOX_STRICT
1579	for (unsigned i = 0; i < RT_MIN(RT_ELEMENTS(pShwPT->a), pPage->iFirstPresent); i++)
1580	AssertMsg(!PGMSHWPTEPAE_IS_P(pShwPT->a[i]), ("Unexpected PTE: idx=%d %RX64 (first=%d)\n", i, PGMSHWPTEPAE_GET_LOG(pShwPT->a[i]), pPage->iFirstPresent));
1581	#endif
1582	*pfFlush = false;
1583
1584	for (unsigned i = pPage->iFirstPresent; i < RT_ELEMENTS(pShwPT->a); i++)
1585	{
1586	/* Check the new value written by the guest. If present and with a bogus physical address, then
1587	* it's fairly safe to assume the guest is reusing the PT.
1588	*/
1589	if ( fAllowRemoval
1590	&& pGstPT->a[i].n.u1Present)
1591	{
1592	if (!PGMPhysIsGCPhysValid(pPool->CTX_SUFF(pVM), pGstPT->a[i].u & X86_PTE_PAE_PG_MASK))
1593	{
1594	*pfFlush = true;
1595	return ++cChanged;
1596	}
1597	}
1598	if (PGMSHWPTEPAE_IS_P(pShwPT->a[i]))
1599	{
1600	/* If the old cached PTE is identical, then there's no need to flush the shadow copy. */
1601	if ((pGstPT->a[i].u & X86_PTE_PAE_PG_MASK) == (pOldGstPT->a[i].u & X86_PTE_PAE_PG_MASK))
1602	{
1603	#ifdef VBOX_STRICT
1604	RTHCPHYS HCPhys = NIL_RTGCPHYS;
1605	int rc = PGMPhysGCPhys2HCPhys(pPool->CTX_SUFF(pVM), pGstPT->a[i].u & X86_PTE_PAE_PG_MASK, &HCPhys);
1606	AssertMsg(rc == VINF_SUCCESS && PGMSHWPTEPAE_GET_HCPHYS(pShwPT->a[i]) == HCPhys, ("rc=%d guest %RX64 old %RX64 shw=%RX64 vs %RHp\n", rc, pGstPT->a[i].u, pOldGstPT->a[i].u, PGMSHWPTEPAE_GET_LOG(pShwPT->a[i]), HCPhys));
1607	#endif
1608	uint64_t uHostAttr = PGMSHWPTEPAE_GET_U(pShwPT->a[i]) & (X86_PTE_P \| X86_PTE_US \| X86_PTE_A \| X86_PTE_D \| X86_PTE_G \| X86_PTE_PAE_NX);
1609	bool fHostRW = !!(PGMSHWPTEPAE_GET_U(pShwPT->a[i]) & X86_PTE_RW);
1610	uint64_t uGuestAttr = pGstPT->a[i].u & (X86_PTE_P \| X86_PTE_US \| X86_PTE_A \| X86_PTE_D \| X86_PTE_G \| X86_PTE_PAE_NX);
1611	bool fGuestRW = !!(pGstPT->a[i].u & X86_PTE_RW);
1612
1613	if ( uHostAttr == uGuestAttr
1614	&& fHostRW <= fGuestRW)
1615	continue;
1616	}
1617	cChanged++;
1618	/* Something was changed, so flush it. */
1619	Log4(("pgmPoolTrackDerefPTPaePae: i=%d pte=%RX64 hint=%RX64\n",
1620	i, PGMSHWPTEPAE_GET_HCPHYS(pShwPT->a[i]), pOldGstPT->a[i].u & X86_PTE_PAE_PG_MASK));
1621	pgmPoolTracDerefGCPhysHint(pPool, pPage, PGMSHWPTEPAE_GET_HCPHYS(pShwPT->a[i]), pOldGstPT->a[i].u & X86_PTE_PAE_PG_MASK, i);
1622	PGMSHWPTEPAE_ATOMIC_SET(pShwPT->a[i], 0);
1623	}
1624	}
1625	return cChanged;
1626	}
1627
1628
1629	/**
1630	* Clear references to guest physical memory in a PAE / PAE page table.
1631	*
1632	* @returns nr of changed PTEs
1633	* @param pPool The pool.
1634	* @param pPage The page.
1635	* @param pShwPT The shadow page table (mapping of the page).
1636	* @param pGstPT The guest page table.
1637	* @param pOldGstPT The old cached guest page table.
1638	* @param fAllowRemoval Bail out as soon as we encounter an invalid PTE
1639	* @param pfFlush Flush reused page table (out)
1640	*/
1641	DECLINLINE(unsigned) pgmPoolTrackFlushPTPae32Bit(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PPGMSHWPTPAE pShwPT, PCX86PT pGstPT,
1642	PCX86PT pOldGstPT, bool fAllowRemoval, bool *pfFlush)
1643	{
1644	unsigned cChanged = 0;
1645
1646	#ifdef VBOX_STRICT
1647	for (unsigned i = 0; i < RT_MIN(RT_ELEMENTS(pShwPT->a), pPage->iFirstPresent); i++)
1648	AssertMsg(!PGMSHWPTEPAE_IS_P(pShwPT->a[i]), ("Unexpected PTE: idx=%d %RX64 (first=%d)\n", i, PGMSHWPTEPAE_GET_LOG(pShwPT->a[i]), pPage->iFirstPresent));
1649	#endif
1650	*pfFlush = false;
1651
1652	for (unsigned i = pPage->iFirstPresent; i < RT_ELEMENTS(pShwPT->a); i++)
1653	{
1654	/* Check the new value written by the guest. If present and with a bogus physical address, then
1655	* it's fairly safe to assume the guest is reusing the PT.
1656	*/
1657	if ( fAllowRemoval
1658	&& pGstPT->a[i].n.u1Present)
1659	{
1660	if (!PGMPhysIsGCPhysValid(pPool->CTX_SUFF(pVM), pGstPT->a[i].u & X86_PTE_PG_MASK))
1661	{
1662	*pfFlush = true;
1663	return ++cChanged;
1664	}
1665	}
1666	if (PGMSHWPTEPAE_IS_P(pShwPT->a[i]))
1667	{
1668	/* If the old cached PTE is identical, then there's no need to flush the shadow copy. */
1669	if ((pGstPT->a[i].u & X86_PTE_PG_MASK) == (pOldGstPT->a[i].u & X86_PTE_PG_MASK))
1670	{
1671	#ifdef VBOX_STRICT
1672	RTHCPHYS HCPhys = NIL_RTGCPHYS;
1673	int rc = PGMPhysGCPhys2HCPhys(pPool->CTX_SUFF(pVM), pGstPT->a[i].u & X86_PTE_PG_MASK, &HCPhys);
1674	AssertMsg(rc == VINF_SUCCESS && PGMSHWPTEPAE_GET_HCPHYS(pShwPT->a[i]) == HCPhys, ("rc=%d guest %x old %x shw=%RX64 vs %RHp\n", rc, pGstPT->a[i].u, pOldGstPT->a[i].u, PGMSHWPTEPAE_GET_LOG(pShwPT->a[i]), HCPhys));
1675	#endif
1676	uint64_t uHostAttr = PGMSHWPTEPAE_GET_U(pShwPT->a[i]) & (X86_PTE_P \| X86_PTE_US \| X86_PTE_A \| X86_PTE_D \| X86_PTE_G);
1677	bool fHostRW = !!(PGMSHWPTEPAE_GET_U(pShwPT->a[i]) & X86_PTE_RW);
1678	uint64_t uGuestAttr = pGstPT->a[i].u & (X86_PTE_P \| X86_PTE_US \| X86_PTE_A \| X86_PTE_D \| X86_PTE_G);
1679	bool fGuestRW = !!(pGstPT->a[i].u & X86_PTE_RW);
1680
1681	if ( uHostAttr == uGuestAttr
1682	&& fHostRW <= fGuestRW)
1683	continue;
1684	}
1685	cChanged++;
1686	/* Something was changed, so flush it. */
1687	Log4(("pgmPoolTrackDerefPTPaePae: i=%d pte=%RX64 hint=%x\n",
1688	i, PGMSHWPTEPAE_GET_HCPHYS(pShwPT->a[i]), pOldGstPT->a[i].u & X86_PTE_PG_MASK));
1689	pgmPoolTracDerefGCPhysHint(pPool, pPage, PGMSHWPTEPAE_GET_HCPHYS(pShwPT->a[i]), pOldGstPT->a[i].u & X86_PTE_PG_MASK, i);
1690	PGMSHWPTEPAE_ATOMIC_SET(pShwPT->a[i], 0);
1691	}
1692	}
1693	return cChanged;
1694	}
1695
1696
1697	/**
1698	* Flush a dirty page
1699	*
1700	* @param pVM The cross context VM structure.
1701	* @param pPool The pool.
1702	* @param idxSlot Dirty array slot index
1703	* @param fAllowRemoval Allow a reused page table to be removed
1704	*/
1705	static void pgmPoolFlushDirtyPage(PVM pVM, PPGMPOOL pPool, unsigned idxSlot, bool fAllowRemoval = false)
1706	{
1707	PPGMPOOLPAGE pPage;
1708	unsigned idxPage;
1709
1710	Assert(idxSlot < RT_ELEMENTS(pPool->aDirtyPages));
1711	if (pPool->aDirtyPages[idxSlot].uIdx == NIL_PGMPOOL_IDX)
1712	return;
1713
1714	idxPage = pPool->aDirtyPages[idxSlot].uIdx;
1715	AssertRelease(idxPage != NIL_PGMPOOL_IDX);
1716	pPage = &pPool->aPages[idxPage];
1717	Assert(pPage->idx == idxPage);
1718	Assert(pPage->iMonitoredNext == NIL_PGMPOOL_IDX && pPage->iMonitoredPrev == NIL_PGMPOOL_IDX);
1719
1720	AssertMsg(pPage->fDirty, ("Page %RGp (slot=%d) not marked dirty!", pPage->GCPhys, idxSlot));
1721	Log(("Flush dirty page %RGp cMods=%d\n", pPage->GCPhys, pPage->cModifications));
1722
1723	#if defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0) \|\| defined(IN_RC)
1724	PVMCPU pVCpu = VMMGetCpu(pVM);
1725	uint32_t iPrevSubset = PGMRZDynMapPushAutoSubset(pVCpu);
1726	#endif
1727
1728	/* First write protect the page again to catch all write accesses. (before checking for changes -> SMP) */
1729	int rc = PGMHandlerPhysicalReset(pVM, pPage->GCPhys & PAGE_BASE_GC_MASK);
1730	Assert(rc == VINF_SUCCESS);
1731	pPage->fDirty = false;
1732
1733	#ifdef VBOX_STRICT
1734	uint64_t fFlags = 0;
1735	RTHCPHYS HCPhys;
1736	rc = PGMShwGetPage(VMMGetCpu(pVM), pPage->GCPtrDirtyFault, &fFlags, &HCPhys);
1737	AssertMsg( ( rc == VINF_SUCCESS
1738	&& (!(fFlags & X86_PTE_RW) \|\| HCPhys != pPage->Core.Key))
1739	/* In the SMP case the page table might be removed while we wait for the PGM lock in the trap handler. */
1740	\|\| rc == VERR_PAGE_TABLE_NOT_PRESENT
1741	\|\| rc == VERR_PAGE_NOT_PRESENT,
1742	("PGMShwGetPage -> GCPtr=%RGv rc=%d flags=%RX64\n", pPage->GCPtrDirtyFault, rc, fFlags));
1743	#endif
1744
1745	/* Flush those PTEs that have changed. */
1746	STAM_PROFILE_START(&pPool->StatTrackDeref,a);
1747	void *pvShw = PGMPOOL_PAGE_2_PTR(pVM, pPage);
1748	void *pvGst;
1749	rc = PGM_GCPHYS_2_PTR_EX(pVM, pPage->GCPhys, &pvGst); AssertReleaseRC(rc);
1750	bool fFlush;
1751	unsigned cChanges;
1752
1753	if (pPage->enmKind == PGMPOOLKIND_PAE_PT_FOR_PAE_PT)
1754	cChanges = pgmPoolTrackFlushPTPaePae(pPool, pPage, (PPGMSHWPTPAE)pvShw, (PCX86PTPAE)pvGst,
1755	(PCX86PTPAE)&pPool->aDirtyPages[idxSlot].aPage[0], fAllowRemoval, &fFlush);
1756	else
1757	cChanges = pgmPoolTrackFlushPTPae32Bit(pPool, pPage, (PPGMSHWPTPAE)pvShw, (PCX86PT)pvGst,
1758	(PCX86PT)&pPool->aDirtyPages[idxSlot].aPage[0], fAllowRemoval, &fFlush);
1759
1760	PGM_DYNMAP_UNUSED_HINT_VM(pVM, pvGst);
1761	PGM_DYNMAP_UNUSED_HINT_VM(pVM, pvShw);
1762	STAM_PROFILE_STOP(&pPool->StatTrackDeref,a);
1763	/* Note: we might want to consider keeping the dirty page active in case there were many changes. */
1764
1765	/* This page is likely to be modified again, so reduce the nr of modifications just a bit here. */
1766	Assert(pPage->cModifications);
1767	if (cChanges < 4)
1768	pPage->cModifications = 1; /* must use > 0 here */
1769	else
1770	pPage->cModifications = RT_MAX(1, pPage->cModifications / 2);
1771
1772	STAM_COUNTER_INC(&pPool->StatResetDirtyPages);
1773	if (pPool->cDirtyPages == RT_ELEMENTS(pPool->aDirtyPages))
1774	pPool->idxFreeDirtyPage = idxSlot;
1775
1776	pPool->cDirtyPages--;
1777	pPool->aDirtyPages[idxSlot].uIdx = NIL_PGMPOOL_IDX;
1778	Assert(pPool->cDirtyPages <= RT_ELEMENTS(pPool->aDirtyPages));
1779	if (fFlush)
1780	{
1781	Assert(fAllowRemoval);
1782	Log(("Flush reused page table!\n"));
1783	pgmPoolFlushPage(pPool, pPage);
1784	STAM_COUNTER_INC(&pPool->StatForceFlushReused);
1785	}
1786	else
1787	Log(("Removed dirty page %RGp cMods=%d cChanges=%d\n", pPage->GCPhys, pPage->cModifications, cChanges));
1788
1789	#if defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0) \|\| defined(IN_RC)
1790	PGMRZDynMapPopAutoSubset(pVCpu, iPrevSubset);
1791	#endif
1792	}
1793
1794
1795	# ifndef IN_RING3
1796	/**
1797	* Add a new dirty page
1798	*
1799	* @param pVM The cross context VM structure.
1800	* @param pPool The pool.
1801	* @param pPage The page.
1802	*/
1803	void pgmPoolAddDirtyPage(PVM pVM, PPGMPOOL pPool, PPGMPOOLPAGE pPage)
1804	{
1805	unsigned idxFree;
1806
1807	PGM_LOCK_ASSERT_OWNER(pVM);
1808	AssertCompile(RT_ELEMENTS(pPool->aDirtyPages) == 8 \|\| RT_ELEMENTS(pPool->aDirtyPages) == 16);
1809	Assert(!pPage->fDirty);
1810
1811	idxFree = pPool->idxFreeDirtyPage;
1812	Assert(idxFree < RT_ELEMENTS(pPool->aDirtyPages));
1813	Assert(pPage->iMonitoredNext == NIL_PGMPOOL_IDX && pPage->iMonitoredPrev == NIL_PGMPOOL_IDX);
1814
1815	if (pPool->cDirtyPages >= RT_ELEMENTS(pPool->aDirtyPages))
1816	{
1817	STAM_COUNTER_INC(&pPool->StatDirtyPageOverFlowFlush);
1818	pgmPoolFlushDirtyPage(pVM, pPool, idxFree, true /* allow removal of reused page tables*/);
1819	}
1820	Assert(pPool->cDirtyPages < RT_ELEMENTS(pPool->aDirtyPages));
1821	AssertMsg(pPool->aDirtyPages[idxFree].uIdx == NIL_PGMPOOL_IDX, ("idxFree=%d cDirtyPages=%d\n", idxFree, pPool->cDirtyPages));
1822
1823	Log(("Add dirty page %RGp (slot=%d)\n", pPage->GCPhys, idxFree));
1824
1825	/*
1826	* Make a copy of the guest page table as we require valid GCPhys addresses
1827	* when removing references to physical pages.
1828	* (The HCPhys linear lookup is extremely expensive!)
1829	*/
1830	void *pvGst;
1831	int rc = PGM_GCPHYS_2_PTR_EX(pVM, pPage->GCPhys, &pvGst); AssertReleaseRC(rc);
1832	memcpy(&pPool->aDirtyPages[idxFree].aPage[0], pvGst, (pPage->enmKind == PGMPOOLKIND_PAE_PT_FOR_PAE_PT) ? PAGE_SIZE : PAGE_SIZE/2);
1833	# ifdef VBOX_STRICT
1834	void *pvShw = PGMPOOL_PAGE_2_PTR(pVM, pPage);
1835	if (pPage->enmKind == PGMPOOLKIND_PAE_PT_FOR_PAE_PT)
1836	pgmPoolTrackCheckPTPaePae(pPool, pPage, (PPGMSHWPTPAE)pvShw, (PCX86PTPAE)pvGst);
1837	else
1838	pgmPoolTrackCheckPTPae32Bit(pPool, pPage, (PPGMSHWPTPAE)pvShw, (PCX86PT)pvGst);
1839	PGM_DYNMAP_UNUSED_HINT_VM(pVM, pvShw);
1840	# endif
1841	PGM_DYNMAP_UNUSED_HINT_VM(pVM, pvGst);
1842
1843	STAM_COUNTER_INC(&pPool->StatDirtyPage);
1844	pPage->fDirty = true;
1845	pPage->idxDirtyEntry = (uint8_t)idxFree; Assert(pPage->idxDirtyEntry == idxFree);
1846	pPool->aDirtyPages[idxFree].uIdx = pPage->idx;
1847	pPool->cDirtyPages++;
1848
1849	pPool->idxFreeDirtyPage = (pPool->idxFreeDirtyPage + 1) & (RT_ELEMENTS(pPool->aDirtyPages) - 1);
1850	if ( pPool->cDirtyPages < RT_ELEMENTS(pPool->aDirtyPages)
1851	&& pPool->aDirtyPages[pPool->idxFreeDirtyPage].uIdx != NIL_PGMPOOL_IDX)
1852	{
1853	unsigned i;
1854	for (i = 1; i < RT_ELEMENTS(pPool->aDirtyPages); i++)
1855	{
1856	idxFree = (pPool->idxFreeDirtyPage + i) & (RT_ELEMENTS(pPool->aDirtyPages) - 1);
1857	if (pPool->aDirtyPages[idxFree].uIdx == NIL_PGMPOOL_IDX)
1858	{
1859	pPool->idxFreeDirtyPage = idxFree;
1860	break;
1861	}
1862	}
1863	Assert(i != RT_ELEMENTS(pPool->aDirtyPages));
1864	}
1865
1866	Assert(pPool->cDirtyPages == RT_ELEMENTS(pPool->aDirtyPages) \|\| pPool->aDirtyPages[pPool->idxFreeDirtyPage].uIdx == NIL_PGMPOOL_IDX);
1867
1868	/*
1869	* Clear all references to this shadow table. See @bugref{7298}.
1870	*/
1871	pgmPoolTrackClearPageUsers(pPool, pPage);
1872	}
1873	# endif /* !IN_RING3 */
1874
1875
1876	/**
1877	* Check if the specified page is dirty (not write monitored)
1878	*
1879	* @return dirty or not
1880	* @param pVM The cross context VM structure.
1881	* @param GCPhys Guest physical address
1882	*/
1883	bool pgmPoolIsDirtyPage(PVM pVM, RTGCPHYS GCPhys)
1884	{
1885	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
1886	PGM_LOCK_ASSERT_OWNER(pVM);
1887	if (!pPool->cDirtyPages)
1888	return false;
1889
1890	GCPhys = GCPhys & ~(RTGCPHYS)PAGE_OFFSET_MASK;
1891
1892	for (unsigned i = 0; i < RT_ELEMENTS(pPool->aDirtyPages); i++)
1893	{
1894	if (pPool->aDirtyPages[i].uIdx != NIL_PGMPOOL_IDX)
1895	{
1896	PPGMPOOLPAGE pPage;
1897	unsigned idxPage = pPool->aDirtyPages[i].uIdx;
1898
1899	pPage = &pPool->aPages[idxPage];
1900	if (pPage->GCPhys == GCPhys)
1901	return true;
1902	}
1903	}
1904	return false;
1905	}
1906
1907
1908	/**
1909	* Reset all dirty pages by reinstating page monitoring.
1910	*
1911	* @param pVM The cross context VM structure.
1912	*/
1913	void pgmPoolResetDirtyPages(PVM pVM)
1914	{
1915	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
1916	PGM_LOCK_ASSERT_OWNER(pVM);
1917	Assert(pPool->cDirtyPages <= RT_ELEMENTS(pPool->aDirtyPages));
1918
1919	if (!pPool->cDirtyPages)
1920	return;
1921
1922	Log(("pgmPoolResetDirtyPages\n"));
1923	for (unsigned i = 0; i < RT_ELEMENTS(pPool->aDirtyPages); i++)
1924	pgmPoolFlushDirtyPage(pVM, pPool, i, true /* allow removal of reused page tables*/);
1925
1926	pPool->idxFreeDirtyPage = 0;
1927	if ( pPool->cDirtyPages != RT_ELEMENTS(pPool->aDirtyPages)
1928	&& pPool->aDirtyPages[pPool->idxFreeDirtyPage].uIdx != NIL_PGMPOOL_IDX)
1929	{
1930	unsigned i;
1931	for (i = 1; i < RT_ELEMENTS(pPool->aDirtyPages); i++)
1932	{
1933	if (pPool->aDirtyPages[i].uIdx == NIL_PGMPOOL_IDX)
1934	{
1935	pPool->idxFreeDirtyPage = i;
1936	break;
1937	}
1938	}
1939	AssertMsg(i != RT_ELEMENTS(pPool->aDirtyPages), ("cDirtyPages %d", pPool->cDirtyPages));
1940	}
1941
1942	Assert(pPool->aDirtyPages[pPool->idxFreeDirtyPage].uIdx == NIL_PGMPOOL_IDX \|\| pPool->cDirtyPages == RT_ELEMENTS(pPool->aDirtyPages));
1943	return;
1944	}
1945
1946
1947	/**
1948	* Invalidate the PT entry for the specified page
1949	*
1950	* @param pVM The cross context VM structure.
1951	* @param GCPtrPage Guest page to invalidate
1952	*/
1953	void pgmPoolResetDirtyPage(PVM pVM, RTGCPTR GCPtrPage)
1954	{
1955	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
1956	PGM_LOCK_ASSERT_OWNER(pVM);
1957	Assert(pPool->cDirtyPages <= RT_ELEMENTS(pPool->aDirtyPages));
1958
1959	if (!pPool->cDirtyPages)
1960	return;
1961
1962	Log(("pgmPoolResetDirtyPage %RGv\n", GCPtrPage));
1963	for (unsigned i = 0; i < RT_ELEMENTS(pPool->aDirtyPages); i++)
1964	{
1965	}
1966	}
1967
1968
1969	/**
1970	* Reset all dirty pages by reinstating page monitoring.
1971	*
1972	* @param pVM The cross context VM structure.
1973	* @param GCPhysPT Physical address of the page table
1974	*/
1975	void pgmPoolInvalidateDirtyPage(PVM pVM, RTGCPHYS GCPhysPT)
1976	{
1977	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
1978	PGM_LOCK_ASSERT_OWNER(pVM);
1979	Assert(pPool->cDirtyPages <= RT_ELEMENTS(pPool->aDirtyPages));
1980	unsigned idxDirtyPage = RT_ELEMENTS(pPool->aDirtyPages);
1981
1982	if (!pPool->cDirtyPages)
1983	return;
1984
1985	GCPhysPT = GCPhysPT & ~(RTGCPHYS)PAGE_OFFSET_MASK;
1986
1987	for (unsigned i = 0; i < RT_ELEMENTS(pPool->aDirtyPages); i++)
1988	{
1989	if (pPool->aDirtyPages[i].uIdx != NIL_PGMPOOL_IDX)
1990	{
1991	unsigned idxPage = pPool->aDirtyPages[i].uIdx;
1992
1993	PPGMPOOLPAGE pPage = &pPool->aPages[idxPage];
1994	if (pPage->GCPhys == GCPhysPT)
1995	{
1996	idxDirtyPage = i;
1997	break;
1998	}
1999	}
2000	}
2001
2002	if (idxDirtyPage != RT_ELEMENTS(pPool->aDirtyPages))
2003	{
2004	pgmPoolFlushDirtyPage(pVM, pPool, idxDirtyPage, true /* allow removal of reused page tables*/);
2005	if ( pPool->cDirtyPages != RT_ELEMENTS(pPool->aDirtyPages)
2006	&& pPool->aDirtyPages[pPool->idxFreeDirtyPage].uIdx != NIL_PGMPOOL_IDX)
2007	{
2008	unsigned i;
2009	for (i = 0; i < RT_ELEMENTS(pPool->aDirtyPages); i++)
2010	{
2011	if (pPool->aDirtyPages[i].uIdx == NIL_PGMPOOL_IDX)
2012	{
2013	pPool->idxFreeDirtyPage = i;
2014	break;
2015	}
2016	}
2017	AssertMsg(i != RT_ELEMENTS(pPool->aDirtyPages), ("cDirtyPages %d", pPool->cDirtyPages));
2018	}
2019	}
2020	}
2021
2022	# endif /* PGMPOOL_WITH_OPTIMIZED_DIRTY_PT */
2023
2024	/**
2025	* Inserts a page into the GCPhys hash table.
2026	*
2027	* @param pPool The pool.
2028	* @param pPage The page.
2029	*/
2030	DECLINLINE(void) pgmPoolHashInsert(PPGMPOOL pPool, PPGMPOOLPAGE pPage)
2031	{
2032	Log3(("pgmPoolHashInsert: %RGp\n", pPage->GCPhys));
2033	Assert(pPage->GCPhys != NIL_RTGCPHYS); Assert(pPage->iNext == NIL_PGMPOOL_IDX);
2034	uint16_t iHash = PGMPOOL_HASH(pPage->GCPhys);
2035	pPage->iNext = pPool->aiHash[iHash];
2036	pPool->aiHash[iHash] = pPage->idx;
2037	}
2038
2039
2040	/**
2041	* Removes a page from the GCPhys hash table.
