Changeset 100964 in vbox for trunk/src/VBox/VMM/VMMAll

Timestamp:

Aug 24, 2023 2:45:42 PM (16 months ago)

Author:

vboxsync

Message:

VMM/PGM: Some experiments wrt preseving ZERO page status as the (windows) guest zero's all memory prior to use. bugref:6385 bugref:10509

Location:

trunk/src/VBox/VMM/VMMAll

Files:

• PGMAll.cpp (modified) (3 diffs)
• PGMAllBth.h (modified) (10 diffs)
• PGMAllPool.cpp (modified) (1 diff)

trunk/src/VBox/VMM/VMMAll/PGMAll.cpp

@@ -72 +72 @@
 static int pgmShwSyncLongModePDPtr(PVMCPUCC pVCpu, RTGCPTR64 GCPtr, X86PGPAEUINT uGstPml4e, X86PGPAEUINT uGstPdpe, PX86PDPAE *ppPD);
 static int pgmShwGetEPTPDPtr(PVMCPUCC pVCpu, RTGCPTR64 GCPtr, PEPTPDPT *ppPdpt, PEPTPD *ppPD);
+#ifdef PGM_WITH_PAGE_ZEROING_DETECTION
+static bool pgmHandlePageZeroingCode(PVMCPUCC pVCpu, PCPUMCTX pCtx);
+#endif
 
 
@@ -3931 +3934 @@
 
         cch = pfnOutput(pvArgOutput, szTmp, cch);
+#if 0
+        size_t cch2 = 0;
+        szTmp[cch2++] = '(';
+        cch2 += RTStrFormatNumber(&szTmp[cch2], (uintptr_t)pPage, 16, 18, 0, RTSTR_F_SPECIAL | RTSTR_F_ZEROPAD | RTSTR_F_64BIT);
+        szTmp[cch2++] = ')';
+        szTmp[cch2] = '\0';
+        cch += pfnOutput(pvArgOutput, szTmp, cch2);
+#endif
     }
     else
@@ -4075 +4086 @@
 }
 
