Changeset 31136 in vbox

Timestamp:

Jul 27, 2010 12:06:18 PM (14 years ago)

Author:

vboxsync

Message:

PGM: cache the last physical handler lookup result in each ring.

Location:

trunk/src/VBox/VMM

Files:

• PGM.cpp (modified) (4 diffs)
• PGMInline.h (modified) (1 diff)
• PGMInternal.h (modified) (8 diffs)
• VMMAll/PGMAllBth.h (modified) (3 diffs)
• VMMAll/PGMAllHandler.cpp (modified) (6 diffs)
• VMMAll/PGMAllPhys.cpp (modified) (7 diffs)

trunk/src/VBox/VMM/PGM.cpp

@@ -1696 +1696 @@
     PGM_REG_COUNTER(&pStats->StatRZPhysHandlerReset,            "/PGM/RZ/PhysHandlerReset",           "The number of times PGMHandlerPhysicalReset is called.");
     PGM_REG_COUNTER(&pStats->StatR3PhysHandlerReset,            "/PGM/R3/PhysHandlerReset",           "The number of times PGMHandlerPhysicalReset is called.");
+    PGM_REG_COUNTER(&pStats->StatRZPhysHandlerLookupHits,       "/PGM/RZ/PhysHandlerLookupHits",      "The number of cache hits when looking up physical handlers.");
+    PGM_REG_COUNTER(&pStats->StatR3PhysHandlerLookupHits,       "/PGM/R3/PhysHandlerLookupHits",      "The number of cache hits when looking up physical handlers.");
+    PGM_REG_COUNTER(&pStats->StatRZPhysHandlerLookupMisses,     "/PGM/RZ/PhysHandlerLookupMisses",    "The number of cache misses when looking up physical handlers.");
+    PGM_REG_COUNTER(&pStats->StatR3PhysHandlerLookupMisses,     "/PGM/R3/PhysHandlerLookupMisses",    "The number of cache misses when looking up physical handlers.");
     PGM_REG_PROFILE(&pStats->StatRZVirtHandlerSearchByPhys,     "/PGM/RZ/VirtHandlerSearchByPhys",    "Profiling of pgmHandlerVirtualFindByPhysAddr.");
     PGM_REG_PROFILE(&pStats->StatR3VirtHandlerSearchByPhys,     "/PGM/R3/VirtHandlerSearchByPhys",    "Profiling of pgmHandlerVirtualFindByPhysAddr.");
@@ -2029 +2033 @@
     AssertRelease(pMapping);
     const uintptr_t off = pVM->pgm.s.pbDynPageMapBaseGC - pMapping->GCPtr;
-    const unsigned iPT = off >> X86_PD_SHIFT;
+    const unsigned iPT =  off >> X86_PD_SHIFT;
     const unsigned iPG = (off >> X86_PT_SHIFT) & X86_PT_MASK;
     pVM->pgm.s.paDynPageMap32BitPTEsGC = pMapping->aPTs[iPT].pPTRC      + iPG * sizeof(pMapping->aPTs[0].pPTR3->a[0]);
@@ -2219 +2223 @@
      */
     RTAvlroGCPhysDoWithAll(&pVM->pgm.s.pTreesR3->PhysHandlers,     true, pgmR3RelocatePhysHandler,      &offDelta);
+    pVM->pgm.s.pLastPhysHandlerRC = NIL_RTRCPTR;
     RTAvlroGCPtrDoWithAll(&pVM->pgm.s.pTreesR3->VirtHandlers,      true, pgmR3RelocateVirtHandler,      &offDelta);
     RTAvlroGCPtrDoWithAll(&pVM->pgm.s.pTreesR3->HyperVirtHandlers, true, pgmR3RelocateHyperVirtHandler, &offDelta);
@@ -4587 +4592 @@
      */
     int cErrors = 0;
-    const static PGMCHECKINTARGS s_LeftToRight = { true, NULL, NULL, NULL, pVM };
+    const static PGMCHECKINTARGS s_LeftToRight = {  true, NULL, NULL, NULL, pVM };
     const static PGMCHECKINTARGS s_RightToLeft = { false, NULL, NULL, NULL, pVM };
     PGMCHECKINTARGS Args = s_LeftToRight;

