Changeset 4689 in vbox for trunk/src/VBox

Timestamp:

Sep 11, 2007 9:18:54 AM (17 years ago)

Author:

vboxsync

Message:

ring-3 chunk mappings (in progress).

Location:

trunk/src/VBox/VMM

Files:

• PGMInternal.h (modified) (2 diffs)
• PGMPhys.cpp (modified) (2 diffs)
• VMM.cpp (modified) (2 diffs)
• VMMAll/PGMAllPhys.cpp (modified) (4 diffs)

trunk/src/VBox/VMM/PGMInternal.h

@@ -575 +575 @@
     PGMPHYSCACHE_ENTRY              Entry[PGM_MAX_PHYSCACHE_ENTRIES];
 } PGMPHYSCACHE;
+
+
+/** Pointer to an allocation chunk ring-3 mapping. */
+typedef struct PGMCHUNKR3MAP *PPGMCHUNKR3MAP;
+/** Pointer to an allocation chunk ring-3 mapping pointer. */
+typedef PPGMCHUNKR3MAP *PPPGMCHUNKR3MAP;
+
+/**
+ * Ring-3 tracking structore for an allocation chunk ring-3 mapping.
+ * 
+ * The primary tree (Core) uses the chunk id as key.
+ * The secondary tree (AgeCore) is used for ageing and uses ageing sequence number as key.
+ */
+typedef struct PGMCHUNKR3MAP
+{
+    /** The key is the chunk id. */
+    AVLU32NODECORE      Core;
+    /** The key is the ageing sequence number. */
+    AVLLU32NODECORE     AgeCore;
+    /** The current age thingy. */
+    uint32_t            iAge;
+    /** The current reference count. */
+    uint32_t volatile   cRefs;
+    /** The current permanent reference count. */
+    uint32_t volatile   cPermRefs;
+    /** The mapping address. */
+    void               *pv;
+} PGMCHUNKR3MAP;
+
+/**
+ * Allocation chunk ring-3 mapping TLB entry.
+ */
+typedef struct PGMCHUNKR3MAPTLBE
+{
+    /** The chunk id. */
+    uint32_t                    idChunk;
+#if HC_ARCH_BITS == 64
+    uint32_t                    u32Padding; /**< alignment padding. */
+#endif 
+    /** The chunk map. */
+    HCPTRTYPE(PPGMCHUNKR3MAP)   pChunk;
+} PGMCHUNKR3MAPTLBE;
+/** Pointer to the an allocation chunk ring-3 mapping TLB entry. */
+typedef PGMCHUNKR3MAPTLBE *PPGMCHUNKR3MAPTLBE;
+
+/** The number of TLB entries in PGMCHUNKR3TLB. */
+#define PGMCHUNKR3MAPTLB_ENTRIES   32
+
+/**
+ * Allocation chunk ring-3 mapping TLB.
+ * 
+ * @remarks We use a TLB to speed up lookups by avoiding walking the AVL.
+ *          At first glance this might look kinda odd since AVL trees are 
+ *          supposed to give the most optimial lookup times of all trees
+ *          due to their balancing. However, take a tree with 1023 nodes 
+ *          in it, that's 10 levels, meaning that most searches has to go
+ *          down 9 levels before they find what they want. This isn't fast
+ *          compared to a TLB hit. There is the factor of cache misses,
+ *          and of course the problem with trees and branch prediction.
+ *          This is why we use TLBs in front of most of the trees.
+ * 
+ * @todo    Generalize this TLB + AVL stuff, shouldn't be all that 
+ *          difficult when we switch to inlined AVL trees (from kStuff).
+ */
+typedef struct PGMCHUNKR3MAPTLB
+{
+    /** The TLB entries. */
+    PGMCHUNKR3MAPTLBE   aEntries[PGMCHUNKR3MAPTLB_ENTRIES];
+} PGMCHUNKR3MAPTLB;
+
+
+/**
+ * Ring-3 guest page mapping TLB entry.
+ * @remarks used in ring-0 as well at the moment.
+ */
+typedef struct PGMPAGER3MAPTLBE
+{
+    /** The page id. */
+    uint32_t                    idPage;
+#if HC_ARCH_BITS == 64
+    uint32_t                    u32Padding; /**< alignment padding. */
+#endif 
+    /** The guest page. */
+    HCPTRTYPE(PPGMPAGE)         pPage;
+    /** Pointer to the page mapping tracking structure, PGMCHUNKR3MAP. */
+    HCPTRTYPE(PPGMCHUNKR3MAP)   pMap;
+    /** The address */
+    HCPTRTYPE(void *)           pv;
+} PGMPAGER3MAPTLBE;
+/** Pointer to an entry in the HC physical TLB. */
+typedef PGMPAGER3MAPTLBE *PPGMPAGER3MAPTLBE;
+
+
+/** The number of entries in the ring-3 guest page mapping TLB. */
+#define PGMPAGER3MAPTLB_ENTRIES 64
+         
+/**
+ * Ring-3 guest page mapping TLB.
+ * @remarks used in ring-0 as well at the moment.
+ */
+typedef struct PGMPAGER3MAPTLB
+{
+    /** The TLB entries. */
+    PGMPAGER3MAPTLBE            aEntries[PGMPAGER3MAPTLB_ENTRIES];
+} PGMPAGER3MAPTLB;
+/** Pointer to the ring-3 guest page mapping TLB. */
+typedef PGMPAGER3MAPTLB *PPGMPAGER3MAPTLB;
+
+
 