+#ifdef PGM_WITH_PAGE_ZEROING_DETECTION
+
+/**
+ * Helper for checking whether XMM0 is zero, possibly retriving external state.
+ */
+static bool pgmHandlePageZeroingIsXmm0Zero(PVMCPUCC pVCpu, PCPUMCTX pCtx)
+{
+    if (pCtx->fExtrn & CPUMCTX_EXTRN_SSE_AVX)
+    {
+        int rc = CPUMImportGuestStateOnDemand(pVCpu, CPUMCTX_EXTRN_SSE_AVX);
+        AssertRCReturn(rc, false);
+    }
+    return pCtx->XState.x87.aXMM[0].au64[0] == 0
+        && pCtx->XState.x87.aXMM[0].au64[1] == 0
+        && pCtx->XState.x87.aXMM[0].au64[2] == 0
+        && pCtx->XState.x87.aXMM[0].au64[3] == 0;
+}
+
+
+/**
+ * Helper for comparing opcode bytes.
+ */
+static bool pgmHandlePageZeroingMatchOpcodes(PVMCPUCC pVCpu, PCPUMCTX pCtx, uint8_t const *pbOpcodes, uint32_t cbOpcodes)
+{
+    uint8_t abTmp[64];
+    AssertMsgReturn(cbOpcodes <= sizeof(abTmp), ("cbOpcodes=%#x\n", cbOpcodes), false);
+    int rc = PGMPhysSimpleReadGCPtr(pVCpu, abTmp, pCtx->rip + pCtx->cs.u64Base, cbOpcodes);
+    if (RT_SUCCESS(rc))
+        return memcmp(abTmp, pbOpcodes, cbOpcodes) == 0;
+    return false;
+}
+
+
+/**
+ * Called on faults on ZERO pages to check if the guest is trying to zero it.
+ *
+ * Since it's a waste of time to zero a ZERO page and it will cause an
+ * unnecessary page allocation, we'd like to detect and avoid this.
+ * If any known page zeroing code is detected, this function will update the CPU
+ * state to pretend the page was zeroed by the code.
+ *
+ * @returns true if page zeroing code was detected and CPU state updated to skip
+ *          the code.
+ * @param   pVCpu   The cross context virtual CPU structure of the calling EMT.
+ * @param   pCtx    The guest register context.
+ */
+static bool pgmHandlePageZeroingCode(PVMCPUCC pVCpu, PCPUMCTX pCtx)
+{
+    CPUMCTX_ASSERT_NOT_EXTRN(pCtx, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR3 | CPUMCTX_EXTRN_CR4 | CPUMCTX_EXTRN_EFER);
+
+    /*
+     * Sort by mode first.
+     */
+    if (CPUMIsGuestInLongModeEx(pCtx))
+    {
+        if (CPUMIsGuestIn64BitCodeEx(pCtx))
+        {
+            /*
+             * 64-bit code.
+             */
+            Log9(("pgmHandlePageZeroingCode: not page zeroing - 64-bit\n"));
+        }
+        else if (pCtx->cs.Attr.n.u1DefBig)
+            Log9(("pgmHandlePageZeroingCode: not page zeroing - 32-bit lm\n"));
+        else
+            Log9(("pgmHandlePageZeroingCode: not page zeroing - 16-bit lm\n"));
+    }
+    else if (CPUMIsGuestInPagedProtectedModeEx(pCtx))
+    {
+        if (pCtx->cs.Attr.n.u1DefBig)
+        {
+            /*
+             * 32-bit paged protected mode code.
+             */
+            CPUMCTX_ASSERT_NOT_EXTRN(pCtx, CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RCX | CPUMCTX_EXTRN_RDX | CPUMCTX_EXTRN_RBX
+                                         | CPUMCTX_EXTRN_RSP | CPUMCTX_EXTRN_RBP | CPUMCTX_EXTRN_RSI | CPUMCTX_EXTRN_RDI
+                                         | CPUMCTX_EXTRN_RIP | CPUMCTX_EXTRN_RFLAGS);
+
+            /* 1. Generic 'rep stosd' detection. */
+            static uint8_t const s_abRepStosD[] = { 0xf3, 0xab };
+            if (   pCtx->eax == 0
+                && pCtx->ecx == X86_PAGE_SIZE / 4
+                && !(pCtx->edi & X86_PAGE_OFFSET_MASK)
+                && pgmHandlePageZeroingMatchOpcodes(pVCpu, pCtx, s_abRepStosD, sizeof(s_abRepStosD)))
+            {
+                pCtx->ecx  = 0;
+                pCtx->edi += X86_PAGE_SIZE;
+                Log9(("pgmHandlePageZeroingCode: REP STOSD: eip=%RX32 -> %RX32\n", pCtx->eip, pCtx->eip + sizeof(s_abRepStosD)));
+                pCtx->eip += sizeof(s_abRepStosD);
+                return true;
+            }
+
+            /* 2. Windows 2000 sp4 KiXMMIZeroPageNoSave loop code: */
+            static uint8_t const s_abW2kSp4XmmZero[] =
+            {
+                0x0f, 0x2b, 0x01,
+                0x0f, 0x2b, 0x41, 0x10,
+                0x0f, 0x2b, 0x41, 0x20,
+                0x0f, 0x2b, 0x41, 0x30,
+                0x83, 0xc1, 0x40,
+                0x48,
+                0x75, 0xeb,
+            };
+            if (   pCtx->eax == 64
+                && !(pCtx->ecx & X86_PAGE_OFFSET_MASK)
+                && pgmHandlePageZeroingMatchOpcodes(pVCpu, pCtx, s_abW2kSp4XmmZero, sizeof(s_abW2kSp4XmmZero))
+                && pgmHandlePageZeroingIsXmm0Zero(pVCpu, pCtx))
+            {
+                pCtx->eax  = 1;
+                pCtx->ecx += X86_PAGE_SIZE;
+                Log9(("pgmHandlePageZeroingCode: w2k sp4 xmm: eip=%RX32 -> %RX32\n",
+                      pCtx->eip, pCtx->eip + sizeof(s_abW2kSp4XmmZero) - 3));
+                pCtx->eip += sizeof(s_abW2kSp4XmmZero) - 3;
+                return true;
+            }
+            Log9(("pgmHandlePageZeroingCode: not page zeroing - 32-bit\n"));
+        }
+        else if (!pCtx->eflags.Bits.u1VM)
+            Log9(("pgmHandlePageZeroingCode: not page zeroing - 16-bit\n"));
+        else
+            Log9(("pgmHandlePageZeroingCode: not page zeroing - v86\n"));
+    }
+    return false;
+}
+
+#endif /* PGM_WITH_PAGE_ZEROING_DETECTION */