trunk/src/VBox/VMM/PGMInline.h

@@ -1186 +1186 @@
 
 #endif /* !IN_RC */
+
+
+/**
+ * Cached physical handler lookup.
+ *
+ * @returns Physical handler covering @a GCPhys.
+ * @param   pVM                 The VM handle.
+ * @param   GCPhys              The lookup address.
+ */
+DECLINLINE(PPGMPHYSHANDLER) pgmHandlerPhysicalLookup(PVM pVM, RTGCPHYS GCPhys)
+{
+    PPGMPHYSHANDLER pHandler = pVM->pgm.s.CTX_SUFF(pLastPhysHandler);
+    if (   pHandler
+        && GCPhys >= pHandler->Core.Key
+        && GCPhys < pHandler->Core.KeyLast)
+    {
+        STAM_COUNTER_INC(&pVM->pgm.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,PhysHandlerLookupHits));
+        return pHandler;
+    }
+
+    STAM_COUNTER_INC(&pVM->pgm.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,PhysHandlerLookupMisses));
+    pHandler = (PPGMPHYSHANDLER)RTAvlroGCPhysRangeGet(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers, GCPhys);
+    if (pHandler)
+        pVM->pgm.s.CTX_SUFF(pLastPhysHandler) = pHandler;
+    return pHandler;
+}
+
 
 /**

trunk/src/VBox/VMM/PGMInternal.h

@@ -2621 +2621 @@
     STAMPROFILE StatR3ResolveConflict;              /**< R3: pgmR3SyncPTResolveConflict() profiling (includes the entire relocation). */
 
+    /* R3+RZ */
     STAMCOUNTER StatRZChunkR3MapTlbHits;            /**< RC/R0: Ring-3/0 chunk mapper TLB hits. */
     STAMCOUNTER StatRZChunkR3MapTlbMisses;          /**< RC/R0: Ring-3/0 chunk mapper TLB misses. */
@@ -2637 +2638 @@
     STAMCOUNTER StatR3PhysHandlerReset;             /**< R3: The number of times PGMHandlerPhysicalReset is called. */
     STAMCOUNTER StatRZPhysHandlerReset;             /**< RC/R0: The number of times PGMHandlerPhysicalReset is called. */
+    STAMCOUNTER StatR3PhysHandlerLookupHits;        /**< R3: Number of cache hits when looking up physical handlers. */
+    STAMCOUNTER StatR3PhysHandlerLookupMisses;      /**< R3: Number of cache misses when looking up physical handlers. */
+    STAMCOUNTER StatRZPhysHandlerLookupHits;        /**< RC/R0: Number of cache hits when lookup up physical handlers. */
+    STAMCOUNTER StatRZPhysHandlerLookupMisses;      /**< RC/R0: Number of cache misses when looking up physical handlers */
     STAMPROFILE StatRZVirtHandlerSearchByPhys;      /**< RC/R0: Profiling of pgmHandlerVirtualFindByPhysAddr. */
     STAMPROFILE StatR3VirtHandlerSearchByPhys;      /**< R3: Profiling of pgmHandlerVirtualFindByPhysAddr. */
@@ -2716 +2721 @@
 {
     /** Offset to the VM structure. */
-    RTINT                           offVM;
+    int32_t                         offVM;
     /** Offset of the PGMCPU structure relative to VMCPU. */
-    RTINT                           offVCpuPGM;
+    int32_t                         offVCpuPGM;
 