2042	*
2043	* @param pPool The pool.
2044	* @param pPage The page.
2045	*/
2046	DECLINLINE(void) pgmPoolHashRemove(PPGMPOOL pPool, PPGMPOOLPAGE pPage)
2047	{
2048	Log3(("pgmPoolHashRemove: %RGp\n", pPage->GCPhys));
2049	uint16_t iHash = PGMPOOL_HASH(pPage->GCPhys);
2050	if (pPool->aiHash[iHash] == pPage->idx)
2051	pPool->aiHash[iHash] = pPage->iNext;
2052	else
2053	{
2054	uint16_t iPrev = pPool->aiHash[iHash];
2055	for (;;)
2056	{
2057	const int16_t i = pPool->aPages[iPrev].iNext;
2058	if (i == pPage->idx)
2059	{
2060	pPool->aPages[iPrev].iNext = pPage->iNext;
2061	break;
2062	}
2063	if (i == NIL_PGMPOOL_IDX)
2064	{
2065	AssertReleaseMsgFailed(("GCPhys=%RGp idx=%d\n", pPage->GCPhys, pPage->idx));
2066	break;
2067	}
2068	iPrev = i;
2069	}
2070	}
2071	pPage->iNext = NIL_PGMPOOL_IDX;
2072	}
2073
2074
2075	/**
2076	* Frees up one cache page.
2077	*
2078	* @returns VBox status code.
2079	* @retval VINF_SUCCESS on success.
2080	* @param pPool The pool.
2081	* @param iUser The user index.
2082	*/
2083	static int pgmPoolCacheFreeOne(PPGMPOOL pPool, uint16_t iUser)
2084	{
2085	#ifndef IN_RC
2086	const PVM pVM = pPool->CTX_SUFF(pVM);
2087	#endif
2088	Assert(pPool->iAgeHead != pPool->iAgeTail); /* We shouldn't be here if there < 2 cached entries! */
2089	STAM_COUNTER_INC(&pPool->StatCacheFreeUpOne);
2090
2091	/*
2092	* Select one page from the tail of the age list.
2093	*/
2094	PPGMPOOLPAGE pPage;
2095	for (unsigned iLoop = 0; ; iLoop++)
2096	{
2097	uint16_t iToFree = pPool->iAgeTail;
2098	if (iToFree == iUser && iUser != NIL_PGMPOOL_IDX)
2099	iToFree = pPool->aPages[iToFree].iAgePrev;
2100	/* This is the alternative to the SyncCR3 pgmPoolCacheUsed calls.
2101	if (pPool->aPages[iToFree].iUserHead != NIL_PGMPOOL_USER_INDEX)
2102	{
2103	uint16_t i = pPool->aPages[iToFree].iAgePrev;
2104	for (unsigned j = 0; j < 10 && i != NIL_PGMPOOL_USER_INDEX; j++, i = pPool->aPages[i].iAgePrev)
2105	{
2106	if (pPool->aPages[iToFree].iUserHead == NIL_PGMPOOL_USER_INDEX)
2107	continue;
2108	iToFree = i;
2109	break;
2110	}
2111	}
2112	*/
2113	Assert(iToFree != iUser);
2114	AssertRelease(iToFree != NIL_PGMPOOL_IDX);
2115	pPage = &pPool->aPages[iToFree];
2116
2117	/*
2118	* Reject any attempts at flushing the currently active shadow CR3 mapping.
2119	* Call pgmPoolCacheUsed to move the page to the head of the age list.
2120	*/
2121	if ( !pgmPoolIsPageLocked(pPage)
2122	&& pPage->idx >= PGMPOOL_IDX_FIRST /* paranoia (#6349) */)
2123	break;
2124	LogFlow(("pgmPoolCacheFreeOne: refuse CR3 mapping\n"));
2125	pgmPoolCacheUsed(pPool, pPage);
2126	AssertLogRelReturn(iLoop < 8192, VERR_PGM_POOL_TOO_MANY_LOOPS);
2127	}
2128
2129	/*
2130	* Found a usable page, flush it and return.
2131	*/
2132	int rc = pgmPoolFlushPage(pPool, pPage);
2133	/* This flush was initiated by us and not the guest, so explicitly flush the TLB. */
2134	/* todo: find out why this is necessary; pgmPoolFlushPage should trigger a flush if one is really needed. */
2135	if (rc == VINF_SUCCESS)
2136	PGM_INVL_ALL_VCPU_TLBS(pVM);
2137	return rc;
2138	}
2139
2140
2141	/**
2142	* Checks if a kind mismatch is really a page being reused
2143	* or if it's just normal remappings.
2144	*
2145	* @returns true if reused and the cached page (enmKind1) should be flushed
2146	* @returns false if not reused.
2147	* @param enmKind1 The kind of the cached page.
2148	* @param enmKind2 The kind of the requested page.
2149	*/
2150	static bool pgmPoolCacheReusedByKind(PGMPOOLKIND enmKind1, PGMPOOLKIND enmKind2)
2151	{
2152	switch (enmKind1)
2153	{
2154	/*
2155	* Never reuse them. There is no remapping in non-paging mode.
2156	*/
2157	case PGMPOOLKIND_32BIT_PT_FOR_PHYS:
2158	case PGMPOOLKIND_32BIT_PD_PHYS:
2159	case PGMPOOLKIND_PAE_PT_FOR_PHYS:
2160	case PGMPOOLKIND_PAE_PD_PHYS:
2161	case PGMPOOLKIND_PAE_PDPT_PHYS:
2162	case PGMPOOLKIND_64BIT_PDPT_FOR_PHYS:
2163	case PGMPOOLKIND_64BIT_PD_FOR_PHYS:
2164	case PGMPOOLKIND_EPT_PT_FOR_PHYS:
2165	case PGMPOOLKIND_EPT_PD_FOR_PHYS:
2166	case PGMPOOLKIND_EPT_PDPT_FOR_PHYS:
2167	case PGMPOOLKIND_PAE_PDPT_FOR_32BIT: /* never reuse them for other types */
2168	return false;
2169
2170	/*
2171	* It's perfectly fine to reuse these, except for PAE and non-paging stuff.
2172	*/
2173	case PGMPOOLKIND_PAE_PT_FOR_32BIT_4MB:
2174	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_4MB:
2175	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_PT:
2176	case PGMPOOLKIND_PAE_PT_FOR_32BIT_PT:
2177	case PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD:
2178	case PGMPOOLKIND_PAE_PD1_FOR_32BIT_PD:
2179	case PGMPOOLKIND_PAE_PD2_FOR_32BIT_PD:
2180	case PGMPOOLKIND_PAE_PD3_FOR_32BIT_PD:
2181	case PGMPOOLKIND_32BIT_PD:
2182	case PGMPOOLKIND_PAE_PDPT:
2183	switch (enmKind2)
2184	{
2185	case PGMPOOLKIND_PAE_PD_FOR_PAE_PD:
2186	case PGMPOOLKIND_PAE_PT_FOR_PAE_PT:
2187	case PGMPOOLKIND_64BIT_PD_FOR_64BIT_PD:
2188	case PGMPOOLKIND_64BIT_PDPT_FOR_64BIT_PDPT:
2189	case PGMPOOLKIND_64BIT_PML4:
2190	case PGMPOOLKIND_PAE_PT_FOR_PAE_2MB:
2191	case PGMPOOLKIND_32BIT_PT_FOR_PHYS:
2192	case PGMPOOLKIND_PAE_PT_FOR_PHYS:
2193	case PGMPOOLKIND_64BIT_PDPT_FOR_PHYS:
2194	case PGMPOOLKIND_64BIT_PD_FOR_PHYS:
2195	case PGMPOOLKIND_EPT_PDPT_FOR_PHYS:
2196	case PGMPOOLKIND_EPT_PD_FOR_PHYS:
2197	case PGMPOOLKIND_EPT_PT_FOR_PHYS:
2198	return true;
2199	default:
2200	return false;
2201	}
2202
2203	/*
2204	* It's perfectly fine to reuse these, except for PAE and non-paging stuff.
2205	*/
2206	case PGMPOOLKIND_PAE_PD_FOR_PAE_PD:
2207	case PGMPOOLKIND_PAE_PT_FOR_PAE_PT:
2208	case PGMPOOLKIND_64BIT_PD_FOR_64BIT_PD:
2209	case PGMPOOLKIND_64BIT_PDPT_FOR_64BIT_PDPT:
2210	case PGMPOOLKIND_64BIT_PML4:
2211	case PGMPOOLKIND_PAE_PT_FOR_PAE_2MB:
2212	switch (enmKind2)
2213	{
2214	case PGMPOOLKIND_PAE_PT_FOR_32BIT_4MB:
2215	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_4MB:
2216	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_PT:
2217	case PGMPOOLKIND_PAE_PT_FOR_32BIT_PT:
2218	case PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD:
2219	case PGMPOOLKIND_PAE_PD1_FOR_32BIT_PD:
2220	case PGMPOOLKIND_PAE_PD2_FOR_32BIT_PD:
2221	case PGMPOOLKIND_PAE_PD3_FOR_32BIT_PD:
2222	case PGMPOOLKIND_32BIT_PT_FOR_PHYS:
2223	case PGMPOOLKIND_PAE_PT_FOR_PHYS:
2224	case PGMPOOLKIND_64BIT_PDPT_FOR_PHYS:
2225	case PGMPOOLKIND_64BIT_PD_FOR_PHYS:
2226	case PGMPOOLKIND_EPT_PDPT_FOR_PHYS:
2227	case PGMPOOLKIND_EPT_PD_FOR_PHYS:
2228	case PGMPOOLKIND_EPT_PT_FOR_PHYS:
2229	return true;
2230	default:
2231	return false;
2232	}
2233
2234	/*
2235	* These cannot be flushed, and it's common to reuse the PDs as PTs.
2236	*/
2237	case PGMPOOLKIND_ROOT_NESTED:
2238	return false;
2239
2240	default:
2241	AssertFatalMsgFailed(("enmKind1=%d\n", enmKind1));
2242	}
2243	}
2244
2245
2246	/**
2247	* Attempts to satisfy a pgmPoolAlloc request from the cache.
2248	*
2249	* @returns VBox status code.
2250	* @retval VINF_PGM_CACHED_PAGE on success.
2251	* @retval VERR_FILE_NOT_FOUND if not found.
2252	* @param pPool The pool.
2253	* @param GCPhys The GC physical address of the page we're gonna shadow.
2254	* @param enmKind The kind of mapping.
2255	* @param enmAccess Access type for the mapping (only relevant for big pages)
2256	* @param fA20Enabled Whether the CPU has the A20 gate enabled.
2257	* @param iUser The shadow page pool index of the user table. This is
2258	* NIL_PGMPOOL_IDX for root pages.
2259	* @param iUserTable The index into the user table (shadowed). Ignored if
2260	* root page
2261	* @param ppPage Where to store the pointer to the page.
2262	*/
2263	static int pgmPoolCacheAlloc(PPGMPOOL pPool, RTGCPHYS GCPhys, PGMPOOLKIND enmKind, PGMPOOLACCESS enmAccess, bool fA20Enabled,
2264	uint16_t iUser, uint32_t iUserTable, PPPGMPOOLPAGE ppPage)
2265	{
2266	/*
2267	* Look up the GCPhys in the hash.
2268	*/
2269	unsigned i = pPool->aiHash[PGMPOOL_HASH(GCPhys)];
2270	Log3(("pgmPoolCacheAlloc: %RGp kind %s iUser=%d iUserTable=%x SLOT=%d\n", GCPhys, pgmPoolPoolKindToStr(enmKind), iUser, iUserTable, i));
2271	if (i != NIL_PGMPOOL_IDX)
2272	{
2273	do
2274	{
2275	PPGMPOOLPAGE pPage = &pPool->aPages[i];
2276	Log4(("pgmPoolCacheAlloc: slot %d found page %RGp\n", i, pPage->GCPhys));
2277	if (pPage->GCPhys == GCPhys)
2278	{
2279	if ( (PGMPOOLKIND)pPage->enmKind == enmKind
2280	&& (PGMPOOLACCESS)pPage->enmAccess == enmAccess
2281	&& pPage->fA20Enabled == fA20Enabled)
2282	{
2283	/* Put it at the start of the use list to make sure pgmPoolTrackAddUser
2284	* doesn't flush it in case there are no more free use records.
2285	*/
2286	pgmPoolCacheUsed(pPool, pPage);
2287
2288	int rc = VINF_SUCCESS;
2289	if (iUser != NIL_PGMPOOL_IDX)
2290	rc = pgmPoolTrackAddUser(pPool, pPage, iUser, iUserTable);
2291	if (RT_SUCCESS(rc))
2292	{
2293	Assert((PGMPOOLKIND)pPage->enmKind == enmKind);
2294	*ppPage = pPage;
2295	if (pPage->cModifications)
2296	pPage->cModifications = 1; /* reset counter (can't use 0, or else it will be reinserted in the modified list) */
2297	STAM_COUNTER_INC(&pPool->StatCacheHits);
2298	return VINF_PGM_CACHED_PAGE;
2299	}
2300	return rc;
2301	}
2302
2303	if ((PGMPOOLKIND)pPage->enmKind != enmKind)
2304	{
2305	/*
2306	* The kind is different. In some cases we should now flush the page
2307	* as it has been reused, but in most cases this is normal remapping
2308	* of PDs as PT or big pages using the GCPhys field in a slightly
2309	* different way than the other kinds.
2310	*/
2311	if (pgmPoolCacheReusedByKind((PGMPOOLKIND)pPage->enmKind, enmKind))
2312	{
2313	STAM_COUNTER_INC(&pPool->StatCacheKindMismatches);
2314	pgmPoolFlushPage(pPool, pPage);
2315	break;
2316	}
2317	}
2318	}
2319
2320	/* next */
2321	i = pPage->iNext;
2322	} while (i != NIL_PGMPOOL_IDX);
2323	}
2324
2325	Log3(("pgmPoolCacheAlloc: Missed GCPhys=%RGp enmKind=%s\n", GCPhys, pgmPoolPoolKindToStr(enmKind)));
2326	STAM_COUNTER_INC(&pPool->StatCacheMisses);
2327	return VERR_FILE_NOT_FOUND;
2328	}
2329
2330
2331	/**
2332	* Inserts a page into the cache.
2333	*
2334	* @param pPool The pool.
2335	* @param pPage The cached page.
2336	* @param fCanBeCached Set if the page is fit for caching from the caller's point of view.
2337	*/
2338	static void pgmPoolCacheInsert(PPGMPOOL pPool, PPGMPOOLPAGE pPage, bool fCanBeCached)
2339	{
2340	/*
2341	* Insert into the GCPhys hash if the page is fit for that.
2342	*/
2343	Assert(!pPage->fCached);
2344	if (fCanBeCached)
2345	{
2346	pPage->fCached = true;
2347	pgmPoolHashInsert(pPool, pPage);
2348	Log3(("pgmPoolCacheInsert: Caching %p:{.Core=%RHp, .idx=%d, .enmKind=%s, GCPhys=%RGp}\n",
2349	pPage, pPage->Core.Key, pPage->idx, pgmPoolPoolKindToStr(pPage->enmKind), pPage->GCPhys));
2350	STAM_COUNTER_INC(&pPool->StatCacheCacheable);
2351	}
2352	else
2353	{
2354	Log3(("pgmPoolCacheInsert: Not caching %p:{.Core=%RHp, .idx=%d, .enmKind=%s, GCPhys=%RGp}\n",
2355	pPage, pPage->Core.Key, pPage->idx, pgmPoolPoolKindToStr(pPage->enmKind), pPage->GCPhys));
2356	STAM_COUNTER_INC(&pPool->StatCacheUncacheable);
2357	}
2358
2359	/*
2360	* Insert at the head of the age list.
2361	*/
2362	pPage->iAgePrev = NIL_PGMPOOL_IDX;
2363	pPage->iAgeNext = pPool->iAgeHead;
2364	if (pPool->iAgeHead != NIL_PGMPOOL_IDX)
2365	pPool->aPages[pPool->iAgeHead].iAgePrev = pPage->idx;
2366	else
2367	pPool->iAgeTail = pPage->idx;
2368	pPool->iAgeHead = pPage->idx;
2369	}
2370
2371
2372	/**
2373	* Flushes a cached page.
2374	*
2375	* @param pPool The pool.
2376	* @param pPage The cached page.
2377	*/
2378	static void pgmPoolCacheFlushPage(PPGMPOOL pPool, PPGMPOOLPAGE pPage)
2379	{
2380	Log3(("pgmPoolCacheFlushPage: %RGp\n", pPage->GCPhys));
2381
2382	/*
2383	* Remove the page from the hash.
2384	*/
2385	if (pPage->fCached)
2386	{
2387	pPage->fCached = false;
2388	pgmPoolHashRemove(pPool, pPage);
2389	}
2390	else
2391	Assert(pPage->iNext == NIL_PGMPOOL_IDX);
2392
2393	/*
2394	* Remove it from the age list.
2395	*/
2396	if (pPage->iAgeNext != NIL_PGMPOOL_IDX)
2397	pPool->aPages[pPage->iAgeNext].iAgePrev = pPage->iAgePrev;
2398	else
2399	pPool->iAgeTail = pPage->iAgePrev;
2400	if (pPage->iAgePrev != NIL_PGMPOOL_IDX)
2401	pPool->aPages[pPage->iAgePrev].iAgeNext = pPage->iAgeNext;
2402	else
2403	pPool->iAgeHead = pPage->iAgeNext;
2404	pPage->iAgeNext = NIL_PGMPOOL_IDX;
2405	pPage->iAgePrev = NIL_PGMPOOL_IDX;
2406	}
2407
2408
2409	/**
2410	* Looks for pages sharing the monitor.
2411	*
2412	* @returns Pointer to the head page.
2413	* @returns NULL if not found.
2414	* @param pPool The Pool
2415	* @param pNewPage The page which is going to be monitored.
2416	*/
2417	static PPGMPOOLPAGE pgmPoolMonitorGetPageByGCPhys(PPGMPOOL pPool, PPGMPOOLPAGE pNewPage)
2418	{
2419	/*
2420	* Look up the GCPhys in the hash.
2421	*/
2422	RTGCPHYS GCPhys = pNewPage->GCPhys & ~(RTGCPHYS)PAGE_OFFSET_MASK;
2423	unsigned i = pPool->aiHash[PGMPOOL_HASH(GCPhys)];
2424	if (i == NIL_PGMPOOL_IDX)
2425	return NULL;
2426	do
2427	{
2428	PPGMPOOLPAGE pPage = &pPool->aPages[i];
2429	if ( pPage->GCPhys - GCPhys < PAGE_SIZE
2430	&& pPage != pNewPage)
2431	{
2432	switch (pPage->enmKind)
2433	{
2434	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_PT:
2435	case PGMPOOLKIND_PAE_PT_FOR_32BIT_PT:
2436	case PGMPOOLKIND_PAE_PT_FOR_PAE_PT:
2437	case PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD:
2438	case PGMPOOLKIND_PAE_PD1_FOR_32BIT_PD:
2439	case PGMPOOLKIND_PAE_PD2_FOR_32BIT_PD:
2440	case PGMPOOLKIND_PAE_PD3_FOR_32BIT_PD:
2441	case PGMPOOLKIND_PAE_PD_FOR_PAE_PD:
2442	case PGMPOOLKIND_64BIT_PD_FOR_64BIT_PD:
2443	case PGMPOOLKIND_64BIT_PDPT_FOR_64BIT_PDPT:
2444	case PGMPOOLKIND_64BIT_PML4:
2445	case PGMPOOLKIND_32BIT_PD:
2446	case PGMPOOLKIND_PAE_PDPT:
2447	{
2448	/* find the head */
2449	while (pPage->iMonitoredPrev != NIL_PGMPOOL_IDX)
2450	{
2451	Assert(pPage->iMonitoredPrev != pPage->idx);
2452	pPage = &pPool->aPages[pPage->iMonitoredPrev];
2453	}
2454	return pPage;
2455	}
2456
2457	/* ignore, no monitoring. */
2458	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_4MB:
2459	case PGMPOOLKIND_PAE_PT_FOR_PAE_2MB:
2460	case PGMPOOLKIND_PAE_PT_FOR_32BIT_4MB:
2461	case PGMPOOLKIND_32BIT_PT_FOR_PHYS:
2462	case PGMPOOLKIND_PAE_PT_FOR_PHYS:
2463	case PGMPOOLKIND_64BIT_PDPT_FOR_PHYS:
2464	case PGMPOOLKIND_64BIT_PD_FOR_PHYS:
2465	case PGMPOOLKIND_EPT_PDPT_FOR_PHYS:
2466	case PGMPOOLKIND_EPT_PD_FOR_PHYS:
2467	case PGMPOOLKIND_EPT_PT_FOR_PHYS:
2468	case PGMPOOLKIND_ROOT_NESTED:
2469	case PGMPOOLKIND_PAE_PD_PHYS:
2470	case PGMPOOLKIND_PAE_PDPT_PHYS:
2471	case PGMPOOLKIND_32BIT_PD_PHYS:
2472	case PGMPOOLKIND_PAE_PDPT_FOR_32BIT:
2473	break;
2474	default:
2475	AssertFatalMsgFailed(("enmKind=%d idx=%d\n", pPage->enmKind, pPage->idx));
2476	}
2477	}
2478
2479	/* next */
2480	i = pPage->iNext;
2481	} while (i != NIL_PGMPOOL_IDX);
2482	return NULL;
2483	}
2484
2485
2486	/**
2487	* Enabled write monitoring of a guest page.
2488	*
2489	* @returns VBox status code.
2490	* @retval VINF_SUCCESS on success.
2491	* @param pPool The pool.
2492	* @param pPage The cached page.
2493	*/
2494	static int pgmPoolMonitorInsert(PPGMPOOL pPool, PPGMPOOLPAGE pPage)
2495	{
2496	LogFlow(("pgmPoolMonitorInsert %RGp\n", pPage->GCPhys & ~(RTGCPHYS)PAGE_OFFSET_MASK));
2497
2498	/*
2499	* Filter out the relevant kinds.
2500	*/
2501	switch (pPage->enmKind)
2502	{
2503	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_PT:
2504	case PGMPOOLKIND_PAE_PT_FOR_32BIT_PT:
2505	case PGMPOOLKIND_PAE_PD_FOR_PAE_PD:
2506	case PGMPOOLKIND_PAE_PT_FOR_PAE_PT:
2507	case PGMPOOLKIND_64BIT_PD_FOR_64BIT_PD:
2508	case PGMPOOLKIND_64BIT_PDPT_FOR_64BIT_PDPT:
2509	case PGMPOOLKIND_64BIT_PML4:
2510	case PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD:
2511	case PGMPOOLKIND_PAE_PD1_FOR_32BIT_PD:
2512	case PGMPOOLKIND_PAE_PD2_FOR_32BIT_PD:
2513	case PGMPOOLKIND_PAE_PD3_FOR_32BIT_PD:
2514	case PGMPOOLKIND_32BIT_PD:
2515	case PGMPOOLKIND_PAE_PDPT:
2516	break;
2517
2518	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_4MB:
2519	case PGMPOOLKIND_PAE_PT_FOR_32BIT_4MB:
2520	case PGMPOOLKIND_PAE_PT_FOR_PAE_2MB:
2521	case PGMPOOLKIND_32BIT_PT_FOR_PHYS:
2522	case PGMPOOLKIND_PAE_PT_FOR_PHYS:
2523	case PGMPOOLKIND_64BIT_PDPT_FOR_PHYS:
2524	case PGMPOOLKIND_64BIT_PD_FOR_PHYS:
2525	case PGMPOOLKIND_EPT_PDPT_FOR_PHYS:
2526	case PGMPOOLKIND_EPT_PD_FOR_PHYS:
2527	case PGMPOOLKIND_EPT_PT_FOR_PHYS:
2528	case PGMPOOLKIND_ROOT_NESTED:
2529	/* Nothing to monitor here. */
2530	return VINF_SUCCESS;
2531
2532	case PGMPOOLKIND_32BIT_PD_PHYS:
2533	case PGMPOOLKIND_PAE_PDPT_PHYS:
2534	case PGMPOOLKIND_PAE_PD_PHYS:
2535	case PGMPOOLKIND_PAE_PDPT_FOR_32BIT:
2536	/* Nothing to monitor here. */
2537	return VINF_SUCCESS;
2538	default:
2539	AssertFatalMsgFailed(("This can't happen! enmKind=%d\n", pPage->enmKind));
2540	}
2541
2542	/*
2543	* Install handler.
2544	*/
2545	int rc;
2546	PPGMPOOLPAGE pPageHead = pgmPoolMonitorGetPageByGCPhys(pPool, pPage);
2547	if (pPageHead)
2548	{
2549	Assert(pPageHead != pPage); Assert(pPageHead->iMonitoredNext != pPage->idx);
2550	Assert(pPageHead->iMonitoredPrev != pPage->idx);
2551
2552	#ifdef PGMPOOL_WITH_OPTIMIZED_DIRTY_PT
2553	if (pPageHead->fDirty)
2554	pgmPoolFlushDirtyPage(pPool->CTX_SUFF(pVM), pPool, pPageHead->idxDirtyEntry, false /* do not remove */);
2555	#endif
2556
2557	pPage->iMonitoredPrev = pPageHead->idx;
2558	pPage->iMonitoredNext = pPageHead->iMonitoredNext;
2559	if (pPageHead->iMonitoredNext != NIL_PGMPOOL_IDX)
2560	pPool->aPages[pPageHead->iMonitoredNext].iMonitoredPrev = pPage->idx;
2561	pPageHead->iMonitoredNext = pPage->idx;
2562	rc = VINF_SUCCESS;
2563	}
2564	else
2565	{
2566	Assert(pPage->iMonitoredNext == NIL_PGMPOOL_IDX); Assert(pPage->iMonitoredPrev == NIL_PGMPOOL_IDX);
2567	PVM pVM = pPool->CTX_SUFF(pVM);
2568	const RTGCPHYS GCPhysPage = pPage->GCPhys & ~(RTGCPHYS)PAGE_OFFSET_MASK;
2569	rc = PGMHandlerPhysicalRegister(pVM, GCPhysPage, GCPhysPage + PAGE_OFFSET_MASK, pPool->hAccessHandlerType,
2570	MMHyperCCToR3(pVM, pPage), MMHyperCCToR0(pVM, pPage), MMHyperCCToRC(pVM, pPage),
2571	NIL_RTR3PTR /pszDesc/);
2572	/** @todo we should probably deal with out-of-memory conditions here, but for now increasing
2573	* the heap size should suffice. */
2574	AssertFatalMsgRC(rc, ("PGMHandlerPhysicalRegisterEx %RGp failed with %Rrc\n", GCPhysPage, rc));
2575	PVMCPU pVCpu = VMMGetCpu(pVM);
2576	AssertFatalMsg(!(pVCpu->pgm.s.fSyncFlags & PGM_SYNC_CLEAR_PGM_POOL) \|\| VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3), ("fSyncFlags=%x syncff=%d\n", pVCpu->pgm.s.fSyncFlags, VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3)));
2577	}
2578	pPage->fMonitored = true;
2579	return rc;
2580	}
2581
2582
2583	/**
2584	* Disables write monitoring of a guest page.