trunk/src/VBox/VMM/VMMAll/PGMAllBth.h

@@ -783 +783 @@
 #   endif
                 AssertFatalMsg(!PGM_PAGE_IS_BALLOONED(pPage), ("Unexpected ballooned page at %RGp\n", GCPhys));
+#  ifdef PGM_WITH_PAGE_ZEROING_DETECTION
+                if (   PGM_PAGE_GET_STATE(pPage) == PGM_PAGE_STATE_ZERO
+                    && (pvFault & X86_PAGE_OFFSET_MASK) == 0
+                    && pgmHandlePageZeroingCode(pVCpu, pCtx))
+                {
+                    STAM_STATS({ pVCpu->pgmr0.s.pStatTrap0eAttributionR0 = &pVCpu->pgm.s.Stats.StatRZTrap0eTime2PageZeroing; });
+                    return VINF_SUCCESS;
+                }
+#  endif
                 STAM_STATS({ pVCpu->pgmr0.s.pStatTrap0eAttributionR0 = &pVCpu->pgm.s.Stats.StatRZTrap0eTime2MakeWritable; });
 
@@ -1313 +1322 @@
             /* This is a read-only page. */
             AssertFatalMsg(!PGM_PAGE_IS_BALLOONED(pPage), ("Unexpected ballooned page at %RGp\n", GCPhysPage));
+#ifdef PGM_WITH_PAGE_ZEROING_DETECTION
+            if (   PGM_PAGE_GET_STATE(pPage) == PGM_PAGE_STATE_ZERO
+                && (GCPhysNestedFault & X86_PAGE_OFFSET_MASK) == 0
+                && pgmHandlePageZeroingCode(pVCpu, pCtx))
+            {
+                STAM_STATS({ pVCpu->pgmr0.s.pStatTrap0eAttributionR0 = &pVCpu->pgm.s.Stats.StatRZTrap0eTime2PageZeroing; });
+                return VINF_SUCCESS;
+            }
+#endif
             STAM_STATS({ pVCpu->pgmr0.s.pStatTrap0eAttributionR0 = &pVCpu->pgm.s.Stats.StatRZTrap0eTime2MakeWritable; });
 
@@ -1679 +1697 @@
     }
 # else
-  NOREF(GCPhysPage);
+    NOREF(GCPhysPage);
 # endif
-
-    STAM_PROFILE_START(&pVM->pgm.s.Stats.StatTrackDeref, a);
-    LogFlow(("SyncPageWorkerTrackDeref: Damn HCPhys=%RHp pShwPage->idx=%#x!!!\n", HCPhys, pShwPage->idx));
 
     /** @todo If this turns out to be a bottle neck (*very* likely) two things can be done:
      *      1. have a medium sized HCPhys -> GCPhys TLB (hash?)
      *      2. write protect all shadowed pages. I.e. implement caching.
-     */
+     *
+     *  2023-08-24 bird: If we allow the ZeroPg to enter the shadow page tables,
+     *  this becomes a common occurence and we screw up. A better to the above would
+     *  be to have a parallel table that records the guest physical addresses of the
+     *  pages mapped by the shadow page table...  For nested page tables,
+     *  we can easily correleate a table entry to a page entry, so it won't be
+     *  needed for those.
+     */
+# if  PGM_TYPE_IS_NESTED_OR_EPT(PGM_SHW_TYPE) || !PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE)
+    /*
+     * For non-paged guest tables, EPT and nested tables we can figure out the
+     * physical page corresponding to the entry and dereference it.
+     * (This ASSUMES that shadow PTs won't be used ever be used out of place.)
+     */
+    if (   pShwPage->enmKind == PGMPOOLKIND_EPT_PT_FOR_PHYS
+        || pShwPage->enmKind == PGMPOOLKIND_PAE_PT_FOR_PHYS
+        || pShwPage->enmKind == PGMPOOLKIND_32BIT_PT_FOR_PHYS)
+    {
+        RTGCPHYS GCPhysNestedEntry = pShwPage->GCPhys + ((uint32_t)iPte << X86_PAGE_SHIFT);
+        if (!pShwPage->fA20Enabled)
+            GCPhysNestedEntry &= ~(uint64_t)RT_BIT_64(20);
+        PPGMPAGE const pPhysPage = pgmPhysGetPage(pVM, GCPhysNestedEntry);
+        AssertRelease(pPhysPage);
+        pgmTrackDerefGCPhys(pVM->pgm.s.CTX_SUFF(pPool), pShwPage, pPhysPage, iPte);
+    }
+    else
+        AssertMsgFailed(("enmKind=%d GCPhys=%RGp\n", pShwPage->enmKind, pShwPage->GCPhys));
+# endif
+
     /** @todo duplicated in the 2nd half of pgmPoolTracDerefGCPhysHint */
 