     /** @cfgm{RamPreAlloc, boolean, false}
@@ -2740 +2745 @@
     /** The host paging mode. (This is what SUPLib reports.) */
     SUPPAGINGMODE                   enmHostMode;
-
-    /** Pointer to the page table entries for the dynamic page mapping area - GCPtr. */
-    RCPTRTYPE(PX86PTE)              paDynPageMap32BitPTEsGC;
-    /** Pointer to the page table entries for the dynamic page mapping area - GCPtr. */
-    RCPTRTYPE(PX86PTEPAE)           paDynPageMapPaePTEsGC;
-
-    /** 4 MB page mask; 32 or 36 bits depending on PSE-36 (identical for all VCPUs) */
-    RTGCPHYS                        GCPhys4MBPSEMask;
-    /** Mask containing the invalid bits of a guest physical address.
-     * @remarks this does not stop at bit 52.  */
-    RTGCPHYS                        GCPhysInvAddrMask;
-
-    /** Pointer to the list of RAM ranges (Phys GC -> Phys HC conversion) - for R3.
-     * This is sorted by physical address and contains no overlapping ranges. */
-    R3PTRTYPE(PPGMRAMRANGE)         pRamRangesR3;
-    /** R0 pointer corresponding to PGM::pRamRangesR3. */
-    R0PTRTYPE(PPGMRAMRANGE)         pRamRangesR0;
-    /** RC pointer corresponding to PGM::pRamRangesR3. */
-    RCPTRTYPE(PPGMRAMRANGE)         pRamRangesRC;
-    /** Generation ID for the RAM ranges. This member is incremented everytime a RAM
-     * range is linked or unlinked. */
-    uint32_t volatile               idRamRangesGen;
-
-    /** Pointer to the list of ROM ranges - for R3.
-     * This is sorted by physical address and contains no overlapping ranges. */
-    R3PTRTYPE(PPGMROMRANGE)         pRomRangesR3;
-    /** R0 pointer corresponding to PGM::pRomRangesR3. */
-    R0PTRTYPE(PPGMROMRANGE)         pRomRangesR0;
-    /** RC pointer corresponding to PGM::pRomRangesR3. */
-    RCPTRTYPE(PPGMROMRANGE)         pRomRangesRC;
-#if HC_ARCH_BITS == 64
-    /** Alignment padding. */
-    RTRCPTR                         GCPtrPadding2;
-#endif
-
-    /** Pointer to the list of MMIO2 ranges - for R3.
-     * Registration order. */
-    R3PTRTYPE(PPGMMMIO2RANGE)       pMmio2RangesR3;
-
-    /** PGM offset based trees - R3 Ptr. */
-    R3PTRTYPE(PPGMTREES)            pTreesR3;
-    /** PGM offset based trees - R0 Ptr. */
-    R0PTRTYPE(PPGMTREES)            pTreesR0;
-    /** PGM offset based trees - RC Ptr. */
-    RCPTRTYPE(PPGMTREES)            pTreesRC;
-
-    /** Linked list of GC mappings - for RC.
-     * The list is sorted ascending on address.
-     */
-    RCPTRTYPE(PPGMMAPPING)          pMappingsRC;
-    /** Linked list of GC mappings - for HC.
-     * The list is sorted ascending on address.
-     */
-    R3PTRTYPE(PPGMMAPPING)          pMappingsR3;
-    /** Linked list of GC mappings - for R0.
-     * The list is sorted ascending on address.
-     */
-    R0PTRTYPE(PPGMMAPPING)          pMappingsR0;
-
-    /** Pointer to the 5 page CR3 content mapping.
-     * The first page is always the CR3 (in some form) while the 4 other pages
-     * are used of the PDs in PAE mode. */
-    RTGCPTR                         GCPtrCR3Mapping;
-#if HC_ARCH_BITS == 64 && GC_ARCH_BITS == 32
-    uint32_t                        u32Alignment1;
-#endif
+    /** We're not in a state which permits writes to guest memory.
+     * (Only used in strict builds.) */
+    bool                            fNoMorePhysWrites;
+    /** Alignment padding that makes the next member start on a 8 byte boundrary. */
+    bool                            afAlignment1[3];
 