 
@@ -1501 +1610 @@
     PGMPHYSCACHE                    pgmphyswritecache;
 
+    /** 
+     * Data associated with managing the ring-3 mappings of the allocation chunks.
+     */
+    struct 
+    {
+        /** The chunk tree, ordered by chunk id. */
+        HCPTRTYPE(PAVLU32NODECORE)  pTree;
+        /** The chunk mapping TLB. */
+        PGMCHUNKR3MAPTLB            Tlb;
+        /** The number of mapped chunks. */
+        uint32_t                    c;
+        /** The maximum number of mapped chunks. 
+         * @cfgm    PGM/MaxRing3Chunks */
+        uint32_t                    cMax;
+        /** The chunk age tree, ordered by ageing sequence number. */
+        HCPTRTYPE(PAVLLU32NODECORE) pAgeTree;
+        /** The current time. */
+        uint32_t                    iNow;
+        /** Number of pgmR3PhysChunkFindUnmapCandidate calls left to the next ageing. */
+        uint32_t                    AgeingCountdown;
+    }                               ChunkR3Map;
+
+    /** 
+     * The page mapping TLB for ring-3 and (for the time being) ring-0.
+     */
+    PGMPAGER3MAPTLB                 PhysTlbHC;
+
     /** @name Release Statistics
      * @{ */

trunk/src/VBox/VMM/PGMPhys.cpp

@@ -43 +43 @@
 
 
+/*
+ * PGMR3PhysReadByte/Word/Dword
+ * PGMR3PhysWriteByte/Word/Dword
+ */
+
+#define PGMPHYSFN_READNAME  PGMR3PhysReadByte
+#define PGMPHYSFN_WRITENAME PGMR3PhysWriteByte
+#define PGMPHYS_DATASIZE    1
+#define PGMPHYS_DATATYPE    uint8_t
+#include "PGMPhys.h"
+
+#define PGMPHYSFN_READNAME  PGMR3PhysReadWord
+#define PGMPHYSFN_WRITENAME PGMR3PhysWriteWord
+#define PGMPHYS_DATASIZE    2
+#define PGMPHYS_DATATYPE    uint16_t
+#include "PGMPhys.h"
+
+#define PGMPHYSFN_READNAME  PGMR3PhysReadDword
+#define PGMPHYSFN_WRITENAME PGMR3PhysWriteDword
+#define PGMPHYS_DATASIZE    4
+#define PGMPHYS_DATATYPE    uint32_t
+#include "PGMPhys.h"
+
+
+
 
