Changeset 86704 in vbox for trunk/src/VBox/VMM

Timestamp:

Oct 26, 2020 12:04:05 PM (4 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

141088

Message:

VMM/DBGF: Updates to the new breakpoint manager, L2 table management groundwork, bugref:9837

Location:

trunk/src/VBox/VMM

Files:

• VMMR0/DBGFR0Bp.cpp (modified) (5 diffs)
• VMMR0/VMMR0.cpp (modified) (2 diffs)
• VMMR3/DBGFR3Bp.cpp (modified) (5 diffs)
• VMMRZ/DBGFRZ.cpp (modified) (1 diff)
• include/DBGFInternal.h (modified) (5 diffs)

trunk/src/VBox/VMM/VMMR0/DBGFR0Bp.cpp

@@ -62 +62 @@
     }
 
+    for (uint32_t i = 0; i < RT_ELEMENTS(pGVM->dbgfr0.s.aBpL2TblChunks); i++)
+    {
+        PDBGFBPL2TBLCHUNKR0 pL2Chunk = &pGVM->dbgfr0.s.aBpL2TblChunks[i];
+
+        pL2Chunk->hMemObj          = NIL_RTR0MEMOBJ;
+        pL2Chunk->hMapObj          = NIL_RTR0MEMOBJ;
+        //pL2Chunk->paBpL2TblBaseSharedR0 = NULL;
+    }
+
     pGVM->dbgfr0.s.hMemObjBpLocL1 = NIL_RTR0MEMOBJ;
     //pGVM->dbgfr0.s.paBpLocL1R0    = NULL;
@@ -112 +121 @@
         }
 
+        for (uint32_t i = 0; i < RT_ELEMENTS(pGVM->dbgfr0.s.aBpL2TblChunks); i++)
+        {
+            PDBGFBPL2TBLCHUNKR0 pL2Chunk = &pGVM->dbgfr0.s.aBpL2TblChunks[i];
+
+            if (pL2Chunk->hMemObj != NIL_RTR0MEMOBJ)
+            {
+                Assert(pL2Chunk->hMapObj != NIL_RTR0MEMOBJ);
+
+                pL2Chunk->paBpL2TblBaseSharedR0 = NULL;
+
+                hMemObj = pL2Chunk->hMapObj;
+                pL2Chunk->hMapObj = NIL_RTR0MEMOBJ;
+                RTR0MemObjFree(hMemObj, true);
+
+                hMemObj = pL2Chunk->hMemObj;
+                pL2Chunk->hMemObj = NIL_RTR0MEMOBJ;
+                RTR0MemObjFree(hMemObj, true);
+            }
+        }
+
         pGVM->dbgfr0.s.fInit = false;
     }
@@ -128 +157 @@
             Assert(!pBpChunk->paBpBaseSharedR0);
             Assert(!pBpChunk->paBpBaseR0Only);
+        }
+
+        for (uint32_t i = 0; i < RT_ELEMENTS(pGVM->dbgfr0.s.aBpL2TblChunks); i++)
+        {
+            PDBGFBPL2TBLCHUNKR0 pL2Chunk = &pGVM->dbgfr0.s.aBpL2TblChunks[i];
+
+            Assert(pL2Chunk->hMemObj == NIL_RTR0MEMOBJ);
+            Assert(pL2Chunk->hMapObj == NIL_RTR0MEMOBJ);
+            Assert(!pL2Chunk->paBpL2TblBaseSharedR0);
         }
     }
@@ -239 +277 @@
 