     /** Indicates that PGMR3FinalizeMappings has been called and that further
@@ -2821 +2765 @@
      * This is valid if either fMappingsFixed or fMappingsFixedRestored is set. */
     uint32_t                        cbMappingFixed;
+    /** Generation ID for the RAM ranges. This member is incremented everytime
+     * a RAM range is linked or unlinked. */
+    uint32_t volatile               idRamRangesGen;
+
     /** Base address (GC) of fixed mapping.
      * This is valid if either fMappingsFixed or fMappingsFixedRestored is set. */
@@ -2826 +2774 @@
     /** The address of the previous RAM range mapping. */
     RTGCPTR                         GCPtrPrevRamRangeMapping;
+
+    /** 4 MB page mask; 32 or 36 bits depending on PSE-36 (identical for all VCPUs) */
+    RTGCPHYS                        GCPhys4MBPSEMask;
+    /** Mask containing the invalid bits of a guest physical address.
+     * @remarks this does not stop at bit 52.  */
+    RTGCPHYS                        GCPhysInvAddrMask;
+
+
+    /** Pointer to the list of RAM ranges (Phys GC -> Phys HC conversion) - for R3.
+     * This is sorted by physical address and contains no overlapping ranges. */
+    R3PTRTYPE(PPGMRAMRANGE)         pRamRangesR3;
+    /** PGM offset based trees - R3 Ptr. */
+    R3PTRTYPE(PPGMTREES)            pTreesR3;
+    /** Caching the last physical handler we looked up in R3. */
+    R3PTRTYPE(PPGMPHYSHANDLER)      pLastPhysHandlerR3;
+    /** Shadow Page Pool - R3 Ptr. */
+    R3PTRTYPE(PPGMPOOL)             pPoolR3;
+    /** Linked list of GC mappings - for HC.
+     * The list is sorted ascending on address. */
+    R3PTRTYPE(PPGMMAPPING)          pMappingsR3;
+    /** Pointer to the list of ROM ranges - for R3.
+     * This is sorted by physical address and contains no overlapping ranges. */
+    R3PTRTYPE(PPGMROMRANGE)         pRomRangesR3;
+    /** Pointer to the list of MMIO2 ranges - for R3.
+     * Registration order. */
+    R3PTRTYPE(PPGMMMIO2RANGE)       pMmio2RangesR3;
+    /** Pointer to SHW+GST mode data (function pointers).
+     * The index into this table is made up from */
+    R3PTRTYPE(PPGMMODEDATA)         paModeData;
+    /*RTR3PTR                         R3PtrAlignment0;*/
+
+
+    /** R0 pointer corresponding to PGM::pRamRangesR3. */
+    R0PTRTYPE(PPGMRAMRANGE)         pRamRangesR0;
+    /** PGM offset based trees - R0 Ptr. */
+    R0PTRTYPE(PPGMTREES)            pTreesR0;
+    /** Caching the last physical handler we looked up in R0. */
+    R0PTRTYPE(PPGMPHYSHANDLER)      pLastPhysHandlerR0;
+    /** Shadow Page Pool - R0 Ptr. */
+    R0PTRTYPE(PPGMPOOL)             pPoolR0;
+    /** Linked list of GC mappings - for R0.
+     * The list is sorted ascending on address. */
+    R0PTRTYPE(PPGMMAPPING)          pMappingsR0;
+    /** R0 pointer corresponding to PGM::pRomRangesR3. */
+    R0PTRTYPE(PPGMROMRANGE)         pRomRangesR0;
+    /*RTR0PTR                         R0PtrAlignment0;*/
+
+
+    /** RC pointer corresponding to PGM::pRamRangesR3. */
+    RCPTRTYPE(PPGMRAMRANGE)         pRamRangesRC;
+    /** PGM offset based trees - RC Ptr. */
+    RCPTRTYPE(PPGMTREES)            pTreesRC;
+    /** Caching the last physical handler we looked up in RC. */
+    RCPTRTYPE(PPGMPHYSHANDLER)      pLastPhysHandlerRC;
+    /** Shadow Page Pool - RC Ptr. */
+    RCPTRTYPE(PPGMPOOL)             pPoolRC;
+    /** Linked list of GC mappings - for RC.
+     * The list is sorted ascending on address. */
+    RCPTRTYPE(PPGMMAPPING)          pMappingsRC;
+    /** RC pointer corresponding to PGM::pRomRangesR3. */
+    RCPTRTYPE(PPGMROMRANGE)         pRomRangesRC;
+    /*RTRCPTR                         RCPtrAlignment0;*/
+    /** Pointer to the page table entries for the dynamic page mapping area - GCPtr. */
+    RCPTRTYPE(PX86PTE)              paDynPageMap32BitPTEsGC;
+    /** Pointer to the page table entries for the dynamic page mapping area - GCPtr. */
+    RCPTRTYPE(PX86PTEPAE)           paDynPageMapPaePTEsGC;
+
+
+    /** Pointer to the 5 page CR3 content mapping.
+     * The first page is always the CR3 (in some form) while the 4 other pages
+     * are used of the PDs in PAE mode. */
+    RTGCPTR                         GCPtrCR3Mapping;
 