 /**
@@ -599 +624 @@
 
 
-/*
- * PGMR3PhysReadByte/Word/Dword
- * PGMR3PhysWriteByte/Word/Dword
- */
-
-#define PGMPHYSFN_READNAME  PGMR3PhysReadByte
-#define PGMPHYSFN_WRITENAME PGMR3PhysWriteByte
-#define PGMPHYS_DATASIZE    1
-#define PGMPHYS_DATATYPE    uint8_t
-#include "PGMPhys.h"
-
-#define PGMPHYSFN_READNAME  PGMR3PhysReadWord
-#define PGMPHYSFN_WRITENAME PGMR3PhysWriteWord
-#define PGMPHYS_DATASIZE    2
-#define PGMPHYS_DATATYPE    uint16_t
-#include "PGMPhys.h"
-
-#define PGMPHYSFN_READNAME  PGMR3PhysReadDword
-#define PGMPHYSFN_WRITENAME PGMR3PhysWriteDword
-#define PGMPHYS_DATASIZE    4
-#define PGMPHYS_DATATYPE    uint32_t
-#include "PGMPhys.h"
+/**
+ * Tree enumeration callback for dealing with age rollover.
+ * It will perform a simple compression of the current age.
+ */
+static DECLCALLBACK(int) pgmR3PhysChunkAgeingRolloverCallback(PAVLU32NODECORE pNode, void *pvUser)
+{
+    /* Age compression - ASSUMES iNow == 4. */
+    PPGMCHUNKR3MAP pChunk = (PPGMCHUNKR3MAP)pNode;
+    if (pChunk->iAge >= UINT32_C(0xffffff00))
+        pChunk->iAge = 3;
+    else if (pChunk->iAge >= UINT32_C(0xfffff000))
+        pChunk->iAge = 2;
+    else if (pChunk->iAge)
+        pChunk->iAge = 1;
+    else /* iAge = 0 */
+        pChunk->iAge = 4;
+
+    /* reinsert */
+    PVM pVM = (PVM)pvUser;
+    RTAvllU32Remove(&pVM->pgm.s.ChunkR3Map.pAgeTree, pChunk->AgeCore.Key);
+    pChunk->AgeCore.Key = pChunk->iAge;
+    RTAvllU32Insert(&pVM->pgm.s.ChunkR3Map.pAgeTree, &pChunk->AgeCore);
+    return 0;
+}
+
+
+/**
+ * Tree enumeration callback that updates the chunks that have
+ * been used since the last
+ */
+static DECLCALLBACK(int) pgmR3PhysChunkAgeingCallback(PAVLU32NODECORE pNode, void *pvUser)
+{
+    PPGMCHUNKR3MAP pChunk = (PPGMCHUNKR3MAP)pNode;
+    if (!pChunk->iAge)
+    {
+        PVM pVM = (PVM)pvUser;
+        RTAvllU32Remove(&pVM->pgm.s.ChunkR3Map.pAgeTree, pChunk->AgeCore.Key);
+        pChunk->AgeCore.Key = pChunk->iAge = pVM->pgm.s.ChunkR3Map.iNow;
+        RTAvllU32Insert(&pVM->pgm.s.ChunkR3Map.pAgeTree, &pChunk->AgeCore);
+    }
+
+    return 0;
+}
+
+
+/**
+ * Performs ageing of the ring-3 chunk mappings.
+ *
+ * @param   pVM         The VM handle.
+ */
+PGMR3DECL(void) PGMR3PhysChunkAgeing(PVM pVM)
+{
+    pVM->pgm.s.ChunkR3Map.AgeingCountdown = RT_MIN(pVM->pgm.s.ChunkR3Map.cMax / 4, 1024);
+    pVM->pgm.s.ChunkR3Map.iNow++;
+    if (pVM->pgm.s.ChunkR3Map.iNow == 0)
+    {
+        pVM->pgm.s.ChunkR3Map.iNow = 4;
+        RTAvlU32DoWithAll(&pVM->pgm.s.ChunkR3Map.pTree, true /*fFromLeft*/, pgmR3PhysChunkAgeingRolloverCallback, pVM);
+    }
+    else
+        RTAvlU32DoWithAll(&pVM->pgm.s.ChunkR3Map.pTree, true /*fFromLeft*/, pgmR3PhysChunkAgeingCallback, pVM);
+}
+
+
+/**
+ * The structure passed in the pvUser argument of pgmR3PhysChunkUnmapCandidateCallback().
+ */
+typedef struct PGMR3PHYSCHUNKUNMAPCB
+{
+    PVM                 pVM;            /**< The VM handle. */
+    PPGMCHUNKR3MAP      pChunk;         /**< The chunk to unmap. */
+} PGMR3PHYSCHUNKUNMAPCB, *PPGMR3PHYSCHUNKUNMAPCB;