 /**
+ * Worker for DBGFR0BpL2TblChunkAllocReqHandler() that does the actual chunk allocation.
+ *
+ * @returns VBox status code.
+ * @param   pGVM            The global (ring-0) VM structure.
+ * @param   idChunk         The chunk ID to allocate.
+ * @param   ppL2ChunkBaseR3 Where to return the ring-3 chunk base address on success.
+ * @thread  EMT(0)
+ */
+static int dbgfR0BpL2TblChunkAllocWorker(PGVM pGVM, uint32_t idChunk, R3PTRTYPE(void *) *ppL2ChunkBaseR3)
+{
+    /*
+     * Figure out how much memory we need for the chunk and allocate it.
+     */
+    uint32_t const cbTotal = RT_ALIGN_32(DBGF_BP_L2_TBL_ENTRIES_PER_CHUNK * sizeof(DBGFBPL2ENTRY), PAGE_SIZE);
+
+    RTR0MEMOBJ hMemObj;
+    int rc = RTR0MemObjAllocPage(&hMemObj, cbTotal, false /*fExecutable*/);
+    if (RT_FAILURE(rc))
+        return rc;
+    RT_BZERO(RTR0MemObjAddress(hMemObj), cbTotal);
+
+    /* Map it. */
+    RTR0MEMOBJ hMapObj;
+    rc = RTR0MemObjMapUserEx(&hMapObj, hMemObj, (RTR3PTR)-1, 0, RTMEM_PROT_READ | RTMEM_PROT_WRITE, RTR0ProcHandleSelf(),
+                             0 /*offSub*/, cbTotal);
+    if (RT_SUCCESS(rc))
+    {
+        PDBGFBPL2TBLCHUNKR0 pL2ChunkR0 = &pGVM->dbgfr0.s.aBpL2TblChunks[idChunk];
+
+        pL2ChunkR0->hMemObj               = hMemObj;
+        pL2ChunkR0->hMapObj               = hMapObj;
+        pL2ChunkR0->paBpL2TblBaseSharedR0 = (PDBGFBPL2ENTRY)RTR0MemObjAddress(hMemObj);
+
+        /*
+         * We're done.
+         */
+        *ppL2ChunkBaseR3 = RTR0MemObjAddressR3(hMapObj);
+        return rc;
+    }
+
+    RTR0MemObjFree(hMemObj, true);
+    return rc;
+}
+
+
+/**
  * Used by ring-3 DBGF to fully initialize the breakpoint manager for operation.
  *
@@ -293 +377 @@
 }
 
+
+/**
+ * Used by ring-3 DBGF to allocate a given chunk in the global L2 lookup table.
+ *
+ * @returns VBox status code.
+ * @param   pGVM    The global (ring-0) VM structure.
+ * @param   pReq    Pointer to the request buffer.
+ * @thread  EMT(0)
+ */
+VMMR0_INT_DECL(int) DBGFR0BpL2TblChunkAllocReqHandler(PGVM pGVM, PDBGFBPL2TBLCHUNKALLOCREQ pReq)
+{
+    LogFlow(("DBGFR0BpL2TblChunkAllocReqHandler:\n"));
+
+    /*
+     * Validate the request.
+     */
+    AssertReturn(pReq->Hdr.cbReq == sizeof(*pReq), VERR_INVALID_PARAMETER);
+
+    uint32_t const idChunk = pReq->idChunk;
+    AssertReturn(idChunk < DBGF_BP_L2_TBL_CHUNK_COUNT, VERR_INVALID_PARAMETER);
+
+    int rc = GVMMR0ValidateGVMandEMT(pGVM, 0);
+    AssertRCReturn(rc, rc);
+
+    AssertReturn(pGVM->dbgfr0.s.fInit, VERR_WRONG_ORDER);
+    AssertReturn(pGVM->dbgfr0.s.aBpL2TblChunks[idChunk].hMemObj == NIL_RTR0MEMOBJ, VERR_INVALID_PARAMETER);
+
+    return dbgfR0BpL2TblChunkAllocWorker(pGVM, idChunk, &pReq->pChunkBaseR3);
+}
+

trunk/src/VBox/VMM/VMMR0/VMMR0.cpp

@@ -2287 +2287 @@
             break;
         }
+
+        case VMMR0_DO_DBGF_BP_L2_TBL_CHUNK_ALLOC:
+        {
+            if (!pReqHdr || u64Arg || idCpu != 0)
+                return VERR_INVALID_PARAMETER;
+            rc = DBGFR0BpL2TblChunkAllocReqHandler(pGVM, (PDBGFBPL2TBLCHUNKALLOCREQ)pReqHdr);
+            VMM_CHECK_SMAP_CHECK2(pGVM, RT_NOTHING);
+            break;
+        }
 #endif
 