     /** @name Intermediate Context
@@ -2877 +2897 @@
      */
     PDMCRITSECT                     CritSect;
-
-    /** Pointer to SHW+GST mode data (function pointers).
-     * The index into this table is made up from */
-    R3PTRTYPE(PPGMMODEDATA)         paModeData;
-
-    /** Shadow Page Pool - R3 Ptr. */
-    R3PTRTYPE(PPGMPOOL)             pPoolR3;
-    /** Shadow Page Pool - R0 Ptr. */
-    R0PTRTYPE(PPGMPOOL)             pPoolR0;
-    /** Shadow Page Pool - RC Ptr. */
-    RCPTRTYPE(PPGMPOOL)             pPoolRC;
-
-    /** We're not in a state which permits writes to guest memory.
-     * (Only used in strict builds.) */
-    bool                            fNoMorePhysWrites;
-    /** Alignment padding that makes the next member start on a 8 byte boundrary. */
-    bool                            afAlignment3[HC_ARCH_BITS == 32 ? 7: 3];
 
     /**
@@ -3350 +3353 @@
     bool                            fGst32BitPageSizeExtension;
     /** Alignment padding. */
-    bool                            afAlignment4[3];
+    bool                            afAlignment2[3];
     /** @} */
 

trunk/src/VBox/VMM/VMMAll/PGMAllBth.h

@@ -162 +162 @@
         const RTGCPHYS  GCPhysFault = (RTGCPHYS)pvFault;
 # endif
-        PPGMPHYSHANDLER pCur = (PPGMPHYSHANDLER)RTAvlroGCPhysRangeGet(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers, GCPhysFault);
+        PPGMPHYSHANDLER pCur = pgmHandlerPhysicalLookup(pVM, GCPhysFault);
         if (pCur)
         {
@@ -212 +212 @@
                 STAM_PROFILE_START(&pCur->Stat, h);
                 if (fLeaveLock)
-                    pgmUnlock(pVM); /* @todo: Not entirely safe. */
+                    pgmUnlock(pVM); /** @todo: Not entirely safe. */
 
                 rc = pfnHandler(pVM, uErr, pRegFrame, pvFault, GCPhysFault, pvUser);
@@ -218 +218 @@
                     pgmLock(pVM);
 #  ifdef VBOX_WITH_STATISTICS
-                pCur = (PPGMPHYSHANDLER)RTAvlroGCPhysRangeGet(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers, GCPhysFault);
+                pCur = pgmHandlerPhysicalLookup(pVM, GCPhysFault);
                 if (pCur)
                     STAM_PROFILE_STOP(&pCur->Stat, h);

trunk/src/VBox/VMM/VMMAll/PGMAllHandler.cpp

@@ -5 +5 @@
 
 /*
- * Copyright (C) 2006-2007 Oracle Corporation
+ * Copyright (C) 2006-2010 Oracle Corporation
  *
  * This file is part of VirtualBox Open Source Edition (OSE), as
@@ -262 +262 @@
 
         /*
-         * Clear the page bits and notify the REM about this change.
+         * Clear the page bits, notify the REM about this change and clear
+         * the cache.
          */
         pgmHandlerPhysicalResetRamFlags(pVM, pCur);
         pgmHandlerPhysicalDeregisterNotifyREM(pVM, pCur);
+        pVM->pgm.s.pLastPhysHandlerR0 = 0;
+        pVM->pgm.s.pLastPhysHandlerR3 = 0;
+        pVM->pgm.s.pLastPhysHandlerRC = 0;
         MMHyperFree(pVM, pCur);
         pgmUnlock(pVM);
@@ -575 +579 @@
 