2585	*
2586	* @returns VBox status code.
2587	* @retval VINF_SUCCESS on success.
2588	* @param pPool The pool.
2589	* @param pPage The cached page.
2590	*/
2591	static int pgmPoolMonitorFlush(PPGMPOOL pPool, PPGMPOOLPAGE pPage)
2592	{
2593	/*
2594	* Filter out the relevant kinds.
2595	*/
2596	switch (pPage->enmKind)
2597	{
2598	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_PT:
2599	case PGMPOOLKIND_PAE_PT_FOR_32BIT_PT:
2600	case PGMPOOLKIND_PAE_PD_FOR_PAE_PD:
2601	case PGMPOOLKIND_PAE_PT_FOR_PAE_PT:
2602	case PGMPOOLKIND_64BIT_PD_FOR_64BIT_PD:
2603	case PGMPOOLKIND_64BIT_PDPT_FOR_64BIT_PDPT:
2604	case PGMPOOLKIND_64BIT_PML4:
2605	case PGMPOOLKIND_32BIT_PD:
2606	case PGMPOOLKIND_PAE_PDPT:
2607	case PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD:
2608	case PGMPOOLKIND_PAE_PD1_FOR_32BIT_PD:
2609	case PGMPOOLKIND_PAE_PD2_FOR_32BIT_PD:
2610	case PGMPOOLKIND_PAE_PD3_FOR_32BIT_PD:
2611	break;
2612
2613	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_4MB:
2614	case PGMPOOLKIND_PAE_PT_FOR_32BIT_4MB:
2615	case PGMPOOLKIND_PAE_PT_FOR_PAE_2MB:
2616	case PGMPOOLKIND_32BIT_PT_FOR_PHYS:
2617	case PGMPOOLKIND_PAE_PT_FOR_PHYS:
2618	case PGMPOOLKIND_64BIT_PDPT_FOR_PHYS:
2619	case PGMPOOLKIND_64BIT_PD_FOR_PHYS:
2620	case PGMPOOLKIND_EPT_PDPT_FOR_PHYS:
2621	case PGMPOOLKIND_EPT_PD_FOR_PHYS:
2622	case PGMPOOLKIND_EPT_PT_FOR_PHYS:
2623	case PGMPOOLKIND_ROOT_NESTED:
2624	case PGMPOOLKIND_PAE_PD_PHYS:
2625	case PGMPOOLKIND_PAE_PDPT_PHYS:
2626	case PGMPOOLKIND_32BIT_PD_PHYS:
2627	/* Nothing to monitor here. */
2628	Assert(!pPage->fMonitored);
2629	return VINF_SUCCESS;
2630
2631	default:
2632	AssertFatalMsgFailed(("This can't happen! enmKind=%d\n", pPage->enmKind));
2633	}
2634	Assert(pPage->fMonitored);
2635
2636	/*
2637	* Remove the page from the monitored list or uninstall it if last.
2638	*/
2639	const PVM pVM = pPool->CTX_SUFF(pVM);
2640	int rc;
2641	if ( pPage->iMonitoredNext != NIL_PGMPOOL_IDX
2642	\|\| pPage->iMonitoredPrev != NIL_PGMPOOL_IDX)
2643	{
2644	if (pPage->iMonitoredPrev == NIL_PGMPOOL_IDX)
2645	{
2646	PPGMPOOLPAGE pNewHead = &pPool->aPages[pPage->iMonitoredNext];
2647	pNewHead->iMonitoredPrev = NIL_PGMPOOL_IDX;
2648	rc = PGMHandlerPhysicalChangeUserArgs(pVM, pPage->GCPhys & ~(RTGCPHYS)PAGE_OFFSET_MASK, MMHyperCCToR3(pVM, pNewHead),
2649	MMHyperCCToR0(pVM, pNewHead), MMHyperCCToRC(pVM, pNewHead));
2650
2651	AssertFatalRCSuccess(rc);
2652	pPage->iMonitoredNext = NIL_PGMPOOL_IDX;
2653	}
2654	else
2655	{
2656	pPool->aPages[pPage->iMonitoredPrev].iMonitoredNext = pPage->iMonitoredNext;
2657	if (pPage->iMonitoredNext != NIL_PGMPOOL_IDX)
2658	{
2659	pPool->aPages[pPage->iMonitoredNext].iMonitoredPrev = pPage->iMonitoredPrev;
2660	pPage->iMonitoredNext = NIL_PGMPOOL_IDX;
2661	}
2662	pPage->iMonitoredPrev = NIL_PGMPOOL_IDX;
2663	rc = VINF_SUCCESS;
2664	}
2665	}
2666	else
2667	{
2668	rc = PGMHandlerPhysicalDeregister(pVM, pPage->GCPhys & ~(RTGCPHYS)PAGE_OFFSET_MASK);
2669	AssertFatalRC(rc);
2670	PVMCPU pVCpu = VMMGetCpu(pVM);
2671	AssertFatalMsg(!(pVCpu->pgm.s.fSyncFlags & PGM_SYNC_CLEAR_PGM_POOL) \|\| VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3),
2672	("%#x %#x\n", pVCpu->pgm.s.fSyncFlags, pVM->fGlobalForcedActions));
2673	}
2674	pPage->fMonitored = false;
2675
2676	/*
2677	* Remove it from the list of modified pages (if in it).
2678	*/
2679	pgmPoolMonitorModifiedRemove(pPool, pPage);
2680
2681	return rc;
2682	}
2683
2684
2685	/**
2686	* Inserts the page into the list of modified pages.
2687	*
2688	* @param pPool The pool.
2689	* @param pPage The page.
2690	*/
2691	void pgmPoolMonitorModifiedInsert(PPGMPOOL pPool, PPGMPOOLPAGE pPage)
2692	{
2693	Log3(("pgmPoolMonitorModifiedInsert: idx=%d\n", pPage->idx));
2694	AssertMsg( pPage->iModifiedNext == NIL_PGMPOOL_IDX
2695	&& pPage->iModifiedPrev == NIL_PGMPOOL_IDX
2696	&& pPool->iModifiedHead != pPage->idx,
2697	("Next=%d Prev=%d idx=%d cModifications=%d Head=%d cModifiedPages=%d\n",
2698	pPage->iModifiedNext, pPage->iModifiedPrev, pPage->idx, pPage->cModifications,
2699	pPool->iModifiedHead, pPool->cModifiedPages));
2700
2701	pPage->iModifiedNext = pPool->iModifiedHead;
2702	if (pPool->iModifiedHead != NIL_PGMPOOL_IDX)
2703	pPool->aPages[pPool->iModifiedHead].iModifiedPrev = pPage->idx;
2704	pPool->iModifiedHead = pPage->idx;
2705	pPool->cModifiedPages++;
2706	#ifdef VBOX_WITH_STATISTICS
2707	if (pPool->cModifiedPages > pPool->cModifiedPagesHigh)
2708	pPool->cModifiedPagesHigh = pPool->cModifiedPages;
2709	#endif
2710	}
2711
2712
2713	/**
2714	* Removes the page from the list of modified pages and resets the
2715	* modification counter.
2716	*
2717	* @param pPool The pool.
2718	* @param pPage The page which is believed to be in the list of modified pages.
2719	*/
2720	static void pgmPoolMonitorModifiedRemove(PPGMPOOL pPool, PPGMPOOLPAGE pPage)
2721	{
2722	Log3(("pgmPoolMonitorModifiedRemove: idx=%d cModifications=%d\n", pPage->idx, pPage->cModifications));
2723	if (pPool->iModifiedHead == pPage->idx)
2724	{
2725	Assert(pPage->iModifiedPrev == NIL_PGMPOOL_IDX);
2726	pPool->iModifiedHead = pPage->iModifiedNext;
2727	if (pPage->iModifiedNext != NIL_PGMPOOL_IDX)
2728	{
2729	pPool->aPages[pPage->iModifiedNext].iModifiedPrev = NIL_PGMPOOL_IDX;
2730	pPage->iModifiedNext = NIL_PGMPOOL_IDX;
2731	}
2732	pPool->cModifiedPages--;
2733	}
2734	else if (pPage->iModifiedPrev != NIL_PGMPOOL_IDX)
2735	{
2736	pPool->aPages[pPage->iModifiedPrev].iModifiedNext = pPage->iModifiedNext;
2737	if (pPage->iModifiedNext != NIL_PGMPOOL_IDX)
2738	{
2739	pPool->aPages[pPage->iModifiedNext].iModifiedPrev = pPage->iModifiedPrev;
2740	pPage->iModifiedNext = NIL_PGMPOOL_IDX;
2741	}
2742	pPage->iModifiedPrev = NIL_PGMPOOL_IDX;
2743	pPool->cModifiedPages--;
2744	}
2745	else
2746	Assert(pPage->iModifiedPrev == NIL_PGMPOOL_IDX);
2747	pPage->cModifications = 0;
2748	}
2749
2750
2751	/**
2752	* Zaps the list of modified pages, resetting their modification counters in the process.
2753	*
2754	* @param pVM The cross context VM structure.
2755	*/
2756	static void pgmPoolMonitorModifiedClearAll(PVM pVM)
2757	{
2758	pgmLock(pVM);
2759	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
2760	LogFlow(("pgmPoolMonitorModifiedClearAll: cModifiedPages=%d\n", pPool->cModifiedPages));
2761
2762	unsigned cPages = 0; NOREF(cPages);
2763
2764	#ifdef PGMPOOL_WITH_OPTIMIZED_DIRTY_PT
2765	pgmPoolResetDirtyPages(pVM);
2766	#endif
2767
2768	uint16_t idx = pPool->iModifiedHead;
2769	pPool->iModifiedHead = NIL_PGMPOOL_IDX;
2770	while (idx != NIL_PGMPOOL_IDX)
2771	{
2772	PPGMPOOLPAGE pPage = &pPool->aPages[idx];
2773	idx = pPage->iModifiedNext;
2774	pPage->iModifiedNext = NIL_PGMPOOL_IDX;
2775	pPage->iModifiedPrev = NIL_PGMPOOL_IDX;
2776	pPage->cModifications = 0;
2777	Assert(++cPages);
2778	}
2779	AssertMsg(cPages == pPool->cModifiedPages, ("%d != %d\n", cPages, pPool->cModifiedPages));
2780	pPool->cModifiedPages = 0;
2781	pgmUnlock(pVM);
2782	}
2783
2784
2785	/**
2786	* Handle SyncCR3 pool tasks
2787	*
2788	* @returns VBox status code.
2789	* @retval VINF_SUCCESS if successfully added.
2790	* @retval VINF_PGM_SYNC_CR3 is it needs to be deferred to ring 3 (GC only)
2791	* @param pVCpu The cross context virtual CPU structure.
2792	* @remark Should only be used when monitoring is available, thus placed in
2793	* the PGMPOOL_WITH_MONITORING \#ifdef.
2794	*/
2795	int pgmPoolSyncCR3(PVMCPU pVCpu)
2796	{
2797	PVM pVM = pVCpu->CTX_SUFF(pVM);
2798	LogFlow(("pgmPoolSyncCR3 fSyncFlags=%x\n", pVCpu->pgm.s.fSyncFlags));
2799
2800	/*
2801	* When monitoring shadowed pages, we reset the modification counters on CR3 sync.
2802	* Occasionally we will have to clear all the shadow page tables because we wanted
2803	* to monitor a page which was mapped by too many shadowed page tables. This operation
2804	* sometimes referred to as a 'lightweight flush'.
2805	*/
2806	# ifdef IN_RING3 /* Don't flush in ring-0 or raw mode, it's taking too long. */
2807	if (pVCpu->pgm.s.fSyncFlags & PGM_SYNC_CLEAR_PGM_POOL)
2808	pgmR3PoolClearAll(pVM, false /fFlushRemTlb/);
2809	# else /* !IN_RING3 */
2810	if (pVCpu->pgm.s.fSyncFlags & PGM_SYNC_CLEAR_PGM_POOL)
2811	{
2812	Log(("SyncCR3: PGM_SYNC_CLEAR_PGM_POOL is set -> VINF_PGM_SYNC_CR3\n"));
2813	VMCPU_FF_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3); /** @todo no need to do global sync, right? */
2814
2815	/* Make sure all other VCPUs return to ring 3. */
2816	if (pVM->cCpus > 1)
2817	{
2818	VM_FF_SET(pVM, VM_FF_PGM_POOL_FLUSH_PENDING);
2819	PGM_INVL_ALL_VCPU_TLBS(pVM);
2820	}
2821	return VINF_PGM_SYNC_CR3;
2822	}
2823	# endif /* !IN_RING3 */
2824	else
2825	{
2826	pgmPoolMonitorModifiedClearAll(pVM);
2827
2828	/* pgmPoolMonitorModifiedClearAll can cause a pgm pool flush (dirty page clearing), so make sure we handle this! */
2829	if (pVCpu->pgm.s.fSyncFlags & PGM_SYNC_CLEAR_PGM_POOL)
2830	{
2831	Log(("pgmPoolMonitorModifiedClearAll caused a pgm flush -> call pgmPoolSyncCR3 again!\n"));
2832	return pgmPoolSyncCR3(pVCpu);
2833	}
2834	}
2835	return VINF_SUCCESS;
2836	}
2837
2838
2839	/**
2840	* Frees up at least one user entry.
2841	*
2842	* @returns VBox status code.
2843	* @retval VINF_SUCCESS if successfully added.
2844	* @retval VERR_PGM_POOL_FLUSHED if the pool was flushed.
2845	* @param pPool The pool.
2846	* @param iUser The user index.
2847	*/
2848	static int pgmPoolTrackFreeOneUser(PPGMPOOL pPool, uint16_t iUser)
2849	{
2850	STAM_COUNTER_INC(&pPool->StatTrackFreeUpOneUser);
2851	/*
2852	* Just free cached pages in a braindead fashion.
2853	*/
2854	/** @todo walk the age list backwards and free the first with usage. */
2855	int rc = VINF_SUCCESS;
2856	do
2857	{
2858	int rc2 = pgmPoolCacheFreeOne(pPool, iUser);
2859	if (RT_FAILURE(rc2) && rc == VINF_SUCCESS)
2860	rc = rc2;
2861	} while (pPool->iUserFreeHead == NIL_PGMPOOL_USER_INDEX);
2862	return rc;
2863	}
2864
2865
2866	/**
2867	* Inserts a page into the cache.
2868	*
2869	* This will create user node for the page, insert it into the GCPhys
2870	* hash, and insert it into the age list.
2871	*
2872	* @returns VBox status code.
2873	* @retval VINF_SUCCESS if successfully added.
2874	* @retval VERR_PGM_POOL_FLUSHED if the pool was flushed.
2875	* @param pPool The pool.
2876	* @param pPage The cached page.
2877	* @param GCPhys The GC physical address of the page we're gonna shadow.
2878	* @param iUser The user index.
2879	* @param iUserTable The user table index.
2880	*/
2881	DECLINLINE(int) pgmPoolTrackInsert(PPGMPOOL pPool, PPGMPOOLPAGE pPage, RTGCPHYS GCPhys, uint16_t iUser, uint32_t iUserTable)
2882	{
2883	int rc = VINF_SUCCESS;
2884	PPGMPOOLUSER paUsers = pPool->CTX_SUFF(paUsers);
2885
2886	LogFlow(("pgmPoolTrackInsert GCPhys=%RGp iUser=%d iUserTable=%x\n", GCPhys, iUser, iUserTable));
2887
2888	if (iUser != NIL_PGMPOOL_IDX)
2889	{
2890	#ifdef VBOX_STRICT
2891	/*
2892	* Check that the entry doesn't already exists.
2893	*/
2894	if (pPage->iUserHead != NIL_PGMPOOL_USER_INDEX)
2895	{
2896	uint16_t i = pPage->iUserHead;
2897	do
2898	{
2899	Assert(i < pPool->cMaxUsers);
2900	AssertMsg(paUsers[i].iUser != iUser \|\| paUsers[i].iUserTable != iUserTable, ("%x %x vs new %x %x\n", paUsers[i].iUser, paUsers[i].iUserTable, iUser, iUserTable));
2901	i = paUsers[i].iNext;
2902	} while (i != NIL_PGMPOOL_USER_INDEX);
2903	}
2904	#endif
2905
2906	/*
2907	* Find free a user node.
2908	*/
2909	uint16_t i = pPool->iUserFreeHead;
2910	if (i == NIL_PGMPOOL_USER_INDEX)
2911	{
2912	rc = pgmPoolTrackFreeOneUser(pPool, iUser);
2913	if (RT_FAILURE(rc))
2914	return rc;
2915	i = pPool->iUserFreeHead;
2916	}
2917
2918	/*
2919	* Unlink the user node from the free list,
2920	* initialize and insert it into the user list.
2921	*/
2922	pPool->iUserFreeHead = paUsers[i].iNext;
2923	paUsers[i].iNext = NIL_PGMPOOL_USER_INDEX;
2924	paUsers[i].iUser = iUser;
2925	paUsers[i].iUserTable = iUserTable;
2926	pPage->iUserHead = i;
2927	}
2928	else
2929	pPage->iUserHead = NIL_PGMPOOL_USER_INDEX;
2930
2931
2932	/*
2933	* Insert into cache and enable monitoring of the guest page if enabled.
2934	*
2935	* Until we implement caching of all levels, including the CR3 one, we'll
2936	* have to make sure we don't try monitor & cache any recursive reuse of
2937	* a monitored CR3 page. Because all windows versions are doing this we'll
2938	* have to be able to do combined access monitoring, CR3 + PT and
2939	* PD + PT (guest PAE).
2940	*
2941	* Update:
2942	* We're now cooperating with the CR3 monitor if an uncachable page is found.
2943	*/
2944	const bool fCanBeMonitored = true;
2945	pgmPoolCacheInsert(pPool, pPage, fCanBeMonitored); /* This can be expanded. */
2946	if (fCanBeMonitored)
2947	{
2948	rc = pgmPoolMonitorInsert(pPool, pPage);
2949	AssertRC(rc);
2950	}
2951	return rc;
2952	}
2953
2954
2955	/**
2956	* Adds a user reference to a page.
2957	*
2958	* This will move the page to the head of the
2959	*
2960	* @returns VBox status code.
2961	* @retval VINF_SUCCESS if successfully added.
2962	* @retval VERR_PGM_POOL_FLUSHED if the pool was flushed.
2963	* @param pPool The pool.
2964	* @param pPage The cached page.
2965	* @param iUser The user index.
2966	* @param iUserTable The user table.
2967	*/
2968	static int pgmPoolTrackAddUser(PPGMPOOL pPool, PPGMPOOLPAGE pPage, uint16_t iUser, uint32_t iUserTable)
2969	{
2970	Log3(("pgmPoolTrackAddUser: GCPhys=%RGp iUser=%x iUserTable=%x\n", pPage->GCPhys, iUser, iUserTable));
2971	PPGMPOOLUSER paUsers = pPool->CTX_SUFF(paUsers);
2972	Assert(iUser != NIL_PGMPOOL_IDX);
2973
2974	# ifdef VBOX_STRICT
2975	/*
2976	* Check that the entry doesn't already exists. We only allow multiple
2977	* users of top-level paging structures (SHW_POOL_ROOT_IDX).
2978	*/
2979	if (pPage->iUserHead != NIL_PGMPOOL_USER_INDEX)
2980	{
2981	uint16_t i = pPage->iUserHead;
2982	do
2983	{
2984	Assert(i < pPool->cMaxUsers);
2985	/** @todo this assertion looks odd... Shouldn't it be && here? */
2986	AssertMsg(paUsers[i].iUser != iUser \|\| paUsers[i].iUserTable != iUserTable, ("%x %x vs new %x %x\n", paUsers[i].iUser, paUsers[i].iUserTable, iUser, iUserTable));
2987	i = paUsers[i].iNext;
2988	} while (i != NIL_PGMPOOL_USER_INDEX);
2989	}
2990	# endif
2991
2992	/*
2993	* Allocate a user node.
2994	*/
2995	uint16_t i = pPool->iUserFreeHead;
2996	if (i == NIL_PGMPOOL_USER_INDEX)
2997	{
2998	int rc = pgmPoolTrackFreeOneUser(pPool, iUser);
2999	if (RT_FAILURE(rc))
3000	return rc;
3001	i = pPool->iUserFreeHead;
3002	}
3003	pPool->iUserFreeHead = paUsers[i].iNext;
3004
3005	/*
3006	* Initialize the user node and insert it.
3007	*/
3008	paUsers[i].iNext = pPage->iUserHead;
3009	paUsers[i].iUser = iUser;
3010	paUsers[i].iUserTable = iUserTable;
3011	pPage->iUserHead = i;
3012
3013	# ifdef PGMPOOL_WITH_OPTIMIZED_DIRTY_PT
3014	if (pPage->fDirty)
3015	pgmPoolFlushDirtyPage(pPool->CTX_SUFF(pVM), pPool, pPage->idxDirtyEntry, false /* do not remove */);
3016	# endif
3017
3018	/*
3019	* Tell the cache to update its replacement stats for this page.
3020	*/
3021	pgmPoolCacheUsed(pPool, pPage);
3022	return VINF_SUCCESS;
3023	}
3024
3025
3026	/**
3027	* Frees a user record associated with a page.
3028	*
3029	* This does not clear the entry in the user table, it simply replaces the
3030	* user record to the chain of free records.
3031	*
3032	* @param pPool The pool.
3033	* @param pPage The shadow page.
3034	* @param iUser The shadow page pool index of the user table.
3035	* @param iUserTable The index into the user table (shadowed).
3036	*
3037	* @remarks Don't call this for root pages.
3038	*/
3039	static void pgmPoolTrackFreeUser(PPGMPOOL pPool, PPGMPOOLPAGE pPage, uint16_t iUser, uint32_t iUserTable)
3040	{
3041	Log3(("pgmPoolTrackFreeUser %RGp %x %x\n", pPage->GCPhys, iUser, iUserTable));
3042	PPGMPOOLUSER paUsers = pPool->CTX_SUFF(paUsers);
3043	Assert(iUser != NIL_PGMPOOL_IDX);
3044
3045	/*
3046	* Unlink and free the specified user entry.
3047	*/
3048
3049	/* Special: For PAE and 32-bit paging, there is usually no more than one user. */
3050	uint16_t i = pPage->iUserHead;
3051	if ( i != NIL_PGMPOOL_USER_INDEX
3052	&& paUsers[i].iUser == iUser
3053	&& paUsers[i].iUserTable == iUserTable)
3054	{
3055	pPage->iUserHead = paUsers[i].iNext;
3056
3057	paUsers[i].iUser = NIL_PGMPOOL_IDX;
3058	paUsers[i].iNext = pPool->iUserFreeHead;
3059	pPool->iUserFreeHead = i;
3060	return;
3061	}
3062
3063	/* General: Linear search. */
3064	uint16_t iPrev = NIL_PGMPOOL_USER_INDEX;
3065	while (i != NIL_PGMPOOL_USER_INDEX)
3066	{
3067	if ( paUsers[i].iUser == iUser
3068	&& paUsers[i].iUserTable == iUserTable)
3069	{
3070	if (iPrev != NIL_PGMPOOL_USER_INDEX)
3071	paUsers[iPrev].iNext = paUsers[i].iNext;
3072	else
3073	pPage->iUserHead = paUsers[i].iNext;
3074
3075	paUsers[i].iUser = NIL_PGMPOOL_IDX;
3076	paUsers[i].iNext = pPool->iUserFreeHead;
3077	pPool->iUserFreeHead = i;
3078	return;
3079	}
3080	iPrev = i;
3081	i = paUsers[i].iNext;
3082	}
3083
3084	/* Fatal: didn't find it */
3085	AssertFatalMsgFailed(("Didn't find the user entry! iUser=%d iUserTable=%#x GCPhys=%RGp\n",
3086	iUser, iUserTable, pPage->GCPhys));
3087	}
3088
3089
3090	/**
3091	* Gets the entry size of a shadow table.
3092	*
3093	* @param enmKind The kind of page.
3094	*
3095	* @returns The size of the entry in bytes. That is, 4 or 8.
3096	* @returns If the kind is not for a table, an assertion is raised and 0 is
3097	* returned.