@@ -2395 +2404 @@
             case VMMR0_DO_DBGF_BP_INIT:
             case VMMR0_DO_DBGF_BP_CHUNK_ALLOC:
+            case VMMR0_DO_DBGF_BP_L2_TBL_CHUNK_ALLOC:
 #endif
             {

trunk/src/VBox/VMM/VMMR3/DBGFR3Bp.cpp

@@ -201 +201 @@
     }
 
+    for (uint32_t i = 0; i < RT_ELEMENTS(pUVM->dbgf.s.aBpL2TblChunks); i++)
+    {
+        PDBGFBPL2TBLCHUNKR3 pL2Chunk = &pUVM->dbgf.s.aBpL2TblChunks[i];
+
+        //pL2Chunk->pL2BaseR3 = NULL;
+        //pL2Chunk->pbmAlloc  = NULL;
+        //pL2Chunk->cFree     = 0;
+        pL2Chunk->idChunk = DBGF_BP_CHUNK_ID_INVALID; /* Not allocated. */
+    }
+
     //pUVM->dbgf.s.paBpLocL1R3 = NULL;
-    return VINF_SUCCESS;
+    pUVM->dbgf.s.hMtxBpL2Wr = NIL_RTSEMFASTMUTEX;
+    return RTSemFastMutexCreate(&pUVM->dbgf.s.hMtxBpL2Wr);
 }
 
@@ -226 +237 @@
             pBpChunk->idChunk = DBGF_BP_CHUNK_ID_INVALID;
         }
+    }
+
+    for (uint32_t i = 0; i < RT_ELEMENTS(pUVM->dbgf.s.aBpL2TblChunks); i++)
+    {
+        PDBGFBPL2TBLCHUNKR3 pL2Chunk = &pUVM->dbgf.s.aBpL2TblChunks[i];
+
+        if (pL2Chunk->idChunk != DBGF_BP_CHUNK_ID_INVALID)
+        {
+            AssertPtr(pL2Chunk->pbmAlloc);
+            RTMemFree((void *)pL2Chunk->pbmAlloc);
+            pL2Chunk->pbmAlloc = NULL;
+            pL2Chunk->idChunk = DBGF_BP_CHUNK_ID_INVALID;
+        }
+    }
+
+    if (pUVM->dbgf.s.hMtxBpL2Wr != NIL_RTSEMFASTMUTEX)
+    {
+        RTSemFastMutexDestroy(pUVM->dbgf.s.hMtxBpL2Wr);
+        pUVM->dbgf.s.hMtxBpL2Wr = NIL_RTSEMFASTMUTEX;
     }
 