@@ -1694 +1737 @@
      * Find the guest address.
      */
+    STAM_PROFILE_START(&pVM->pgm.s.Stats.StatTrackDeref, a);
+    LogFlow(("SyncPageWorkerTrackDeref(%d,%d): Damn HCPhys=%RHp pShwPage->idx=%#x!!!\n",
+             PGM_SHW_TYPE, PGM_GST_TYPE, HCPhys, pShwPage->idx));
     for (PPGMRAMRANGE pRam = pVM->pgm.s.CTX_SUFF(pRamRangesX);
          pRam;
@@ -1750 +1796 @@
 
     /* write back */
-    Log2(("SyncPageWorkerTrackAddRef: u16=%#x->%#x  iPTDst=%#x\n", u16, PGM_PAGE_GET_TRACKING(pPage), iPTDst));
+    Log2(("SyncPageWorkerTrackAddRef: u16=%#x->%#x  iPTDst=%#x pPage=%p\n", u16, PGM_PAGE_GET_TRACKING(pPage), iPTDst, pPage));
     PGM_PAGE_SET_TRACKING(pVM, pPage, u16);
 
@@ -2574 +2620 @@
         if (SHW_PTE_IS_P(*pPte))
         {
-            Log2(("SyncPageWorker: deref! *pPte=%RX64\n", SHW_PTE_LOG64(*pPte)));
+            Log2(("NestedSyncPageWorker: deref! *pPte=%RX64\n", SHW_PTE_LOG64(*pPte)));
             PGM_BTH_NAME(SyncPageWorkerTrackDeref)(pVCpu, pShwPage, SHW_PTE_GET_HCPHYS(*pPte), iPte, NIL_RTGCPHYS);
         }
@@ -2650 +2696 @@
         else if (SHW_PTE_GET_HCPHYS(*pPte) != SHW_PTE_GET_HCPHYS(Pte))
         {
-            Log2(("SyncPageWorker: deref! *pPte=%RX64 Pte=%RX64\n", SHW_PTE_LOG64(*pPte), SHW_PTE_LOG64(Pte)));
+            Log2(("NestedSyncPageWorker: deref! *pPte=%RX64 Pte=%RX64\n", SHW_PTE_LOG64(*pPte), SHW_PTE_LOG64(Pte)));
             PGM_BTH_NAME(SyncPageWorkerTrackDeref)(pVCpu, pShwPage, SHW_PTE_GET_HCPHYS(*pPte), iPte, NIL_RTGCPHYS);
             PGM_BTH_NAME(SyncPageWorkerTrackAddref)(pVCpu, pShwPage, PGM_PAGE_GET_TRACKING(pPage), pPage, iPte);
@@ -2657 +2703 @@
     else if (SHW_PTE_IS_P(*pPte))
     {
-        Log2(("SyncPageWorker: deref! *pPte=%RX64\n", SHW_PTE_LOG64(*pPte)));
+        Log2(("NestedSyncPageWorker: deref! *pPte=%RX64\n", SHW_PTE_LOG64(*pPte)));
         PGM_BTH_NAME(SyncPageWorkerTrackDeref)(pVCpu, pShwPage, SHW_PTE_GET_HCPHYS(*pPte), iPte, NIL_RTGCPHYS);
     }
@@ -3849 +3895 @@
                 }
             }
+#  if !defined(VBOX_WITH_NEW_LAZY_PAGE_ALLOC) && !defined(PGM_WITH_PAGE_ZEROING_DETECTION) /* This code is too aggresive! */
             else if (   PGMIsUsingLargePages(pVM)
                      && PGM_A20_IS_ENABLED(pVCpu))
@@ -3862 +3909 @@
                     LogFlow(("pgmPhysAllocLargePage failed with %Rrc\n", rc));
             }
+#  endif
 
             if (HCPhys != NIL_RTHCPHYS)

trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp

@@ -3750 +3750 @@
          * will be needed for this problem of course, but it will have to wait...
          */
+# ifndef VBOX_WITH_NEW_LAZY_PAGE_ALLOC /* end up guruing after pgmR0PhysAllocateLargePage otherwise. */
         if (    PGM_PAGE_IS_ZERO(pPhysPage)
             ||  PGM_PAGE_IS_BALLOONED(pPhysPage))
+# else
+        if (PGM_PAGE_IS_BALLOONED(pPhysPage))
+# endif
             rc = VINF_PGM_GCPHYS_ALIASED;
         else