3098	*/
3099	DECLINLINE(unsigned) pgmPoolTrackGetShadowEntrySize(PGMPOOLKIND enmKind)
3100	{
3101	switch (enmKind)
3102	{
3103	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_PT:
3104	case PGMPOOLKIND_32BIT_PT_FOR_PHYS:
3105	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_4MB:
3106	case PGMPOOLKIND_32BIT_PD:
3107	case PGMPOOLKIND_32BIT_PD_PHYS:
3108	return 4;
3109
3110	case PGMPOOLKIND_PAE_PT_FOR_PHYS:
3111	case PGMPOOLKIND_PAE_PT_FOR_32BIT_PT:
3112	case PGMPOOLKIND_PAE_PT_FOR_32BIT_4MB:
3113	case PGMPOOLKIND_PAE_PT_FOR_PAE_PT:
3114	case PGMPOOLKIND_PAE_PT_FOR_PAE_2MB:
3115	case PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD:
3116	case PGMPOOLKIND_PAE_PD1_FOR_32BIT_PD:
3117	case PGMPOOLKIND_PAE_PD2_FOR_32BIT_PD:
3118	case PGMPOOLKIND_PAE_PD3_FOR_32BIT_PD:
3119	case PGMPOOLKIND_PAE_PD_FOR_PAE_PD:
3120	case PGMPOOLKIND_64BIT_PD_FOR_64BIT_PD:
3121	case PGMPOOLKIND_64BIT_PDPT_FOR_64BIT_PDPT:
3122	case PGMPOOLKIND_64BIT_PML4:
3123	case PGMPOOLKIND_PAE_PDPT:
3124	case PGMPOOLKIND_ROOT_NESTED:
3125	case PGMPOOLKIND_64BIT_PDPT_FOR_PHYS:
3126	case PGMPOOLKIND_64BIT_PD_FOR_PHYS:
3127	case PGMPOOLKIND_EPT_PDPT_FOR_PHYS:
3128	case PGMPOOLKIND_EPT_PD_FOR_PHYS:
3129	case PGMPOOLKIND_EPT_PT_FOR_PHYS:
3130	case PGMPOOLKIND_PAE_PD_PHYS:
3131	case PGMPOOLKIND_PAE_PDPT_PHYS:
3132	return 8;
3133
3134	default:
3135	AssertFatalMsgFailed(("enmKind=%d\n", enmKind));
3136	}
3137	}
3138
3139
3140	/**
3141	* Gets the entry size of a guest table.
3142	*
3143	* @param enmKind The kind of page.
3144	*
3145	* @returns The size of the entry in bytes. That is, 0, 4 or 8.
3146	* @returns If the kind is not for a table, an assertion is raised and 0 is
3147	* returned.
3148	*/
3149	DECLINLINE(unsigned) pgmPoolTrackGetGuestEntrySize(PGMPOOLKIND enmKind)
3150	{
3151	switch (enmKind)
3152	{
3153	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_PT:
3154	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_4MB:
3155	case PGMPOOLKIND_32BIT_PD:
3156	case PGMPOOLKIND_PAE_PT_FOR_32BIT_PT:
3157	case PGMPOOLKIND_PAE_PT_FOR_32BIT_4MB:
3158	case PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD:
3159	case PGMPOOLKIND_PAE_PD1_FOR_32BIT_PD:
3160	case PGMPOOLKIND_PAE_PD2_FOR_32BIT_PD:
3161	case PGMPOOLKIND_PAE_PD3_FOR_32BIT_PD:
3162	return 4;
3163
3164	case PGMPOOLKIND_PAE_PT_FOR_PAE_PT:
3165	case PGMPOOLKIND_PAE_PT_FOR_PAE_2MB:
3166	case PGMPOOLKIND_PAE_PD_FOR_PAE_PD:
3167	case PGMPOOLKIND_64BIT_PD_FOR_64BIT_PD:
3168	case PGMPOOLKIND_64BIT_PDPT_FOR_64BIT_PDPT:
3169	case PGMPOOLKIND_64BIT_PML4:
3170	case PGMPOOLKIND_PAE_PDPT:
3171	return 8;
3172
3173	case PGMPOOLKIND_32BIT_PT_FOR_PHYS:
3174	case PGMPOOLKIND_PAE_PT_FOR_PHYS:
3175	case PGMPOOLKIND_64BIT_PDPT_FOR_PHYS:
3176	case PGMPOOLKIND_64BIT_PD_FOR_PHYS:
3177	case PGMPOOLKIND_EPT_PDPT_FOR_PHYS:
3178	case PGMPOOLKIND_EPT_PD_FOR_PHYS:
3179	case PGMPOOLKIND_EPT_PT_FOR_PHYS:
3180	case PGMPOOLKIND_ROOT_NESTED:
3181	case PGMPOOLKIND_PAE_PD_PHYS:
3182	case PGMPOOLKIND_PAE_PDPT_PHYS:
3183	case PGMPOOLKIND_32BIT_PD_PHYS:
3184	/** @todo can we return 0? (nobody is calling this...) */
3185	AssertFailed();
3186	return 0;
3187
3188	default:
3189	AssertFatalMsgFailed(("enmKind=%d\n", enmKind));
3190	}
3191	}
3192
3193
3194	/**
3195	* Checks one shadow page table entry for a mapping of a physical page.
3196	*
3197	* @returns true / false indicating removal of all relevant PTEs
3198	*
3199	* @param pVM The cross context VM structure.
3200	* @param pPhysPage The guest page in question.
3201	* @param fFlushPTEs Flush PTEs or allow them to be updated (e.g. in case of an RW bit change)
3202	* @param iShw The shadow page table.
3203	* @param iPte Page table entry or NIL_PGMPOOL_PHYSEXT_IDX_PTE if unknown
3204	*/
3205	static bool pgmPoolTrackFlushGCPhysPTInt(PVM pVM, PCPGMPAGE pPhysPage, bool fFlushPTEs, uint16_t iShw, uint16_t iPte)
3206	{
3207	LogFlow(("pgmPoolTrackFlushGCPhysPTInt: pPhysPage=%RHp iShw=%d iPte=%d\n", PGM_PAGE_GET_HCPHYS(pPhysPage), iShw, iPte));
3208	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
3209	bool fRet = false;
3210
3211	/*
3212	* Assert sanity.
3213	*/
3214	Assert(iPte != NIL_PGMPOOL_PHYSEXT_IDX_PTE);
3215	AssertFatalMsg(iShw < pPool->cCurPages && iShw != NIL_PGMPOOL_IDX, ("iShw=%d\n", iShw));
3216	PPGMPOOLPAGE pPage = &pPool->aPages[iShw];
3217
3218	/*
3219	* Then, clear the actual mappings to the page in the shadow PT.
3220	*/
3221	switch (pPage->enmKind)
3222	{
3223	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_PT:
3224	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_4MB:
3225	case PGMPOOLKIND_32BIT_PT_FOR_PHYS:
3226	{
3227	const uint32_t u32 = PGM_PAGE_GET_HCPHYS(pPhysPage) \| X86_PTE_P;
3228	PX86PT pPT = (PX86PT)PGMPOOL_PAGE_2_PTR(pVM, pPage);
3229	uint32_t u32AndMask = 0;
3230	uint32_t u32OrMask = 0;
3231
3232	if (!fFlushPTEs)
3233	{
3234	switch (PGM_PAGE_GET_HNDL_PHYS_STATE(pPhysPage))
3235	{
3236	case PGM_PAGE_HNDL_PHYS_STATE_NONE: /** No handler installed. */
3237	case PGM_PAGE_HNDL_PHYS_STATE_DISABLED: /** Monitoring is temporarily disabled. */
3238	u32OrMask = X86_PTE_RW;
3239	u32AndMask = UINT32_MAX;
3240	fRet = true;
3241	STAM_COUNTER_INC(&pPool->StatTrackFlushEntryKeep);
3242	break;
3243
3244	case PGM_PAGE_HNDL_PHYS_STATE_WRITE: /** Write access is monitored. */
3245	u32OrMask = 0;
3246	u32AndMask = ~X86_PTE_RW;
3247	fRet = true;
3248	STAM_COUNTER_INC(&pPool->StatTrackFlushEntryKeep);
3249	break;
3250	default:
3251	/* (shouldn't be here, will assert below) */
3252	STAM_COUNTER_INC(&pPool->StatTrackFlushEntry);
3253	break;
3254	}
3255	}
3256	else
3257	STAM_COUNTER_INC(&pPool->StatTrackFlushEntry);
3258
3259	/* Update the counter if we're removing references. */
3260	if (!u32AndMask)
3261	{
3262	Assert(pPage->cPresent);
3263	Assert(pPool->cPresent);
3264	pPage->cPresent--;
3265	pPool->cPresent--;
3266	}
3267
3268	if ((pPT->a[iPte].u & (X86_PTE_PG_MASK \| X86_PTE_P)) == u32)
3269	{
3270	X86PTE Pte;
3271
3272	Log4(("pgmPoolTrackFlushGCPhysPTs: i=%d pte=%RX32\n", iPte, pPT->a[iPte]));
3273	Pte.u = (pPT->a[iPte].u & u32AndMask) \| u32OrMask;
3274	if (Pte.u & PGM_PTFLAGS_TRACK_DIRTY)
3275	Pte.n.u1Write = 0; /* need to disallow writes when dirty bit tracking is still active. */
3276
3277	ASMAtomicWriteU32(&pPT->a[iPte].u, Pte.u);
3278	PGM_DYNMAP_UNUSED_HINT_VM(pVM, pPT);
3279	return fRet;
3280	}
3281	#ifdef LOG_ENABLED
3282	Log(("iFirstPresent=%d cPresent=%d\n", pPage->iFirstPresent, pPage->cPresent));
3283	for (unsigned i = 0, cFound = 0; i < RT_ELEMENTS(pPT->a); i++)
3284	if ((pPT->a[i].u & (X86_PTE_PG_MASK \| X86_PTE_P)) == u32)
3285	{
3286	Log(("i=%d cFound=%d\n", i, ++cFound));
3287	}
3288	#endif
3289	AssertFatalMsgFailed(("iFirstPresent=%d cPresent=%d u32=%RX32 poolkind=%x\n", pPage->iFirstPresent, pPage->cPresent, u32, pPage->enmKind));
3290	/PGM_DYNMAP_UNUSED_HINT_VM(pVM, pPT);/
3291	break;
3292	}
3293
3294	case PGMPOOLKIND_PAE_PT_FOR_32BIT_PT:
3295	case PGMPOOLKIND_PAE_PT_FOR_32BIT_4MB:
3296	case PGMPOOLKIND_PAE_PT_FOR_PAE_PT:
3297	case PGMPOOLKIND_PAE_PT_FOR_PAE_2MB:
3298	case PGMPOOLKIND_PAE_PT_FOR_PHYS:
3299	case PGMPOOLKIND_EPT_PT_FOR_PHYS: /* physical mask the same as PAE; RW bit as well; be careful! */
3300	{
3301	const uint64_t u64 = PGM_PAGE_GET_HCPHYS(pPhysPage) \| X86_PTE_P;
3302	PPGMSHWPTPAE pPT = (PPGMSHWPTPAE)PGMPOOL_PAGE_2_PTR(pVM, pPage);
3303	uint64_t u64OrMask = 0;
3304	uint64_t u64AndMask = 0;
3305
3306	if (!fFlushPTEs)
3307	{
3308	switch (PGM_PAGE_GET_HNDL_PHYS_STATE(pPhysPage))
3309	{
3310	case PGM_PAGE_HNDL_PHYS_STATE_NONE: /* No handler installed. */
3311	case PGM_PAGE_HNDL_PHYS_STATE_DISABLED: /* Monitoring is temporarily disabled. */
3312	u64OrMask = X86_PTE_RW;
3313	u64AndMask = UINT64_MAX;
3314	fRet = true;
3315	STAM_COUNTER_INC(&pPool->StatTrackFlushEntryKeep);
3316	break;
3317
3318	case PGM_PAGE_HNDL_PHYS_STATE_WRITE: /* Write access is monitored. */
3319	u64OrMask = 0;
3320	u64AndMask = ~(uint64_t)X86_PTE_RW;
3321	fRet = true;
3322	STAM_COUNTER_INC(&pPool->StatTrackFlushEntryKeep);
3323	break;
3324
3325	default:
3326	/* (shouldn't be here, will assert below) */
3327	STAM_COUNTER_INC(&pPool->StatTrackFlushEntry);
3328	break;
3329	}
3330	}
3331	else
3332	STAM_COUNTER_INC(&pPool->StatTrackFlushEntry);
3333
3334	/* Update the counter if we're removing references. */
3335	if (!u64AndMask)
3336	{
3337	Assert(pPage->cPresent);
3338	Assert(pPool->cPresent);
3339	pPage->cPresent--;
3340	pPool->cPresent--;
3341	}
3342
3343	if ((PGMSHWPTEPAE_GET_U(pPT->a[iPte]) & (X86_PTE_PAE_PG_MASK \| X86_PTE_P \| X86_PTE_PAE_MBZ_MASK_NX)) == u64)
3344	{
3345	X86PTEPAE Pte;
3346
3347	Log4(("pgmPoolTrackFlushGCPhysPTs: i=%d pte=%RX64\n", iPte, PGMSHWPTEPAE_GET_LOG(pPT->a[iPte])));
3348	Pte.u = (PGMSHWPTEPAE_GET_U(pPT->a[iPte]) & u64AndMask) \| u64OrMask;
3349	if (Pte.u & PGM_PTFLAGS_TRACK_DIRTY)
3350	Pte.n.u1Write = 0; /* need to disallow writes when dirty bit tracking is still active. */
3351
3352	PGMSHWPTEPAE_ATOMIC_SET(pPT->a[iPte], Pte.u);
3353	PGM_DYNMAP_UNUSED_HINT_VM(pVM, pPT);
3354	return fRet;
3355	}
3356	#ifdef LOG_ENABLED
3357	Log(("iFirstPresent=%d cPresent=%d\n", pPage->iFirstPresent, pPage->cPresent));
3358	Log(("Found %RX64 expected %RX64\n", PGMSHWPTEPAE_GET_U(pPT->a[iPte]) & (X86_PTE_PAE_PG_MASK \| X86_PTE_P \| X86_PTE_PAE_MBZ_MASK_NX), u64));
3359	for (unsigned i = 0, cFound = 0; i < RT_ELEMENTS(pPT->a); i++)
3360	if ((PGMSHWPTEPAE_GET_U(pPT->a[i]) & (X86_PTE_PAE_PG_MASK \| X86_PTE_P \| X86_PTE_PAE_MBZ_MASK_NX)) == u64)
3361	Log(("i=%d cFound=%d\n", i, ++cFound));
3362	#endif
3363	AssertFatalMsgFailed(("iFirstPresent=%d cPresent=%d u64=%RX64 poolkind=%x iPte=%d PT=%RX64\n", pPage->iFirstPresent, pPage->cPresent, u64, pPage->enmKind, iPte, PGMSHWPTEPAE_GET_LOG(pPT->a[iPte])));
3364	/PGM_DYNMAP_UNUSED_HINT_VM(pVM, pPT);/
3365	break;
3366	}
3367
3368	#ifdef PGM_WITH_LARGE_PAGES
3369	/* Large page case only. */
3370	case PGMPOOLKIND_EPT_PD_FOR_PHYS:
3371	{
3372	Assert(pVM->pgm.s.fNestedPaging);
3373
3374	const uint64_t u64 = PGM_PAGE_GET_HCPHYS(pPhysPage) \| X86_PDE4M_P \| X86_PDE4M_PS;
3375	PEPTPD pPD = (PEPTPD)PGMPOOL_PAGE_2_PTR(pVM, pPage);
3376
3377	if ((pPD->a[iPte].u & (EPT_PDE2M_PG_MASK \| X86_PDE4M_P \| X86_PDE4M_PS)) == u64)
3378	{
3379	Log4(("pgmPoolTrackFlushGCPhysPTs: i=%d pde=%RX64\n", iPte, pPD->a[iPte]));
3380	STAM_COUNTER_INC(&pPool->StatTrackFlushEntry);
3381	pPD->a[iPte].u = 0;
3382	PGM_DYNMAP_UNUSED_HINT_VM(pVM, pPD);
3383
3384	/* Update the counter as we're removing references. */
3385	Assert(pPage->cPresent);
3386	Assert(pPool->cPresent);
3387	pPage->cPresent--;
3388	pPool->cPresent--;
3389
3390	return fRet;
3391	}
3392	# ifdef LOG_ENABLED
3393	Log(("iFirstPresent=%d cPresent=%d\n", pPage->iFirstPresent, pPage->cPresent));
3394	for (unsigned i = 0, cFound = 0; i < RT_ELEMENTS(pPD->a); i++)
3395	if ((pPD->a[i].u & (EPT_PDE2M_PG_MASK \| X86_PDE4M_P \| X86_PDE4M_PS)) == u64)
3396	Log(("i=%d cFound=%d\n", i, ++cFound));
3397	# endif
3398	AssertFatalMsgFailed(("iFirstPresent=%d cPresent=%d\n", pPage->iFirstPresent, pPage->cPresent));
3399	/PGM_DYNMAP_UNUSED_HINT_VM(pVM, pPD);/
3400	break;
3401	}
3402
3403	/* AMD-V nested paging / /* @todo merge with EPT as we only check the parts that are identical. */
3404	case PGMPOOLKIND_PAE_PD_PHYS:
3405	{
3406	Assert(pVM->pgm.s.fNestedPaging);
3407
3408	const uint64_t u64 = PGM_PAGE_GET_HCPHYS(pPhysPage) \| X86_PDE4M_P \| X86_PDE4M_PS;
3409	PX86PD pPD = (PX86PD)PGMPOOL_PAGE_2_PTR(pVM, pPage);
3410
3411	if ((pPD->a[iPte].u & (X86_PDE2M_PAE_PG_MASK \| X86_PDE4M_P \| X86_PDE4M_PS)) == u64)
3412	{
3413	Log4(("pgmPoolTrackFlushGCPhysPTs: i=%d pde=%RX64\n", iPte, pPD->a[iPte]));
3414	STAM_COUNTER_INC(&pPool->StatTrackFlushEntry);
3415	pPD->a[iPte].u = 0;
3416	PGM_DYNMAP_UNUSED_HINT_VM(pVM, pPD);
3417
3418	/* Update the counter as we're removing references. */
3419	Assert(pPage->cPresent);
3420	Assert(pPool->cPresent);
3421	pPage->cPresent--;
3422	pPool->cPresent--;
3423	return fRet;
3424	}
3425	# ifdef LOG_ENABLED
3426	Log(("iFirstPresent=%d cPresent=%d\n", pPage->iFirstPresent, pPage->cPresent));
3427	for (unsigned i = 0, cFound = 0; i < RT_ELEMENTS(pPD->a); i++)
3428	if ((pPD->a[i].u & (X86_PDE2M_PAE_PG_MASK \| X86_PDE4M_P \| X86_PDE4M_PS)) == u64)
3429	Log(("i=%d cFound=%d\n", i, ++cFound));
3430	# endif
3431	AssertFatalMsgFailed(("iFirstPresent=%d cPresent=%d\n", pPage->iFirstPresent, pPage->cPresent));
3432	/PGM_DYNMAP_UNUSED_HINT_VM(pVM, pPD);/
3433	break;
3434	}
3435	#endif /* PGM_WITH_LARGE_PAGES */
3436
3437	default:
3438	AssertFatalMsgFailed(("enmKind=%d iShw=%d\n", pPage->enmKind, iShw));
3439	}
3440
3441	/* not reached. */
3442	#ifndef _MSC_VER
3443	return fRet;
3444	#endif
3445	}
3446
3447
3448	/**
3449	* Scans one shadow page table for mappings of a physical page.
3450	*
3451	* @param pVM The cross context VM structure.
3452	* @param pPhysPage The guest page in question.
3453	* @param fFlushPTEs Flush PTEs or allow them to be updated (e.g. in case of an RW bit change)
3454	* @param iShw The shadow page table.
3455	*/
3456	static void pgmPoolTrackFlushGCPhysPT(PVM pVM, PPGMPAGE pPhysPage, bool fFlushPTEs, uint16_t iShw)
3457	{
3458	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool); NOREF(pPool);
3459
3460	/* We should only come here with when there's only one reference to this physical page. */
3461	Assert(PGMPOOL_TD_GET_CREFS(PGM_PAGE_GET_TRACKING(pPhysPage)) == 1);
3462
3463	Log2(("pgmPoolTrackFlushGCPhysPT: pPhysPage=%RHp iShw=%d\n", PGM_PAGE_GET_HCPHYS(pPhysPage), iShw));
3464	STAM_PROFILE_START(&pPool->StatTrackFlushGCPhysPT, f);
3465	bool fKeptPTEs = pgmPoolTrackFlushGCPhysPTInt(pVM, pPhysPage, fFlushPTEs, iShw, PGM_PAGE_GET_PTE_INDEX(pPhysPage));
3466	if (!fKeptPTEs)
3467	PGM_PAGE_SET_TRACKING(pVM, pPhysPage, 0);
3468	STAM_PROFILE_STOP(&pPool->StatTrackFlushGCPhysPT, f);
3469	}
3470
3471
3472	/**
3473	* Flushes a list of shadow page tables mapping the same physical page.
3474	*
3475	* @param pVM The cross context VM structure.
3476	* @param pPhysPage The guest page in question.
3477	* @param fFlushPTEs Flush PTEs or allow them to be updated (e.g. in case of an RW bit change)
3478	* @param iPhysExt The physical cross reference extent list to flush.
3479	*/
3480	static void pgmPoolTrackFlushGCPhysPTs(PVM pVM, PPGMPAGE pPhysPage, bool fFlushPTEs, uint16_t iPhysExt)
3481	{
3482	PGM_LOCK_ASSERT_OWNER(pVM);
3483	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
3484	bool fKeepList = false;
3485
3486	STAM_PROFILE_START(&pPool->StatTrackFlushGCPhysPTs, f);
3487	Log2(("pgmPoolTrackFlushGCPhysPTs: pPhysPage=%RHp iPhysExt=%u\n", PGM_PAGE_GET_HCPHYS(pPhysPage), iPhysExt));
3488
3489	const uint16_t iPhysExtStart = iPhysExt;
3490	PPGMPOOLPHYSEXT pPhysExt;
3491	do
3492	{
3493	Assert(iPhysExt < pPool->cMaxPhysExts);
3494	pPhysExt = &pPool->CTX_SUFF(paPhysExts)[iPhysExt];
3495	for (unsigned i = 0; i < RT_ELEMENTS(pPhysExt->aidx); i++)
3496	{
3497	if (pPhysExt->aidx[i] != NIL_PGMPOOL_IDX)
3498	{
3499	bool fKeptPTEs = pgmPoolTrackFlushGCPhysPTInt(pVM, pPhysPage, fFlushPTEs, pPhysExt->aidx[i], pPhysExt->apte[i]);
3500	if (!fKeptPTEs)
3501	{
3502	pPhysExt->aidx[i] = NIL_PGMPOOL_IDX;
3503	pPhysExt->apte[i] = NIL_PGMPOOL_PHYSEXT_IDX_PTE;
3504	}
3505	else
3506	fKeepList = true;
3507	}
3508	}
3509	/* next */
3510	iPhysExt = pPhysExt->iNext;
3511	} while (iPhysExt != NIL_PGMPOOL_PHYSEXT_INDEX);
3512
3513	if (!fKeepList)
3514	{
3515	/* insert the list into the free list and clear the ram range entry. */
3516	pPhysExt->iNext = pPool->iPhysExtFreeHead;
3517	pPool->iPhysExtFreeHead = iPhysExtStart;
3518	/* Invalidate the tracking data. */
3519	PGM_PAGE_SET_TRACKING(pVM, pPhysPage, 0);
3520	}
3521
3522	STAM_PROFILE_STOP(&pPool->StatTrackFlushGCPhysPTs, f);
3523	}
3524
3525
3526	/**
3527	* Flushes all shadow page table mappings of the given guest page.
3528	*
3529	* This is typically called when the host page backing the guest one has been
3530	* replaced or when the page protection was changed due to a guest access
3531	* caught by the monitoring.
3532	*
3533	* @returns VBox status code.
3534	* @retval VINF_SUCCESS if all references has been successfully cleared.
3535	* @retval VINF_PGM_SYNC_CR3 if we're better off with a CR3 sync and a page
3536	* pool cleaning. FF and sync flags are set.
3537	*
3538	* @param pVM The cross context VM structure.
3539	* @param GCPhysPage GC physical address of the page in question
3540	* @param pPhysPage The guest page in question.
3541	* @param fFlushPTEs Flush PTEs or allow them to be updated (e.g. in case of an RW bit change)
3542	* @param pfFlushTLBs This is set to @a true if the shadow TLBs should be
3543	* flushed, it is NOT touched if this isn't necessary.
3544	* The caller MUST initialized this to @a false.
3545	*/
3546	int pgmPoolTrackUpdateGCPhys(PVM pVM, RTGCPHYS GCPhysPage, PPGMPAGE pPhysPage, bool fFlushPTEs, bool *pfFlushTLBs)
3547	{
3548	PVMCPU pVCpu = VMMGetCpu(pVM);
3549	pgmLock(pVM);
3550	int rc = VINF_SUCCESS;
3551
3552	#ifdef PGM_WITH_LARGE_PAGES
3553	/* Is this page part of a large page? */
3554	if (PGM_PAGE_GET_PDE_TYPE(pPhysPage) == PGM_PAGE_PDE_TYPE_PDE)
3555	{
3556	RTGCPHYS GCPhysBase = GCPhysPage & X86_PDE2M_PAE_PG_MASK;
3557	GCPhysPage &= X86_PDE_PAE_PG_MASK;
3558
3559	/* Fetch the large page base. */
3560	PPGMPAGE pLargePage;
3561	if (GCPhysBase != GCPhysPage)
3562	{
3563	pLargePage = pgmPhysGetPage(pVM, GCPhysBase);
3564	AssertFatal(pLargePage);
3565	}
3566	else
3567	pLargePage = pPhysPage;
3568
3569	Log(("pgmPoolTrackUpdateGCPhys: update large page PDE for %RGp (%RGp)\n", GCPhysBase, GCPhysPage));
3570
3571	if (PGM_PAGE_GET_PDE_TYPE(pLargePage) == PGM_PAGE_PDE_TYPE_PDE)
3572	{
3573	/* Mark the large page as disabled as we need to break it up to change a single page in the 2 MB range. */
3574	PGM_PAGE_SET_PDE_TYPE(pVM, pLargePage, PGM_PAGE_PDE_TYPE_PDE_DISABLED);
3575	pVM->pgm.s.cLargePagesDisabled++;
3576
3577	/* Update the base as that only that one has a reference and there's only one PDE to clear. */
3578	rc = pgmPoolTrackUpdateGCPhys(pVM, GCPhysBase, pLargePage, fFlushPTEs, pfFlushTLBs);
3579
3580	*pfFlushTLBs = true;
3581	pgmUnlock(pVM);
3582	return rc;
3583	}
3584	}
3585	#else
3586	NOREF(GCPhysPage);
3587	#endif /* PGM_WITH_LARGE_PAGES */
3588
3589	const uint16_t u16 = PGM_PAGE_GET_TRACKING(pPhysPage);
3590	if (u16)
3591	{
3592	/*
3593	* The zero page is currently screwing up the tracking and we'll
3594	* have to flush the whole shebang. Unless VBOX_WITH_NEW_LAZY_PAGE_ALLOC
3595	* is defined, zero pages won't normally be mapped. Some kind of solution
3596	* will be needed for this problem of course, but it will have to wait...