@@ -563 +593 @@
 
 /**
+ * @callback_method_impl{FNVMMEMTRENDEZVOUS}
+ */
+static DECLCALLBACK(VBOXSTRICTRC) dbgfR3BpL2TblChunkAllocEmtWorker(PVM pVM, PVMCPU pVCpu, void *pvUser)
+{
+    uint32_t idChunk = (uint32_t)(uintptr_t)pvUser;
+
+    VMCPU_ASSERT_EMT(pVCpu);
+    VM_ASSERT_VALID_EXT_RETURN(pVM, VERR_INVALID_VM_HANDLE);
+
+    AssertReturn(idChunk < DBGF_BP_L2_TBL_CHUNK_COUNT, VERR_DBGF_BP_IPE_1);
+
+    PUVM pUVM = pVM->pUVM;
+    PDBGFBPL2TBLCHUNKR3 pL2Chunk = &pUVM->dbgf.s.aBpL2TblChunks[idChunk];
+
+    AssertReturn(   pL2Chunk->idChunk == DBGF_BP_L2_IDX_CHUNK_ID_INVALID
+                 || pL2Chunk->idChunk == idChunk,
+                 VERR_DBGF_BP_IPE_2);
+
+    /*
+     * The initialization will be done on EMT(0). It is possible that multiple
+     * allocation attempts are done when multiple racing non EMT threads try to
+     * allocate a breakpoint and a new chunk needs to be allocated.
+     * Ignore the request and succeed if the chunk is allocated meaning that a
+     * previous rendezvous successfully allocated the chunk.
+     */
+    int rc = VINF_SUCCESS;
+    if (   pVCpu->idCpu == 0
+        && pL2Chunk->idChunk == DBGF_BP_L2_IDX_CHUNK_ID_INVALID)
+    {
+        /* Allocate the bitmap first so we can skip calling into VMMR0 if it fails. */
+        AssertCompile(!(DBGF_BP_L2_TBL_ENTRIES_PER_CHUNK % 8));
+        volatile void *pbmAlloc = RTMemAllocZ(DBGF_BP_L2_TBL_ENTRIES_PER_CHUNK / 8);
+        if (RT_LIKELY(pbmAlloc))
+        {
+            DBGFBPL2TBLCHUNKALLOCREQ Req;
+            Req.Hdr.u32Magic = SUPVMMR0REQHDR_MAGIC;
+            Req.Hdr.cbReq    = sizeof(Req);
+            Req.idChunk      = idChunk;
+            Req.pChunkBaseR3 = NULL;
+            rc = VMMR3CallR0Emt(pVM, pVCpu, VMMR0_DO_DBGF_BP_L2_TBL_CHUNK_ALLOC, 0 /*u64Arg*/, &Req.Hdr);
+            AssertLogRelMsgRC(rc, ("VMMR0_DO_DBGF_BP_L2_TBL_CHUNK_ALLOC failed: %Rrc\n", rc));
+            if (RT_SUCCESS(rc))
+            {
+                pL2Chunk->pL2BaseR3 = (PDBGFBPL2ENTRY)Req.pChunkBaseR3;
+                pL2Chunk->pbmAlloc  = pbmAlloc;
+                pL2Chunk->cFree     = DBGF_BP_L2_TBL_ENTRIES_PER_CHUNK;
+                pL2Chunk->idChunk   = idChunk;
+                return VINF_SUCCESS;
+            }
+
+            RTMemFree((void *)pbmAlloc);
+        }
+        else
+            rc = VERR_NO_MEMORY;
+    }
+
+    return rc;
+}
+
+
+/**
+ * Tries to allocate the given L2 table chunk which requires an EMT rendezvous.
+ *
+ * @returns VBox status code.
+ * @param   pUVM                The user mode VM handle.
+ * @param   idChunk             The chunk to allocate.
+ *
+ * @thread Any thread.
+ */
+DECLINLINE(int) dbgfR3BpL2TblChunkAlloc(PUVM pUVM, uint32_t idChunk)
+{
+    return VMMR3EmtRendezvous(pUVM->pVM, VMMEMTRENDEZVOUS_FLAGS_TYPE_ALL_AT_ONCE, dbgfR3BpL2TblChunkAllocEmtWorker, (void *)(uintptr_t)idChunk);
+}
+
+
+/**
+ * Tries to allocate a new breakpoint of the given type.
+ *
+ * @returns VBox status code.
+ * @param   pUVM                The user mode VM handle.
+ * @param   pidxL2Tbl           Where to return the L2 table entry index on success.
+ * @param   ppL2TblEntry        Where to return the pointer to the L2 table entry on success.
+ *
+ * @thread Any thread.
+ */
+static int dbgfR3BpL2TblEntryAlloc(PUVM pUVM, uint32_t *pidxL2Tbl, PDBGFBPL2ENTRY *ppL2TblEntry)
+{
+    /*
+     * Search for a chunk having a free entry, allocating new chunks
+     * if the encountered ones are full.
+     *
+     * This can be called from multiple threads at the same time so special care
+     * has to be taken to not require any locking here.
+     */
+    for (uint32_t i = 0; i < RT_ELEMENTS(pUVM->dbgf.s.aBpL2TblChunks); i++)
+    {
+        PDBGFBPL2TBLCHUNKR3 pL2Chunk = &pUVM->dbgf.s.aBpL2TblChunks[i];
+
+        uint32_t idChunk  = ASMAtomicReadU32(&pL2Chunk->idChunk);