+
+
+/**
+ * Callback used to find the mapping that's been unused for
+ * the longest time.
+ */
+static DECLCALLBACK(int) pgmR3PhysChunkUnmapCandidateCallback(PAVLLU32NODECORE pNode, void *pvUser)
+{
+    do
+    {
+        PPGMCHUNKR3MAP pChunk = (PPGMCHUNKR3MAP)((uint8_t *)pNode - RT_OFFSETOF(PGMCHUNKR3MAP, AgeCore));
+        if (    pChunk->iAge
+            &&  !pChunk->cRefs)
+        {
+            /*
+             * Check that it's not in any of the TLBs.
+             */
+            PVM pVM = ((PPGMR3PHYSCHUNKUNMAPCB)pvUser)->pVM;
+            for (unsigned i = 0; i < RT_ELEMENTS(pVM->pgm.s.ChunkR3Map.Tlb.aEntries); i++)
+                if (pVM->pgm.s.ChunkR3Map.Tlb.aEntries[i].pChunk == pChunk)
+                {
+                    pChunk = NULL;
+                    break;
+                }
+            if (pChunk)
+                for (unsigned i = 0; i < RT_ELEMENTS(pVM->pgm.s.PhysTlbHC.aEntries); i++)
+                    if (pVM->pgm.s.PhysTlbHC.aEntries[i].pMap == pChunk)
+                    {
+                        pChunk = NULL;
+                        break;
+                    }
+            if (pChunk)
+            {
+                ((PPGMR3PHYSCHUNKUNMAPCB)pvUser)->pChunk = pChunk;
+                return 1; /* done */
+            }
+        }
+
+        /* next with the same age - this version of the AVL API doesn't enumerate the list, so we have to do it. */
+        pNode = pNode->pList;
+    } while (pNode);
+    return 0;
+}
+
+
+/**
+ * Finds a good candidate for unmapping when the ring-3 mapping cache is full.
+ *
+ * The candidate will not be part of any TLBs, so no need to flush
+ * anything afterwards.
+ *
+ * @returns Chunk id.
+ * @param   pVM         The VM handle.
+ */
+static int32_t pgmR3PhysChunkFindUnmapCandidate(PVM pVM)
+{
+    /*
+     * Do tree ageing first?
+     */
+    if (pVM->pgm.s.ChunkR3Map.AgeingCountdown-- == 0)
+        PGMR3PhysChunkAgeing(pVM);
+
+    /*
+     * Enumerate the age tree starting with the left most node.
+     */
+    PGMR3PHYSCHUNKUNMAPCB Args;
+    Args.pVM = pVM;
+    Args.pChunk = NULL;
+    if (RTAvllU32DoWithAll(&pVM->pgm.s.ChunkR3Map.pAgeTree, true /*fFromLeft*/, pgmR3PhysChunkUnmapCandidateCallback, pVM))
+        return Args.pChunk->Core.Key;
+    return INT32_MAX;
+}
+
+
+#define VMMR0_DO_PGM_MAP_CHUNK 0 // later
+/**
+ * Argument package for the VMMR0_DO_PGM_MAP_CHUNK request.
+ */
+typedef struct PGMMAPCHUNKREQ
+{
+    /** The chunk to map, UINT32_MAX if unmap only. (IN) */
+    uint32_t    idChunkMap;
+    /** The chunk to unmap, UINT32_MAX if map only. (IN) */
+    uint32_t    idChunkUnmap;
+    /** Where the mapping address is returned. (OUT) */
+    RTR3PTR     pvR3;
+} PGMMAPCHUNKREQ;
+
+
+/**
+ * Maps the given chunk into the ring-3 mapping cache.
+ *
+ * This will call ring-0.
+ *
+ * @returns VBox status code.
+ * @param   pVM         The VM handle.
+ * @param   idChunk     The chunk in question.
+ * @param   ppChunk     Where to store the chunk tracking structure.