3597	*/
3598	if ( PGM_PAGE_IS_ZERO(pPhysPage)
3599	\|\| PGM_PAGE_IS_BALLOONED(pPhysPage))
3600	rc = VINF_PGM_GCPHYS_ALIASED;
3601	else
3602	{
3603	# if defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0) \|\| defined(IN_RC) /** @todo we can drop this now. */
3604	/* Start a subset here because pgmPoolTrackFlushGCPhysPTsSlow and
3605	pgmPoolTrackFlushGCPhysPTs will/may kill the pool otherwise. */
3606	uint32_t iPrevSubset = PGMRZDynMapPushAutoSubset(pVCpu);
3607	# endif
3608
3609	if (PGMPOOL_TD_GET_CREFS(u16) != PGMPOOL_TD_CREFS_PHYSEXT)
3610	{
3611	Assert(PGMPOOL_TD_GET_CREFS(u16) == 1);
3612	pgmPoolTrackFlushGCPhysPT(pVM,
3613	pPhysPage,
3614	fFlushPTEs,
3615	PGMPOOL_TD_GET_IDX(u16));
3616	}
3617	else if (u16 != PGMPOOL_TD_MAKE(PGMPOOL_TD_CREFS_PHYSEXT, PGMPOOL_TD_IDX_OVERFLOWED))
3618	pgmPoolTrackFlushGCPhysPTs(pVM, pPhysPage, fFlushPTEs, PGMPOOL_TD_GET_IDX(u16));
3619	else
3620	rc = pgmPoolTrackFlushGCPhysPTsSlow(pVM, pPhysPage);
3621	*pfFlushTLBs = true;
3622
3623	# if defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0) \|\| defined(IN_RC)
3624	PGMRZDynMapPopAutoSubset(pVCpu, iPrevSubset);
3625	# endif
3626	}
3627	}
3628
3629	if (rc == VINF_PGM_GCPHYS_ALIASED)
3630	{
3631	pVCpu->pgm.s.fSyncFlags \|= PGM_SYNC_CLEAR_PGM_POOL;
3632	VMCPU_FF_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3);
3633	rc = VINF_PGM_SYNC_CR3;
3634	}
3635	pgmUnlock(pVM);
3636	return rc;
3637	}
3638
3639
3640	/**
3641	* Scans all shadow page tables for mappings of a physical page.
3642	*
3643	* This may be slow, but it's most likely more efficient than cleaning
3644	* out the entire page pool / cache.
3645	*
3646	* @returns VBox status code.
3647	* @retval VINF_SUCCESS if all references has been successfully cleared.
3648	* @retval VINF_PGM_GCPHYS_ALIASED if we're better off with a CR3 sync and
3649	* a page pool cleaning.
3650	*
3651	* @param pVM The cross context VM structure.
3652	* @param pPhysPage The guest page in question.
3653	*/
3654	int pgmPoolTrackFlushGCPhysPTsSlow(PVM pVM, PPGMPAGE pPhysPage)
3655	{
3656	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
3657	STAM_PROFILE_START(&pPool->StatTrackFlushGCPhysPTsSlow, s);
3658	LogFlow(("pgmPoolTrackFlushGCPhysPTsSlow: cUsedPages=%d cPresent=%d pPhysPage=%R[pgmpage]\n",
3659	pPool->cUsedPages, pPool->cPresent, pPhysPage));
3660
3661	/*
3662	* There is a limit to what makes sense.
3663	*/
3664	if ( pPool->cPresent > 1024
3665	&& pVM->cCpus == 1)
3666	{
3667	LogFlow(("pgmPoolTrackFlushGCPhysPTsSlow: giving up... (cPresent=%d)\n", pPool->cPresent));
3668	STAM_PROFILE_STOP(&pPool->StatTrackFlushGCPhysPTsSlow, s);
3669	return VINF_PGM_GCPHYS_ALIASED;
3670	}
3671
3672	/*
3673	* Iterate all the pages until we've encountered all that in use.
3674	* This is simple but not quite optimal solution.
3675	*/
3676	const uint64_t u64 = PGM_PAGE_GET_HCPHYS(pPhysPage) \| X86_PTE_P; /** @todo drop X86_PTE_P here as we always test if present separately, anyway. */
3677	const uint32_t u32 = u64; /** @todo move into the 32BIT_PT_xx case */
3678	unsigned cLeft = pPool->cUsedPages;
3679	unsigned iPage = pPool->cCurPages;
3680	while (--iPage >= PGMPOOL_IDX_FIRST)
3681	{
3682	PPGMPOOLPAGE pPage = &pPool->aPages[iPage];
3683	if ( pPage->GCPhys != NIL_RTGCPHYS
3684	&& pPage->cPresent)
3685	{
3686	switch (pPage->enmKind)
3687	{
3688	/*
3689	* We only care about shadow page tables.
3690	*/
3691	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_PT:
3692	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_4MB:
3693	case PGMPOOLKIND_32BIT_PT_FOR_PHYS:
3694	{
3695	unsigned cPresent = pPage->cPresent;
3696	PX86PT pPT = (PX86PT)PGMPOOL_PAGE_2_PTR(pVM, pPage);
3697	for (unsigned i = pPage->iFirstPresent; i < RT_ELEMENTS(pPT->a); i++)
3698	if (pPT->a[i].n.u1Present)
3699	{
3700	if ((pPT->a[i].u & (X86_PTE_PG_MASK \| X86_PTE_P)) == u32)
3701	{
3702	//Log4(("pgmPoolTrackFlushGCPhysPTsSlow: idx=%d i=%d pte=%RX32\n", iPage, i, pPT->a[i]));
3703	pPT->a[i].u = 0;
3704
3705	/* Update the counter as we're removing references. */
3706	Assert(pPage->cPresent);
3707	Assert(pPool->cPresent);
3708	pPage->cPresent--;
3709	pPool->cPresent--;
3710	}
3711	if (!--cPresent)
3712	break;
3713	}
3714	PGM_DYNMAP_UNUSED_HINT_VM(pVM, pPT);
3715	break;
3716	}
3717
3718	case PGMPOOLKIND_PAE_PT_FOR_32BIT_PT:
3719	case PGMPOOLKIND_PAE_PT_FOR_32BIT_4MB:
3720	case PGMPOOLKIND_PAE_PT_FOR_PAE_PT:
3721	case PGMPOOLKIND_PAE_PT_FOR_PAE_2MB:
3722	case PGMPOOLKIND_PAE_PT_FOR_PHYS:
3723	{
3724	unsigned cPresent = pPage->cPresent;
3725	PPGMSHWPTPAE pPT = (PPGMSHWPTPAE)PGMPOOL_PAGE_2_PTR(pVM, pPage);
3726	for (unsigned i = pPage->iFirstPresent; i < RT_ELEMENTS(pPT->a); i++)
3727	if (PGMSHWPTEPAE_IS_P(pPT->a[i]))
3728	{
3729	if ((PGMSHWPTEPAE_GET_U(pPT->a[i]) & (X86_PTE_PAE_PG_MASK \| X86_PTE_P)) == u64)
3730	{
3731	//Log4(("pgmPoolTrackFlushGCPhysPTsSlow: idx=%d i=%d pte=%RX64\n", iPage, i, pPT->a[i]));
3732	PGMSHWPTEPAE_SET(pPT->a[i], 0); /// @todo why not atomic?
3733
3734	/* Update the counter as we're removing references. */
3735	Assert(pPage->cPresent);
3736	Assert(pPool->cPresent);
3737	pPage->cPresent--;
3738	pPool->cPresent--;
3739	}
3740	if (!--cPresent)
3741	break;
3742	}
3743	PGM_DYNMAP_UNUSED_HINT_VM(pVM, pPT);
3744	break;
3745	}
3746	#ifndef IN_RC
3747	case PGMPOOLKIND_EPT_PT_FOR_PHYS:
3748	{
3749	unsigned cPresent = pPage->cPresent;
3750	PEPTPT pPT = (PEPTPT)PGMPOOL_PAGE_2_PTR(pVM, pPage);
3751	for (unsigned i = pPage->iFirstPresent; i < RT_ELEMENTS(pPT->a); i++)
3752	if (pPT->a[i].n.u1Present)
3753	{
3754	if ((pPT->a[i].u & (EPT_PTE_PG_MASK \| X86_PTE_P)) == u64)
3755	{
3756	//Log4(("pgmPoolTrackFlushGCPhysPTsSlow: idx=%d i=%d pte=%RX64\n", iPage, i, pPT->a[i]));
3757	pPT->a[i].u = 0;
3758
3759	/* Update the counter as we're removing references. */
3760	Assert(pPage->cPresent);
3761	Assert(pPool->cPresent);
3762	pPage->cPresent--;
3763	pPool->cPresent--;
3764	}
3765	if (!--cPresent)
3766	break;
3767	}
3768	PGM_DYNMAP_UNUSED_HINT_VM(pVM, pPT);
3769	break;
3770	}
3771	#endif
3772	}
3773	if (!--cLeft)
3774	break;
3775	}
3776	}
3777
3778	PGM_PAGE_SET_TRACKING(pVM, pPhysPage, 0);
3779	STAM_PROFILE_STOP(&pPool->StatTrackFlushGCPhysPTsSlow, s);
3780
3781	/*
3782	* There is a limit to what makes sense. The above search is very expensive, so force a pgm pool flush.
3783	*/
3784	if (pPool->cPresent > 1024)
3785	{
3786	LogFlow(("pgmPoolTrackFlushGCPhysPTsSlow: giving up... (cPresent=%d)\n", pPool->cPresent));
3787	return VINF_PGM_GCPHYS_ALIASED;
3788	}
3789
3790	return VINF_SUCCESS;
3791	}
3792
3793
3794	/**
3795	* Clears the user entry in a user table.
3796	*
3797	* This is used to remove all references to a page when flushing it.
3798	*/
3799	static void pgmPoolTrackClearPageUser(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PCPGMPOOLUSER pUser)
3800	{
3801	Assert(pUser->iUser != NIL_PGMPOOL_IDX);
3802	Assert(pUser->iUser < pPool->cCurPages);
3803	uint32_t iUserTable = pUser->iUserTable;
3804
3805	/*
3806	* Map the user page. Ignore references made by fictitious pages.
3807	*/
3808	PPGMPOOLPAGE pUserPage = &pPool->aPages[pUser->iUser];
3809	LogFlow(("pgmPoolTrackClearPageUser: clear %x in %s (%RGp) (flushing %s)\n", iUserTable, pgmPoolPoolKindToStr(pUserPage->enmKind), pUserPage->Core.Key, pgmPoolPoolKindToStr(pPage->enmKind)));
3810	union
3811	{
3812	uint64_t *pau64;
3813	uint32_t *pau32;
3814	} u;
3815	if (pUserPage->idx < PGMPOOL_IDX_FIRST)
3816	{
3817	Assert(!pUserPage->pvPageR3);
3818	return;
3819	}
3820	u.pau64 = (uint64_t *)PGMPOOL_PAGE_2_PTR(pPool->CTX_SUFF(pVM), pUserPage);
3821
3822
3823	/* Safety precaution in case we change the paging for other modes too in the future. */
3824	Assert(!pgmPoolIsPageLocked(pPage));
3825
3826	#ifdef VBOX_STRICT
3827	/*
3828	* Some sanity checks.
3829	*/
3830	switch (pUserPage->enmKind)
3831	{
3832	case PGMPOOLKIND_32BIT_PD:
3833	case PGMPOOLKIND_32BIT_PD_PHYS:
3834	Assert(iUserTable < X86_PG_ENTRIES);
3835	break;
3836	case PGMPOOLKIND_PAE_PDPT:
3837	case PGMPOOLKIND_PAE_PDPT_FOR_32BIT:
3838	case PGMPOOLKIND_PAE_PDPT_PHYS:
3839	Assert(iUserTable < 4);
3840	Assert(!(u.pau64[iUserTable] & PGM_PLXFLAGS_PERMANENT));
3841	break;
3842	case PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD:
3843	case PGMPOOLKIND_PAE_PD1_FOR_32BIT_PD:
3844	case PGMPOOLKIND_PAE_PD2_FOR_32BIT_PD:
3845	case PGMPOOLKIND_PAE_PD3_FOR_32BIT_PD:
3846	case PGMPOOLKIND_PAE_PD_FOR_PAE_PD:
3847	case PGMPOOLKIND_PAE_PD_PHYS:
3848	Assert(iUserTable < X86_PG_PAE_ENTRIES);
3849	break;
3850	case PGMPOOLKIND_64BIT_PD_FOR_64BIT_PD:
3851	Assert(iUserTable < X86_PG_PAE_ENTRIES);
3852	Assert(!(u.pau64[iUserTable] & PGM_PDFLAGS_MAPPING));
3853	break;
3854	case PGMPOOLKIND_64BIT_PDPT_FOR_64BIT_PDPT:
3855	Assert(iUserTable < X86_PG_PAE_ENTRIES);
3856	Assert(!(u.pau64[iUserTable] & PGM_PLXFLAGS_PERMANENT));
3857	break;
3858	case PGMPOOLKIND_64BIT_PML4:
3859	Assert(!(u.pau64[iUserTable] & PGM_PLXFLAGS_PERMANENT));
3860	/* GCPhys >> PAGE_SHIFT is the index here */
3861	break;
3862	case PGMPOOLKIND_64BIT_PDPT_FOR_PHYS:
3863	case PGMPOOLKIND_64BIT_PD_FOR_PHYS:
3864	Assert(iUserTable < X86_PG_PAE_ENTRIES);
3865	break;
3866
3867	case PGMPOOLKIND_EPT_PDPT_FOR_PHYS:
3868	case PGMPOOLKIND_EPT_PD_FOR_PHYS:
3869	Assert(iUserTable < X86_PG_PAE_ENTRIES);
3870	break;
3871
3872	case PGMPOOLKIND_ROOT_NESTED:
3873	Assert(iUserTable < X86_PG_PAE_ENTRIES);
3874	break;
3875
3876	default:
3877	AssertMsgFailed(("enmKind=%d\n", pUserPage->enmKind));
3878	break;
3879	}
3880	#endif /* VBOX_STRICT */
3881
3882	/*
3883	* Clear the entry in the user page.
3884	*/
3885	switch (pUserPage->enmKind)
3886	{
3887	/* 32-bit entries */
3888	case PGMPOOLKIND_32BIT_PD:
3889	case PGMPOOLKIND_32BIT_PD_PHYS:
3890	ASMAtomicWriteU32(&u.pau32[iUserTable], 0);
3891	break;
3892
3893	/* 64-bit entries */
3894	case PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD:
3895	case PGMPOOLKIND_PAE_PD1_FOR_32BIT_PD:
3896	case PGMPOOLKIND_PAE_PD2_FOR_32BIT_PD:
3897	case PGMPOOLKIND_PAE_PD3_FOR_32BIT_PD:
3898	case PGMPOOLKIND_PAE_PD_FOR_PAE_PD:
3899	#ifdef IN_RC
3900	/*
3901	* In 32 bits PAE mode we must invalidate the TLB when changing a
3902	* PDPT entry; the CPU fetches them only during cr3 load, so any
3903	* non-present PDPT will continue to cause page faults.
3904	*/
3905	ASMReloadCR3();
3906	/* no break */
3907	#endif
3908	case PGMPOOLKIND_PAE_PD_PHYS:
3909	case PGMPOOLKIND_PAE_PDPT_PHYS:
3910	case PGMPOOLKIND_64BIT_PD_FOR_64BIT_PD:
3911	case PGMPOOLKIND_64BIT_PDPT_FOR_64BIT_PDPT:
3912	case PGMPOOLKIND_64BIT_PML4:
3913	case PGMPOOLKIND_64BIT_PDPT_FOR_PHYS:
3914	case PGMPOOLKIND_64BIT_PD_FOR_PHYS:
3915	case PGMPOOLKIND_PAE_PDPT:
3916	case PGMPOOLKIND_PAE_PDPT_FOR_32BIT:
3917	case PGMPOOLKIND_ROOT_NESTED:
3918	case PGMPOOLKIND_EPT_PDPT_FOR_PHYS:
3919	case PGMPOOLKIND_EPT_PD_FOR_PHYS:
3920	ASMAtomicWriteU64(&u.pau64[iUserTable], 0);
3921	break;
3922
3923	default:
3924	AssertFatalMsgFailed(("enmKind=%d iUser=%d iUserTable=%#x\n", pUserPage->enmKind, pUser->iUser, pUser->iUserTable));
3925	}
3926	PGM_DYNMAP_UNUSED_HINT_VM(pPool->CTX_SUFF(pVM), u.pau64);
3927	}
3928
3929
3930	/**
3931	* Clears all users of a page.
3932	*/
3933	static void pgmPoolTrackClearPageUsers(PPGMPOOL pPool, PPGMPOOLPAGE pPage)
3934	{
3935	/*
3936	* Free all the user records.
3937	*/
3938	LogFlow(("pgmPoolTrackClearPageUsers %RGp\n", pPage->GCPhys));
3939
3940	PPGMPOOLUSER paUsers = pPool->CTX_SUFF(paUsers);
3941	uint16_t i = pPage->iUserHead;
3942	while (i != NIL_PGMPOOL_USER_INDEX)
3943	{
3944	/* Clear enter in user table. */
3945	pgmPoolTrackClearPageUser(pPool, pPage, &paUsers[i]);
3946
3947	/* Free it. */
3948	const uint16_t iNext = paUsers[i].iNext;
3949	paUsers[i].iUser = NIL_PGMPOOL_IDX;
3950	paUsers[i].iNext = pPool->iUserFreeHead;
3951	pPool->iUserFreeHead = i;
3952
3953	/* Next. */
3954	i = iNext;
3955	}
3956	pPage->iUserHead = NIL_PGMPOOL_USER_INDEX;
3957	}
3958
3959
3960	/**
3961	* Allocates a new physical cross reference extent.
3962	*
3963	* @returns Pointer to the allocated extent on success. NULL if we're out of them.
3964	* @param pVM The cross context VM structure.
3965	* @param piPhysExt Where to store the phys ext index.
3966	*/
3967	PPGMPOOLPHYSEXT pgmPoolTrackPhysExtAlloc(PVM pVM, uint16_t *piPhysExt)
3968	{
3969	PGM_LOCK_ASSERT_OWNER(pVM);
3970	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
3971	uint16_t iPhysExt = pPool->iPhysExtFreeHead;
3972	if (iPhysExt == NIL_PGMPOOL_PHYSEXT_INDEX)
3973	{
3974	STAM_COUNTER_INC(&pPool->StamTrackPhysExtAllocFailures);
3975	return NULL;
3976	}
3977	PPGMPOOLPHYSEXT pPhysExt = &pPool->CTX_SUFF(paPhysExts)[iPhysExt];
3978	pPool->iPhysExtFreeHead = pPhysExt->iNext;
3979	pPhysExt->iNext = NIL_PGMPOOL_PHYSEXT_INDEX;
3980	*piPhysExt = iPhysExt;
3981	return pPhysExt;
3982	}
3983
3984
3985	/**
3986	* Frees a physical cross reference extent.
3987	*
3988	* @param pVM The cross context VM structure.
3989	* @param iPhysExt The extent to free.
3990	*/
3991	void pgmPoolTrackPhysExtFree(PVM pVM, uint16_t iPhysExt)
3992	{
3993	PGM_LOCK_ASSERT_OWNER(pVM);
3994	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
3995	Assert(iPhysExt < pPool->cMaxPhysExts);
3996	PPGMPOOLPHYSEXT pPhysExt = &pPool->CTX_SUFF(paPhysExts)[iPhysExt];
3997	for (unsigned i = 0; i < RT_ELEMENTS(pPhysExt->aidx); i++)
3998	{
3999	pPhysExt->aidx[i] = NIL_PGMPOOL_IDX;
4000	pPhysExt->apte[i] = NIL_PGMPOOL_PHYSEXT_IDX_PTE;
4001	}
4002	pPhysExt->iNext = pPool->iPhysExtFreeHead;
4003	pPool->iPhysExtFreeHead = iPhysExt;
4004	}
4005
4006
4007	/**
4008	* Frees a physical cross reference extent.
4009	*
4010	* @param pVM The cross context VM structure.
4011	* @param iPhysExt The extent to free.
4012	*/
4013	void pgmPoolTrackPhysExtFreeList(PVM pVM, uint16_t iPhysExt)
4014	{
4015	PGM_LOCK_ASSERT_OWNER(pVM);
4016	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
4017
4018	const uint16_t iPhysExtStart = iPhysExt;
4019	PPGMPOOLPHYSEXT pPhysExt;
4020	do
4021	{
4022	Assert(iPhysExt < pPool->cMaxPhysExts);
4023	pPhysExt = &pPool->CTX_SUFF(paPhysExts)[iPhysExt];
4024	for (unsigned i = 0; i < RT_ELEMENTS(pPhysExt->aidx); i++)
4025	{
4026	pPhysExt->aidx[i] = NIL_PGMPOOL_IDX;
4027	pPhysExt->apte[i] = NIL_PGMPOOL_PHYSEXT_IDX_PTE;
4028	}
4029
4030	/* next */
4031	iPhysExt = pPhysExt->iNext;
4032	} while (iPhysExt != NIL_PGMPOOL_PHYSEXT_INDEX);
4033
4034	pPhysExt->iNext = pPool->iPhysExtFreeHead;
4035	pPool->iPhysExtFreeHead = iPhysExtStart;
4036	}
4037
4038
4039	/**
4040	* Insert a reference into a list of physical cross reference extents.
4041	*
4042	* @returns The new tracking data for PGMPAGE.
4043	*
4044	* @param pVM The cross context VM structure.
4045	* @param iPhysExt The physical extent index of the list head.
4046	* @param iShwPT The shadow page table index.
4047	* @param iPte Page table entry
4048	*
4049	*/
4050	static uint16_t pgmPoolTrackPhysExtInsert(PVM pVM, uint16_t iPhysExt, uint16_t iShwPT, uint16_t iPte)
4051	{
4052	PGM_LOCK_ASSERT_OWNER(pVM);
4053	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
4054	PPGMPOOLPHYSEXT paPhysExts = pPool->CTX_SUFF(paPhysExts);
4055
4056	/*
4057	* Special common cases.
4058	*/
4059	if (paPhysExts[iPhysExt].aidx[1] == NIL_PGMPOOL_IDX)
4060	{
4061	paPhysExts[iPhysExt].aidx[1] = iShwPT;
4062	paPhysExts[iPhysExt].apte[1] = iPte;
4063	STAM_COUNTER_INC(&pVM->pgm.s.CTX_SUFF(pStats)->StatTrackAliasedMany);
4064	LogFlow(("pgmPoolTrackPhysExtInsert: %d:{,%d pte %d,}\n", iPhysExt, iShwPT, iPte));
4065	return PGMPOOL_TD_MAKE(PGMPOOL_TD_CREFS_PHYSEXT, iPhysExt);
4066	}
4067	if (paPhysExts[iPhysExt].aidx[2] == NIL_PGMPOOL_IDX)
4068	{
4069	paPhysExts[iPhysExt].aidx[2] = iShwPT;
4070	paPhysExts[iPhysExt].apte[2] = iPte;
4071	STAM_COUNTER_INC(&pVM->pgm.s.CTX_SUFF(pStats)->StatTrackAliasedMany);
4072	LogFlow(("pgmPoolTrackPhysExtInsert: %d:{,,%d pte %d}\n", iPhysExt, iShwPT, iPte));
4073	return PGMPOOL_TD_MAKE(PGMPOOL_TD_CREFS_PHYSEXT, iPhysExt);
4074	}
4075	AssertCompile(RT_ELEMENTS(paPhysExts[iPhysExt].aidx) == 3);
4076
4077	/*
4078	* General treatment.
4079	*/
4080	const uint16_t iPhysExtStart = iPhysExt;
4081	unsigned cMax = 15;
4082	for (;;)
4083	{
4084	Assert(iPhysExt < pPool->cMaxPhysExts);
4085	for (unsigned i = 0; i < RT_ELEMENTS(paPhysExts[iPhysExt].aidx); i++)
4086	if (paPhysExts[iPhysExt].aidx[i] == NIL_PGMPOOL_IDX)
4087	{
4088	paPhysExts[iPhysExt].aidx[i] = iShwPT;
4089	paPhysExts[iPhysExt].apte[i] = iPte;
4090	STAM_COUNTER_INC(&pVM->pgm.s.CTX_SUFF(pStats)->StatTrackAliasedMany);
4091	LogFlow(("pgmPoolTrackPhysExtInsert: %d:{%d pte %d} i=%d cMax=%d\n", iPhysExt, iShwPT, iPte, i, cMax));
4092	return PGMPOOL_TD_MAKE(PGMPOOL_TD_CREFS_PHYSEXT, iPhysExtStart);
4093	}
4094	if (!--cMax)
4095	{
4096	STAM_COUNTER_INC(&pVM->pgm.s.CTX_SUFF(pStats)->StatTrackOverflows);
4097	pgmPoolTrackPhysExtFreeList(pVM, iPhysExtStart);
4098	LogFlow(("pgmPoolTrackPhysExtInsert: overflow (1) iShwPT=%d\n", iShwPT));
4099	return PGMPOOL_TD_MAKE(PGMPOOL_TD_CREFS_PHYSEXT, PGMPOOL_TD_IDX_OVERFLOWED);
4100	}
4101
4102	/* advance */
4103	iPhysExt = paPhysExts[iPhysExt].iNext;
4104	if (iPhysExt == NIL_PGMPOOL_PHYSEXT_INDEX)
4105	break;
4106	}
4107
4108	/*
4109	* Add another extent to the list.