+        if (idChunk == DBGF_BP_L2_IDX_CHUNK_ID_INVALID)
+        {
+            int rc = dbgfR3BpL2TblChunkAlloc(pUVM, i);
+            if (RT_FAILURE(rc))
+            {
+                LogRel(("DBGF/Bp: Allocating new breakpoint L2 lookup table chunk failed with %Rrc\n", rc));
+                break;
+            }
+
+            idChunk = ASMAtomicReadU32(&pL2Chunk->idChunk);
+            Assert(idChunk == i);
+        }
+
+        /** @todo Optimize with some hinting if this turns out to be too slow. */
+        for (;;)
+        {
+            uint32_t cFree = ASMAtomicReadU32(&pL2Chunk->cFree);
+            if (cFree)
+            {
+                /*
+                 * Scan the associated bitmap for a free entry, if none can be found another thread
+                 * raced us and we go to the next chunk.
+                 */
+                int32_t iClr = ASMBitFirstClear(pL2Chunk->pbmAlloc, DBGF_BP_L2_TBL_ENTRIES_PER_CHUNK);
+                if (iClr != -1)
+                {
+                    /*
+                     * Try to allocate, we could get raced here as well. In that case
+                     * we try again.
+                     */
+                    if (!ASMAtomicBitTestAndSet(pL2Chunk->pbmAlloc, iClr))
+                    {
+                        /* Success, immediately mark as allocated, initialize the breakpoint state and return. */
+                        ASMAtomicDecU32(&pL2Chunk->cFree);
+
+                        PDBGFBPL2ENTRY pL2Entry = &pL2Chunk->pL2BaseR3[iClr];
+
+                        *pidxL2Tbl    = DBGF_BP_L2_IDX_CREATE(idChunk, iClr);
+                        *ppL2TblEntry = pL2Entry;
+                        return VINF_SUCCESS;
+                    }
+                    /* else Retry with another spot. */
+                }
+                else /* no free entry in bitmap, go to the next chunk */
+                    break;
+            }
+            else /* !cFree, go to the next chunk */
+                break;
+        }
+    }
+
+    return VERR_DBGF_NO_MORE_BP_SLOTS;
+}
+
+
+/**
+ * Frees the given breakpoint handle.
+ *
+ * @returns nothing.
+ * @param   pUVM                The user mode VM handle.
+ * @param   idxL2Tbl            The L2 table index to free.
+ * @param   pL2TblEntry         The L2 table entry pointer to free.
+ */
+static void dbgfR3BpL2TblEntryFree(PUVM pUVM, uint32_t idxL2Tbl, PDBGFBPL2ENTRY pL2TblEntry)
+{
+    uint32_t idChunk  = DBGF_BP_L2_IDX_GET_CHUNK_ID(idxL2Tbl);
+    uint32_t idxEntry = DBGF_BP_L2_IDX_GET_ENTRY(idxL2Tbl);
+
+    AssertReturnVoid(idChunk < DBGF_BP_L2_TBL_CHUNK_COUNT);
+    AssertReturnVoid(idxEntry < DBGF_BP_L2_TBL_ENTRIES_PER_CHUNK);
+
+    PDBGFBPL2TBLCHUNKR3 pL2Chunk = &pUVM->dbgf.s.aBpL2TblChunks[idChunk];
+    AssertPtrReturnVoid(pL2Chunk->pbmAlloc);
+    AssertReturnVoid(ASMBitTest(pL2Chunk->pbmAlloc, idxEntry));
+
+    memset(pL2TblEntry, 0, sizeof(*pL2TblEntry));
+
+    ASMAtomicBitClear(pL2Chunk->pbmAlloc, idxEntry);
+    ASMAtomicIncU32(&pL2Chunk->cFree);
+}
+
+
+/**
  * Sets the enabled flag of the given breakpoint to the given value.
  *
@@ -881 +1093 @@
         case DBGFBPTYPE_INT3:
         {
-            dbgfR3BpSetEnabled(pBp, false /*fEnabled*/);
-
             /*
              * Check that the current byte is the int3 instruction, and restore the original one.
@@ -896 +1106 @@
                 {
                     ASMAtomicDecU32(&pVM->dbgf.s.cEnabledInt3Breakpoints);
+                    dbgfR3BpSetEnabled(pBp, false /*fEnabled*/);
                     Log(("DBGF: Removed breakpoint at %RGv (Phys %RGp)\n", pBp->Pub.u.Int3.GCPtr, pBp->Pub.u.Int3.PhysAddr));
                 }
             }
-
-            if (RT_FAILURE(rc))
-                dbgfR3BpSetEnabled(pBp, true /*fEnabled*/);
-
             break;
         }