         /*
-         * Invalid new location, free it.
+         * Invalid new location, flush the cache and free it.
          * We've only gotta notify REM and free the memory.
          */
         pgmHandlerPhysicalDeregisterNotifyREM(pVM, pCur);
+        pVM->pgm.s.pLastPhysHandlerR0 = 0;
+        pVM->pgm.s.pLastPhysHandlerR3 = 0;
+        pVM->pgm.s.pLastPhysHandlerRC = 0;
         MMHyperFree(pVM, pCur);
     }
@@ -746 +753 @@
                         LogFlow(("PGMHandlerPhysicalJoin: %RGp-%RGp %RGp-%RGp\n",
                                  pCur1->Core.Key, pCur1->Core.KeyLast, pCur2->Core.Key, pCur2->Core.KeyLast));
+                        pVM->pgm.s.pLastPhysHandlerR0 = 0;
+                        pVM->pgm.s.pLastPhysHandlerR3 = 0;
+                        pVM->pgm.s.pLastPhysHandlerRC = 0;
                         MMHyperFree(pVM, pCur2);
                         pgmUnlock(pVM);
@@ -1175 +1185 @@
      */
     pgmLock(pVM);
-    PPGMPHYSHANDLER pCur = (PPGMPHYSHANDLER)RTAvlroGCPhysRangeGet(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers, GCPhys);
+    PPGMPHYSHANDLER pCur = pgmHandlerPhysicalLookup(pVM, GCPhys);
     if (pCur)
     {
@@ -1204 +1214 @@
 {
     pgmLock(pVM);
-    PPGMPHYSHANDLER pCur = (PPGMPHYSHANDLER)RTAvlroGCPhysRangeGet(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers, GCPhys);
+    PPGMPHYSHANDLER pCur = pgmHandlerPhysicalLookup(pVM, GCPhys);
     if (!pCur)
     {

trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp

@@ -1758 +1758 @@
     {
 #ifdef IN_RING3
-        pPhys = (PPGMPHYSHANDLER)RTAvlroGCPhysRangeGet(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers, GCPhys);
+        pPhys = pgmHandlerPhysicalLookup(pVM, GCPhys);
         AssertReleaseMsg(pPhys, ("GCPhys=%RGp cb=%#x\n", GCPhys, cb));
         Assert(GCPhys >= pPhys->Core.Key && GCPhys <= pPhys->Core.KeyLast);
@@ -1776 +1776 @@
         pgmLock(pVM);
 # ifdef VBOX_WITH_STATISTICS
-        pPhys = (PPGMPHYSHANDLER)RTAvlroGCPhysRangeGet(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers, GCPhys);
+        pPhys = pgmHandlerPhysicalLookup(pVM, GCPhys);
         if (pPhys)
             STAM_PROFILE_STOP(&pPhys->Stat, h);
@@ -1987 +1987 @@
         ||  PGM_PAGE_IS_MMIO(pPage) /* screw virtual handlers on MMIO pages */)
     {
-        PPGMPHYSHANDLER pCur = (PPGMPHYSHANDLER)RTAvlroGCPhysRangeGet(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers, GCPhys);
+        PPGMPHYSHANDLER pCur = pgmHandlerPhysicalLookup(pVM, GCPhys);
         if (pCur)
         {
@@ -2021 +2021 @@
                 pgmLock(pVM);
 # ifdef VBOX_WITH_STATISTICS
-                pCur = (PPGMPHYSHANDLER)RTAvlroGCPhysRangeGet(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers, GCPhys);
+                pCur = pgmHandlerPhysicalLookup(pVM, GCPhys);
                 if (pCur)
                     STAM_PROFILE_STOP(&pCur->Stat, h);
@@ -2174 +2174 @@
         if (fMorePhys && !pPhys)
         {
-            pPhys = (PPGMPHYSHANDLER)RTAvlroGCPhysRangeGet(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers, GCPhys);
+            pPhys = pgmHandlerPhysicalLookup(pVM, GCPhys);
             if (pPhys)
             {
@@ -2233 +2233 @@
             pgmLock(pVM);
 # ifdef VBOX_WITH_STATISTICS
-            pPhys = (PPGMPHYSHANDLER)RTAvlroGCPhysRangeGet(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers, GCPhys);
+            pPhys = pgmHandlerPhysicalLookup(pVM, GCPhys);
             if (pPhys)
                 STAM_PROFILE_STOP(&pPhys->Stat, h);
@@ -2302 +2302 @@
             pgmLock(pVM);
 # ifdef VBOX_WITH_STATISTICS
-            pPhys = (PPGMPHYSHANDLER)RTAvlroGCPhysRangeGet(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers, GCPhys);
+            pPhys = pgmHandlerPhysicalLookup(pVM, GCPhys);
             if (pPhys)
                 STAM_PROFILE_STOP(&pPhys->Stat, h);