4110	*/
4111	PPGMPOOLPHYSEXT pNew = pgmPoolTrackPhysExtAlloc(pVM, &iPhysExt);
4112	if (!pNew)
4113	{
4114	STAM_COUNTER_INC(&pVM->pgm.s.CTX_SUFF(pStats)->StatTrackNoExtentsLeft);
4115	pgmPoolTrackPhysExtFreeList(pVM, iPhysExtStart);
4116	LogFlow(("pgmPoolTrackPhysExtInsert: pgmPoolTrackPhysExtAlloc failed iShwPT=%d\n", iShwPT));
4117	return PGMPOOL_TD_MAKE(PGMPOOL_TD_CREFS_PHYSEXT, PGMPOOL_TD_IDX_OVERFLOWED);
4118	}
4119	pNew->iNext = iPhysExtStart;
4120	pNew->aidx[0] = iShwPT;
4121	pNew->apte[0] = iPte;
4122	LogFlow(("pgmPoolTrackPhysExtInsert: added new extent %d:{%d pte %d}->%d\n", iPhysExt, iShwPT, iPte, iPhysExtStart));
4123	return PGMPOOL_TD_MAKE(PGMPOOL_TD_CREFS_PHYSEXT, iPhysExt);
4124	}
4125
4126
4127	/**
4128	* Add a reference to guest physical page where extents are in use.
4129	*
4130	* @returns The new tracking data for PGMPAGE.
4131	*
4132	* @param pVM The cross context VM structure.
4133	* @param pPhysPage Pointer to the aPages entry in the ram range.
4134	* @param u16 The ram range flags (top 16-bits).
4135	* @param iShwPT The shadow page table index.
4136	* @param iPte Page table entry
4137	*/
4138	uint16_t pgmPoolTrackPhysExtAddref(PVM pVM, PPGMPAGE pPhysPage, uint16_t u16, uint16_t iShwPT, uint16_t iPte)
4139	{
4140	pgmLock(pVM);
4141	if (PGMPOOL_TD_GET_CREFS(u16) != PGMPOOL_TD_CREFS_PHYSEXT)
4142	{
4143	/*
4144	* Convert to extent list.
4145	*/
4146	Assert(PGMPOOL_TD_GET_CREFS(u16) == 1);
4147	uint16_t iPhysExt;
4148	PPGMPOOLPHYSEXT pPhysExt = pgmPoolTrackPhysExtAlloc(pVM, &iPhysExt);
4149	if (pPhysExt)
4150	{
4151	LogFlow(("pgmPoolTrackPhysExtAddref: new extent: %d:{%d, %d}\n", iPhysExt, PGMPOOL_TD_GET_IDX(u16), iShwPT));
4152	STAM_COUNTER_INC(&pVM->pgm.s.CTX_SUFF(pStats)->StatTrackAliased);
4153	pPhysExt->aidx[0] = PGMPOOL_TD_GET_IDX(u16);
4154	pPhysExt->apte[0] = PGM_PAGE_GET_PTE_INDEX(pPhysPage);
4155	pPhysExt->aidx[1] = iShwPT;
4156	pPhysExt->apte[1] = iPte;
4157	u16 = PGMPOOL_TD_MAKE(PGMPOOL_TD_CREFS_PHYSEXT, iPhysExt);
4158	}
4159	else
4160	u16 = PGMPOOL_TD_MAKE(PGMPOOL_TD_CREFS_PHYSEXT, PGMPOOL_TD_IDX_OVERFLOWED);
4161	}
4162	else if (u16 != PGMPOOL_TD_MAKE(PGMPOOL_TD_CREFS_PHYSEXT, PGMPOOL_TD_IDX_OVERFLOWED))
4163	{
4164	/*
4165	* Insert into the extent list.
4166	*/
4167	u16 = pgmPoolTrackPhysExtInsert(pVM, PGMPOOL_TD_GET_IDX(u16), iShwPT, iPte);
4168	}
4169	else
4170	STAM_COUNTER_INC(&pVM->pgm.s.CTX_SUFF(pStats)->StatTrackAliasedLots);
4171	pgmUnlock(pVM);
4172	return u16;
4173	}
4174
4175
4176	/**
4177	* Clear references to guest physical memory.
4178	*
4179	* @param pPool The pool.
4180	* @param pPage The page.
4181	* @param pPhysPage Pointer to the aPages entry in the ram range.
4182	* @param iPte Shadow PTE index
4183	*/
4184	void pgmPoolTrackPhysExtDerefGCPhys(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PPGMPAGE pPhysPage, uint16_t iPte)
4185	{
4186	PVM pVM = pPool->CTX_SUFF(pVM);
4187	const unsigned cRefs = PGM_PAGE_GET_TD_CREFS(pPhysPage);
4188	AssertFatalMsg(cRefs == PGMPOOL_TD_CREFS_PHYSEXT, ("cRefs=%d pPhysPage=%R[pgmpage] pPage=%p:{.idx=%d}\n", cRefs, pPhysPage, pPage, pPage->idx));
4189
4190	uint16_t iPhysExt = PGM_PAGE_GET_TD_IDX(pPhysPage);
4191	if (iPhysExt != PGMPOOL_TD_IDX_OVERFLOWED)
4192	{
4193	pgmLock(pVM);
4194
4195	uint16_t iPhysExtPrev = NIL_PGMPOOL_PHYSEXT_INDEX;
4196	PPGMPOOLPHYSEXT paPhysExts = pPool->CTX_SUFF(paPhysExts);
4197	do
4198	{
4199	Assert(iPhysExt < pPool->cMaxPhysExts);
4200
4201	/*
4202	* Look for the shadow page and check if it's all freed.
4203	*/
4204	for (unsigned i = 0; i < RT_ELEMENTS(paPhysExts[iPhysExt].aidx); i++)
4205	{
4206	if ( paPhysExts[iPhysExt].aidx[i] == pPage->idx
4207	&& paPhysExts[iPhysExt].apte[i] == iPte)
4208	{
4209	paPhysExts[iPhysExt].aidx[i] = NIL_PGMPOOL_IDX;
4210	paPhysExts[iPhysExt].apte[i] = NIL_PGMPOOL_PHYSEXT_IDX_PTE;
4211
4212	for (i = 0; i < RT_ELEMENTS(paPhysExts[iPhysExt].aidx); i++)
4213	if (paPhysExts[iPhysExt].aidx[i] != NIL_PGMPOOL_IDX)
4214	{
4215	Log2(("pgmPoolTrackPhysExtDerefGCPhys: pPhysPage=%R[pgmpage] idx=%d\n", pPhysPage, pPage->idx));
4216	pgmUnlock(pVM);
4217	return;
4218	}
4219
4220	/* we can free the node. */
4221	const uint16_t iPhysExtNext = paPhysExts[iPhysExt].iNext;
4222	if ( iPhysExtPrev == NIL_PGMPOOL_PHYSEXT_INDEX
4223	&& iPhysExtNext == NIL_PGMPOOL_PHYSEXT_INDEX)
4224	{
4225	/* lonely node */
4226	pgmPoolTrackPhysExtFree(pVM, iPhysExt);
4227	Log2(("pgmPoolTrackPhysExtDerefGCPhys: pPhysPage=%R[pgmpage] idx=%d lonely\n", pPhysPage, pPage->idx));
4228	PGM_PAGE_SET_TRACKING(pVM, pPhysPage, 0);
4229	}
4230	else if (iPhysExtPrev == NIL_PGMPOOL_PHYSEXT_INDEX)
4231	{
4232	/* head */
4233	Log2(("pgmPoolTrackPhysExtDerefGCPhys: pPhysPage=%R[pgmpage] idx=%d head\n", pPhysPage, pPage->idx));
4234	PGM_PAGE_SET_TRACKING(pVM, pPhysPage, PGMPOOL_TD_MAKE(PGMPOOL_TD_CREFS_PHYSEXT, iPhysExtNext));
4235	pgmPoolTrackPhysExtFree(pVM, iPhysExt);
4236	}
4237	else
4238	{
4239	/* in list */
4240	Log2(("pgmPoolTrackPhysExtDerefGCPhys: pPhysPage=%R[pgmpage] idx=%d in list\n", pPhysPage, pPage->idx));
4241	paPhysExts[iPhysExtPrev].iNext = iPhysExtNext;
4242	pgmPoolTrackPhysExtFree(pVM, iPhysExt);
4243	}
4244	iPhysExt = iPhysExtNext;
4245	pgmUnlock(pVM);
4246	return;
4247	}
4248	}
4249
4250	/* next */
4251	iPhysExtPrev = iPhysExt;
4252	iPhysExt = paPhysExts[iPhysExt].iNext;
4253	} while (iPhysExt != NIL_PGMPOOL_PHYSEXT_INDEX);
4254
4255	pgmUnlock(pVM);
4256	AssertFatalMsgFailed(("not-found! cRefs=%d pPhysPage=%R[pgmpage] pPage=%p:{.idx=%d}\n", cRefs, pPhysPage, pPage, pPage->idx));
4257	}
4258	else /* nothing to do */
4259	Log2(("pgmPoolTrackPhysExtDerefGCPhys: pPhysPage=%R[pgmpage]\n", pPhysPage));
4260	}
4261
4262	/**
4263	* Clear references to guest physical memory.
4264	*
4265	* This is the same as pgmPoolTracDerefGCPhysHint except that the guest
4266	* physical address is assumed to be correct, so the linear search can be
4267	* skipped and we can assert at an earlier point.
4268	*
4269	* @param pPool The pool.
4270	* @param pPage The page.
4271	* @param HCPhys The host physical address corresponding to the guest page.
4272	* @param GCPhys The guest physical address corresponding to HCPhys.
4273	* @param iPte Shadow PTE index
4274	*/
4275	static void pgmPoolTracDerefGCPhys(PPGMPOOL pPool, PPGMPOOLPAGE pPage, RTHCPHYS HCPhys, RTGCPHYS GCPhys, uint16_t iPte)
4276	{
4277	/*
4278	* Lookup the page and check if it checks out before derefing it.
4279	*/
4280	PVM pVM = pPool->CTX_SUFF(pVM);
4281	PPGMPAGE pPhysPage = pgmPhysGetPage(pVM, GCPhys);
4282	if (pPhysPage)
4283	{
4284	Assert(PGM_PAGE_GET_HCPHYS(pPhysPage));
4285	#ifdef LOG_ENABLED
4286	RTHCPHYS HCPhysPage = PGM_PAGE_GET_HCPHYS(pPhysPage);
4287	Log2(("pgmPoolTracDerefGCPhys %RHp vs %RHp\n", HCPhysPage, HCPhys));
4288	#endif
4289	if (PGM_PAGE_GET_HCPHYS(pPhysPage) == HCPhys)
4290	{
4291	Assert(pPage->cPresent);
4292	Assert(pPool->cPresent);
4293	pPage->cPresent--;
4294	pPool->cPresent--;
4295	pgmTrackDerefGCPhys(pPool, pPage, pPhysPage, iPte);
4296	return;
4297	}
4298
4299	AssertFatalMsgFailed(("HCPhys=%RHp GCPhys=%RGp; found page has HCPhys=%RHp\n",
4300	HCPhys, GCPhys, PGM_PAGE_GET_HCPHYS(pPhysPage)));
4301	}
4302	AssertFatalMsgFailed(("HCPhys=%RHp GCPhys=%RGp\n", HCPhys, GCPhys));
4303	}
4304
4305
4306	/**
4307	* Clear references to guest physical memory.
4308	*
4309	* @param pPool The pool.
4310	* @param pPage The page.
4311	* @param HCPhys The host physical address corresponding to the guest page.
4312	* @param GCPhysHint The guest physical address which may corresponding to HCPhys.
4313	* @param iPte Shadow pte index
4314	*/
4315	void pgmPoolTracDerefGCPhysHint(PPGMPOOL pPool, PPGMPOOLPAGE pPage, RTHCPHYS HCPhys, RTGCPHYS GCPhysHint, uint16_t iPte)
4316	{
4317	Log4(("pgmPoolTracDerefGCPhysHint %RHp %RGp\n", HCPhys, GCPhysHint));
4318
4319	/*
4320	* Try the hint first.
4321	*/
4322	RTHCPHYS HCPhysHinted;
4323	PVM pVM = pPool->CTX_SUFF(pVM);
4324	PPGMPAGE pPhysPage = pgmPhysGetPage(pVM, GCPhysHint);
4325	if (pPhysPage)
4326	{
4327	HCPhysHinted = PGM_PAGE_GET_HCPHYS(pPhysPage);
4328	Assert(HCPhysHinted);
4329	if (HCPhysHinted == HCPhys)
4330	{
4331	Assert(pPage->cPresent);
4332	Assert(pPool->cPresent);
4333	pPage->cPresent--;
4334	pPool->cPresent--;
4335	pgmTrackDerefGCPhys(pPool, pPage, pPhysPage, iPte);
4336	return;
4337	}
4338	}
4339	else
4340	HCPhysHinted = UINT64_C(0xdeadbeefdeadbeef);
4341
4342	/*
4343	* Damn, the hint didn't work. We'll have to do an expensive linear search.
4344	*/
4345	STAM_COUNTER_INC(&pPool->StatTrackLinearRamSearches);
4346	PPGMRAMRANGE pRam = pPool->CTX_SUFF(pVM)->pgm.s.CTX_SUFF(pRamRangesX);
4347	while (pRam)
4348	{
4349	unsigned iPage = pRam->cb >> PAGE_SHIFT;
4350	while (iPage-- > 0)
4351	{
4352	if (PGM_PAGE_GET_HCPHYS(&pRam->aPages[iPage]) == HCPhys)
4353	{
4354	Log4(("pgmPoolTracDerefGCPhysHint: Linear HCPhys=%RHp GCPhysHint=%RGp GCPhysReal=%RGp\n",
4355	HCPhys, GCPhysHint, pRam->GCPhys + (iPage << PAGE_SHIFT)));
4356	Assert(pPage->cPresent);
4357	Assert(pPool->cPresent);
4358	pPage->cPresent--;
4359	pPool->cPresent--;
4360	pgmTrackDerefGCPhys(pPool, pPage, &pRam->aPages[iPage], iPte);
4361	return;
4362	}
4363	}
4364	pRam = pRam->CTX_SUFF(pNext);
4365	}
4366
4367	AssertFatalMsgFailed(("HCPhys=%RHp GCPhysHint=%RGp (Hinted page has HCPhys = %RHp)\n", HCPhys, GCPhysHint, HCPhysHinted));
4368	}
4369
4370
4371	/**
4372	* Clear references to guest physical memory in a 32-bit / 32-bit page table.
4373	*
4374	* @param pPool The pool.
4375	* @param pPage The page.
4376	* @param pShwPT The shadow page table (mapping of the page).
4377	* @param pGstPT The guest page table.
4378	*/
4379	DECLINLINE(void) pgmPoolTrackDerefPT32Bit32Bit(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PX86PT pShwPT, PCX86PT pGstPT)
4380	{
4381	RTGCPHYS32 const fPgMask = pPage->fA20Enabled ? X86_PTE_PG_MASK : X86_PTE_PG_MASK & ~RT_BIT_32(20);
4382	for (unsigned i = pPage->iFirstPresent; i < RT_ELEMENTS(pShwPT->a); i++)
4383	{
4384	Assert(!(pShwPT->a[i].u & RT_BIT_32(10)));
4385	if (pShwPT->a[i].n.u1Present)
4386	{
4387	Log4(("pgmPoolTrackDerefPT32Bit32Bit: i=%d pte=%RX32 hint=%RX32\n",
4388	i, pShwPT->a[i].u & X86_PTE_PG_MASK, pGstPT->a[i].u & X86_PTE_PG_MASK));
4389	pgmPoolTracDerefGCPhysHint(pPool, pPage, pShwPT->a[i].u & X86_PTE_PG_MASK, pGstPT->a[i].u & fPgMask, i);
4390	if (!pPage->cPresent)
4391	break;
4392	}
4393	}
4394	}
4395
4396
4397	/**
4398	* Clear references to guest physical memory in a PAE / 32-bit page table.
4399	*
4400	* @param pPool The pool.
4401	* @param pPage The page.
4402	* @param pShwPT The shadow page table (mapping of the page).
4403	* @param pGstPT The guest page table (just a half one).
4404	*/
4405	DECLINLINE(void) pgmPoolTrackDerefPTPae32Bit(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PPGMSHWPTPAE pShwPT, PCX86PT pGstPT)
4406	{
4407	RTGCPHYS32 const fPgMask = pPage->fA20Enabled ? X86_PTE_PG_MASK : X86_PTE_PG_MASK & ~RT_BIT_32(20);
4408	for (unsigned i = pPage->iFirstPresent; i < RT_ELEMENTS(pShwPT->a); i++)
4409	{
4410	Assert( (PGMSHWPTEPAE_GET_U(pShwPT->a[i]) & UINT64_C(0x7ff0000000000400)) == 0
4411	\|\| (PGMSHWPTEPAE_GET_U(pShwPT->a[i]) & UINT64_C(0x7ff0000000000400)) == UINT64_C(0x7ff0000000000000));
4412	if (PGMSHWPTEPAE_IS_P(pShwPT->a[i]))
4413	{
4414	Log4(("pgmPoolTrackDerefPTPae32Bit: i=%d pte=%RX64 hint=%RX32\n",
4415	i, PGMSHWPTEPAE_GET_HCPHYS(pShwPT->a[i]), pGstPT->a[i].u & X86_PTE_PG_MASK));
4416	pgmPoolTracDerefGCPhysHint(pPool, pPage, PGMSHWPTEPAE_GET_HCPHYS(pShwPT->a[i]), pGstPT->a[i].u & fPgMask, i);
4417	if (!pPage->cPresent)
4418	break;
4419	}
4420	}
4421	}
4422
4423
4424	/**
4425	* Clear references to guest physical memory in a PAE / PAE page table.
4426	*
4427	* @param pPool The pool.
4428	* @param pPage The page.
4429	* @param pShwPT The shadow page table (mapping of the page).
4430	* @param pGstPT The guest page table.
4431	*/
4432	DECLINLINE(void) pgmPoolTrackDerefPTPaePae(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PPGMSHWPTPAE pShwPT, PCX86PTPAE pGstPT)
4433	{
4434	RTGCPHYS const fPgMask = pPage->fA20Enabled ? X86_PTE_PAE_PG_MASK : X86_PTE_PAE_PG_MASK & ~RT_BIT_64(20);
4435	for (unsigned i = pPage->iFirstPresent; i < RT_ELEMENTS(pShwPT->a); i++)
4436	{
4437	Assert( (PGMSHWPTEPAE_GET_U(pShwPT->a[i]) & UINT64_C(0x7ff0000000000400)) == 0
4438	\|\| (PGMSHWPTEPAE_GET_U(pShwPT->a[i]) & UINT64_C(0x7ff0000000000400)) == UINT64_C(0x7ff0000000000000));
4439	if (PGMSHWPTEPAE_IS_P(pShwPT->a[i]))
4440	{
4441	Log4(("pgmPoolTrackDerefPTPaePae: i=%d pte=%RX32 hint=%RX32\n",
4442	i, PGMSHWPTEPAE_GET_HCPHYS(pShwPT->a[i]), pGstPT->a[i].u & X86_PTE_PAE_PG_MASK));
4443	pgmPoolTracDerefGCPhysHint(pPool, pPage, PGMSHWPTEPAE_GET_HCPHYS(pShwPT->a[i]), pGstPT->a[i].u & fPgMask, i);
4444	if (!pPage->cPresent)
4445	break;
4446	}
4447	}
4448	}
4449
4450
4451	/**
4452	* Clear references to guest physical memory in a 32-bit / 4MB page table.
4453	*
4454	* @param pPool The pool.
4455	* @param pPage The page.
4456	* @param pShwPT The shadow page table (mapping of the page).
4457	*/
4458	DECLINLINE(void) pgmPoolTrackDerefPT32Bit4MB(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PX86PT pShwPT)
4459	{
4460	RTGCPHYS const GCPhysA20Mask = pPage->fA20Enabled ? UINT64_MAX : ~RT_BIT_64(20);
4461	RTGCPHYS GCPhys = pPage->GCPhys + PAGE_SIZE * pPage->iFirstPresent;
4462	for (unsigned i = pPage->iFirstPresent; i < RT_ELEMENTS(pShwPT->a); i++, GCPhys += PAGE_SIZE)
4463	{
4464	Assert(!(pShwPT->a[i].u & RT_BIT_32(10)));
4465	if (pShwPT->a[i].n.u1Present)
4466	{
4467	Log4(("pgmPoolTrackDerefPT32Bit4MB: i=%d pte=%RX32 GCPhys=%RGp\n",
4468	i, pShwPT->a[i].u & X86_PTE_PG_MASK, GCPhys));
4469	pgmPoolTracDerefGCPhys(pPool, pPage, pShwPT->a[i].u & X86_PTE_PG_MASK, GCPhys & GCPhysA20Mask, i);
4470	if (!pPage->cPresent)
4471	break;
4472	}
4473	}
4474	}
4475
4476
4477	/**
4478	* Clear references to guest physical memory in a PAE / 2/4MB page table.
4479	*
4480	* @param pPool The pool.
4481	* @param pPage The page.
4482	* @param pShwPT The shadow page table (mapping of the page).
4483	*/
4484	DECLINLINE(void) pgmPoolTrackDerefPTPaeBig(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PPGMSHWPTPAE pShwPT)
4485	{
4486	RTGCPHYS const GCPhysA20Mask = pPage->fA20Enabled ? UINT64_MAX : ~RT_BIT_64(20);
4487	RTGCPHYS GCPhys = pPage->GCPhys + PAGE_SIZE * pPage->iFirstPresent;
4488	for (unsigned i = pPage->iFirstPresent; i < RT_ELEMENTS(pShwPT->a); i++, GCPhys += PAGE_SIZE)
4489	{
4490	Assert( (PGMSHWPTEPAE_GET_U(pShwPT->a[i]) & UINT64_C(0x7ff0000000000400)) == 0
4491	\|\| (PGMSHWPTEPAE_GET_U(pShwPT->a[i]) & UINT64_C(0x7ff0000000000400)) == UINT64_C(0x7ff0000000000000));
4492	if (PGMSHWPTEPAE_IS_P(pShwPT->a[i]))
4493	{
4494	Log4(("pgmPoolTrackDerefPTPaeBig: i=%d pte=%RX64 hint=%RGp\n",
4495	i, PGMSHWPTEPAE_GET_HCPHYS(pShwPT->a[i]), GCPhys));
4496	pgmPoolTracDerefGCPhys(pPool, pPage, PGMSHWPTEPAE_GET_HCPHYS(pShwPT->a[i]), GCPhys & GCPhysA20Mask, i);
4497	if (!pPage->cPresent)
4498	break;
4499	}
4500	}
4501	}
4502
4503
4504	/**
4505	* Clear references to shadowed pages in an EPT page table.
4506	*
4507	* @param pPool The pool.
4508	* @param pPage The page.
4509	* @param pShwPT The shadow page directory pointer table (mapping of the
4510	* page).
4511	*/
4512	DECLINLINE(void) pgmPoolTrackDerefPTEPT(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PEPTPT pShwPT)
4513	{
4514	RTGCPHYS const GCPhysA20Mask = pPage->fA20Enabled ? UINT64_MAX : ~RT_BIT_64(20);
4515	RTGCPHYS GCPhys = pPage->GCPhys + PAGE_SIZE * pPage->iFirstPresent;
4516	for (unsigned i = pPage->iFirstPresent; i < RT_ELEMENTS(pShwPT->a); i++, GCPhys += PAGE_SIZE)
4517	{
4518	Assert((pShwPT->a[i].u & UINT64_C(0xfff0000000000f80)) == 0);
4519	if (pShwPT->a[i].n.u1Present)
4520	{
4521	Log4(("pgmPoolTrackDerefPTEPT: i=%d pte=%RX64 GCPhys=%RX64\n",
4522	i, pShwPT->a[i].u & EPT_PTE_PG_MASK, pPage->GCPhys));
4523	pgmPoolTracDerefGCPhys(pPool, pPage, pShwPT->a[i].u & EPT_PTE_PG_MASK, GCPhys & GCPhysA20Mask, i);
4524	if (!pPage->cPresent)
4525	break;
4526	}
4527	}
4528	}
4529
4530
4531	/**
4532	* Clear references to shadowed pages in a 32 bits page directory.
4533	*
4534	* @param pPool The pool.
4535	* @param pPage The page.
4536	* @param pShwPD The shadow page directory (mapping of the page).
4537	*/
4538	DECLINLINE(void) pgmPoolTrackDerefPD(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PX86PD pShwPD)
4539	{
4540	for (unsigned i = 0; i < RT_ELEMENTS(pShwPD->a); i++)
4541	{
4542	Assert(!(pShwPD->a[i].u & RT_BIT_32(9)));
4543	if ( pShwPD->a[i].n.u1Present
4544	&& !(pShwPD->a[i].u & PGM_PDFLAGS_MAPPING)
4545	)
4546	{
4547	PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPD->a[i].u & X86_PDE_PG_MASK);
4548	if (pSubPage)
4549	pgmPoolTrackFreeUser(pPool, pSubPage, pPage->idx, i);
4550	else
4551	AssertFatalMsgFailed(("%x\n", pShwPD->a[i].u & X86_PDE_PG_MASK));
4552	}
4553	}
4554	}
4555
4556
4557	/**
4558	* Clear references to shadowed pages in a PAE (legacy or 64 bits) page directory.
4559	*
4560	* @param pPool The pool.
4561	* @param pPage The page.
4562	* @param pShwPD The shadow page directory (mapping of the page).