trunk/src/VBox/VMM/VMMRZ/DBGFRZ.cpp

@@ -238 +238 @@
 
     /** @todo Owner handling. */
+    RT_NOREF(pVM, pRegFrame, pBpR0);
 
     LogFlow(("dbgfRZBpHit: hit breakpoint %u at %04x:%RGv cHits=0x%RX64\n",

trunk/src/VBox/VMM/include/DBGFInternal.h

@@ -56 +56 @@
 
 #ifdef VBOX_WITH_LOTS_OF_DBGF_BPS
-/** @name Breakpoint handling defines.
+/** @name Global breakpoint table handling defines.
  * @{ */
 /** Maximum number of breakpoints supported (power of two). */
@@ -66 +66 @@
 /** Number of chunks required to support all breakpoints. */
 #define DBGF_BP_CHUNK_COUNT                 (DBGF_BP_COUNT_MAX / DBGF_BP_COUNT_PER_CHUNK)
+/** @} */
+
+/** @name L2 lookup table limit defines.
+ * @{ */
+/** Maximum number of entreis in the L2 lookup table. */
+#define DBGF_BP_L2_TBL_ENTRY_COUNT_MAX      _512K
+/** Number of L2 entries handled in one chunk. */
+#define DBGF_BP_L2_TBL_ENTRIES_PER_CHUNK    _64K
+/** Number of chunks required tp support all L2 lookup table entries. */
+#define DBGF_BP_L2_TBL_CHUNK_COUNT          (DBGF_BP_L2_TBL_ENTRY_COUNT_MAX / DBGF_BP_L2_TBL_ENTRIES_PER_CHUNK)
 /** @} */
 #endif
@@ -916 +926 @@
 /** Pointer to a breakpoint table chunk - Ring-0 Ptr. */
 typedef R0PTRTYPE(DBGFBPCHUNKR0 *) PDBGFBPCHUNKR0;
+
+
+/**
+ * L2 lookup table entry.
+ *
+ * @remark The order of the members matters to be able to atomically update
+ *         the AVL left/right pointers and depth with a single 64bit atomic write.
+ * @verbatim
+ *         7         6        5        4        3        2        1        0
+ *     +--------+--------+--------+--------+--------+--------+--------+--------+
+ *     |    hBp[15:0]    |                   GCPtrKey[63:16]                   |
+ *     +--------+--------+--------+--------+--------+--------+--------+--------+
+ *     | hBp[27:16] | iDepth |     idxRight[21:0]     |      idxLeft[21:0]     |
+ *     +--------+--------+--------+--------+--------+--------+--------+--------+
+ *                  \_8 bits_/
+ * @endverbatim
+ */
+typedef struct DBGFBPL2ENTRY
+{
+    /** The upper 6 bytes of the breakpoint address and the low 16 bits of the breakpoint handle. */
+    volatile uint64_t           u64GCPtrKeyAndBpHnd1;
+    /** Left/right lower index, tree depth and remaining 12 bits of the breakpoint handle. */
+    volatile uint64_t           u64LeftRightIdxDepthBpHnd2;
+} DBGFBPL2ENTRY;
+AssertCompileSize(DBGFBPL2ENTRY, 16);
+/** Pointer to a L2 lookup table entry. */
+typedef DBGFBPL2ENTRY *PDBGFBPL2ENTRY;
+/** Pointer to a const L2 lookup table entry. */
+typedef const DBGFBPL2ENTRY *PCDBGFBPL2ENTRY;
+
+/** An invalid breakpoint chunk ID. */
+#define DBGF_BP_L2_IDX_CHUNK_ID_INVALID             UINT32_MAX
+/** Generates a unique breakpoint handle from the given chunk ID and entry inside the chunk. */
+#define DBGF_BP_L2_IDX_CREATE(a_idChunk, a_idEntry) RT_MAKE_U32(a_idEntry, a_idChunk);
+/** Returns the chunk ID from the given breakpoint handle. */
+#define DBGF_BP_L2_IDX_GET_CHUNK_ID(a_idxL2)        ((uint32_t)RT_HI_U16(a_idxL2))
+/** Returns the entry index inside a chunk from the given breakpoint handle. */
+#define DBGF_BP_L2_IDX_GET_ENTRY(a_idxL2)           ((uint32_t)RT_LO_U16(a_idxL2))
+
+/** Number of bits for the left/right index pointers. */
+#define DBGF_BP_L2_ENTRY_LEFT_RIGHT_IDX_BITS            22
+/** Index mask. */
+#define DBGF_BP_L2_ENTRY_LEFT_RIGHT_IDX_MASK            (RT_BIT_32(DBGF_BP_L2_ENTRY_LEFT_RIGHT_IDX_BITS) - 1)
+/** Returns the upper 6 bytes of the GC pointer from the given breakpoint entry. */
+#define DBGF_BP_L2_ENTRY_GET_GCPTR(a_u64GCPtrKeyAndBpHnd1) ((a_u64GCPtrKeyAndBpHnd1) & UINT64_C(0x0000ffffffffffff))
+/** Returns the breakpoint handle from both L2 entry members. */
+#define DBGF_BP_L2_ENTRY_GET_BP_HND(a_u64GCPtrKeyAndBpHnd1, a_u64LeftRightIdxDepthBpHnd2) \
+    ((DBGFBP)(((a_u64GCPtrKeyAndBpHnd1) >> 48) | (((a_u64LeftRightIdxDepthBpHnd2) >> 52) << 16)))
+/** Extracts the depth of the second 64bit L2 entry value. */
+#define DBGF_BP_L2_ENTRY_GET_DEPTH(a_u64LeftRightIdxDepthBpHnd2) ((uint8_t)(((a_u64LeftRightIdxDepthBpHnd2) >> 44) & UINT8_MAX))
+/** Extracts the lower right index value from the L2 entry value. */
+#define DBGF_BP_L2_ENTRY_GET_IDX_RIGHT(a_u64LeftRightIdxDepthBpHnd2) \
+    ((uint32_t)(((a_u64LeftRightIdxDepthBpHnd2) >> 22) & DBGF_BP_L2_ENTRY_LEFT_RIGHT_IDX_MASK))
+/** Extracts the lower left index value from the L2 entry value. */
+#define DBGF_BP_L2_ENTRY_GET_IDX_LEFT(a_u64LeftRightIdxDepthBpHnd2) \
+    ((uint32_t)((a_u64LeftRightIdxDepthBpHnd2) & DBGF_BP_L2_ENTRY_LEFT_RIGHT_IDX_MASK))
+
+
+/**
+ * A breakpoint L2 lookup table chunk, ring-3 state.
+ */
+typedef struct DBGFBPL2TBLCHUNKR3
+{
+    /** Pointer to the R3 base of the chunk. */
+    R3PTRTYPE(PDBGFBPL2ENTRY)   pL2BaseR3;
+    /** Bitmap of free/occupied breakpoint entries. */
+    R3PTRTYPE(volatile void *)  pbmAlloc;
+    /** Number of free entries in the chunk. */
+    volatile uint32_t           cFree;
+    /** The chunk index this tracking structure refers to. */
+    uint32_t                    idChunk;
+} DBGFBPL2TBLCHUNKR3;
+/** Pointer to a breakpoint L2 lookup table chunk - Ring-3 Ptr. */
+typedef DBGFBPL2TBLCHUNKR3 *PDBGFBPL2TBLCHUNKR3;
+/** Pointer to a const breakpoint L2 lookup table chunk - Ring-3 Ptr. */
+typedef const DBGFBPL2TBLCHUNKR3 *PCDBGFBPL2TBLCHUNKR3;
+
+
+/**
+ * Breakpoint L2 lookup table chunk, ring-0 state.
+ */
+typedef struct DBGFBPL2TBLCHUNKR0
+{
+    /** The chunks memory. */
+    RTR0MEMOBJ                  hMemObj;
+    /** The ring-3 mapping object. */
+    RTR0MEMOBJ                  hMapObj;
+    /** Pointer to the breakpoint entries base. */
+    R0PTRTYPE(PDBGFBPL2ENTRY)   paBpL2TblBaseSharedR0;
+} DBGFBPL2TBLCHUNKR0;
+/** Pointer to a breakpoint L2 lookup table chunk - Ring-0 Ptr. */
+typedef R0PTRTYPE(DBGFBPL2TBLCHUNKR0 *) PDBGFBPL2TBLCHUNKR0;
 #endif
 