+ *
+ * @remarks Called from within the PGM critical section.
+ */
+int pgmR3PhysChunkMap(PVM pVM, uint32_t idChunk, PPPGMCHUNKR3MAP ppChunk)
+{
+    int rc;
+    /*
+     * Allocate a new tracking structure first.
+     */
+#if 0 /* for later when we've got a separate mapping method for ring-0. */
+    PPGMCHUNKR3MAP pChunk = (PPGMCHUNKR3MAP)MMR3HeapAlloc(pVM, MM_TAG_PGM_CHUNK_MAPPING, sizeof(*pChunk));
+    AssertReturn(pChunk, VERR_NO_MEMORY);
+#else
+    PPGMCHUNKR3MAP pChunk;
+    rc = MMHyperAlloc(pVM, sizeof(*pChunk), 0, MM_TAG_PGM_CHUNK_MAPPING, (void **)&pChunk);
+    AssertRCReturn(rc, rc);
+#endif
+    pChunk->Core.Key = idChunk;
+    pChunk->AgeCore.Key = pVM->pgm.s.ChunkR3Map.iNow;
+    pChunk->iAge = 0;
+    pChunk->cRefs = 0;
+    pChunk->cPermRefs = 0;
+    pChunk->pv = NULL;
+
+    /*
+     * Request the ring-0 part to map the chunk in question and if
+     * necessary unmap another one to make space in the mapping cache.
+     */
+    PGMMAPCHUNKREQ Req;
+    Req.pvR3 = NULL;
+    Req.idChunkMap = idChunk;
+    Req.idChunkUnmap = INT32_MAX;
+    if (pVM->pgm.s.ChunkR3Map.c >= pVM->pgm.s.ChunkR3Map.cMax)
+        Req.idChunkUnmap = pgmR3PhysChunkFindUnmapCandidate(pVM);
+    /** @todo SUPCallVMMR0Ex needs to support in+out or similar.  */
+    rc = SUPCallVMMR0Ex(pVM->pVMR0, VMMR0_DO_PGM_MAP_CHUNK, &Req, sizeof(Req));
+    if (VBOX_SUCCESS(rc))
+    {
+        /*
+         * Update the tree.
+         */
+        /* insert the new one. */
+        AssertPtr(Req.pvR3);
+        pChunk->pv = Req.pvR3;
+        bool fRc = RTAvlU32Insert(&pVM->pgm.s.ChunkR3Map.pTree, &pChunk->Core);
+        AssertRelease(fRc);
+        pVM->pgm.s.ChunkR3Map.c++;
+
+        fRc = RTAvllU32Insert(&pVM->pgm.s.ChunkR3Map.pAgeTree, &pChunk->AgeCore);
+        AssertRelease(fRc);
+
+        /* remove the unmapped one. */
+        if (Req.idChunkUnmap != INT32_MAX)
+        {
+            PPGMCHUNKR3MAP pUnmappedChunk = (PPGMCHUNKR3MAP)RTAvlU32Remove(&pVM->pgm.s.ChunkR3Map.pTree, Req.idChunkUnmap);
+            AssertRelease(pUnmappedChunk);
+            pUnmappedChunk->pv = NULL;
+            pUnmappedChunk->Core.Key = UINT32_MAX;
+#if 0 /* for later when we've got a separate mapping method for ring-0. */
+            MMR3HeapFree(pUnmappedChunk);
+#else
+            MMHyperFree(pVM, pUnmappedChunk);
+#endif
+            pVM->pgm.s.ChunkR3Map.c--;
+        }
+    }
+    else
+    {
+        AssertRC(rc);
+#if 0 /* for later when we've got a separate mapping method for ring-0. */
+        MMR3HeapFree(pChunk);
+#else
+        MMHyperFree(pVM, pChunk);
+#endif
+        pChunk = NULL;
+    }
+
+    *ppChunk = pChunk;
+    return rc;
+}
+
+
+/**
+ * For VMMCALLHOST_PGM_MAP_CHUNK, considered internal.
+ * 
+ * @returns see pgmR3PhysChunkMap.
+ * @param   pVM         The VM handle.
+ * @param   idChunk     The chunk to map.
+ */
+PDMR3DECL(int) PGMR3PhysChunkMap(PVM pVM, uint32_t idChunk)
+{
+    PPGMCHUNKR3MAP pChunk;
+    return pgmR3PhysChunkMap(pVM, idChunk, &pChunk);
+}
+