4563	*/
4564	DECLINLINE(void) pgmPoolTrackDerefPDPae(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PX86PDPAE pShwPD)
4565	{
4566	for (unsigned i = 0; i < RT_ELEMENTS(pShwPD->a); i++)
4567	{
4568	if ( pShwPD->a[i].n.u1Present
4569	&& !(pShwPD->a[i].u & PGM_PDFLAGS_MAPPING))
4570	{
4571	#ifdef PGM_WITH_LARGE_PAGES
4572	if (pShwPD->a[i].b.u1Size)
4573	{
4574	Log4(("pgmPoolTrackDerefPDPae: i=%d pde=%RX64 GCPhys=%RX64\n",
4575	i, pShwPD->a[i].u & X86_PDE2M_PAE_PG_MASK, pPage->GCPhys));
4576	pgmPoolTracDerefGCPhys(pPool, pPage, pShwPD->a[i].u & X86_PDE2M_PAE_PG_MASK,
4577	pPage->GCPhys + i * 2 * _1M /* pPage->GCPhys = base address of the memory described by the PD */,
4578	i);
4579	}
4580	else
4581	#endif
4582	{
4583	Assert((pShwPD->a[i].u & (X86_PDE_PAE_MBZ_MASK_NX \| UINT64_C(0x7ff0000000000200))) == 0);
4584	PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPD->a[i].u & X86_PDE_PAE_PG_MASK);
4585	if (pSubPage)
4586	pgmPoolTrackFreeUser(pPool, pSubPage, pPage->idx, i);
4587	else
4588	AssertFatalMsgFailed(("%RX64\n", pShwPD->a[i].u & X86_PDE_PAE_PG_MASK));
4589	/** @todo 64-bit guests: have to ensure that we're not exhausting the dynamic mappings! */
4590	}
4591	}
4592	}
4593	}
4594
4595
4596	/**
4597	* Clear references to shadowed pages in a PAE page directory pointer table.
4598	*
4599	* @param pPool The pool.
4600	* @param pPage The page.
4601	* @param pShwPDPT The shadow page directory pointer table (mapping of the page).
4602	*/
4603	DECLINLINE(void) pgmPoolTrackDerefPDPTPae(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PX86PDPT pShwPDPT)
4604	{
4605	for (unsigned i = 0; i < X86_PG_PAE_PDPE_ENTRIES; i++)
4606	{
4607	Assert((pShwPDPT->a[i].u & (X86_PDPE_PAE_MBZ_MASK \| UINT64_C(0x7ff0000000000200))) == 0);
4608	if ( pShwPDPT->a[i].n.u1Present
4609	&& !(pShwPDPT->a[i].u & PGM_PLXFLAGS_MAPPING)
4610	)
4611	{
4612	PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPDPT->a[i].u & X86_PDPE_PG_MASK);
4613	if (pSubPage)
4614	pgmPoolTrackFreeUser(pPool, pSubPage, pPage->idx, i);
4615	else
4616	AssertFatalMsgFailed(("%RX64\n", pShwPDPT->a[i].u & X86_PDPE_PG_MASK));
4617	}
4618	}
4619	}
4620
4621
4622	/**
4623	* Clear references to shadowed pages in a 64-bit page directory pointer table.
4624	*
4625	* @param pPool The pool.
4626	* @param pPage The page.
4627	* @param pShwPDPT The shadow page directory pointer table (mapping of the page).
4628	*/
4629	DECLINLINE(void) pgmPoolTrackDerefPDPT64Bit(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PX86PDPT pShwPDPT)
4630	{
4631	for (unsigned i = 0; i < RT_ELEMENTS(pShwPDPT->a); i++)
4632	{
4633	Assert((pShwPDPT->a[i].u & (X86_PDPE_LM_MBZ_MASK_NX \| UINT64_C(0x7ff0000000000200))) == 0);
4634	if (pShwPDPT->a[i].n.u1Present)
4635	{
4636	PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPDPT->a[i].u & X86_PDPE_PG_MASK);
4637	if (pSubPage)
4638	pgmPoolTrackFreeUser(pPool, pSubPage, pPage->idx, i);
4639	else
4640	AssertFatalMsgFailed(("%RX64\n", pShwPDPT->a[i].u & X86_PDPE_PG_MASK));
4641	/** @todo 64-bit guests: have to ensure that we're not exhausting the dynamic mappings! */
4642	}
4643	}
4644	}
4645
4646
4647	/**
4648	* Clear references to shadowed pages in a 64-bit level 4 page table.
4649	*
4650	* @param pPool The pool.
4651	* @param pPage The page.
4652	* @param pShwPML4 The shadow page directory pointer table (mapping of the page).
4653	*/
4654	DECLINLINE(void) pgmPoolTrackDerefPML464Bit(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PX86PML4 pShwPML4)
4655	{
4656	for (unsigned i = 0; i < RT_ELEMENTS(pShwPML4->a); i++)
4657	{
4658	Assert((pShwPML4->a[i].u & (X86_PML4E_MBZ_MASK_NX \| UINT64_C(0x7ff0000000000200))) == 0);
4659	if (pShwPML4->a[i].n.u1Present)
4660	{
4661	PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPML4->a[i].u & X86_PDPE_PG_MASK);
4662	if (pSubPage)
4663	pgmPoolTrackFreeUser(pPool, pSubPage, pPage->idx, i);
4664	else
4665	AssertFatalMsgFailed(("%RX64\n", pShwPML4->a[i].u & X86_PML4E_PG_MASK));
4666	/** @todo 64-bit guests: have to ensure that we're not exhausting the dynamic mappings! */
4667	}
4668	}
4669	}
4670
4671
4672	/**
4673	* Clear references to shadowed pages in an EPT page directory.
4674	*
4675	* @param pPool The pool.
4676	* @param pPage The page.
4677	* @param pShwPD The shadow page directory (mapping of the page).
4678	*/
4679	DECLINLINE(void) pgmPoolTrackDerefPDEPT(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PEPTPD pShwPD)
4680	{
4681	for (unsigned i = 0; i < RT_ELEMENTS(pShwPD->a); i++)
4682	{
4683	Assert((pShwPD->a[i].u & UINT64_C(0xfff0000000000f80)) == 0);
4684	if (pShwPD->a[i].n.u1Present)
4685	{
4686	#ifdef PGM_WITH_LARGE_PAGES
4687	if (pShwPD->a[i].b.u1Size)
4688	{
4689	Log4(("pgmPoolTrackDerefPDEPT: i=%d pde=%RX64 GCPhys=%RX64\n",
4690	i, pShwPD->a[i].u & X86_PDE2M_PAE_PG_MASK, pPage->GCPhys));
4691	pgmPoolTracDerefGCPhys(pPool, pPage, pShwPD->a[i].u & X86_PDE2M_PAE_PG_MASK,
4692	pPage->GCPhys + i * 2 * _1M /* pPage->GCPhys = base address of the memory described by the PD */,
4693	i);
4694	}
4695	else
4696	#endif
4697	{
4698	PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPD->a[i].u & EPT_PDE_PG_MASK);
4699	if (pSubPage)
4700	pgmPoolTrackFreeUser(pPool, pSubPage, pPage->idx, i);
4701	else
4702	AssertFatalMsgFailed(("%RX64\n", pShwPD->a[i].u & EPT_PDE_PG_MASK));
4703	}
4704	/** @todo 64-bit guests: have to ensure that we're not exhausting the dynamic mappings! */
4705	}
4706	}
4707	}
4708
4709
4710	/**
4711	* Clear references to shadowed pages in an EPT page directory pointer table.
4712	*
4713	* @param pPool The pool.
4714	* @param pPage The page.
4715	* @param pShwPDPT The shadow page directory pointer table (mapping of the page).
4716	*/
4717	DECLINLINE(void) pgmPoolTrackDerefPDPTEPT(PPGMPOOL pPool, PPGMPOOLPAGE pPage, PEPTPDPT pShwPDPT)
4718	{
4719	for (unsigned i = 0; i < RT_ELEMENTS(pShwPDPT->a); i++)
4720	{
4721	Assert((pShwPDPT->a[i].u & UINT64_C(0xfff0000000000f80)) == 0);
4722	if (pShwPDPT->a[i].n.u1Present)
4723	{
4724	PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPDPT->a[i].u & EPT_PDPTE_PG_MASK);
4725	if (pSubPage)
4726	pgmPoolTrackFreeUser(pPool, pSubPage, pPage->idx, i);
4727	else
4728	AssertFatalMsgFailed(("%RX64\n", pShwPDPT->a[i].u & EPT_PDPTE_PG_MASK));
4729	/** @todo 64-bit guests: have to ensure that we're not exhausting the dynamic mappings! */
4730	}
4731	}
4732	}
4733
4734
4735	/**
4736	* Clears all references made by this page.
4737	*
4738	* This includes other shadow pages and GC physical addresses.
4739	*
4740	* @param pPool The pool.
4741	* @param pPage The page.
4742	*/
4743	static void pgmPoolTrackDeref(PPGMPOOL pPool, PPGMPOOLPAGE pPage)
4744	{
4745	/*
4746	* Map the shadow page and take action according to the page kind.
4747	*/
4748	PVM pVM = pPool->CTX_SUFF(pVM);
4749	void *pvShw = PGMPOOL_PAGE_2_PTR(pVM, pPage);
4750	switch (pPage->enmKind)
4751	{
4752	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_PT:
4753	{
4754	STAM_PROFILE_START(&pPool->StatTrackDerefGCPhys, g);
4755	void *pvGst;
4756	int rc = PGM_GCPHYS_2_PTR(pVM, pPage->GCPhys, &pvGst); AssertReleaseRC(rc);
4757	pgmPoolTrackDerefPT32Bit32Bit(pPool, pPage, (PX86PT)pvShw, (PCX86PT)pvGst);
4758	PGM_DYNMAP_UNUSED_HINT_VM(pVM, pvGst);
4759	STAM_PROFILE_STOP(&pPool->StatTrackDerefGCPhys, g);
4760	break;
4761	}
4762
4763	case PGMPOOLKIND_PAE_PT_FOR_32BIT_PT:
4764	{
4765	STAM_PROFILE_START(&pPool->StatTrackDerefGCPhys, g);
4766	void *pvGst;
4767	int rc = PGM_GCPHYS_2_PTR_EX(pVM, pPage->GCPhys, &pvGst); AssertReleaseRC(rc);
4768	pgmPoolTrackDerefPTPae32Bit(pPool, pPage, (PPGMSHWPTPAE)pvShw, (PCX86PT)pvGst);
4769	PGM_DYNMAP_UNUSED_HINT_VM(pVM, pvGst);
4770	STAM_PROFILE_STOP(&pPool->StatTrackDerefGCPhys, g);
4771	break;
4772	}
4773
4774	case PGMPOOLKIND_PAE_PT_FOR_PAE_PT:
4775	{
4776	STAM_PROFILE_START(&pPool->StatTrackDerefGCPhys, g);
4777	void *pvGst;
4778	int rc = PGM_GCPHYS_2_PTR(pVM, pPage->GCPhys, &pvGst); AssertReleaseRC(rc);
4779	pgmPoolTrackDerefPTPaePae(pPool, pPage, (PPGMSHWPTPAE)pvShw, (PCX86PTPAE)pvGst);
4780	PGM_DYNMAP_UNUSED_HINT_VM(pVM, pvGst);
4781	STAM_PROFILE_STOP(&pPool->StatTrackDerefGCPhys, g);
4782	break;
4783	}
4784
4785	case PGMPOOLKIND_32BIT_PT_FOR_PHYS: /* treat it like a 4 MB page */
4786	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_4MB:
4787	{
4788	STAM_PROFILE_START(&pPool->StatTrackDerefGCPhys, g);
4789	pgmPoolTrackDerefPT32Bit4MB(pPool, pPage, (PX86PT)pvShw);
4790	STAM_PROFILE_STOP(&pPool->StatTrackDerefGCPhys, g);
4791	break;
4792	}
4793
4794	case PGMPOOLKIND_PAE_PT_FOR_PHYS: /* treat it like a 2 MB page */
4795	case PGMPOOLKIND_PAE_PT_FOR_PAE_2MB:
4796	case PGMPOOLKIND_PAE_PT_FOR_32BIT_4MB:
4797	{
4798	STAM_PROFILE_START(&pPool->StatTrackDerefGCPhys, g);
4799	pgmPoolTrackDerefPTPaeBig(pPool, pPage, (PPGMSHWPTPAE)pvShw);
4800	STAM_PROFILE_STOP(&pPool->StatTrackDerefGCPhys, g);
4801	break;
4802	}
4803
4804	case PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD:
4805	case PGMPOOLKIND_PAE_PD1_FOR_32BIT_PD:
4806	case PGMPOOLKIND_PAE_PD2_FOR_32BIT_PD:
4807	case PGMPOOLKIND_PAE_PD3_FOR_32BIT_PD:
4808	case PGMPOOLKIND_PAE_PD_FOR_PAE_PD:
4809	case PGMPOOLKIND_PAE_PD_PHYS:
4810	case PGMPOOLKIND_64BIT_PD_FOR_64BIT_PD:
4811	case PGMPOOLKIND_64BIT_PD_FOR_PHYS:
4812	pgmPoolTrackDerefPDPae(pPool, pPage, (PX86PDPAE)pvShw);
4813	break;
4814
4815	case PGMPOOLKIND_32BIT_PD_PHYS:
4816	case PGMPOOLKIND_32BIT_PD:
4817	pgmPoolTrackDerefPD(pPool, pPage, (PX86PD)pvShw);
4818	break;
4819
4820	case PGMPOOLKIND_PAE_PDPT_FOR_32BIT:
4821	case PGMPOOLKIND_PAE_PDPT:
4822	case PGMPOOLKIND_PAE_PDPT_PHYS:
4823	pgmPoolTrackDerefPDPTPae(pPool, pPage, (PX86PDPT)pvShw);
4824	break;
4825
4826	case PGMPOOLKIND_64BIT_PDPT_FOR_PHYS:
4827	case PGMPOOLKIND_64BIT_PDPT_FOR_64BIT_PDPT:
4828	pgmPoolTrackDerefPDPT64Bit(pPool, pPage, (PX86PDPT)pvShw);
4829	break;
4830
4831	case PGMPOOLKIND_64BIT_PML4:
4832	pgmPoolTrackDerefPML464Bit(pPool, pPage, (PX86PML4)pvShw);
4833	break;
4834
4835	case PGMPOOLKIND_EPT_PT_FOR_PHYS:
4836	pgmPoolTrackDerefPTEPT(pPool, pPage, (PEPTPT)pvShw);
4837	break;
4838
4839	case PGMPOOLKIND_EPT_PD_FOR_PHYS:
4840	pgmPoolTrackDerefPDEPT(pPool, pPage, (PEPTPD)pvShw);
4841	break;
4842
4843	case PGMPOOLKIND_EPT_PDPT_FOR_PHYS:
4844	pgmPoolTrackDerefPDPTEPT(pPool, pPage, (PEPTPDPT)pvShw);
4845	break;
4846
4847	default:
4848	AssertFatalMsgFailed(("enmKind=%d\n", pPage->enmKind));
4849	}
4850
4851	/* paranoia, clear the shadow page. Remove this laser (i.e. let Alloc and ClearAll do it). */
4852	STAM_PROFILE_START(&pPool->StatZeroPage, z);
4853	ASMMemZeroPage(pvShw);
4854	STAM_PROFILE_STOP(&pPool->StatZeroPage, z);
4855	pPage->fZeroed = true;
4856	Assert(!pPage->cPresent);
4857	PGM_DYNMAP_UNUSED_HINT_VM(pVM, pvShw);
4858	}
4859
4860
4861	/**
4862	* Flushes a pool page.
4863	*
4864	* This moves the page to the free list after removing all user references to it.
4865	*
4866	* @returns VBox status code.
4867	* @retval VINF_SUCCESS on success.
4868	* @param pPool The pool.
4869	* @param pPage The shadow page.
4870	* @param fFlush Flush the TLBS when required (should only be false in very specific use cases!!)
4871	*/
4872	int pgmPoolFlushPage(PPGMPOOL pPool, PPGMPOOLPAGE pPage, bool fFlush)
4873	{
4874	PVM pVM = pPool->CTX_SUFF(pVM);
4875	bool fFlushRequired = false;
4876
4877	int rc = VINF_SUCCESS;
4878	STAM_PROFILE_START(&pPool->StatFlushPage, f);
4879	LogFlow(("pgmPoolFlushPage: pPage=%p:{.Key=%RHp, .idx=%d, .enmKind=%s, .GCPhys=%RGp}\n",
4880	pPage, pPage->Core.Key, pPage->idx, pgmPoolPoolKindToStr(pPage->enmKind), pPage->GCPhys));
4881
4882	/*
4883	* Reject any attempts at flushing any of the special root pages (shall
4884	* not happen).
4885	*/
4886	AssertMsgReturn(pPage->idx >= PGMPOOL_IDX_FIRST,
4887	("pgmPoolFlushPage: special root page, rejected. enmKind=%s idx=%d\n",
4888	pgmPoolPoolKindToStr(pPage->enmKind), pPage->idx),
4889	VINF_SUCCESS);
4890
4891	pgmLock(pVM);
4892
4893	/*
4894	* Quietly reject any attempts at flushing the currently active shadow CR3 mapping
4895	*/
4896	if (pgmPoolIsPageLocked(pPage))
4897	{
4898	AssertMsg( pPage->enmKind == PGMPOOLKIND_64BIT_PML4
4899	\|\| pPage->enmKind == PGMPOOLKIND_PAE_PDPT
4900	\|\| pPage->enmKind == PGMPOOLKIND_PAE_PDPT_FOR_32BIT
4901	\|\| pPage->enmKind == PGMPOOLKIND_32BIT_PD
4902	\|\| pPage->enmKind == PGMPOOLKIND_PAE_PD_FOR_PAE_PD
4903	\|\| pPage->enmKind == PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD
4904	\|\| pPage->enmKind == PGMPOOLKIND_PAE_PD1_FOR_32BIT_PD
4905	\|\| pPage->enmKind == PGMPOOLKIND_PAE_PD2_FOR_32BIT_PD
4906	\|\| pPage->enmKind == PGMPOOLKIND_PAE_PD3_FOR_32BIT_PD
4907	\|\| pPage->enmKind == PGMPOOLKIND_ROOT_NESTED,
4908	("Can't free the shadow CR3! (%RHp vs %RHp kind=%d\n", PGMGetHyperCR3(VMMGetCpu(pVM)), pPage->Core.Key, pPage->enmKind));
4909	Log(("pgmPoolFlushPage: current active shadow CR3, rejected. enmKind=%s idx=%d\n", pgmPoolPoolKindToStr(pPage->enmKind), pPage->idx));
4910	pgmUnlock(pVM);
4911	return VINF_SUCCESS;
4912	}
4913
4914	#if defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0) \|\| defined(IN_RC)
4915	/* Start a subset so we won't run out of mapping space. */
4916	PVMCPU pVCpu = VMMGetCpu(pVM);
4917	uint32_t iPrevSubset = PGMRZDynMapPushAutoSubset(pVCpu);
4918	#endif
4919
4920	/*
4921	* Mark the page as being in need of an ASMMemZeroPage().
4922	*/
4923	pPage->fZeroed = false;
4924
4925	#ifdef PGMPOOL_WITH_OPTIMIZED_DIRTY_PT
4926	if (pPage->fDirty)
4927	pgmPoolFlushDirtyPage(pVM, pPool, pPage->idxDirtyEntry, false /* do not remove */);
4928	#endif
4929
4930	/* If there are any users of this table, then we must issue a tlb flush on all VCPUs. */
4931	if (pPage->iUserHead != NIL_PGMPOOL_USER_INDEX)
4932	fFlushRequired = true;
4933
4934	/*
4935	* Clear the page.
4936	*/
4937	pgmPoolTrackClearPageUsers(pPool, pPage);
4938	STAM_PROFILE_START(&pPool->StatTrackDeref,a);
4939	pgmPoolTrackDeref(pPool, pPage);
4940	STAM_PROFILE_STOP(&pPool->StatTrackDeref,a);
4941
4942	/*
4943	* Flush it from the cache.
4944	*/
4945	pgmPoolCacheFlushPage(pPool, pPage);
4946
4947	#if defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0) \|\| defined(IN_RC)
4948	/* Heavy stuff done. */
4949	PGMRZDynMapPopAutoSubset(pVCpu, iPrevSubset);
4950	#endif
4951
4952	/*
4953	* Deregistering the monitoring.
4954	*/
4955	if (pPage->fMonitored)
4956	rc = pgmPoolMonitorFlush(pPool, pPage);
4957
4958	/*
4959	* Free the page.
4960	*/
4961	Assert(pPage->iNext == NIL_PGMPOOL_IDX);
4962	pPage->iNext = pPool->iFreeHead;
4963	pPool->iFreeHead = pPage->idx;
4964	pPage->enmKind = PGMPOOLKIND_FREE;
4965	pPage->enmAccess = PGMPOOLACCESS_DONTCARE;
4966	pPage->GCPhys = NIL_RTGCPHYS;
4967	pPage->fReusedFlushPending = false;
4968
4969	pPool->cUsedPages--;
4970
4971	/* Flush the TLBs of all VCPUs if required. */
4972	if ( fFlushRequired
4973	&& fFlush)
4974	{
4975	PGM_INVL_ALL_VCPU_TLBS(pVM);
4976	}
4977
4978	pgmUnlock(pVM);
4979	STAM_PROFILE_STOP(&pPool->StatFlushPage, f);
4980	return rc;
4981	}
4982
4983
4984	/**
4985	* Frees a usage of a pool page.
4986	*
4987	* The caller is responsible to updating the user table so that it no longer
4988	* references the shadow page.
4989	*
4990	* @param pPool The pool.
4991	* @param pPage The shadow page.
4992	* @param iUser The shadow page pool index of the user table.
4993	* NIL_PGMPOOL_IDX for root pages.
4994	* @param iUserTable The index into the user table (shadowed). Ignored if
4995	* root page.
4996	*/
4997	void pgmPoolFreeByPage(PPGMPOOL pPool, PPGMPOOLPAGE pPage, uint16_t iUser, uint32_t iUserTable)
4998	{
4999	PVM pVM = pPool->CTX_SUFF(pVM);
5000
5001	STAM_PROFILE_START(&pPool->StatFree, a);
5002	LogFlow(("pgmPoolFreeByPage: pPage=%p:{.Key=%RHp, .idx=%d, enmKind=%s} iUser=%d iUserTable=%#x\n",
5003	pPage, pPage->Core.Key, pPage->idx, pgmPoolPoolKindToStr(pPage->enmKind), iUser, iUserTable));
5004	AssertReturnVoid(pPage->idx >= PGMPOOL_IDX_FIRST); /* paranoia (#6349) */
5005
5006	pgmLock(pVM);
5007	if (iUser != NIL_PGMPOOL_IDX)
5008	pgmPoolTrackFreeUser(pPool, pPage, iUser, iUserTable);
5009	if (!pPage->fCached)
5010	pgmPoolFlushPage(pPool, pPage);
5011	pgmUnlock(pVM);
5012	STAM_PROFILE_STOP(&pPool->StatFree, a);
5013	}
5014
5015
5016	/**
5017	* Makes one or more free page free.
5018	*
5019	* @returns VBox status code.
5020	* @retval VINF_SUCCESS on success.
5021	* @retval VERR_PGM_POOL_FLUSHED if the pool was flushed.
5022	*
5023	* @param pPool The pool.
5024	* @param enmKind Page table kind
5025	* @param iUser The user of the page.
5026	*/
5027	static int pgmPoolMakeMoreFreePages(PPGMPOOL pPool, PGMPOOLKIND enmKind, uint16_t iUser)
5028	{
5029	PVM pVM = pPool->CTX_SUFF(pVM);
5030	LogFlow(("pgmPoolMakeMoreFreePages: enmKind=%d iUser=%d\n", enmKind, iUser));
5031	NOREF(enmKind);
5032
5033	/*
5034	* If the pool isn't full grown yet, expand it.
5035	*/
5036	if ( pPool->cCurPages < pPool->cMaxPages
5037	#if defined(IN_RC)
5038	/* Hack alert: we can't deal with jumps to ring 3 when called from MapCR3 and allocating pages for PAE PDs. */
5039	&& enmKind != PGMPOOLKIND_PAE_PD_FOR_PAE_PD
5040	&& (enmKind < PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD \|\| enmKind > PGMPOOLKIND_PAE_PD3_FOR_32BIT_PD)
5041	#endif
5042	)
5043	{
5044	STAM_PROFILE_ADV_SUSPEND(&pPool->StatAlloc, a);
5045	#ifdef IN_RING3
5046	int rc = PGMR3PoolGrow(pVM);
5047	#else
5048	int rc = VMMRZCallRing3NoCpu(pVM, VMMCALLRING3_PGM_POOL_GROW, 0);
5049	#endif
5050	if (RT_FAILURE(rc))
5051	return rc;
5052	STAM_PROFILE_ADV_RESUME(&pPool->StatAlloc, a);
5053	if (pPool->iFreeHead != NIL_PGMPOOL_IDX)
5054	return VINF_SUCCESS;
5055	}
5056
5057	/*
5058	* Free one cached page.
5059	*/
5060	return pgmPoolCacheFreeOne(pPool, iUser);
5061	}
5062
5063
5064	/**
5065	* Allocates a page from the pool.
5066	*
5067	* This page may actually be a cached page and not in need of any processing
5068	* on the callers part.
5069	*
5070	* @returns VBox status code.
5071	* @retval VINF_SUCCESS if a NEW page was allocated.
5072	* @retval VINF_PGM_CACHED_PAGE if a CACHED page was returned.
5073	* @retval VERR_PGM_POOL_FLUSHED if the pool was flushed.
5074	*
5075	* @param pVM The cross context VM structure.
5076	* @param GCPhys The GC physical address of the page we're gonna shadow.
5077	* For 4MB and 2MB PD entries, it's the first address the
5078	* shadow PT is covering.
5079	* @param enmKind The kind of mapping.
5080	* @param enmAccess Access type for the mapping (only relevant for big pages)
5081	* @param fA20Enabled Whether the A20 gate is enabled or not.
5082	* @param iUser The shadow page pool index of the user table. Root
5083	* pages should pass NIL_PGMPOOL_IDX.
5084	* @param iUserTable The index into the user table (shadowed). Ignored for
5085	* root pages (iUser == NIL_PGMPOOL_IDX).
5086	* @param fLockPage Lock the page
5087	* @param ppPage Where to store the pointer to the page. NULL is stored here on failure.