@@ -1158 +1260 @@
     /** Global breakpoint table chunk array. */
     DBGFBPCHUNKR0                       aBpChunks[DBGF_BP_CHUNK_COUNT];
+    /** Breakpoint L2 lookup table chunk array. */
+    DBGFBPL2TBLCHUNKR0                  aBpL2TblChunks[DBGF_BP_L2_TBL_CHUNK_COUNT];
     /** The L1 lookup tables memory object. */
     RTR0MEMOBJ                          hMemObjBpLocL1;
@@ -1247 +1351 @@
     /** Global breakpoint table chunk array. */
     DBGFBPCHUNKR3                   aBpChunks[DBGF_BP_CHUNK_COUNT];
+    /** Breakpoint L2 lookup table chunk array. */
+    DBGFBPL2TBLCHUNKR3              aBpL2TblChunks[DBGF_BP_L2_TBL_CHUNK_COUNT];
     /** Base pointer to the L1 locator table. */
     R3PTRTYPE(volatile uint32_t *)  paBpLocL1R3;
+    /** Fast mutex protecting the L2 table from concurrent write accesses (EMTs
+     * can still do read accesses without holding it while traversing the trees). */
+    RTSEMFASTMUTEX                  hMtxBpL2Wr;
     /** @} */
 #endif