trunk/src/VBox/VMM/VMM.cpp

@@ -2166 +2166 @@
 
         /*
+         * Maps an page allocation chunk into ring-3 so ring-0 can use it.
+         */
+        case VMMCALLHOST_PGM_MAP_CHUNK:
+        {
+            pVM->vmm.s.rcCallHost = PGMR3PhysChunkMap(pVM, pVM->vmm.s.u64CallHostArg);
+            break;
+        }
+#ifndef NEW_PHYS_CODE
+
+        case VMMCALLHOST_PGM_RAM_GROW_RANGE:
+        {
+            pVM->vmm.s.rcCallHost = PGM3PhysGrowRange(pVM, pVM->vmm.s.u64CallHostArg);
+            break;
+        }
+#endif 
+
+        /*
          * Acquire the PGM lock.
          */
@@ -2180 +2197 @@
         {
             REMR3ReplayHandlerNotifications(pVM);
-            break;
-        }
-
-        case VMMCALLHOST_PGM_RAM_GROW_RANGE:
-        {
-            pVM->vmm.s.rcCallHost = PGM3PhysGrowRange(pVM, pVM->vmm.s.u64CallHostArg);
             break;
         }

trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp

@@ -186 +186 @@
 
 
-#ifdef IN_RING3
-
-/**
- * Tree enumeration callback for dealing with age rollover.
- * It will perform a simple compression of the current age.
- */
-static DECLCALLBACK(int) pgmR3PhysChunkAgeingRolloverCallback(PAVLU32NODECORE pNode, void *pvUser)
-{
-    /* ASSMES iNow = 4 */
-    PPGMCHUNKR3MAPPING pChunk = (PPGMCHUNKR3MAPPING)pNode;
-    if (pChunk->iAge >= UINT32_C(0xffffff00))
-        pChunk->iAge = 3;
-    else if (pChunk->iAge >= UINT32_C(0xfffff000))
-        pChunk->iAge = 2;
-    else if (pChunk->iAge)
-        pChunk->iAge = 1;
-    return 0;
-}
-
-
-/**
- * Tree enumeration callback that updates the chunks that have
- * been used since the last
- */
-static DECLCALLBACK(int) pgmR3PhysChunkAgeingCallback(PAVLU32NODECORE pNode, void *pvUser)
-{
-    PPGMCHUNKR3MAPPING pChunk = (PPGMCHUNKR3MAPPING)pNode;
-    if (!pChunk->iAge)
-    {
-        PVM pVM = (PVM)pvUser;
-        RTAvllU32Remove(&pVM->pgm.s.R3ChunkTlb.pAgeTree, pChunk->AgeCore.Key);
-        pChunk->AgeCore.Key = pChunk->iAge = pVM->pgm.s.R3ChunkTlb.iNow;
-        RTAvllU32Insert(&pVM->pgm.s.R3ChunkTlb.pAgeTree, &pChunk->AgeCore);
-    }
-
-    return 0;
-}
-
-
-/**
- * Performs ageing of the ring-3 chunk mappings.
- *
- * @param   pVM         The VM handle.
- */
-PGMR3DECL(void) PGMR3PhysChunkAgeing(PVM pVM)
-{
-    pVM->pgm.s.R3ChunkMap.AgeingCountdown = RT_MIN(pVM->pgm.s.R3ChunkMap.cMax / 4, 1024);
-    pVM->pgm.s.R3ChunkMap.iNow++;
-    if (pVM->pgm.s.R3ChunkMap.iNow == 0)
-    {
-        pVM->pgm.s.R3ChunkMap.iNow = 20;
-        RTAvlU32DoWithAll(&pVM->pgm.s.R3ChunkMap.pTree, true /*fFromLeft*/, pgmR3PhysChunkAgeingRolloverCallback, NULL);
-    }
-    RTAvlU32DoWithAll(&pVM->pgm.s.R3ChunkMap.pTree, true /*fFromLeft*/, pgmR3PhysChunkAgeingCallback, pVM);
-}
-
-
-/**
- * The structure passed in the pvUser argument of pgmR3PhysChunkUnmapCandidateCallback().
- */
-typedef struct PGMR3PHYSCHUNKUNMAPCB
-{
-    PVM                 pVM;            /**< The VM handle. */
-    PPGMR3CHUNKMAP      pChunk;         /**< The chunk to unmap. */
-} PGMR3PHYSCHUNKUNMAPCB, *PPGMR3PHYSCHUNKUNMAPCB;
-
-
-/**
- * Callback used to find the mapping that's been unused for
- * the longest time.
- */
-static DECLCALLBACK(int) pgmR3PhysChunkUnmapCandidateCallback(PAVLLU32NODECORE pNode, void *pvUser)
-{
-    do
-    {
-        PPGMR3CHUNKMAP pChunk = (PPGMR3CHUNKMAP)((uint8_t *)pNode - RT_OFFSETOF(PGMR3CHUNKMAP, AgeCore));
-        if (    pChunk->iAge
-            &&  !pChunk->cRefs)
-        {
-            /*
-             * Check that it's not in any of the TLBs.
-             */
-            PVM pVM = ((PPGMR3PHYSCHUNKUNMAPCB)pvUser)->pVM;
-            for (unsigned i = 0; i < RT_ELEMENTS(pVM->pgm.s.R3ChunkTlb->aEntries); i++)
-                if (pVM->pgm.s.R3ChunkTlb->aEntries[i].pChunk == pChunk)
-                {
-                    pChunk = NULL;
-                    break;
-                }
-            if (pChunk)
-                for (unsigned i = 0; i < RT_ELEMENTS(pVM->pgm.s.CTXSUFF(PhysTlb)->aEntries); i++)
-                    if (pVM->pgm.s.CTXSUFF(PhysTlb)->aEntries[i].pChunk == pChunk)
-                    {
-                        pChunk = NULL;
-                        break;
-                    }
-            if (pChunk)
-            {
-                ((PPGMR3PHYSCHUNKUNMAPCB)pvUser)->pChunk = pChunk;
-                return 1; /* done */
-            }
-        }
-
-        /* next with the same age - this version of the AVL API doesn't enumerate the list, so we have to do it. */
-        pNode = pNode->pList;
-    } while (pNode);
-    return 0;
-}
-
-
-/**
- * Finds a good candidate for unmapping when the ring-3 mapping cache is full.
- *
- * The candidate will not be part of any TLBs, so no need to flush
- * anything afterwards.
- *
- * @returns Chunk id.
- * @param   pVM         The VM handle.
- */
-int pgmR3PhysChunkFindUnmapCandidate(PVM pVM)
-{
-    /*
-     * Do tree ageing first?
-     */
-    if (pVM->pgm.s.R3ChunkMap.AgeingCountdown-- == 0)
-        pgmR3PhysChunkAgeing(pVM);
-
-    /*
-     * Enumerate the age tree starting with the left most node.
-     */
-    PGMR3PHYSCHUNKUNMAPCB Args;
-    Args.pVM = pVM;
-    Args.pChunk = NULL;
-    if (RTAvlU32DoWithAll(&pVM->pgm.s.R3ChunkMap.pAgeTree, true /*fFromLeft*/, pgmR3PhysChunkUnmapCandidateCallback, pVM))
-        return Args.pChunk->idChunk;
-    return INT32_MAX;
-}
-
-
-/**
- * Maps the given chunk into the ring-3 mapping cache.
- *
- * This will call ring-0.
- *
- * @returns VBox status code.
- * @param   pVM         The VM handle.
- * @param   idChunk     The chunk in question.
- * @param   ppChunk     Where to store the chunk tracking structure.
- *
- * @remarks Called from within the PGM critical section.
- */
-int pgmR3PhysChunkMap(PVM pVM, uint32_t idChunk, PPPGMCHUNKR3MAPPING ppChunk)
-{
-    /*
-     * Allocate a new tracking structure first.
-     */
-#if 0 /* for later when we've got a separate mapping method for ring-0. */
-    PPGMCHUNKR3MAPPING pChunk = (PPGMCHUNKR3MAPPING)MMR3HeapAlloc(pVM, MM_TAG_PGM_CHUNK_MAPPING, sizeof(*pChunk));
-#else
-    PPGMCHUNKR3MAPPING pChunk = (PPGMCHUNKR3MAPPING)MMHyperAlloc(pVM, MM_TAG_PGM_CHUNK_MAPPING, sizeof(*pChunk));
-#endif
-    AssertReturn(pChunk, VERR_NO_MEMORY);
-    pChunk->Core.Key = idChunk;
-    pChunk->pv = NULL;
-    pChunk->cRefs = 0;
-    pChunk->iAge = 0;
-
-    /*
-     * Request the ring-0 part to map the chunk in question and if
-     * necessary unmap another one to make space in the mapping cache.
-     */
-    PGMMAPCHUNKREQ Req;
-    Req.pvR3 = NULL;
-    Req.idChunkMap = idChunck;
-    Req.idChunkUnmap = INT32_MAX;
-    if (pVM->pgm.R3ChunkMap.c >= pVM->pgm.R3ChunkMap.cMax)
-        Req.idChunkUnmap = pgmR3PhysChunkFindUnmapCandidate(pVM);
-    /** @todo SUPCallVMMR0Ex needs to support in+out or similar.  */
-    int rc = SUPCallVMMR0Ex(pVM->pVMR0, VMMR0_DO_PGM_MAP_CHUNK, &Req, sizeof(Req));
-    if (VBOX_SUCCESS(rc))
-    {
-        /*
-         * Update the tree.
-         */
-        /* insert the new one. */
-        AssertPtr(Req.pvR3);
-        pChunk->pv = Req.pvR3;
-        bool fRc = RTAvlU32Insert(&pVM->pgm.s.R3ChunkMap.Tree, &pChunk->Core);
-        AssertRelease(fRc);
-        pVM->pgm.s.R3ChunkMap.c++;
-
-        /* remove the unmapped one. */
-        if (Req.idChunkUnmap != INT32_MAX)
-        {
-            PPGMCHUNKR3MAPPING pUnmappedChunk = (PPGMCHUNKR3MAPPING)RTAvlU32Remove(&pVM->pgm.s.R3ChunkMap.Tree, Req.idChunkUnmap);
-            AssertRelease(pUnmappedChunk);
-            pUnmappedChunk->pv = NULL;
-            pUnmappedChunk->Key = INT32_MAX;
-#if 0 /* for later when we've got a separate mapping method for ring-0. */
-            MMR3HeapFree(pUnmappedChunk);
-#else
-            MMHyperFree(pVM, pUnmappedChunk);
-#endif
-            pVM->pgm.R3ChunkMap.c--;
-        }
-    }
-    else
-    {
-        AssertRC(rc);
-#if 0 /* for later when we've got a separate mapping method for ring-0. */
-        MMR3HeapFree(pChunk);
-#else
-        MMHyperFree(pVM, pChunk);
-#endif
-        pChunk = NULL;
-    }
-
-    *ppChunk = pChunk;
-    return rc;
-}
-#endif /* IN_RING3 */
-
-
 /**
  * Maps a page into the current virtual address space so it can be accessed.
@@ -472 +249 @@
             Assert(pChunk);
 #else
-            int rc = pgmR3PhysChunkMap(pVM, idChunk, &pChunk);
+            int rc = PGMR3PhysChunkMap(pVM, idChunk, &pChunk);
             if (VBOX_FAILURE(rc))
                 return rc;
@@ -1913 +1690 @@
 {
     RTGCPHYS    GCPhys;
-    RTGCUINTPTR offset;
     int         rc;
 
@@ -1987 +1763 @@
 {
     RTGCPHYS    GCPhys;
-    RTGCUINTPTR offset;
     int         rc;