5088	*/
5089	int pgmPoolAlloc(PVM pVM, RTGCPHYS GCPhys, PGMPOOLKIND enmKind, PGMPOOLACCESS enmAccess, bool fA20Enabled,
5090	uint16_t iUser, uint32_t iUserTable, bool fLockPage, PPPGMPOOLPAGE ppPage)
5091	{
5092	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
5093	STAM_PROFILE_ADV_START(&pPool->StatAlloc, a);
5094	LogFlow(("pgmPoolAlloc: GCPhys=%RGp enmKind=%s iUser=%d iUserTable=%#x\n", GCPhys, pgmPoolPoolKindToStr(enmKind), iUser, iUserTable));
5095	*ppPage = NULL;
5096	/** @todo CSAM/PGMPrefetchPage messes up here during CSAMR3CheckGates
5097	* (TRPMR3SyncIDT) because of FF priority. Try fix that?
5098	* Assert(!(pVM->pgm.s.fGlobalSyncFlags & PGM_SYNC_CLEAR_PGM_POOL)); */
5099
5100	pgmLock(pVM);
5101
5102	if (pPool->fCacheEnabled)
5103	{
5104	int rc2 = pgmPoolCacheAlloc(pPool, GCPhys, enmKind, enmAccess, fA20Enabled, iUser, iUserTable, ppPage);
5105	if (RT_SUCCESS(rc2))
5106	{
5107	if (fLockPage)
5108	pgmPoolLockPage(pPool, *ppPage);
5109	pgmUnlock(pVM);
5110	STAM_PROFILE_ADV_STOP(&pPool->StatAlloc, a);
5111	LogFlow(("pgmPoolAlloc: cached returns %Rrc ppPage=%p:{.Key=%RHp, .idx=%d}\n", rc2, ppPage, (ppPage)->Core.Key, (ppPage)->idx));
5112	return rc2;
5113	}
5114	}
5115
5116	/*
5117	* Allocate a new one.
5118	*/
5119	int rc = VINF_SUCCESS;
5120	uint16_t iNew = pPool->iFreeHead;
5121	if (iNew == NIL_PGMPOOL_IDX)
5122	{
5123	rc = pgmPoolMakeMoreFreePages(pPool, enmKind, iUser);
5124	if (RT_FAILURE(rc))
5125	{
5126	pgmUnlock(pVM);
5127	Log(("pgmPoolAlloc: returns %Rrc (Free)\n", rc));
5128	STAM_PROFILE_ADV_STOP(&pPool->StatAlloc, a);
5129	return rc;
5130	}
5131	iNew = pPool->iFreeHead;
5132	AssertReleaseReturn(iNew != NIL_PGMPOOL_IDX, VERR_PGM_POOL_IPE);
5133	}
5134
5135	/* unlink the free head */
5136	PPGMPOOLPAGE pPage = &pPool->aPages[iNew];
5137	pPool->iFreeHead = pPage->iNext;
5138	pPage->iNext = NIL_PGMPOOL_IDX;
5139
5140	/*
5141	* Initialize it.
5142	*/
5143	pPool->cUsedPages++; /* physical handler registration / pgmPoolTrackFlushGCPhysPTsSlow requirement. */
5144	pPage->enmKind = enmKind;
5145	pPage->enmAccess = enmAccess;
5146	pPage->GCPhys = GCPhys;
5147	pPage->fA20Enabled = fA20Enabled;
5148	pPage->fSeenNonGlobal = false; /* Set this to 'true' to disable this feature. */
5149	pPage->fMonitored = false;
5150	pPage->fCached = false;
5151	pPage->fDirty = false;
5152	pPage->fReusedFlushPending = false;
5153	pPage->cModifications = 0;
5154	pPage->iModifiedNext = NIL_PGMPOOL_IDX;
5155	pPage->iModifiedPrev = NIL_PGMPOOL_IDX;
5156	pPage->cPresent = 0;
5157	pPage->iFirstPresent = NIL_PGMPOOL_PRESENT_INDEX;
5158	pPage->idxDirtyEntry = 0;
5159	pPage->GCPtrLastAccessHandlerFault = NIL_RTGCPTR;
5160	pPage->GCPtrLastAccessHandlerRip = NIL_RTGCPTR;
5161	pPage->cLastAccessHandler = 0;
5162	pPage->cLocked = 0;
5163	# ifdef VBOX_STRICT
5164	pPage->GCPtrDirtyFault = NIL_RTGCPTR;
5165	# endif
5166
5167	/*
5168	* Insert into the tracking and cache. If this fails, free the page.
5169	*/
5170	int rc3 = pgmPoolTrackInsert(pPool, pPage, GCPhys, iUser, iUserTable);
5171	if (RT_FAILURE(rc3))
5172	{
5173	pPool->cUsedPages--;
5174	pPage->enmKind = PGMPOOLKIND_FREE;
5175	pPage->enmAccess = PGMPOOLACCESS_DONTCARE;
5176	pPage->GCPhys = NIL_RTGCPHYS;
5177	pPage->iNext = pPool->iFreeHead;
5178	pPool->iFreeHead = pPage->idx;
5179	pgmUnlock(pVM);
5180	STAM_PROFILE_ADV_STOP(&pPool->StatAlloc, a);
5181	Log(("pgmPoolAlloc: returns %Rrc (Insert)\n", rc3));
5182	return rc3;
5183	}
5184
5185	/*
5186	* Commit the allocation, clear the page and return.
5187	*/
5188	#ifdef VBOX_WITH_STATISTICS
5189	if (pPool->cUsedPages > pPool->cUsedPagesHigh)
5190	pPool->cUsedPagesHigh = pPool->cUsedPages;
5191	#endif
5192
5193	if (!pPage->fZeroed)
5194	{
5195	STAM_PROFILE_START(&pPool->StatZeroPage, z);
5196	void *pv = PGMPOOL_PAGE_2_PTR(pVM, pPage);
5197	ASMMemZeroPage(pv);
5198	STAM_PROFILE_STOP(&pPool->StatZeroPage, z);
5199	}
5200
5201	*ppPage = pPage;
5202	if (fLockPage)
5203	pgmPoolLockPage(pPool, pPage);
5204	pgmUnlock(pVM);
5205	LogFlow(("pgmPoolAlloc: returns %Rrc *ppPage=%p:{.Key=%RHp, .idx=%d, .fCached=%RTbool, .fMonitored=%RTbool}\n",
5206	rc, pPage, pPage->Core.Key, pPage->idx, pPage->fCached, pPage->fMonitored));
5207	STAM_PROFILE_ADV_STOP(&pPool->StatAlloc, a);
5208	return rc;
5209	}
5210
5211
5212	/**
5213	* Frees a usage of a pool page.
5214	*
5215	* @param pVM The cross context VM structure.
5216	* @param HCPhys The HC physical address of the shadow page.
5217	* @param iUser The shadow page pool index of the user table.
5218	* NIL_PGMPOOL_IDX if root page.
5219	* @param iUserTable The index into the user table (shadowed). Ignored if
5220	* root page.
5221	*/
5222	void pgmPoolFree(PVM pVM, RTHCPHYS HCPhys, uint16_t iUser, uint32_t iUserTable)
5223	{
5224	LogFlow(("pgmPoolFree: HCPhys=%RHp iUser=%d iUserTable=%#x\n", HCPhys, iUser, iUserTable));
5225	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
5226	pgmPoolFreeByPage(pPool, pgmPoolGetPage(pPool, HCPhys), iUser, iUserTable);
5227	}
5228
5229
5230	/**
5231	* Internal worker for finding a 'in-use' shadow page give by it's physical address.
5232	*
5233	* @returns Pointer to the shadow page structure.
5234	* @param pPool The pool.
5235	* @param HCPhys The HC physical address of the shadow page.
5236	*/
5237	PPGMPOOLPAGE pgmPoolGetPage(PPGMPOOL pPool, RTHCPHYS HCPhys)
5238	{
5239	PGM_LOCK_ASSERT_OWNER(pPool->CTX_SUFF(pVM));
5240
5241	/*
5242	* Look up the page.
5243	*/
5244	PPGMPOOLPAGE pPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, HCPhys & X86_PTE_PAE_PG_MASK);
5245
5246	AssertFatalMsg(pPage && pPage->enmKind != PGMPOOLKIND_FREE, ("HCPhys=%RHp pPage=%p idx=%d\n", HCPhys, pPage, (pPage) ? pPage->idx : 0));
5247	return pPage;
5248	}
5249
5250
5251	/**
5252	* Internal worker for finding a page for debugging purposes, no assertions.
5253	*
5254	* @returns Pointer to the shadow page structure. NULL on if not found.
5255	* @param pPool The pool.
5256	* @param HCPhys The HC physical address of the shadow page.
5257	*/
5258	PPGMPOOLPAGE pgmPoolQueryPageForDbg(PPGMPOOL pPool, RTHCPHYS HCPhys)
5259	{
5260	PGM_LOCK_ASSERT_OWNER(pPool->CTX_SUFF(pVM));
5261	return (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, HCPhys & X86_PTE_PAE_PG_MASK);
5262	}
5263
5264	#ifdef IN_RING3 /* currently only used in ring 3; save some space in the R0 & GC modules (left it here as we might need it elsewhere later on) */
5265
5266	/**
5267	* Flush the specified page if present
5268	*
5269	* @param pVM The cross context VM structure.
5270	* @param GCPhys Guest physical address of the page to flush
5271	*/
5272	void pgmPoolFlushPageByGCPhys(PVM pVM, RTGCPHYS GCPhys)
5273	{
5274	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
5275
5276	VM_ASSERT_EMT(pVM);
5277
5278	/*
5279	* Look up the GCPhys in the hash.
5280	*/
5281	GCPhys = GCPhys & ~(RTGCPHYS)PAGE_OFFSET_MASK;
5282	unsigned i = pPool->aiHash[PGMPOOL_HASH(GCPhys)];
5283	if (i == NIL_PGMPOOL_IDX)
5284	return;
5285
5286	do
5287	{
5288	PPGMPOOLPAGE pPage = &pPool->aPages[i];
5289	if (pPage->GCPhys - GCPhys < PAGE_SIZE)
5290	{
5291	switch (pPage->enmKind)
5292	{
5293	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_PT:
5294	case PGMPOOLKIND_PAE_PT_FOR_32BIT_PT:
5295	case PGMPOOLKIND_PAE_PT_FOR_PAE_PT:
5296	case PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD:
5297	case PGMPOOLKIND_PAE_PD1_FOR_32BIT_PD:
5298	case PGMPOOLKIND_PAE_PD2_FOR_32BIT_PD:
5299	case PGMPOOLKIND_PAE_PD3_FOR_32BIT_PD:
5300	case PGMPOOLKIND_PAE_PD_FOR_PAE_PD:
5301	case PGMPOOLKIND_64BIT_PD_FOR_64BIT_PD:
5302	case PGMPOOLKIND_64BIT_PDPT_FOR_64BIT_PDPT:
5303	case PGMPOOLKIND_64BIT_PML4:
5304	case PGMPOOLKIND_32BIT_PD:
5305	case PGMPOOLKIND_PAE_PDPT:
5306	{
5307	Log(("PGMPoolFlushPage: found pgm pool pages for %RGp\n", GCPhys));
5308	#ifdef PGMPOOL_WITH_OPTIMIZED_DIRTY_PT
5309	if (pPage->fDirty)
5310	STAM_COUNTER_INC(&pPool->StatForceFlushDirtyPage);
5311	else
5312	#endif
5313	STAM_COUNTER_INC(&pPool->StatForceFlushPage);
5314	Assert(!pgmPoolIsPageLocked(pPage));
5315	pgmPoolMonitorChainFlush(pPool, pPage);
5316	return;
5317	}
5318
5319	/* ignore, no monitoring. */
5320	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_4MB:
5321	case PGMPOOLKIND_PAE_PT_FOR_PAE_2MB:
5322	case PGMPOOLKIND_PAE_PT_FOR_32BIT_4MB:
5323	case PGMPOOLKIND_32BIT_PT_FOR_PHYS:
5324	case PGMPOOLKIND_PAE_PT_FOR_PHYS:
5325	case PGMPOOLKIND_64BIT_PDPT_FOR_PHYS:
5326	case PGMPOOLKIND_64BIT_PD_FOR_PHYS:
5327	case PGMPOOLKIND_EPT_PDPT_FOR_PHYS:
5328	case PGMPOOLKIND_EPT_PD_FOR_PHYS:
5329	case PGMPOOLKIND_EPT_PT_FOR_PHYS:
5330	case PGMPOOLKIND_ROOT_NESTED:
5331	case PGMPOOLKIND_PAE_PD_PHYS:
5332	case PGMPOOLKIND_PAE_PDPT_PHYS:
5333	case PGMPOOLKIND_32BIT_PD_PHYS:
5334	case PGMPOOLKIND_PAE_PDPT_FOR_32BIT:
5335	break;
5336
5337	default:
5338	AssertFatalMsgFailed(("enmKind=%d idx=%d\n", pPage->enmKind, pPage->idx));
5339	}
5340	}
5341
5342	/* next */
5343	i = pPage->iNext;
5344	} while (i != NIL_PGMPOOL_IDX);
5345	return;
5346	}
5347
5348	#endif /* IN_RING3 */
5349	#ifdef IN_RING3
5350
5351	/**
5352	* Reset CPU on hot plugging.
5353	*
5354	* @param pVM The cross context VM structure.
5355	* @param pVCpu The cross context virtual CPU structure.
5356	*/
5357	void pgmR3PoolResetUnpluggedCpu(PVM pVM, PVMCPU pVCpu)
5358	{
5359	pgmR3ExitShadowModeBeforePoolFlush(pVCpu);
5360
5361	pgmR3ReEnterShadowModeAfterPoolFlush(pVM, pVCpu);
5362	VMCPU_FF_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3);
5363	VMCPU_FF_SET(pVCpu, VMCPU_FF_TLB_FLUSH);
5364	}
5365
5366
5367	/**
5368	* Flushes the entire cache.
5369	*
5370	* It will assert a global CR3 flush (FF) and assumes the caller is aware of
5371	* this and execute this CR3 flush.
5372	*
5373	* @param pVM The cross context VM structure.
5374	*/
5375	void pgmR3PoolReset(PVM pVM)
5376	{
5377	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
5378
5379	PGM_LOCK_ASSERT_OWNER(pVM);
5380	STAM_PROFILE_START(&pPool->StatR3Reset, a);
5381	LogFlow(("pgmR3PoolReset:\n"));
5382
5383	/*
5384	* If there are no pages in the pool, there is nothing to do.
5385	*/
5386	if (pPool->cCurPages <= PGMPOOL_IDX_FIRST)
5387	{
5388	STAM_PROFILE_STOP(&pPool->StatR3Reset, a);
5389	return;
5390	}
5391
5392	/*
5393	* Exit the shadow mode since we're going to clear everything,
5394	* including the root page.
5395	*/
5396	for (VMCPUID i = 0; i < pVM->cCpus; i++)
5397	pgmR3ExitShadowModeBeforePoolFlush(&pVM->aCpus[i]);
5398
5399	/*
5400	* Nuke the free list and reinsert all pages into it.
5401	*/
5402	for (unsigned i = pPool->cCurPages - 1; i >= PGMPOOL_IDX_FIRST; i--)
5403	{
5404	PPGMPOOLPAGE pPage = &pPool->aPages[i];
5405
5406	Assert(pPage->Core.Key == MMPage2Phys(pVM, pPage->pvPageR3));
5407	if (pPage->fMonitored)
5408	pgmPoolMonitorFlush(pPool, pPage);
5409	pPage->iModifiedNext = NIL_PGMPOOL_IDX;
5410	pPage->iModifiedPrev = NIL_PGMPOOL_IDX;
5411	pPage->iMonitoredNext = NIL_PGMPOOL_IDX;
5412	pPage->iMonitoredPrev = NIL_PGMPOOL_IDX;
5413	pPage->cModifications = 0;
5414	pPage->GCPhys = NIL_RTGCPHYS;
5415	pPage->enmKind = PGMPOOLKIND_FREE;
5416	pPage->enmAccess = PGMPOOLACCESS_DONTCARE;
5417	Assert(pPage->idx == i);
5418	pPage->iNext = i + 1;
5419	pPage->fA20Enabled = true;
5420	pPage->fZeroed = false; /* This could probably be optimized, but better safe than sorry. */
5421	pPage->fSeenNonGlobal = false;
5422	pPage->fMonitored = false;
5423	pPage->fDirty = false;
5424	pPage->fCached = false;
5425	pPage->fReusedFlushPending = false;
5426	pPage->iUserHead = NIL_PGMPOOL_USER_INDEX;
5427	pPage->iAgeNext = NIL_PGMPOOL_IDX;
5428	pPage->iAgePrev = NIL_PGMPOOL_IDX;
5429	pPage->GCPtrLastAccessHandlerRip = NIL_RTGCPTR;
5430	pPage->GCPtrLastAccessHandlerFault = NIL_RTGCPTR;
5431	pPage->cLastAccessHandler = 0;
5432	pPage->cLocked = 0;
5433	#ifdef VBOX_STRICT
5434	pPage->GCPtrDirtyFault = NIL_RTGCPTR;
5435	#endif
5436	}
5437	pPool->aPages[pPool->cCurPages - 1].iNext = NIL_PGMPOOL_IDX;
5438	pPool->iFreeHead = PGMPOOL_IDX_FIRST;
5439	pPool->cUsedPages = 0;
5440
5441	/*
5442	* Zap and reinitialize the user records.
5443	*/
5444	pPool->cPresent = 0;
5445	pPool->iUserFreeHead = 0;
5446	PPGMPOOLUSER paUsers = pPool->CTX_SUFF(paUsers);
5447	const unsigned cMaxUsers = pPool->cMaxUsers;
5448	for (unsigned i = 0; i < cMaxUsers; i++)
5449	{
5450	paUsers[i].iNext = i + 1;
5451	paUsers[i].iUser = NIL_PGMPOOL_IDX;
5452	paUsers[i].iUserTable = 0xfffffffe;
5453	}
5454	paUsers[cMaxUsers - 1].iNext = NIL_PGMPOOL_USER_INDEX;
5455
5456	/*
5457	* Clear all the GCPhys links and rebuild the phys ext free list.
5458	*/
5459	for (PPGMRAMRANGE pRam = pVM->pgm.s.CTX_SUFF(pRamRangesX);
5460	pRam;
5461	pRam = pRam->CTX_SUFF(pNext))
5462	{
5463	unsigned iPage = pRam->cb >> PAGE_SHIFT;
5464	while (iPage-- > 0)
5465	PGM_PAGE_SET_TRACKING(pVM, &pRam->aPages[iPage], 0);
5466	}
5467
5468	pPool->iPhysExtFreeHead = 0;
5469	PPGMPOOLPHYSEXT paPhysExts = pPool->CTX_SUFF(paPhysExts);
5470	const unsigned cMaxPhysExts = pPool->cMaxPhysExts;
5471	for (unsigned i = 0; i < cMaxPhysExts; i++)
5472	{
5473	paPhysExts[i].iNext = i + 1;
5474	paPhysExts[i].aidx[0] = NIL_PGMPOOL_IDX;
5475	paPhysExts[i].apte[0] = NIL_PGMPOOL_PHYSEXT_IDX_PTE;
5476	paPhysExts[i].aidx[1] = NIL_PGMPOOL_IDX;
5477	paPhysExts[i].apte[1] = NIL_PGMPOOL_PHYSEXT_IDX_PTE;
5478	paPhysExts[i].aidx[2] = NIL_PGMPOOL_IDX;
5479	paPhysExts[i].apte[2] = NIL_PGMPOOL_PHYSEXT_IDX_PTE;
5480	}
5481	paPhysExts[cMaxPhysExts - 1].iNext = NIL_PGMPOOL_PHYSEXT_INDEX;
5482
5483	/*
5484	* Just zap the modified list.
5485	*/
5486	pPool->cModifiedPages = 0;
5487	pPool->iModifiedHead = NIL_PGMPOOL_IDX;
5488
5489	/*
5490	* Clear the GCPhys hash and the age list.
5491	*/
5492	for (unsigned i = 0; i < RT_ELEMENTS(pPool->aiHash); i++)
5493	pPool->aiHash[i] = NIL_PGMPOOL_IDX;
5494	pPool->iAgeHead = NIL_PGMPOOL_IDX;
5495	pPool->iAgeTail = NIL_PGMPOOL_IDX;
5496
5497	#ifdef PGMPOOL_WITH_OPTIMIZED_DIRTY_PT
5498	/* Clear all dirty pages. */
5499	pPool->idxFreeDirtyPage = 0;
5500	pPool->cDirtyPages = 0;
5501	for (unsigned i = 0; i < RT_ELEMENTS(pPool->aDirtyPages); i++)
5502	pPool->aDirtyPages[i].uIdx = NIL_PGMPOOL_IDX;
5503	#endif
5504
5505	/*
5506	* Reinsert active pages into the hash and ensure monitoring chains are correct.
5507	*/
5508	for (VMCPUID i = 0; i < pVM->cCpus; i++)
5509	{
5510	/*
5511	* Re-enter the shadowing mode and assert Sync CR3 FF.
5512	*/
5513	PVMCPU pVCpu = &pVM->aCpus[i];
5514	pgmR3ReEnterShadowModeAfterPoolFlush(pVM, pVCpu);
5515	VMCPU_FF_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3);
5516	VMCPU_FF_SET(pVCpu, VMCPU_FF_TLB_FLUSH);
5517	}
5518
5519	STAM_PROFILE_STOP(&pPool->StatR3Reset, a);
5520	}
5521
5522	#endif /* IN_RING3 */
5523
5524	#if defined(LOG_ENABLED) \|\| defined(VBOX_STRICT)
5525	/**
5526	* Stringifies a PGMPOOLKIND value.
5527	*/
5528	static const char *pgmPoolPoolKindToStr(uint8_t enmKind)
5529	{
5530	switch ((PGMPOOLKIND)enmKind)
5531	{
5532	case PGMPOOLKIND_INVALID:
5533	return "PGMPOOLKIND_INVALID";
5534	case PGMPOOLKIND_FREE:
5535	return "PGMPOOLKIND_FREE";
5536	case PGMPOOLKIND_32BIT_PT_FOR_PHYS:
5537	return "PGMPOOLKIND_32BIT_PT_FOR_PHYS";
5538	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_PT:
5539	return "PGMPOOLKIND_32BIT_PT_FOR_32BIT_PT";
5540	case PGMPOOLKIND_32BIT_PT_FOR_32BIT_4MB:
5541	return "PGMPOOLKIND_32BIT_PT_FOR_32BIT_4MB";
5542	case PGMPOOLKIND_PAE_PT_FOR_PHYS:
5543	return "PGMPOOLKIND_PAE_PT_FOR_PHYS";
5544	case PGMPOOLKIND_PAE_PT_FOR_32BIT_PT:
5545	return "PGMPOOLKIND_PAE_PT_FOR_32BIT_PT";
5546	case PGMPOOLKIND_PAE_PT_FOR_32BIT_4MB:
5547	return "PGMPOOLKIND_PAE_PT_FOR_32BIT_4MB";
5548	case PGMPOOLKIND_PAE_PT_FOR_PAE_PT:
5549	return "PGMPOOLKIND_PAE_PT_FOR_PAE_PT";
5550	case PGMPOOLKIND_PAE_PT_FOR_PAE_2MB:
5551	return "PGMPOOLKIND_PAE_PT_FOR_PAE_2MB";
5552	case PGMPOOLKIND_32BIT_PD:
5553	return "PGMPOOLKIND_32BIT_PD";
5554	case PGMPOOLKIND_32BIT_PD_PHYS:
5555	return "PGMPOOLKIND_32BIT_PD_PHYS";
5556	case PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD:
5557	return "PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD";
5558	case PGMPOOLKIND_PAE_PD1_FOR_32BIT_PD:
5559	return "PGMPOOLKIND_PAE_PD1_FOR_32BIT_PD";
5560	case PGMPOOLKIND_PAE_PD2_FOR_32BIT_PD:
5561	return "PGMPOOLKIND_PAE_PD2_FOR_32BIT_PD";
5562	case PGMPOOLKIND_PAE_PD3_FOR_32BIT_PD:
5563	return "PGMPOOLKIND_PAE_PD3_FOR_32BIT_PD";
5564	case PGMPOOLKIND_PAE_PD_FOR_PAE_PD:
5565	return "PGMPOOLKIND_PAE_PD_FOR_PAE_PD";
5566	case PGMPOOLKIND_PAE_PD_PHYS:
5567	return "PGMPOOLKIND_PAE_PD_PHYS";
5568	case PGMPOOLKIND_PAE_PDPT_FOR_32BIT:
5569	return "PGMPOOLKIND_PAE_PDPT_FOR_32BIT";
5570	case PGMPOOLKIND_PAE_PDPT:
5571	return "PGMPOOLKIND_PAE_PDPT";
5572	case PGMPOOLKIND_PAE_PDPT_PHYS:
5573	return "PGMPOOLKIND_PAE_PDPT_PHYS";
5574	case PGMPOOLKIND_64BIT_PDPT_FOR_64BIT_PDPT:
5575	return "PGMPOOLKIND_64BIT_PDPT_FOR_64BIT_PDPT";
5576	case PGMPOOLKIND_64BIT_PDPT_FOR_PHYS:
5577	return "PGMPOOLKIND_64BIT_PDPT_FOR_PHYS";
5578	case PGMPOOLKIND_64BIT_PD_FOR_64BIT_PD:
5579	return "PGMPOOLKIND_64BIT_PD_FOR_64BIT_PD";
5580	case PGMPOOLKIND_64BIT_PD_FOR_PHYS:
5581	return "PGMPOOLKIND_64BIT_PD_FOR_PHYS";
5582	case PGMPOOLKIND_64BIT_PML4:
5583	return "PGMPOOLKIND_64BIT_PML4";
5584	case PGMPOOLKIND_EPT_PDPT_FOR_PHYS:
5585	return "PGMPOOLKIND_EPT_PDPT_FOR_PHYS";
5586	case PGMPOOLKIND_EPT_PD_FOR_PHYS:
5587	return "PGMPOOLKIND_EPT_PD_FOR_PHYS";
5588	case PGMPOOLKIND_EPT_PT_FOR_PHYS:
5589	return "PGMPOOLKIND_EPT_PT_FOR_PHYS";
5590	case PGMPOOLKIND_ROOT_NESTED:
5591	return "PGMPOOLKIND_ROOT_NESTED";
5592	}
5593	return "Unknown kind!";
5594	}
5595	#endif /* LOG_ENABLED \|\| VBOX_STRICT */
5596

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp@ 60380

Download in other formats: