PGMAllPhys.cpp@ 14969

Last change on this file since 14969 was 14969, checked in by vboxsync, 16 years ago
VMM support for completing VA in TLB (not much tested)
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 85.4 KB

Line
1	/* $Id: PGMAllPhys.cpp 14969 2008-12-04 10:57:17Z vboxsync $ */
2	/** @file
3	* PGM - Page Manager and Monitor, Physical Memory Addressing.
4	*/
5
6	/*
7	* Copyright (C) 2006-2007 Sun Microsystems, Inc.
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.215389.xyz. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
18	* Clara, CA 95054 USA or visit http://www.sun.com if you need
19	* additional information or have any questions.
20	*/
21
22	/*******************************************************************************
23	* Defined Constants And Macros *
24	*******************************************************************************/
25	/** @def PGM_IGNORE_RAM_FLAGS_RESERVED
26	* Don't respect the MM_RAM_FLAGS_RESERVED flag when converting to HC addresses.
27	*
28	* Since this flag is currently incorrectly kept set for ROM regions we will
29	* have to ignore it for now so we don't break stuff.
30	*
31	* @todo this has been fixed now I believe, remove this hack.
32	*/
33	#define PGM_IGNORE_RAM_FLAGS_RESERVED
34
35
36	/*******************************************************************************
37	* Header Files *
38	*******************************************************************************/
39	#define LOG_GROUP LOG_GROUP_PGM_PHYS
40	#include <VBox/pgm.h>
41	#include <VBox/trpm.h>
42	#include <VBox/vmm.h>
43	#include <VBox/iom.h>
44	#include <VBox/em.h>
45	#include <VBox/rem.h>
46	#include "PGMInternal.h"
47	#include <VBox/vm.h>
48	#include <VBox/param.h>
49	#include <VBox/err.h>
50	#include <iprt/assert.h>
51	#include <iprt/string.h>
52	#include <iprt/asm.h>
53	#include <VBox/log.h>
54	#ifdef IN_RING3
55	# include <iprt/thread.h>
56	#endif
57
58
59
60	#ifndef IN_RING3
61
62	/**
63	* \#PF Handler callback for Guest ROM range write access.
64	* We simply ignore the writes or fall back to the recompiler if we don't support the instruction.
65	*
66	* @returns VBox status code (appropritate for trap handling and GC return).
67	* @param pVM VM Handle.
68	* @param uErrorCode CPU Error code.
69	* @param pRegFrame Trap register frame.
70	* @param pvFault The fault address (cr2).
71	* @param GCPhysFault The GC physical address corresponding to pvFault.
72	* @param pvUser User argument. Pointer to the ROM range structure.
73	*/
74	VMMDECL(int) pgmPhysRomWriteHandler(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame, void pvFault, RTGCPHYS GCPhysFault, void pvUser)
75	{
76	int rc;
77	#ifdef VBOX_WITH_NEW_PHYS_CODE
78	PPGMROMRANGE pRom = (PPGMROMRANGE)pvUser;
79	uint32_t iPage = GCPhysFault - pRom->GCPhys;
80	Assert(iPage < (pRom->cb >> PAGE_SHIFT));
81	switch (pRom->aPages[iPage].enmProt)
82	{
83	case PGMROMPROT_READ_ROM_WRITE_IGNORE:
84	case PGMROMPROT_READ_RAM_WRITE_IGNORE:
85	{
86	#endif
87	/*
88	* If it's a simple instruction which doesn't change the cpu state
89	* we will simply skip it. Otherwise we'll have to defer it to REM.
90	*/
91	uint32_t cbOp;
92	DISCPUSTATE Cpu;
93	rc = EMInterpretDisasOne(pVM, pRegFrame, &Cpu, &cbOp);
94	if ( RT_SUCCESS(rc)
95	&& Cpu.mode == CPUMODE_32BIT /** @todo why does this matter? */
96	&& !(Cpu.prefix & (PREFIX_REPNE \| PREFIX_REP \| PREFIX_SEG)))
97	{
98	switch (Cpu.opcode)
99	{
100	/** @todo Find other instructions we can safely skip, possibly
101	* adding this kind of detection to DIS or EM. */
102	case OP_MOV:
103	pRegFrame->rip += cbOp;
104	STAM_COUNTER_INC(&pVM->pgm.s.StatRZGuestROMWriteHandled);
105	return VINF_SUCCESS;
106	}
107	}
108	else if (RT_UNLIKELY(rc == VERR_INTERNAL_ERROR))
109	return rc;
110	#ifdef VBOX_WITH_NEW_PHYS_CODE
111	break;
112	}
113
114	case PGMROMPROT_READ_RAM_WRITE_RAM:
115	rc = PGMHandlerPhysicalPageTempOff(pVM, pRom->GCPhys, GCPhysFault & X86_PTE_PG_MASK);
116	AssertRC(rc);
117	case PGMROMPROT_READ_ROM_WRITE_RAM:
118	/* Handle it in ring-3 because it's way easier there. */
119	break;
120
121	default:
122	AssertMsgFailedReturn(("enmProt=%d iPage=%d GCPhysFault=%RGp\n",
123	pRom->aPages[iPage].enmProt, iPage, GCPhysFault),
124	VERR_INTERNAL_ERROR);
125	}
126	#endif
127
128	STAM_COUNTER_INC(&pVM->pgm.s.StatRZGuestROMWriteUnhandled);
129	return VINF_EM_RAW_EMULATE_INSTR;
130	}
131
132	#endif /* IN_RING3 */
133
134	/**
135	* Checks if Address Gate 20 is enabled or not.
136	*
137	* @returns true if enabled.
138	* @returns false if disabled.
139	* @param pVM VM handle.
140	*/
141	VMMDECL(bool) PGMPhysIsA20Enabled(PVM pVM)
142	{
143	LogFlow(("PGMPhysIsA20Enabled %d\n", pVM->pgm.s.fA20Enabled));
144	return !!pVM->pgm.s.fA20Enabled ; /* stupid MS compiler doesn't trust me. */
145	}
146
147
148	/**
149	* Validates a GC physical address.
150	*
151	* @returns true if valid.
152	* @returns false if invalid.
153	* @param pVM The VM handle.
154	* @param GCPhys The physical address to validate.
155	*/
156	VMMDECL(bool) PGMPhysIsGCPhysValid(PVM pVM, RTGCPHYS GCPhys)
157	{
158	PPGMPAGE pPage = pgmPhysGetPage(&pVM->pgm.s, GCPhys);
159	return pPage != NULL;
160	}
161
162
163	/**
164	* Checks if a GC physical address is a normal page,
165	* i.e. not ROM, MMIO or reserved.
166	*
167	* @returns true if normal.
168	* @returns false if invalid, ROM, MMIO or reserved page.
169	* @param pVM The VM handle.
170	* @param GCPhys The physical address to check.
171	*/
172	VMMDECL(bool) PGMPhysIsGCPhysNormal(PVM pVM, RTGCPHYS GCPhys)
173	{
174	PPGMPAGE pPage = pgmPhysGetPage(&pVM->pgm.s, GCPhys);
175	return pPage
176	&& !(pPage->HCPhys & (MM_RAM_FLAGS_MMIO \| MM_RAM_FLAGS_ROM \| MM_RAM_FLAGS_RESERVED \| MM_RAM_FLAGS_MMIO2));
177	}
178
179
180	/**
181	* Converts a GC physical address to a HC physical address.
182	*
183	* @returns VINF_SUCCESS on success.
184	* @returns VERR_PGM_PHYS_PAGE_RESERVED it it's a valid GC physical
185	* page but has no physical backing.
186	* @returns VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid
187	* GC physical address.
188	*
189	* @param pVM The VM handle.
190	* @param GCPhys The GC physical address to convert.
191	* @param pHCPhys Where to store the HC physical address on success.
192	*/
193	VMMDECL(int) PGMPhysGCPhys2HCPhys(PVM pVM, RTGCPHYS GCPhys, PRTHCPHYS pHCPhys)
194	{
195	PPGMPAGE pPage;
196	int rc = pgmPhysGetPageEx(&pVM->pgm.s, GCPhys, &pPage);
197	if (RT_FAILURE(rc))
198	return rc;
199
200	#ifndef PGM_IGNORE_RAM_FLAGS_RESERVED
201	if (RT_UNLIKELY(pPage->HCPhys & MM_RAM_FLAGS_RESERVED)) /** @todo PAGE FLAGS */
202	return VERR_PGM_PHYS_PAGE_RESERVED;
203	#endif
204
205	*pHCPhys = PGM_PAGE_GET_HCPHYS(pPage) \| (GCPhys & PAGE_OFFSET_MASK);
206	return VINF_SUCCESS;
207	}
208
209
210	/**
211	* Invalidates the GC page mapping TLB.
212	*
213	* @param pVM The VM handle.
214	*/
215	VMMDECL(void) PGMPhysInvalidatePageGCMapTLB(PVM pVM)
216	{
217	/* later */
218	NOREF(pVM);
219	}
220
221
222	/**
223	* Invalidates the ring-0 page mapping TLB.
224	*
225	* @param pVM The VM handle.
226	*/
227	VMMDECL(void) PGMPhysInvalidatePageR0MapTLB(PVM pVM)
228	{
229	PGMPhysInvalidatePageR3MapTLB(pVM);
230	}
231
232
233	/**
234	* Invalidates the ring-3 page mapping TLB.
235	*
236	* @param pVM The VM handle.
237	*/
238	VMMDECL(void) PGMPhysInvalidatePageR3MapTLB(PVM pVM)
239	{
240	pgmLock(pVM);
241	for (unsigned i = 0; i < RT_ELEMENTS(pVM->pgm.s.PhysTlbHC.aEntries); i++)
242	{
243	pVM->pgm.s.PhysTlbHC.aEntries[i].GCPhys = NIL_RTGCPHYS;
244	pVM->pgm.s.PhysTlbHC.aEntries[i].pPage = 0;
245	pVM->pgm.s.PhysTlbHC.aEntries[i].pMap = 0;
246	pVM->pgm.s.PhysTlbHC.aEntries[i].pv = 0;
247	}
248	pgmUnlock(pVM);
249	}
250
251
252	/**
253	* Frees the specified RAM page.
254	*
255	* This is used by ballooning and remapping MMIO2.
256	*
257	* @param pVM Pointer to the shared VM structure.
258	* @param pPage Pointer to the page structure.
259	* @param GCPhys The guest physical address of the page, if applicable.
260	*/
261	void pgmPhysFreePage(PVM pVM, PPGMPAGE pPage, RTGCPHYS GCPhys)
262	{
263	AssertFatal(PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_RAM);
264
265	/** @todo implement this... */
266	AssertFatalFailed();
267	}
268
269
270	/**
271	* Makes sure that there is at least one handy page ready for use.
272	*
273	* This will also take the appropriate actions when reaching water-marks.
274	*
275	* @returns The following VBox status codes.
276	* @retval VINF_SUCCESS on success.
277	* @retval VERR_EM_NO_MEMORY if we're really out of memory.
278	*
279	* @param pVM The VM handle.
280	*
281	* @remarks Must be called from within the PGM critical section. It may
282	* nip back to ring-3/0 in some cases.
283	*/
284	static int pgmPhysEnsureHandyPage(PVM pVM)
285	{
286	/** @remarks
287	* low-water mark logic for R0 & GC:
288	* - 75%: Set FF.
289	* - 50%: Force return to ring-3 ASAP.
290	*
291	* For ring-3 there is a little problem wrt to the recompiler, so:
292	* - 75%: Set FF.
293	* - 50%: Try allocate pages; on failure we'll force REM to quite ASAP.
294	*
295	* The basic idea is that we should be able to get out of any situation with
296	* only 50% of handy pages remaining.
297	*
298	* At the moment we'll not adjust the number of handy pages relative to the
299	* actual VM RAM committment, that's too much work for now.
300	*/
301	Assert(pVM->pgm.s.cHandyPages <= RT_ELEMENTS(pVM->pgm.s.aHandyPages));
302	if ( !pVM->pgm.s.cHandyPages
303	#ifdef IN_RING3
304	\|\| pVM->pgm.s.cHandyPages - 1 <= RT_ELEMENTS(pVM->pgm.s.aHandyPages) / 2 /* 50% */
305	#endif
306	)
307	{
308	Log(("PGM: cHandyPages=%u out of %u -> allocate more\n", pVM->pgm.s.cHandyPages - 1 <= RT_ELEMENTS(pVM->pgm.s.aHandyPages)));
309	#ifdef IN_RING3
310	int rc = SUPCallVMMR0Ex(pVM->pVMR0, VMMR0_DO_PGM_ALLOCATE_HANDY_PAGES, 0, NULL);
311	#elif defined(IN_RING0)
312	/** @todo call PGMR0PhysAllocateHandyPages directly - need to make sure we can call kernel code first and deal with the seeding fallback. */
313	int rc = VMMR0CallHost(pVM, VMMCALLHOST_PGM_ALLOCATE_HANDY_PAGES, 0);
314	#else
315	int rc = VMMGCCallHost(pVM, VMMCALLHOST_PGM_ALLOCATE_HANDY_PAGES, 0);
316	#endif
317	if (RT_UNLIKELY(rc != VINF_SUCCESS))
318	{
319	Assert(rc == VINF_EM_NO_MEMORY);
320	if (!pVM->pgm.s.cHandyPages)
321	{
322	LogRel(("PGM: no more handy pages!\n"));
323	return VERR_EM_NO_MEMORY;
324	}
325	Assert(VM_FF_ISSET(pVM, VM_FF_PGM_NEED_HANDY_PAGES));
326	#ifdef IN_RING3
327	REMR3NotifyFF(pVM);
328	#else
329	VM_FF_SET(pVM, VM_FF_TO_R3);
330	#endif
331	}
332	Assert(pVM->pgm.s.cHandyPages <= RT_ELEMENTS(pVM->pgm.s.aHandyPages));
333	}
334	else if (pVM->pgm.s.cHandyPages - 1 <= (RT_ELEMENTS(pVM->pgm.s.aHandyPages) / 4) * 3) /* 75% */
335	{
336	VM_FF_SET(pVM, VM_FF_PGM_NEED_HANDY_PAGES);
337	#ifndef IN_RING3
338	if (pVM->pgm.s.cHandyPages - 1 <= RT_ELEMENTS(pVM->pgm.s.aHandyPages) / 2)
339	{
340	Log(("PGM: VM_FF_TO_R3 - cHandyPages=%u out of %u\n", pVM->pgm.s.cHandyPages - 1 <= RT_ELEMENTS(pVM->pgm.s.aHandyPages)));
341	VM_FF_SET(pVM, VM_FF_TO_R3);
342	}
343	#endif
344	}
345
346	return VINF_SUCCESS;
347	}
348
349
350	/**
351	* Replace a zero or shared page with new page that we can write to.
352	*
353	* @returns The following VBox status codes.
354	* @retval VINF_SUCCESS on success, pPage is modified.
355	* @retval VERR_EM_NO_MEMORY if we're totally out of memory.
356	*
357	* @todo Propagate VERR_EM_NO_MEMORY up the call tree.
358	*
359	* @param pVM The VM address.
360	* @param pPage The physical page tracking structure. This will
361	* be modified on success.
362	* @param GCPhys The address of the page.
363	*
364	* @remarks Must be called from within the PGM critical section. It may
365	* nip back to ring-3/0 in some cases.
366	*
367	* @remarks This function shouldn't really fail, however if it does
368	* it probably means we've screwed up the size of the amount
369	* and/or the low-water mark of handy pages. Or, that some
370	* device I/O is causing a lot of pages to be allocated while
371	* while the host is in a low-memory condition.
372	*/
373	int pgmPhysAllocPage(PVM pVM, PPGMPAGE pPage, RTGCPHYS GCPhys)
374	{
375	/*
376	* Ensure that we've got a page handy, take it and use it.
377	*/
378	int rc = pgmPhysEnsureHandyPage(pVM);
379	if (RT_FAILURE(rc))
380	{
381	Assert(rc == VERR_EM_NO_MEMORY);
382	return rc;
383	}
384	AssertMsg(PGM_PAGE_IS_ZERO(pPage) \|\| PGM_PAGE_IS_SHARED(pPage), ("%d %RGp\n", PGM_PAGE_GET_STATE(pPage), GCPhys));
385	Assert(!PGM_PAGE_IS_RESERVED(pPage));
386	Assert(!PGM_PAGE_IS_MMIO(pPage));
387
388	uint32_t iHandyPage = --pVM->pgm.s.cHandyPages;
389	Assert(iHandyPage < RT_ELEMENTS(pVM->pgm.s.aHandyPages));
390	Assert(pVM->pgm.s.aHandyPages[iHandyPage].HCPhysGCPhys != NIL_RTHCPHYS);
391	Assert(!(pVM->pgm.s.aHandyPages[iHandyPage].HCPhysGCPhys & ~X86_PTE_PAE_PG_MASK));
392	Assert(pVM->pgm.s.aHandyPages[iHandyPage].idPage != NIL_GMM_PAGEID);
393	Assert(pVM->pgm.s.aHandyPages[iHandyPage].idSharedPage == NIL_GMM_PAGEID);
394
395	/*
396	* There are one or two action to be taken the next time we allocate handy pages:
397	* - Tell the GMM (global memory manager) what the page is being used for.
398	* (Speeds up replacement operations - sharing and defragmenting.)
399	* - If the current backing is shared, it must be freed.
400	*/
401	const RTHCPHYS HCPhys = pVM->pgm.s.aHandyPages[iHandyPage].HCPhysGCPhys;
402	pVM->pgm.s.aHandyPages[iHandyPage].HCPhysGCPhys = GCPhys;
403
404	if (PGM_PAGE_IS_SHARED(pPage))
405	{
406	pVM->pgm.s.aHandyPages[iHandyPage].idSharedPage = PGM_PAGE_GET_PAGEID(pPage);
407	Assert(PGM_PAGE_GET_PAGEID(pPage) != NIL_GMM_PAGEID);
408	VM_FF_SET(pVM, VM_FF_PGM_NEED_HANDY_PAGES);
409
410	Log2(("PGM: Replaced shared page %#x at %RGp with %#x / %RHp\n", PGM_PAGE_GET_PAGEID(pPage),
411	GCPhys, pVM->pgm.s.aHandyPages[iHandyPage].idPage, HCPhys));
412	STAM_COUNTER_INC(&pVM->pgm.s.CTX_MID_Z(Stat,PageReplaceShared));
413	pVM->pgm.s.cSharedPages--;
414	/** @todo err.. what about copying the page content? */
415	}
416	else
417	{
418	Log2(("PGM: Replaced zero page %RGp with %#x / %RHp\n", GCPhys, pVM->pgm.s.aHandyPages[iHandyPage].idPage, HCPhys));
419	STAM_COUNTER_INC(&pVM->pgm.s.StatRZPageReplaceZero);
420	pVM->pgm.s.cZeroPages--;
421	/** @todo verify that the handy page is zero! */
422	}
423
424	/*
425	* Do the PGMPAGE modifications.
426	*/
427	pVM->pgm.s.cPrivatePages++;
428	PGM_PAGE_SET_HCPHYS(pPage, HCPhys);
429	PGM_PAGE_SET_PAGEID(pPage, pVM->pgm.s.aHandyPages[iHandyPage].idPage);
430	PGM_PAGE_SET_STATE(pPage, PGM_PAGE_STATE_ALLOCATED);
431
432	return VINF_SUCCESS;
433	}
434
435
436	/**
437	* Deal with pages that are not writable, i.e. not in the ALLOCATED state.
438	*
439	* @returns VBox status code.
440	* @retval VINF_SUCCESS on success.
441	* @retval VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical backing.
442	*
443	* @param pVM The VM address.
444	* @param pPage The physical page tracking structure.
445	* @param GCPhys The address of the page.
446	*
447	* @remarks Called from within the PGM critical section.
448	*/
449	int pgmPhysPageMakeWritable(PVM pVM, PPGMPAGE pPage, RTGCPHYS GCPhys)
450	{
451	switch (PGM_PAGE_GET_STATE(pPage))
452	{
453	case PGM_PAGE_STATE_WRITE_MONITORED:
454	PGM_PAGE_SET_WRITTEN_TO(pPage);
455	PGM_PAGE_SET_STATE(pPage, PGM_PAGE_STATE_ALLOCATED);
456	/* fall thru */
457	default: /* to shut up GCC */
458	case PGM_PAGE_STATE_ALLOCATED:
459	return VINF_SUCCESS;
460
461	/*
462	* Zero pages can be dummy pages for MMIO or reserved memory,
463	* so we need to check the flags before joining cause with
464	* shared page replacement.
465	*/
466	case PGM_PAGE_STATE_ZERO:
467	if ( PGM_PAGE_IS_MMIO(pPage)
468	\|\| PGM_PAGE_IS_RESERVED(pPage))
469	return VERR_PGM_PHYS_PAGE_RESERVED;
470	/* fall thru */
471	case PGM_PAGE_STATE_SHARED:
472	return pgmPhysAllocPage(pVM, pPage, GCPhys);
473	}
474	}
475
476
477	/**
478	* Maps a page into the current virtual address space so it can be accessed.
479	*
480	* @returns VBox status code.
481	* @retval VINF_SUCCESS on success.
482	* @retval VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical backing.
483	*
484	* @param pVM The VM address.
485	* @param pPage The physical page tracking structure.
486	* @param GCPhys The address of the page.
487	* @param ppMap Where to store the address of the mapping tracking structure.
488	* @param ppv Where to store the mapping address of the page. The page
489	* offset is masked off!
490	*
491	* @remarks Called from within the PGM critical section.
492	*/
493	int pgmPhysPageMap(PVM pVM, PPGMPAGE pPage, RTGCPHYS GCPhys, PPPGMPAGEMAP ppMap, void **ppv)
494	{
495	#if defined(IN_RC) \|\| defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
496	/*
497	* Just some sketchy GC/R0-darwin code.
498	*/
499	*ppMap = NULL;
500	RTHCPHYS HCPhys = PGM_PAGE_GET_HCPHYS(pPage);
501	Assert(HCPhys != pVM->pgm.s.HCPhysZeroPg);
502	return PGMDynMapHCPage(pVM, HCPhys, ppv);
503
504	#else /* IN_RING3 \|\| IN_RING0 */
505
506	/*
507	* Find/make Chunk TLB entry for the mapping chunk.
508	*/
509	PPGMCHUNKR3MAP pMap;
510	const uint32_t idChunk = PGM_PAGE_GET_CHUNKID(pPage);
511	PPGMCHUNKR3MAPTLBE pTlbe = &pVM->pgm.s.ChunkR3Map.Tlb.aEntries[PGM_CHUNKR3MAPTLB_IDX(idChunk)];
512	if (pTlbe->idChunk == idChunk)
513	{
514	STAM_COUNTER_INC(&pVM->pgm.s.CTX_MID_Z(Stat,ChunkR3MapTlbHits));
515	pMap = pTlbe->pChunk;
516	}
517	else if (idChunk != NIL_GMM_CHUNKID)
518	{
519	STAM_COUNTER_INC(&pVM->pgm.s.CTX_MID_Z(Stat,ChunkR3MapTlbMisses));
520
521	/*
522	* Find the chunk, map it if necessary.
523	*/
524	pMap = (PPGMCHUNKR3MAP)RTAvlU32Get(&pVM->pgm.s.ChunkR3Map.pTree, idChunk);
525	if (!pMap)
526	{
527	#ifdef IN_RING0
528	int rc = VMMR0CallHost(pVM, VMMCALLHOST_PGM_MAP_CHUNK, idChunk);
529	AssertRCReturn(rc, rc);
530	pMap = (PPGMCHUNKR3MAP)RTAvlU32Get(&pVM->pgm.s.ChunkR3Map.pTree, idChunk);
531	Assert(pMap);
532	#else
533	int rc = pgmR3PhysChunkMap(pVM, idChunk, &pMap);
534	if (RT_FAILURE(rc))
535	return rc;
536	#endif
537	}
538
539	/*
540	* Enter it into the Chunk TLB.
541	*/
542	pTlbe->idChunk = idChunk;
543	pTlbe->pChunk = pMap;
544	pMap->iAge = 0;
545	}
546	else
547	{
548	Assert(PGM_PAGE_IS_ZERO(pPage));
549	*ppv = pVM->pgm.s.CTXALLSUFF(pvZeroPg);
550	*ppMap = NULL;
551	return VINF_SUCCESS;
552	}
553
554	ppv = (uint8_t )pMap->pv + (PGM_PAGE_GET_PAGE_IN_CHUNK(pPage) << PAGE_SHIFT);
555	*ppMap = pMap;
556	return VINF_SUCCESS;
557	#endif /* IN_RING3 */
558	}
559
560
561	#if !defined(IN_RC) && !defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
562	/**
563	* Load a guest page into the ring-3 physical TLB.
564	*
565	* @returns VBox status code.
566	* @retval VINF_SUCCESS on success
567	* @retval VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid physical address.
568	* @param pPGM The PGM instance pointer.
569	* @param GCPhys The guest physical address in question.
570	*/
571	int pgmPhysPageLoadIntoTlb(PPGM pPGM, RTGCPHYS GCPhys)
572	{
573	STAM_COUNTER_INC(&pPGM->CTX_MID_Z(Stat,PageMapTlbMisses));
574
575	/*
576	* Find the ram range.
577	* 99.8% of requests are expected to be in the first range.
578	*/
579	PPGMRAMRANGE pRam = pPGM->CTX_SUFF(pRamRanges);
580	RTGCPHYS off = GCPhys - pRam->GCPhys;
581	if (RT_UNLIKELY(off >= pRam->cb))
582	{
583	do
584	{
585	pRam = pRam->CTX_SUFF(pNext);
586	if (!pRam)
587	return VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS;
588	off = GCPhys - pRam->GCPhys;
589	} while (off >= pRam->cb);
590	}
591
592	/*
593	* Map the page.
594	* Make a special case for the zero page as it is kind of special.
595	*/
596	PPGMPAGE pPage = &pRam->aPages[off >> PAGE_SHIFT];
597	PPGMPAGEMAPTLBE pTlbe = &pPGM->CTXSUFF(PhysTlb).aEntries[PGM_PAGEMAPTLB_IDX(GCPhys)];
598	if (!PGM_PAGE_IS_ZERO(pPage))
599	{
600	void *pv;
601	PPGMPAGEMAP pMap;
602	int rc = pgmPhysPageMap(PGM2VM(pPGM), pPage, GCPhys, &pMap, &pv);
603	if (RT_FAILURE(rc))
604	return rc;
605	pTlbe->pMap = pMap;
606	pTlbe->pv = pv;
607	}
608	else
609	{
610	Assert(PGM_PAGE_GET_HCPHYS(pPage) == pPGM->HCPhysZeroPg);
611	pTlbe->pMap = NULL;
612	pTlbe->pv = pPGM->CTXALLSUFF(pvZeroPg);
613	}
614	pTlbe->pPage = pPage;
615	return VINF_SUCCESS;
616	}
617	#endif /* !IN_RC && !VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0 */
618
619
620	/**
621	* Requests the mapping of a guest page into the current context.
622	*
623	* This API should only be used for very short term, as it will consume
624	* scarse resources (R0 and GC) in the mapping cache. When you're done
625	* with the page, call PGMPhysReleasePageMappingLock() ASAP to release it.
626	*
627	* This API will assume your intention is to write to the page, and will
628	* therefore replace shared and zero pages. If you do not intend to modify
629	* the page, use the PGMPhysGCPhys2CCPtrReadOnly() API.
630	*
631	* @returns VBox status code.
632	* @retval VINF_SUCCESS on success.
633	* @retval VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical backing.
634	* @retval VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid physical address.
635	*
636	* @param pVM The VM handle.
637	* @param GCPhys The guest physical address of the page that should be mapped.
638	* @param ppv Where to store the address corresponding to GCPhys.
639	* @param pLock Where to store the lock information that PGMPhysReleasePageMappingLock needs.
640	*
641	* @remark Avoid calling this API from within critical sections (other than
642	* the PGM one) because of the deadlock risk.
643	* @thread Any thread.
644	*/
645	VMMDECL(int) PGMPhysGCPhys2CCPtr(PVM pVM, RTGCPHYS GCPhys, void **ppv, PPGMPAGEMAPLOCK pLock)
646	{
647	#ifdef VBOX_WITH_NEW_PHYS_CODE
648	# if defined(IN_RC) \|\| defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
649	/** @todo this needs to be fixed, it really ain't right. */
650	/* Until a physical TLB is implemented for GC or/and R0-darwin, let PGMDynMapGCPageEx handle it. */
651	return PGMDynMapGCPageOff(pVM, GCPhys, ppv);
652
653	#else
654	int rc = pgmLock(pVM);
655	AssertRCReturn(rc);
656
657	/*
658	* Query the Physical TLB entry for the page (may fail).
659	*/
660	PGMPHYSTLBE pTlbe;
661	int rc = pgmPhysPageQueryTlbe(&pVM->pgm.s, GCPhys, &pTlbe);
662	if (RT_SUCCESS(rc))
663	{
664	/*
665	* If the page is shared, the zero page, or being write monitored
666	* it must be converted to an page that's writable if possible.
667	*/
668	PPGMPAGE pPage = pTlbe->pPage;
669	if (RT_UNLIKELY(PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED))
670	{
671	rc = pgmPhysPageMakeWritable(pVM, pPage, GCPhys);
672	/** @todo stuff is missing here! */
673	}
674	if (RT_SUCCESS(rc))
675	{
676	/*
677	* Now, just perform the locking and calculate the return address.
678	*/
679	PPGMPAGEMAP pMap = pTlbe->pMap;
680	pMap->cRefs++;
681	if (RT_LIKELY(pPage->cLocks != PGM_PAGE_MAX_LOCKS))
682	if (RT_UNLIKELY(++pPage->cLocks == PGM_PAGE_MAX_LOCKS))
683	{
684	AssertMsgFailed(("%RGp is entering permanent locked state!\n", GCPhys));
685	pMap->cRefs++; /* Extra ref to prevent it from going away. */
686	}
687
688	ppv = (void )((uintptr_t)pTlbe->pv \| (GCPhys & PAGE_OFFSET_MASK));
689	pLock->pvPage = pPage;
690	pLock->pvMap = pMap;
691	}
692	}
693
694	pgmUnlock(pVM);
695	return rc;
696
697	#endif /* IN_RING3 \|\| IN_RING0 */
698
699	#else
700	/*
701	* Temporary fallback code.
702	*/
703	# if defined(IN_RC) \|\| defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
704	/** @todo @bugref{3202}: check up this path. */
705	return PGMDynMapGCPageOff(pVM, GCPhys, ppv);
706	# else
707	return PGMPhysGCPhys2R3Ptr(pVM, GCPhys, 1, (PRTR3PTR)ppv);
708	# endif
709	#endif
710	}
711
712
713	/**
714	* Requests the mapping of a guest page into the current context.
715	*
716	* This API should only be used for very short term, as it will consume
717	* scarse resources (R0 and GC) in the mapping cache. When you're done
718	* with the page, call PGMPhysReleasePageMappingLock() ASAP to release it.
719	*
720	* @returns VBox status code.
721	* @retval VINF_SUCCESS on success.
722	* @retval VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical backing.
723	* @retval VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid physical address.
724	*
725	* @param pVM The VM handle.
726	* @param GCPhys The guest physical address of the page that should be mapped.
727	* @param ppv Where to store the address corresponding to GCPhys.
728	* @param pLock Where to store the lock information that PGMPhysReleasePageMappingLock needs.
729	*
730	* @remark Avoid calling this API from within critical sections (other than
731	* the PGM one) because of the deadlock risk.
732	* @thread Any thread.
733	*/
734	VMMDECL(int) PGMPhysGCPhys2CCPtrReadOnly(PVM pVM, RTGCPHYS GCPhys, void const **ppv, PPGMPAGEMAPLOCK pLock)
735	{
736	/** @todo implement this */
737	return PGMPhysGCPhys2CCPtr(pVM, GCPhys, (void **)ppv, pLock);
738	}
739
740
741	/**
742	* Requests the mapping of a guest page given by virtual address into the current context.
743	*
744	* This API should only be used for very short term, as it will consume
745	* scarse resources (R0 and GC) in the mapping cache. When you're done
746	* with the page, call PGMPhysReleasePageMappingLock() ASAP to release it.
747	*
748	* This API will assume your intention is to write to the page, and will
749	* therefore replace shared and zero pages. If you do not intend to modify
750	* the page, use the PGMPhysGCPtr2CCPtrReadOnly() API.
751	*
752	* @returns VBox status code.
753	* @retval VINF_SUCCESS on success.
754	* @retval VERR_PAGE_TABLE_NOT_PRESENT if the page directory for the virtual address isn't present.
755	* @retval VERR_PAGE_NOT_PRESENT if the page at the virtual address isn't present.
756	* @retval VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical backing.
757	* @retval VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid physical address.
758	*
759	* @param pVM The VM handle.
760	* @param GCPhys The guest physical address of the page that should be mapped.
761	* @param ppv Where to store the address corresponding to GCPhys.
762	* @param pLock Where to store the lock information that PGMPhysReleasePageMappingLock needs.
763	*
764	* @remark Avoid calling this API from within critical sections (other than
765	* the PGM one) because of the deadlock risk.
766	* @thread EMT
767	*/
768	VMMDECL(int) PGMPhysGCPtr2CCPtr(PVM pVM, RTGCPTR GCPtr, void **ppv, PPGMPAGEMAPLOCK pLock)
769	{
770	RTGCPHYS GCPhys;
771	int rc = PGMPhysGCPtr2GCPhys(pVM, GCPtr, &GCPhys);
772	if (RT_SUCCESS(rc))
773	rc = PGMPhysGCPhys2CCPtr(pVM, GCPhys, ppv, pLock);
774	return rc;
775	}
776
777
778	/**
779	* Requests the mapping of a guest page given by virtual address into the current context.
780	*
781	* This API should only be used for very short term, as it will consume
782	* scarse resources (R0 and GC) in the mapping cache. When you're done
783	* with the page, call PGMPhysReleasePageMappingLock() ASAP to release it.
784	*
785	* @returns VBox status code.
786	* @retval VINF_SUCCESS on success.
787	* @retval VERR_PAGE_TABLE_NOT_PRESENT if the page directory for the virtual address isn't present.
788	* @retval VERR_PAGE_NOT_PRESENT if the page at the virtual address isn't present.
789	* @retval VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical backing.
790	* @retval VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid physical address.
791	*
792	* @param pVM The VM handle.
793	* @param GCPhys The guest physical address of the page that should be mapped.
794	* @param ppv Where to store the address corresponding to GCPhys.
795	* @param pLock Where to store the lock information that PGMPhysReleasePageMappingLock needs.
796	*
797	* @remark Avoid calling this API from within critical sections (other than
798	* the PGM one) because of the deadlock risk.
799	* @thread EMT
800	*/
801	VMMDECL(int) PGMPhysGCPtr2CCPtrReadOnly(PVM pVM, RTGCPTR GCPtr, void const **ppv, PPGMPAGEMAPLOCK pLock)
802	{
803	RTGCPHYS GCPhys;
804	int rc = PGMPhysGCPtr2GCPhys(pVM, GCPtr, &GCPhys);
805	if (RT_SUCCESS(rc))
806	rc = PGMPhysGCPhys2CCPtrReadOnly(pVM, GCPhys, ppv, pLock);
807	return rc;
808	}
809
810
811	/**
812	* Release the mapping of a guest page.
813	*
814	* This is the counter part of PGMPhysGCPhys2CCPtr, PGMPhysGCPhys2CCPtrReadOnly
815	* PGMPhysGCPtr2CCPtr and PGMPhysGCPtr2CCPtrReadOnly.
816	*
817	* @param pVM The VM handle.
818	* @param pLock The lock structure initialized by the mapping function.
819	*/
820	VMMDECL(void) PGMPhysReleasePageMappingLock(PVM pVM, PPGMPAGEMAPLOCK pLock)
821	{
822	#ifdef VBOX_WITH_NEW_PHYS_CODE
823	#if defined(IN_RC) \|\| defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
824	/* currently nothing to do here. */
825	/* --- postponed
826	#elif defined(IN_RING0)
827	*/
828
829	#else /* IN_RING3 */
830	pgmLock(pVM);
831
832	PPGMPAGE pPage = (PPGMPAGE)pLock->pvPage;
833	Assert(pPage->cLocks >= 1);
834	if (pPage->cLocks != PGM_PAGE_MAX_LOCKS)
835	pPage->cLocks--;
836
837	PPGMCHUNKR3MAP pChunk = (PPGMCHUNKR3MAP)pLock->pvChunk;
838	Assert(pChunk->cRefs >= 1);
839	pChunk->cRefs--;
840	pChunk->iAge = 0;
841
842	pgmUnlock(pVM);
843	#endif /* IN_RING3 */
844	#else
845	NOREF(pVM);
846	NOREF(pLock);
847	#endif
848	}
849
850
851	/**
852	* Converts a GC physical address to a HC ring-3 pointer.
853	*
854	* @returns VINF_SUCCESS on success.
855	* @returns VERR_PGM_PHYS_PAGE_RESERVED it it's a valid GC physical
856	* page but has no physical backing.
857	* @returns VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid
858	* GC physical address.
859	* @returns VERR_PGM_GCPHYS_RANGE_CROSSES_BOUNDARY if the range crosses
860	* a dynamic ram chunk boundary
861	*
862	* @param pVM The VM handle.
863	* @param GCPhys The GC physical address to convert.
864	* @param cbRange Physical range
865	* @param pR3Ptr Where to store the R3 pointer on success.
866	*/
867	VMMDECL(int) PGMPhysGCPhys2R3Ptr(PVM pVM, RTGCPHYS GCPhys, RTUINT cbRange, PRTR3PTR pR3Ptr)
868	{
869	#ifdef VBOX_WITH_NEW_PHYS_CODE
870	VM_ASSERT_EMT(pVM); /* no longer safe for use outside the EMT thread! */
871	#endif
872
873	if ((GCPhys & PGM_DYNAMIC_CHUNK_BASE_MASK) != ((GCPhys+cbRange-1) & PGM_DYNAMIC_CHUNK_BASE_MASK))
874	{
875	AssertMsgFailed(("%RGp - %RGp crosses a chunk boundary!!\n", GCPhys, GCPhys+cbRange));
876	LogRel(("PGMPhysGCPhys2HCPtr %RGp - %RGp crosses a chunk boundary!!\n", GCPhys, GCPhys+cbRange));
877	return VERR_PGM_GCPHYS_RANGE_CROSSES_BOUNDARY;
878	}
879
880	PPGMRAMRANGE pRam;
881	PPGMPAGE pPage;
882	int rc = pgmPhysGetPageAndRangeEx(&pVM->pgm.s, GCPhys, &pPage, &pRam);
883	if (RT_FAILURE(rc))
884	return rc;
885
886	#ifndef PGM_IGNORE_RAM_FLAGS_RESERVED
887	if (RT_UNLIKELY(PGM_PAGE_IS_RESERVED(pPage)))
888	return VERR_PGM_PHYS_PAGE_RESERVED;
889	#endif
890
891	RTGCPHYS off = GCPhys - pRam->GCPhys;
892	if (RT_UNLIKELY(off + cbRange > pRam->cb))
893	{
894	AssertMsgFailed(("%RGp - %RGp crosses a chunk boundary!!\n", GCPhys, GCPhys + cbRange));
895	return VERR_PGM_GCPHYS_RANGE_CROSSES_BOUNDARY;
896	}
897
898	if (pRam->fFlags & MM_RAM_FLAGS_DYNAMIC_ALLOC)
899	{
900	unsigned iChunk = (off >> PGM_DYNAMIC_CHUNK_SHIFT);
901	#if defined(IN_RC) \|\| defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0) /* ASSUMES this is a rare occurence */
902	PRTR3UINTPTR paChunkR3Ptrs = (PRTR3UINTPTR)MMHyperR3ToCC(pVM, pRam->paChunkR3Ptrs);
903	*pR3Ptr = (RTR3PTR)(paChunkR3Ptrs[iChunk] + (off & PGM_DYNAMIC_CHUNK_OFFSET_MASK));
904	#else
905	*pR3Ptr = (RTR3PTR)(pRam->paChunkR3Ptrs[iChunk] + (off & PGM_DYNAMIC_CHUNK_OFFSET_MASK));
906	#endif
907	}
908	else if (RT_LIKELY(pRam->pvR3))
909	*pR3Ptr = (RTR3PTR)((RTR3UINTPTR)pRam->pvR3 + off);
910	else
911	return VERR_PGM_PHYS_PAGE_RESERVED;
912	return VINF_SUCCESS;
913	}
914
915	/**
916	* Converts a GC physical address to a HC ring-3 pointer, with some
917	* additional checks.
918	*
919	* @returns VINF_SUCCESS on success.
920	* @returns VERR_PGM_PHYS_PAGE_RESERVED it it's a valid GC physical
921	* page but has no physical backing, or if partuclar
922	* memory access must always go via PGM, because of handlers.
923	* @returns VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid
924	* GC physical address.
925	*
926	* @param pVM The VM handle.
927	* @param GCPhys The GC physical address to convert.
928	* @param GCPtr The guest VA, to check virtual handler on.
929	* @param flags Flags controlling additional checks.
930	* @param pR3Ptr Where to store the R3 pointer on success.
931	*/
932	VMMDECL(int) PGMPhysGCPhys2R3PtrEx(PVM pVM, RTGCPHYS GCPhys, RTGCPTR GCPtr, uint32_t flags, PRTR3PTR pR3Ptr)
933	{
934	RTR3PTR va;
935	int rc;
936
937	if (flags & PGMPHYS_TRANSLATION_FLAG_CHECK_PHYS_MONITORED)
938	{
939	/* Check if there's a physical handler for PA */
940	if (PGMHandlerPhysicalIsRegistered(pVM, GCPhys))
941	return VERR_PGM_PHYS_PAGE_RESERVED;
942	}
943
944	if (flags & PGMPHYS_TRANSLATION_FLAG_CHECK_VIRT_MONITORED)
945	{
946	/* Check if there's a virtual handler for VA */
947	if (PGMHandlerVirtualIsRegistered(pVM, GCPtr))
948	return VERR_PGM_PHYS_PAGE_RESERVED;
949	}
950
951	rc = PGMPhysGCPhys2R3Ptr(pVM, GCPhys, 1, &va);
952
953	if (RT_FAILURE(rc))
954	return rc;
955
956	*pR3Ptr = va;
957
958	return rc;
959	}
960	/**
961	* PGMPhysGCPhys2R3Ptr convenience for use with assertions.
962	*
963	* @returns The R3Ptr, NIL_RTR3PTR on failure.
964	* @param pVM The VM handle.
965	* @param GCPhys The GC Physical addresss.
966	* @param cbRange Physical range.
967	*/
968	VMMDECL(RTR3PTR) PGMPhysGCPhys2R3PtrAssert(PVM pVM, RTGCPHYS GCPhys, RTUINT cbRange)
969	{
970	RTR3PTR R3Ptr;
971	int rc = PGMPhysGCPhys2R3Ptr(pVM, GCPhys, cbRange, &R3Ptr);
972	if (RT_SUCCESS(rc))
973	return R3Ptr;
974	return NIL_RTR3PTR;
975	}
976
977
978	/**
979	* Converts a guest pointer to a GC physical address.
980	*
981	* This uses the current CR3/CR0/CR4 of the guest.
982	*
983	* @returns VBox status code.
984	* @param pVM The VM Handle
985	* @param GCPtr The guest pointer to convert.
986	* @param pGCPhys Where to store the GC physical address.
987	*/
988	VMMDECL(int) PGMPhysGCPtr2GCPhys(PVM pVM, RTGCPTR GCPtr, PRTGCPHYS pGCPhys)
989	{
990	int rc = PGM_GST_PFN(GetPage,pVM)(pVM, (RTGCUINTPTR)GCPtr, NULL, pGCPhys);
991	if (pGCPhys && RT_SUCCESS(rc))
992	*pGCPhys \|= (RTGCUINTPTR)GCPtr & PAGE_OFFSET_MASK;
993	return rc;
994	}
995
996
997	/**
998	* Converts a guest pointer to a HC physical address.
999	*
1000	* This uses the current CR3/CR0/CR4 of the guest.
1001	*
1002	* @returns VBox status code.
1003	* @param pVM The VM Handle
1004	* @param GCPtr The guest pointer to convert.
1005	* @param pHCPhys Where to store the HC physical address.
1006	*/
1007	VMMDECL(int) PGMPhysGCPtr2HCPhys(PVM pVM, RTGCPTR GCPtr, PRTHCPHYS pHCPhys)
1008	{
1009	RTGCPHYS GCPhys;
1010	int rc = PGM_GST_PFN(GetPage,pVM)(pVM, (RTGCUINTPTR)GCPtr, NULL, &GCPhys);
1011	if (RT_SUCCESS(rc))
1012	rc = PGMPhysGCPhys2HCPhys(pVM, GCPhys \| ((RTGCUINTPTR)GCPtr & PAGE_OFFSET_MASK), pHCPhys);
1013	return rc;
1014	}
1015
1016
1017	/**
1018	* Converts a guest pointer to a R3 pointer.
1019	*
1020	* This uses the current CR3/CR0/CR4 of the guest.
1021	*
1022	* @returns VBox status code.
1023	* @param pVM The VM Handle
1024	* @param GCPtr The guest pointer to convert.
1025	* @param pR3Ptr Where to store the R3 virtual address.
1026	*/
1027	VMMDECL(int) PGMPhysGCPtr2R3Ptr(PVM pVM, RTGCPTR GCPtr, PRTR3PTR pR3Ptr)
1028	{
1029	#ifdef VBOX_WITH_NEW_PHYS_CODE
1030	VM_ASSERT_EMT(pVM); /* no longer safe for use outside the EMT thread! */
1031	#endif
1032
1033	RTGCPHYS GCPhys;
1034	int rc = PGM_GST_PFN(GetPage,pVM)(pVM, (RTGCUINTPTR)GCPtr, NULL, &GCPhys);
1035	if (RT_SUCCESS(rc))
1036	rc = PGMPhysGCPhys2R3Ptr(pVM, GCPhys \| ((RTGCUINTPTR)GCPtr & PAGE_OFFSET_MASK), 1 /* we always stay within one page */, pR3Ptr);
1037	return rc;
1038	}
1039
1040
1041	/**
1042	* Converts a guest virtual address to a HC ring-3 pointer by specfied CR3 and
1043	* flags.
1044	*
1045	* @returns VBox status code.
1046	* @param pVM The VM Handle
1047	* @param GCPtr The guest pointer to convert.
1048	* @param cr3 The guest CR3.
1049	* @param fFlags Flags used for interpreting the PD correctly: X86_CR4_PSE and X86_CR4_PAE
1050	* @param pR3Ptr Where to store the R3 pointer.
1051	*
1052	* @remark This function is used by the REM at a time where PGM could
1053	* potentially not be in sync. It could also be used by a
1054	* future DBGF API to cpu state independent conversions.
1055	*/
1056	VMMDECL(int) PGMPhysGCPtr2R3PtrByGstCR3(PVM pVM, RTGCPTR GCPtr, uint64_t cr3, unsigned fFlags, PRTR3PTR pR3Ptr)
1057	{
1058	#ifdef VBOX_WITH_NEW_PHYS_CODE
1059	VM_ASSERT_EMT(pVM); /* no longer safe for use outside the EMT thread! */
1060	#endif
1061	/*
1062	* PAE or 32-bit?
1063	*/
1064	Assert(!CPUMIsGuestInLongMode(pVM));
1065
1066	int rc;
1067	if (!(fFlags & X86_CR4_PAE))
1068	{
1069	PX86PD pPD;
1070	rc = PGM_GCPHYS_2_PTR(pVM, cr3 & X86_CR3_PAGE_MASK, &pPD);
1071	if (RT_SUCCESS(rc))
1072	{
1073	X86PDE Pde = pPD->a[(RTGCUINTPTR)GCPtr >> X86_PD_SHIFT];
1074	if (Pde.n.u1Present)
1075	{
1076	if ((fFlags & X86_CR4_PSE) && Pde.b.u1Size)
1077	{ /* (big page) */
1078	rc = PGMPhysGCPhys2R3Ptr(pVM, pgmGstGet4MBPhysPage(&pVM->pgm.s, Pde) \| ((RTGCUINTPTR)GCPtr & X86_PAGE_4M_OFFSET_MASK),
1079	1 /* we always stay within one page */, pR3Ptr);
1080	}
1081	else
1082	{ /* (normal page) */
1083	PX86PT pPT;
1084	rc = PGM_GCPHYS_2_PTR(pVM, Pde.u & X86_PDE_PG_MASK, &pPT);
1085	if (RT_SUCCESS(rc))
1086	{
1087	X86PTE Pte = pPT->a[((RTGCUINTPTR)GCPtr >> X86_PT_SHIFT) & X86_PT_MASK];
1088	if (Pte.n.u1Present)
1089	return PGMPhysGCPhys2R3Ptr(pVM, (Pte.u & X86_PTE_PG_MASK) \| ((RTGCUINTPTR)GCPtr & PAGE_OFFSET_MASK),
1090	1 /* we always stay within one page */, pR3Ptr);
1091	rc = VERR_PAGE_NOT_PRESENT;
1092	}
1093	}
1094	}
1095	else
1096	rc = VERR_PAGE_TABLE_NOT_PRESENT;
1097	}
1098	}
1099	else
1100	{
1101	/** @todo long mode! */
1102	Assert(PGMGetGuestMode(pVM) < PGMMODE_AMD64);
1103
1104	PX86PDPT pPdpt;
1105	rc = PGM_GCPHYS_2_PTR(pVM, cr3 & X86_CR3_PAE_PAGE_MASK, &pPdpt);
1106	if (RT_SUCCESS(rc))
1107	{
1108	X86PDPE Pdpe = pPdpt->a[((RTGCUINTPTR)GCPtr >> X86_PDPT_SHIFT) & X86_PDPT_MASK_PAE];
1109	if (Pdpe.n.u1Present)
1110	{
1111	PX86PDPAE pPD;
1112	rc = PGM_GCPHYS_2_PTR(pVM, Pdpe.u & X86_PDPE_PG_MASK, &pPD);
1113	if (RT_SUCCESS(rc))
1114	{
1115	X86PDEPAE Pde = pPD->a[((RTGCUINTPTR)GCPtr >> X86_PD_PAE_SHIFT) & X86_PD_PAE_MASK];
1116	if (Pde.n.u1Present)
1117	{
1118	if ((fFlags & X86_CR4_PSE) && Pde.b.u1Size)
1119	{ /* (big page) */
1120	rc = PGMPhysGCPhys2R3Ptr(pVM, (Pde.u & X86_PDE2M_PAE_PG_MASK) \| ((RTGCUINTPTR)GCPtr & X86_PAGE_2M_OFFSET_MASK),
1121	1 /* we always stay within one page */, pR3Ptr);
1122	}
1123	else
1124	{ /* (normal page) */
1125	PX86PTPAE pPT;
1126	rc = PGM_GCPHYS_2_PTR(pVM, (Pde.u & X86_PDE_PAE_PG_MASK), &pPT);
1127	if (RT_SUCCESS(rc))
1128	{
1129	X86PTEPAE Pte = pPT->a[((RTGCUINTPTR)GCPtr >> X86_PT_PAE_SHIFT) & X86_PT_PAE_MASK];
1130	if (Pte.n.u1Present)
1131	return PGMPhysGCPhys2R3Ptr(pVM, (Pte.u & X86_PTE_PAE_PG_MASK) \| ((RTGCUINTPTR)GCPtr & PAGE_OFFSET_MASK),
1132	1 /* we always stay within one page */, pR3Ptr);
1133	rc = VERR_PAGE_NOT_PRESENT;
1134	}
1135	}
1136	}
1137	else
1138	rc = VERR_PAGE_TABLE_NOT_PRESENT;
1139	}
1140	}
1141	else
1142	rc = VERR_PAGE_TABLE_NOT_PRESENT;
1143	}
1144	}
1145	return rc;
1146	}
1147
1148
1149	#undef LOG_GROUP
1150	#define LOG_GROUP LOG_GROUP_PGM_PHYS_ACCESS
1151
1152
1153	#ifdef IN_RING3
1154	/**
1155	* Cache PGMPhys memory access
1156	*
1157	* @param pVM VM Handle.
1158	* @param pCache Cache structure pointer
1159	* @param GCPhys GC physical address
1160	* @param pbHC HC pointer corresponding to physical page
1161	*
1162	* @thread EMT.
1163	*/
1164	static void pgmPhysCacheAdd(PVM pVM, PGMPHYSCACHE pCache, RTGCPHYS GCPhys, uint8_t pbR3)
1165	{
1166	uint32_t iCacheIndex;
1167
1168	Assert(VM_IS_EMT(pVM));
1169
1170	GCPhys = PHYS_PAGE_ADDRESS(GCPhys);
1171	pbR3 = (uint8_t *)PAGE_ADDRESS(pbR3);
1172
1173	iCacheIndex = ((GCPhys >> PAGE_SHIFT) & PGM_MAX_PHYSCACHE_ENTRIES_MASK);
1174
1175	ASMBitSet(&pCache->aEntries, iCacheIndex);
1176
1177	pCache->Entry[iCacheIndex].GCPhys = GCPhys;
1178	pCache->Entry[iCacheIndex].pbR3 = pbR3;
1179	}
1180	#endif /* IN_RING3 */
1181
1182	/**
1183	* Read physical memory.
1184	*
1185	* This API respects access handlers and MMIO. Use PGMPhysSimpleReadGCPhys() if you
1186	* want to ignore those.
1187	*
1188	* @param pVM VM Handle.
1189	* @param GCPhys Physical address start reading from.
1190	* @param pvBuf Where to put the read bits.
1191	* @param cbRead How many bytes to read.
1192	*/
1193	VMMDECL(void) PGMPhysRead(PVM pVM, RTGCPHYS GCPhys, void *pvBuf, size_t cbRead)
1194	{
1195	#ifdef IN_RING3
1196	bool fGrabbedLock = false;
1197	#endif
1198
1199	AssertMsg(cbRead > 0, ("don't even think about reading zero bytes!\n"));
1200	if (cbRead == 0)
1201	return;
1202
1203	LogFlow(("PGMPhysRead: %RGp %d\n", GCPhys, cbRead));
1204
1205	#ifdef IN_RING3
1206	if (!VM_IS_EMT(pVM))
1207	{
1208	pgmLock(pVM);
1209	fGrabbedLock = true;
1210	}
1211	#endif
1212
1213	/*
1214	* Copy loop on ram ranges.
1215	*/
1216	PPGMRAMRANGE pRam = pVM->pgm.s.CTX_SUFF(pRamRanges);
1217	for (;;)
1218	{
1219	/* Find range. */
1220	while (pRam && GCPhys > pRam->GCPhysLast)
1221	pRam = pRam->CTX_SUFF(pNext);
1222	/* Inside range or not? */
1223	if (pRam && GCPhys >= pRam->GCPhys)
1224	{
1225	/*
1226	* Must work our way thru this page by page.
1227	*/
1228	RTGCPHYS off = GCPhys - pRam->GCPhys;
1229	while (off < pRam->cb)
1230	{
1231	unsigned iPage = off >> PAGE_SHIFT;
1232	PPGMPAGE pPage = &pRam->aPages[iPage];
1233	size_t cb;
1234
1235	/* Physical chunk in dynamically allocated range not present? */
1236	if (RT_UNLIKELY(!PGM_PAGE_GET_HCPHYS(pPage)))
1237	{
1238	/* Treat it as reserved; return zeros */
1239	cb = PAGE_SIZE - (off & PAGE_OFFSET_MASK);
1240	if (cb >= cbRead)
1241	{
1242	memset(pvBuf, 0, cbRead);
1243	goto end;
1244	}
1245	memset(pvBuf, 0, cb);
1246	}
1247	/* temp hacks, will be reorganized. */
1248	/*
1249	* Physical handler.
1250	*/
1251	else if ( RT_UNLIKELY(PGM_PAGE_GET_HNDL_PHYS_STATE(pPage) >= PGM_PAGE_HNDL_PHYS_STATE_ALL)
1252	&& !(pPage->HCPhys & MM_RAM_FLAGS_MMIO)) /// @todo PAGE FLAGS
1253	{
1254	int rc = VINF_PGM_HANDLER_DO_DEFAULT;
1255	cb = PAGE_SIZE - (off & PAGE_OFFSET_MASK);
1256
1257	#ifdef IN_RING3 /** @todo deal with this in GC and R0! */
1258	/* find and call the handler */
1259	PPGMPHYSHANDLER pNode = (PPGMPHYSHANDLER)RTAvlroGCPhysRangeGet(&pVM->pgm.s.pTreesR3->PhysHandlers, GCPhys);
1260	if (pNode && pNode->pfnHandlerR3)
1261	{
1262	size_t cbRange = pNode->Core.KeyLast - GCPhys + 1;
1263	if (cbRange < cb)
1264	cb = cbRange;
1265	if (cb > cbRead)
1266	cb = cbRead;
1267
1268	void *pvSrc = PGMRAMRANGE_GETHCPTR(pRam, off)
1269
1270	/* Note! Dangerous assumption that HC handlers don't do anything that really requires an EMT lock! */
1271	rc = pNode->pfnHandlerR3(pVM, GCPhys, pvSrc, pvBuf, cb, PGMACCESSTYPE_READ, pNode->pvUserR3);
1272	}
1273	#endif /* IN_RING3 */
1274	if (rc == VINF_PGM_HANDLER_DO_DEFAULT)
1275	{
1276	#if defined(IN_RC) \|\| defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
1277	void *pvSrc = NULL;
1278	PGMDynMapHCPageOff(pVM, PGM_PAGE_GET_HCPHYS(pPage) + (off & PAGE_OFFSET_MASK), &pvSrc);
1279	#else
1280	void *pvSrc = PGMRAMRANGE_GETHCPTR(pRam, off)
1281	#endif
1282
1283	if (cb >= cbRead)
1284	{
1285	memcpy(pvBuf, pvSrc, cbRead);
1286	goto end;
1287	}
1288	memcpy(pvBuf, pvSrc, cb);
1289	}
1290	else if (cb >= cbRead)
1291	goto end;
1292	}
1293	/*
1294	* Virtual handlers.
1295	*/
1296	else if ( RT_UNLIKELY(PGM_PAGE_GET_HNDL_VIRT_STATE(pPage) >= PGM_PAGE_HNDL_VIRT_STATE_ALL)
1297	&& !(pPage->HCPhys & MM_RAM_FLAGS_MMIO)) /// @todo PAGE FLAGS
1298	{
1299	int rc = VINF_PGM_HANDLER_DO_DEFAULT;
1300	cb = PAGE_SIZE - (off & PAGE_OFFSET_MASK);
1301	#ifdef IN_RING3 /** @todo deal with this in GC and R0! */
1302	/* Search the whole tree for matching physical addresses (rather expensive!) */
1303	PPGMVIRTHANDLER pNode;
1304	unsigned iPage;
1305	int rc2 = pgmHandlerVirtualFindByPhysAddr(pVM, GCPhys, &pNode, &iPage);
1306	if (RT_SUCCESS(rc2) && pNode->pfnHandlerR3)
1307	{
1308	size_t cbRange = pNode->Core.KeyLast - GCPhys + 1;
1309	if (cbRange < cb)
1310	cb = cbRange;
1311	if (cb > cbRead)
1312	cb = cbRead;
1313	RTGCUINTPTR GCPtr = ((RTGCUINTPTR)pNode->Core.Key & PAGE_BASE_GC_MASK)
1314	+ (iPage << PAGE_SHIFT) + (off & PAGE_OFFSET_MASK);
1315
1316	void *pvSrc = PGMRAMRANGE_GETHCPTR(pRam, off)
1317
1318	/* Note! Dangerous assumption that HC handlers don't do anything that really requires an EMT lock! */
1319	rc = pNode->pfnHandlerR3(pVM, (RTGCPTR)GCPtr, pvSrc, pvBuf, cb, PGMACCESSTYPE_READ, 0);
1320	}
1321	#endif /* IN_RING3 */
1322	if (rc == VINF_PGM_HANDLER_DO_DEFAULT)
1323	{
1324	#if defined(IN_RC) \|\| defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
1325	void *pvSrc = NULL;
1326	PGMDynMapHCPageOff(pVM, PGM_PAGE_GET_HCPHYS(pPage) + (off & PAGE_OFFSET_MASK), &pvSrc);
1327	#else
1328	void *pvSrc = PGMRAMRANGE_GETHCPTR(pRam, off)
1329	#endif
1330	if (cb >= cbRead)
1331	{
1332	memcpy(pvBuf, pvSrc, cbRead);
1333	goto end;
1334	}
1335	memcpy(pvBuf, pvSrc, cb);
1336	}
1337	else if (cb >= cbRead)
1338	goto end;
1339	}
1340	else
1341	{
1342	switch (pPage->HCPhys & (MM_RAM_FLAGS_RESERVED \| MM_RAM_FLAGS_MMIO \| MM_RAM_FLAGS_ROM)) /** @todo PAGE FLAGS */
1343	{
1344	/*
1345	* Normal memory or ROM.
1346	*/
1347	case 0:
1348	case MM_RAM_FLAGS_ROM:
1349	case MM_RAM_FLAGS_ROM \| MM_RAM_FLAGS_RESERVED:
1350	//case MM_RAM_FLAGS_ROM \| MM_RAM_FLAGS_MMIO2: /* = shadow */ - //MMIO2 isn't in the mask.
1351	case MM_RAM_FLAGS_MMIO2: // MMIO2 isn't in the mask.
1352	{
1353	#if defined(IN_RC) \|\| defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
1354	void *pvSrc = NULL;
1355	PGMDynMapHCPageOff(pVM, PGM_PAGE_GET_HCPHYS(pPage) + (off & PAGE_OFFSET_MASK), &pvSrc);
1356	#else
1357	void *pvSrc = PGMRAMRANGE_GETHCPTR(pRam, off)
1358	#endif
1359	cb = PAGE_SIZE - (off & PAGE_OFFSET_MASK);
1360	if (cb >= cbRead)
1361	{
1362	#if defined(IN_RING3) && defined(PGM_PHYSMEMACCESS_CACHING)
1363	if (cbRead <= 4 && !fGrabbedLock /* i.e. EMT */)
1364	pgmPhysCacheAdd(pVM, &pVM->pgm.s.pgmphysreadcache, GCPhys, (uint8_t*)pvSrc);
1365	#endif /* IN_RING3 && PGM_PHYSMEMACCESS_CACHING */
1366	memcpy(pvBuf, pvSrc, cbRead);
1367	goto end;
1368	}
1369	memcpy(pvBuf, pvSrc, cb);
1370	break;
1371	}
1372
1373	/*
1374	* All reserved, nothing there.
1375	*/
1376	case MM_RAM_FLAGS_RESERVED:
1377	cb = PAGE_SIZE - (off & PAGE_OFFSET_MASK);
1378	if (cb >= cbRead)
1379	{
1380	memset(pvBuf, 0, cbRead);
1381	goto end;
1382	}
1383	memset(pvBuf, 0, cb);
1384	break;
1385
1386	/*
1387	* The rest needs to be taken more carefully.
1388	*/
1389	default:
1390	#if 1 /** @todo r=bird: Can you do this properly please. */
1391	/** @todo Try MMIO; quick hack */
1392	if (cbRead <= 8 && IOMMMIORead(pVM, GCPhys, (uint32_t *)pvBuf, cbRead) == VINF_SUCCESS)
1393	goto end;
1394	#endif
1395
1396	/** @todo fix me later. */
1397	AssertReleaseMsgFailed(("Unknown read at %RGp size %u implement the complex physical reading case %RHp\n",
1398	GCPhys, cbRead,
1399	pPage->HCPhys & (MM_RAM_FLAGS_RESERVED \| MM_RAM_FLAGS_MMIO \| MM_RAM_FLAGS_ROM))); /** @todo PAGE FLAGS */
1400	cb = PAGE_SIZE - (off & PAGE_OFFSET_MASK);
1401	break;
1402	}
1403	}
1404	cbRead -= cb;
1405	off += cb;
1406	pvBuf = (char *)pvBuf + cb;
1407	}
1408
1409	GCPhys = pRam->GCPhysLast + 1;
1410	}
1411	else
1412	{
1413	LogFlow(("PGMPhysRead: Unassigned %RGp size=%u\n", GCPhys, cbRead));
1414
1415	/*
1416	* Unassigned address space.
1417	*/
1418	size_t cb;
1419	if ( !pRam
1420	\|\| (cb = pRam->GCPhys - GCPhys) >= cbRead)
1421	{
1422	memset(pvBuf, 0, cbRead);
1423	goto end;
1424	}
1425
1426	memset(pvBuf, 0, cb);
1427	cbRead -= cb;
1428	pvBuf = (char *)pvBuf + cb;
1429	GCPhys += cb;
1430	}
1431	}
1432	end:
1433	#ifdef IN_RING3
1434	if (fGrabbedLock)
1435	pgmUnlock(pVM);
1436	#endif
1437	return;
1438	}
1439
1440
1441	/**
1442	* Write to physical memory.
1443	*
1444	* This API respects access handlers and MMIO. Use PGMPhysSimpleReadGCPhys() if you
1445	* want to ignore those.
1446	*
1447	* @param pVM VM Handle.
1448	* @param GCPhys Physical address to write to.
1449	* @param pvBuf What to write.
1450	* @param cbWrite How many bytes to write.
1451	*/
1452	VMMDECL(void) PGMPhysWrite(PVM pVM, RTGCPHYS GCPhys, const void *pvBuf, size_t cbWrite)
1453	{
1454	#ifdef IN_RING3
1455	bool fGrabbedLock = false;
1456	#endif
1457
1458	AssertMsg(!pVM->pgm.s.fNoMorePhysWrites, ("Calling PGMPhysWrite after pgmR3Save()!\n"));
1459	AssertMsg(cbWrite > 0, ("don't even think about writing zero bytes!\n"));
1460	if (cbWrite == 0)
1461	return;
1462
1463	LogFlow(("PGMPhysWrite: %RGp %d\n", GCPhys, cbWrite));
1464
1465	#ifdef IN_RING3
1466	if (!VM_IS_EMT(pVM))
1467	{
1468	pgmLock(pVM);
1469	fGrabbedLock = true;
1470	}
1471	#endif
1472	/*
1473	* Copy loop on ram ranges.
1474	*/
1475	PPGMRAMRANGE pRam = pVM->pgm.s.CTX_SUFF(pRamRanges);
1476	for (;;)
1477	{
1478	/* Find range. */
1479	while (pRam && GCPhys > pRam->GCPhysLast)
1480	pRam = pRam->CTX_SUFF(pNext);
1481	/* Inside range or not? */
1482	if (pRam && GCPhys >= pRam->GCPhys)
1483	{
1484	/*
1485	* Must work our way thru this page by page.
1486	*/
1487	RTGCPTR off = GCPhys - pRam->GCPhys;
1488	while (off < pRam->cb)
1489	{
1490	RTGCPTR iPage = off >> PAGE_SHIFT;
1491	PPGMPAGE pPage = &pRam->aPages[iPage];
1492
1493	/* Physical chunk in dynamically allocated range not present? */
1494	if (RT_UNLIKELY(!PGM_PAGE_GET_HCPHYS(pPage)))
1495	{
1496	int rc;
1497	#ifdef IN_RING3
1498	if (fGrabbedLock)
1499	{
1500	pgmUnlock(pVM);
1501	rc = pgmr3PhysGrowRange(pVM, GCPhys);
1502	if (rc == VINF_SUCCESS)
1503	PGMPhysWrite(pVM, GCPhys, pvBuf, cbWrite); /* try again; can't assume pRam is still valid (paranoia) */
1504	return;
1505	}
1506	rc = pgmr3PhysGrowRange(pVM, GCPhys);
1507	#else
1508	rc = CTXALLMID(VMM, CallHost)(pVM, VMMCALLHOST_PGM_RAM_GROW_RANGE, GCPhys);
1509	#endif
1510	if (rc != VINF_SUCCESS)
1511	goto end;
1512	}
1513
1514	size_t cb;
1515	/* temporary hack, will reogranize is later. */
1516	/*
1517	* Virtual handlers
1518	*/
1519	if ( PGM_PAGE_HAS_ACTIVE_VIRTUAL_HANDLERS(pPage)
1520	&& !(pPage->HCPhys & MM_RAM_FLAGS_MMIO)) /// @todo PAGE FLAGS
1521	{
1522	if (PGM_PAGE_HAS_ACTIVE_PHYSICAL_HANDLERS(pPage))
1523	{
1524	/*
1525	* Physical write handler + virtual write handler.
1526	* Consider this a quick workaround for the CSAM + shadow caching problem.
1527	*
1528	* We hand it to the shadow caching first since it requires the unchanged
1529	* data. CSAM will have to put up with it already being changed.
1530	*/
1531	int rc = VINF_PGM_HANDLER_DO_DEFAULT;
1532	cb = PAGE_SIZE - (off & PAGE_OFFSET_MASK);
1533	#ifdef IN_RING3 /** @todo deal with this in GC and R0! */
1534	/* 1. The physical handler */
1535	PPGMPHYSHANDLER pPhysNode = (PPGMPHYSHANDLER)RTAvlroGCPhysRangeGet(&pVM->pgm.s.pTreesR3->PhysHandlers, GCPhys);
1536	if (pPhysNode && pPhysNode->pfnHandlerR3)
1537	{
1538	size_t cbRange = pPhysNode->Core.KeyLast - GCPhys + 1;
1539	if (cbRange < cb)
1540	cb = cbRange;
1541	if (cb > cbWrite)
1542	cb = cbWrite;
1543
1544	void *pvDst = PGMRAMRANGE_GETHCPTR(pRam, off)
1545
1546	/* Note! Dangerous assumption that R3 handlers don't do anything that really requires an EMT lock! */
1547	rc = pPhysNode->pfnHandlerR3(pVM, GCPhys, pvDst, (void *)pvBuf, cb, PGMACCESSTYPE_WRITE, pPhysNode->pvUserR3);
1548	}
1549
1550	/* 2. The virtual handler (will see incorrect data) */
1551	PPGMVIRTHANDLER pVirtNode;
1552	unsigned iPage;
1553	int rc2 = pgmHandlerVirtualFindByPhysAddr(pVM, GCPhys, &pVirtNode, &iPage);
1554	if (RT_SUCCESS(rc2) && pVirtNode->pfnHandlerR3)
1555	{
1556	size_t cbRange = pVirtNode->Core.KeyLast - GCPhys + 1;
1557	if (cbRange < cb)
1558	cb = cbRange;
1559	if (cb > cbWrite)
1560	cb = cbWrite;
1561	RTGCUINTPTR GCPtr = ((RTGCUINTPTR)pVirtNode->Core.Key & PAGE_BASE_GC_MASK)
1562	+ (iPage << PAGE_SHIFT) + (off & PAGE_OFFSET_MASK);
1563
1564	void *pvDst = PGMRAMRANGE_GETHCPTR(pRam, off)
1565
1566	/* Note! Dangerous assumption that R3 handlers don't do anything that really requires an EMT lock! */
1567	rc2 = pVirtNode->pfnHandlerR3(pVM, (RTGCPTR)GCPtr, pvDst, (void *)pvBuf, cb, PGMACCESSTYPE_WRITE, 0);
1568	if ( ( rc2 != VINF_PGM_HANDLER_DO_DEFAULT
1569	&& rc == VINF_PGM_HANDLER_DO_DEFAULT)
1570	\|\| ( RT_FAILURE(rc2)
1571	&& RT_SUCCESS(rc)))
1572	rc = rc2;
1573	}
1574	#endif /* IN_RING3 */
1575	if (rc == VINF_PGM_HANDLER_DO_DEFAULT)
1576	{
1577	#if defined(IN_RC) \|\| defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
1578	void *pvDst = NULL;
1579	PGMDynMapHCPageOff(pVM, PGM_PAGE_GET_HCPHYS(pPage) + (off & PAGE_OFFSET_MASK), &pvDst);
1580	#else
1581	void *pvDst = PGMRAMRANGE_GETHCPTR(pRam, off)
1582	#endif
1583	if (cb >= cbWrite)
1584	{
1585	memcpy(pvDst, pvBuf, cbWrite);
1586	goto end;
1587	}
1588	memcpy(pvDst, pvBuf, cb);
1589	}
1590	else if (cb >= cbWrite)
1591	goto end;
1592	}
1593	else
1594	{
1595	int rc = VINF_PGM_HANDLER_DO_DEFAULT;
1596	cb = PAGE_SIZE - (off & PAGE_OFFSET_MASK);
1597	#ifdef IN_RING3
1598	/** @todo deal with this in GC and R0! */
1599	/* Search the whole tree for matching physical addresses (rather expensive!) */
1600	PPGMVIRTHANDLER pNode;
1601	unsigned iPage;
1602	int rc2 = pgmHandlerVirtualFindByPhysAddr(pVM, GCPhys, &pNode, &iPage);
1603	if (RT_SUCCESS(rc2) && pNode->pfnHandlerR3)
1604	{
1605	size_t cbRange = pNode->Core.KeyLast - GCPhys + 1;
1606	if (cbRange < cb)
1607	cb = cbRange;
1608	if (cb > cbWrite)
1609	cb = cbWrite;
1610	RTGCUINTPTR GCPtr = ((RTGCUINTPTR)pNode->Core.Key & PAGE_BASE_GC_MASK)
1611	+ (iPage << PAGE_SHIFT) + (off & PAGE_OFFSET_MASK);
1612
1613	void *pvDst = PGMRAMRANGE_GETHCPTR(pRam, off)
1614
1615	/* Note! Dangerous assumption that R3 handlers don't do anything that really requires an EMT lock! */
1616	rc = pNode->pfnHandlerR3(pVM, (RTGCPTR)GCPtr, pvDst, (void *)pvBuf, cb, PGMACCESSTYPE_WRITE, 0);
1617	}
1618	#endif /* IN_RING3 */
1619	if (rc == VINF_PGM_HANDLER_DO_DEFAULT)
1620	{
1621	#if defined(IN_RC) \|\| defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
1622	void *pvDst = NULL;
1623	PGMDynMapHCPageOff(pVM, PGM_PAGE_GET_HCPHYS(pPage) + (off & PAGE_OFFSET_MASK), &pvDst);
1624	#else
1625	void *pvDst = PGMRAMRANGE_GETHCPTR(pRam, off)
1626	#endif
1627	if (cb >= cbWrite)
1628	{
1629	memcpy(pvDst, pvBuf, cbWrite);
1630	goto end;
1631	}
1632	memcpy(pvDst, pvBuf, cb);
1633	}
1634	else if (cb >= cbWrite)
1635	goto end;
1636	}
1637	}
1638	/*
1639	* Physical handler.
1640	*/
1641	else if ( RT_UNLIKELY(PGM_PAGE_GET_HNDL_PHYS_STATE(pPage) >= PGM_PAGE_HNDL_PHYS_STATE_WRITE)
1642	&& !(pPage->HCPhys & MM_RAM_FLAGS_MMIO)) /// @todo PAGE FLAGS
1643	{
1644	int rc = VINF_PGM_HANDLER_DO_DEFAULT;
1645	cb = PAGE_SIZE - (off & PAGE_OFFSET_MASK);
1646	#ifdef IN_RING3 /** @todo deal with this in GC and R0! */
1647	/* find and call the handler */
1648	PPGMPHYSHANDLER pNode = (PPGMPHYSHANDLER)RTAvlroGCPhysRangeGet(&pVM->pgm.s.pTreesR3->PhysHandlers, GCPhys);
1649	if (pNode && pNode->pfnHandlerR3)
1650	{
1651	size_t cbRange = pNode->Core.KeyLast - GCPhys + 1;
1652	if (cbRange < cb)
1653	cb = cbRange;
1654	if (cb > cbWrite)
1655	cb = cbWrite;
1656
1657	void *pvDst = PGMRAMRANGE_GETHCPTR(pRam, off)
1658
1659	/** @todo Dangerous assumption that HC handlers don't do anything that really requires an EMT lock! */
1660	rc = pNode->pfnHandlerR3(pVM, GCPhys, pvDst, (void *)pvBuf, cb, PGMACCESSTYPE_WRITE, pNode->pvUserR3);
1661	}
1662	#endif /* IN_RING3 */
1663	if (rc == VINF_PGM_HANDLER_DO_DEFAULT)
1664	{
1665	#if defined(IN_RC) \|\| defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
1666	void *pvDst = NULL;
1667	PGMDynMapHCPageOff(pVM, PGM_PAGE_GET_HCPHYS(pPage) + (off & PAGE_OFFSET_MASK), &pvDst);
1668	#else
1669	void *pvDst = PGMRAMRANGE_GETHCPTR(pRam, off)
1670	#endif
1671	if (cb >= cbWrite)
1672	{
1673	memcpy(pvDst, pvBuf, cbWrite);
1674	goto end;
1675	}
1676	memcpy(pvDst, pvBuf, cb);
1677	}
1678	else if (cb >= cbWrite)
1679	goto end;
1680	}
1681	else
1682	{
1683	/** @todo r=bird: missing MM_RAM_FLAGS_ROM here, we shall not allow anyone to overwrite the ROM! */
1684	switch (pPage->HCPhys & (MM_RAM_FLAGS_RESERVED \| MM_RAM_FLAGS_MMIO \| MM_RAM_FLAGS_MMIO2)) /** @todo PAGE FLAGS */
1685	{
1686	/*
1687	* Normal memory, MMIO2 or writable shadow ROM.
1688	*/
1689	case 0:
1690	case MM_RAM_FLAGS_MMIO2:
1691	case MM_RAM_FLAGS_ROM \| MM_RAM_FLAGS_MMIO2: /* shadow rom */
1692	{
1693	#if defined(IN_RC) \|\| defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
1694	void *pvDst = NULL;
1695	PGMDynMapHCPageOff(pVM, PGM_PAGE_GET_HCPHYS(pPage) + (off & PAGE_OFFSET_MASK), &pvDst);
1696	#else
1697	void *pvDst = PGMRAMRANGE_GETHCPTR(pRam, off)
1698	#endif
1699	cb = PAGE_SIZE - (off & PAGE_OFFSET_MASK);
1700	if (cb >= cbWrite)
1701	{
1702	#if defined(IN_RING3) && defined(PGM_PHYSMEMACCESS_CACHING)
1703	if (cbWrite <= 4 && !fGrabbedLock /* i.e. EMT */)
1704	pgmPhysCacheAdd(pVM, &pVM->pgm.s.pgmphyswritecache, GCPhys, (uint8_t*)pvDst);
1705	#endif /* IN_RING3 && PGM_PHYSMEMACCESS_CACHING */
1706	memcpy(pvDst, pvBuf, cbWrite);
1707	goto end;
1708	}
1709	memcpy(pvDst, pvBuf, cb);
1710	break;
1711	}
1712
1713	/*
1714	* All reserved, nothing there.
1715	*/
1716	case MM_RAM_FLAGS_RESERVED:
1717	case MM_RAM_FLAGS_RESERVED \| MM_RAM_FLAGS_MMIO2:
1718	cb = PAGE_SIZE - (off & PAGE_OFFSET_MASK);
1719	if (cb >= cbWrite)
1720	goto end;
1721	break;
1722
1723
1724	/*
1725	* The rest needs to be taken more carefully.
1726	*/
1727	default:
1728	#if 1 /** @todo r=bird: Can you do this properly please. */
1729	/** @todo Try MMIO; quick hack */
1730	if (cbWrite <= 8 && IOMMMIOWrite(pVM, GCPhys, (uint32_t )pvBuf, cbWrite) == VINF_SUCCESS)
1731	goto end;
1732	#endif
1733
1734	/** @todo fix me later. */
1735	AssertReleaseMsgFailed(("Unknown write at %RGp size %u implement the complex physical writing case %RHp\n",
1736	GCPhys, cbWrite,
1737	(pPage->HCPhys & (MM_RAM_FLAGS_RESERVED \| MM_RAM_FLAGS_MMIO \| MM_RAM_FLAGS_MMIO2)))); /** @todo PAGE FLAGS */
1738	/* skip the write */
1739	cb = cbWrite;
1740	break;
1741	}
1742	}
1743
1744	cbWrite -= cb;
1745	off += cb;
1746	pvBuf = (const char *)pvBuf + cb;
1747	}
1748
1749	GCPhys = pRam->GCPhysLast + 1;
1750	}
1751	else
1752	{
1753	/*
1754	* Unassigned address space.
1755	*/
1756	size_t cb;
1757	if ( !pRam
1758	\|\| (cb = pRam->GCPhys - GCPhys) >= cbWrite)
1759	goto end;
1760
1761	cbWrite -= cb;
1762	pvBuf = (const char *)pvBuf + cb;
1763	GCPhys += cb;
1764	}
1765	}
1766	end:
1767	#ifdef IN_RING3
1768	if (fGrabbedLock)
1769	pgmUnlock(pVM);
1770	#endif
1771	return;
1772	}
1773
1774	#ifndef IN_RC /* Ring 0 & 3 only. (Just not needed in GC.) */
1775
1776	/**
1777	* Read from guest physical memory by GC physical address, bypassing
1778	* MMIO and access handlers.
1779	*
1780	* @returns VBox status.
1781	* @param pVM VM handle.
1782	* @param pvDst The destination address.
1783	* @param GCPhysSrc The source address (GC physical address).
1784	* @param cb The number of bytes to read.
1785	*/
1786	VMMDECL(int) PGMPhysSimpleReadGCPhys(PVM pVM, void *pvDst, RTGCPHYS GCPhysSrc, size_t cb)
1787	{
1788	/*
1789	* Treat the first page as a special case.
1790	*/
1791	if (!cb)
1792	return VINF_SUCCESS;
1793
1794	/* map the 1st page */
1795	void const *pvSrc;
1796	PGMPAGEMAPLOCK Lock;
1797	int rc = PGMPhysGCPhys2CCPtrReadOnly(pVM, GCPhysSrc, &pvSrc, &Lock);
1798	if (RT_FAILURE(rc))
1799	return rc;
1800
1801	/* optimize for the case where access is completely within the first page. */
1802	size_t cbPage = PAGE_SIZE - (GCPhysSrc & PAGE_OFFSET_MASK);
1803	if (RT_LIKELY(cb <= cbPage))
1804	{
1805	memcpy(pvDst, pvSrc, cb);
1806	PGMPhysReleasePageMappingLock(pVM, &Lock);
1807	return VINF_SUCCESS;
1808	}
1809
1810	/* copy to the end of the page. */
1811	memcpy(pvDst, pvSrc, cbPage);
1812	PGMPhysReleasePageMappingLock(pVM, &Lock);
1813	GCPhysSrc += cbPage;
1814	pvDst = (uint8_t *)pvDst + cbPage;
1815	cb -= cbPage;
1816
1817	/*
1818	* Page by page.
1819	*/
1820	for (;;)
1821	{
1822	/* map the page */
1823	rc = PGMPhysGCPhys2CCPtrReadOnly(pVM, GCPhysSrc, &pvSrc, &Lock);
1824	if (RT_FAILURE(rc))
1825	return rc;
1826
1827	/* last page? */
1828	if (cb <= PAGE_SIZE)
1829	{
1830	memcpy(pvDst, pvSrc, cb);
1831	PGMPhysReleasePageMappingLock(pVM, &Lock);
1832	return VINF_SUCCESS;
1833	}
1834
1835	/* copy the entire page and advance */
1836	memcpy(pvDst, pvSrc, PAGE_SIZE);
1837	PGMPhysReleasePageMappingLock(pVM, &Lock);
1838	GCPhysSrc += PAGE_SIZE;
1839	pvDst = (uint8_t *)pvDst + PAGE_SIZE;
1840	cb -= PAGE_SIZE;
1841	}
1842	/* won't ever get here. */
1843	}
1844
1845
1846	/**
1847	* Write to guest physical memory referenced by GC pointer.
1848	* Write memory to GC physical address in guest physical memory.
1849	*
1850	* This will bypass MMIO and access handlers.
1851	*
1852	* @returns VBox status.
1853	* @param pVM VM handle.
1854	* @param GCPhysDst The GC physical address of the destination.
1855	* @param pvSrc The source buffer.
1856	* @param cb The number of bytes to write.
1857	*/
1858	VMMDECL(int) PGMPhysSimpleWriteGCPhys(PVM pVM, RTGCPHYS GCPhysDst, const void *pvSrc, size_t cb)
1859	{
1860	LogFlow(("PGMPhysSimpleWriteGCPhys: %RGp %zu\n", GCPhysDst, cb));
1861
1862	/*
1863	* Treat the first page as a special case.
1864	*/
1865	if (!cb)
1866	return VINF_SUCCESS;
1867
1868	/* map the 1st page */
1869	void *pvDst;
1870	PGMPAGEMAPLOCK Lock;
1871	int rc = PGMPhysGCPhys2CCPtr(pVM, GCPhysDst, &pvDst, &Lock);
1872	if (RT_FAILURE(rc))
1873	return rc;
1874
1875	/* optimize for the case where access is completely within the first page. */
1876	size_t cbPage = PAGE_SIZE - (GCPhysDst & PAGE_OFFSET_MASK);
1877	if (RT_LIKELY(cb <= cbPage))
1878	{
1879	memcpy(pvDst, pvSrc, cb);
1880	PGMPhysReleasePageMappingLock(pVM, &Lock);
1881	return VINF_SUCCESS;
1882	}
1883
1884	/* copy to the end of the page. */
1885	memcpy(pvDst, pvSrc, cbPage);
1886	PGMPhysReleasePageMappingLock(pVM, &Lock);
1887	GCPhysDst += cbPage;
1888	pvSrc = (const uint8_t *)pvSrc + cbPage;
1889	cb -= cbPage;
1890
1891	/*
1892	* Page by page.
1893	*/
1894	for (;;)
1895	{
1896	/* map the page */
1897	rc = PGMPhysGCPhys2CCPtr(pVM, GCPhysDst, &pvDst, &Lock);
1898	if (RT_FAILURE(rc))
1899	return rc;
1900
1901	/* last page? */
1902	if (cb <= PAGE_SIZE)
1903	{
1904	memcpy(pvDst, pvSrc, cb);
1905	PGMPhysReleasePageMappingLock(pVM, &Lock);
1906	return VINF_SUCCESS;
1907	}
1908
1909	/* copy the entire page and advance */
1910	memcpy(pvDst, pvSrc, PAGE_SIZE);
1911	PGMPhysReleasePageMappingLock(pVM, &Lock);
1912	GCPhysDst += PAGE_SIZE;
1913	pvSrc = (const uint8_t *)pvSrc + PAGE_SIZE;
1914	cb -= PAGE_SIZE;
1915	}
1916	/* won't ever get here. */
1917	}
1918
1919
1920	/**
1921	* Read from guest physical memory referenced by GC pointer.
1922	*
1923	* This function uses the current CR3/CR0/CR4 of the guest and will
1924	* bypass access handlers and not set any accessed bits.
1925	*
1926	* @returns VBox status.
1927	* @param pVM VM handle.
1928	* @param pvDst The destination address.
1929	* @param GCPtrSrc The source address (GC pointer).
1930	* @param cb The number of bytes to read.
1931	*/
1932	VMMDECL(int) PGMPhysSimpleReadGCPtr(PVM pVM, void *pvDst, RTGCPTR GCPtrSrc, size_t cb)
1933	{
1934	/*
1935	* Treat the first page as a special case.
1936	*/
1937	if (!cb)
1938	return VINF_SUCCESS;
1939
1940	/* map the 1st page */
1941	void const *pvSrc;
1942	PGMPAGEMAPLOCK Lock;
1943	int rc = PGMPhysGCPtr2CCPtrReadOnly(pVM, GCPtrSrc, &pvSrc, &Lock);
1944	if (RT_FAILURE(rc))
1945	return rc;
1946
1947	/* optimize for the case where access is completely within the first page. */
1948	size_t cbPage = PAGE_SIZE - ((RTGCUINTPTR)GCPtrSrc & PAGE_OFFSET_MASK);
1949	if (RT_LIKELY(cb <= cbPage))
1950	{
1951	memcpy(pvDst, pvSrc, cb);
1952	PGMPhysReleasePageMappingLock(pVM, &Lock);
1953	return VINF_SUCCESS;
1954	}
1955
1956	/* copy to the end of the page. */
1957	memcpy(pvDst, pvSrc, cbPage);
1958	PGMPhysReleasePageMappingLock(pVM, &Lock);
1959	GCPtrSrc = (RTGCPTR)((RTGCUINTPTR)GCPtrSrc + cbPage);
1960	pvDst = (uint8_t *)pvDst + cbPage;
1961	cb -= cbPage;
1962
1963	/*
1964	* Page by page.
1965	*/
1966	for (;;)
1967	{
1968	/* map the page */
1969	rc = PGMPhysGCPtr2CCPtrReadOnly(pVM, GCPtrSrc, &pvSrc, &Lock);
1970	if (RT_FAILURE(rc))
1971	return rc;
1972
1973	/* last page? */
1974	if (cb <= PAGE_SIZE)
1975	{
1976	memcpy(pvDst, pvSrc, cb);
1977	PGMPhysReleasePageMappingLock(pVM, &Lock);
1978	return VINF_SUCCESS;
1979	}
1980
1981	/* copy the entire page and advance */
1982	memcpy(pvDst, pvSrc, PAGE_SIZE);
1983	PGMPhysReleasePageMappingLock(pVM, &Lock);
1984	GCPtrSrc = (RTGCPTR)((RTGCUINTPTR)GCPtrSrc + PAGE_SIZE);
1985	pvDst = (uint8_t *)pvDst + PAGE_SIZE;
1986	cb -= PAGE_SIZE;
1987	}
1988	/* won't ever get here. */
1989	}
1990
1991
1992	/**
1993	* Write to guest physical memory referenced by GC pointer.
1994	*
1995	* This function uses the current CR3/CR0/CR4 of the guest and will
1996	* bypass access handlers and not set dirty or accessed bits.
1997	*
1998	* @returns VBox status.
1999	* @param pVM VM handle.
2000	* @param GCPtrDst The destination address (GC pointer).
2001	* @param pvSrc The source address.
2002	* @param cb The number of bytes to write.
2003	*/
2004	VMMDECL(int) PGMPhysSimpleWriteGCPtr(PVM pVM, RTGCPTR GCPtrDst, const void *pvSrc, size_t cb)
2005	{
2006	/*
2007	* Treat the first page as a special case.
2008	*/
2009	if (!cb)
2010	return VINF_SUCCESS;
2011
2012	/* map the 1st page */
2013	void *pvDst;
2014	PGMPAGEMAPLOCK Lock;
2015	int rc = PGMPhysGCPtr2CCPtr(pVM, GCPtrDst, &pvDst, &Lock);
2016	if (RT_FAILURE(rc))
2017	return rc;
2018
2019	/* optimize for the case where access is completely within the first page. */
2020	size_t cbPage = PAGE_SIZE - ((RTGCUINTPTR)GCPtrDst & PAGE_OFFSET_MASK);
2021	if (RT_LIKELY(cb <= cbPage))
2022	{
2023	memcpy(pvDst, pvSrc, cb);
2024	PGMPhysReleasePageMappingLock(pVM, &Lock);
2025	return VINF_SUCCESS;
2026	}
2027
2028	/* copy to the end of the page. */
2029	memcpy(pvDst, pvSrc, cbPage);
2030	PGMPhysReleasePageMappingLock(pVM, &Lock);
2031	GCPtrDst = (RTGCPTR)((RTGCUINTPTR)GCPtrDst + cbPage);
2032	pvSrc = (const uint8_t *)pvSrc + cbPage;
2033	cb -= cbPage;
2034
2035	/*
2036	* Page by page.
2037	*/
2038	for (;;)
2039	{
2040	/* map the page */
2041	rc = PGMPhysGCPtr2CCPtr(pVM, GCPtrDst, &pvDst, &Lock);
2042	if (RT_FAILURE(rc))
2043	return rc;
2044
2045	/* last page? */
2046	if (cb <= PAGE_SIZE)
2047	{
2048	memcpy(pvDst, pvSrc, cb);
2049	PGMPhysReleasePageMappingLock(pVM, &Lock);
2050	return VINF_SUCCESS;
2051	}
2052
2053	/* copy the entire page and advance */
2054	memcpy(pvDst, pvSrc, PAGE_SIZE);
2055	PGMPhysReleasePageMappingLock(pVM, &Lock);
2056	GCPtrDst = (RTGCPTR)((RTGCUINTPTR)GCPtrDst + PAGE_SIZE);
2057	pvSrc = (const uint8_t *)pvSrc + PAGE_SIZE;
2058	cb -= PAGE_SIZE;
2059	}
2060	/* won't ever get here. */
2061	}
2062
2063
2064	/**
2065	* Write to guest physical memory referenced by GC pointer and update the PTE.
2066	*
2067	* This function uses the current CR3/CR0/CR4 of the guest and will
2068	* bypass access handlers but will set any dirty and accessed bits in the PTE.
2069	*
2070	* If you don't want to set the dirty bit, use PGMPhysSimpleWriteGCPtr().
2071	*
2072	* @returns VBox status.
2073	* @param pVM VM handle.
2074	* @param GCPtrDst The destination address (GC pointer).
2075	* @param pvSrc The source address.
2076	* @param cb The number of bytes to write.
2077	*/
2078	VMMDECL(int) PGMPhysSimpleDirtyWriteGCPtr(PVM pVM, RTGCPTR GCPtrDst, const void *pvSrc, size_t cb)
2079	{
2080	/*
2081	* Treat the first page as a special case.
2082	* Btw. this is the same code as in PGMPhyssimpleWriteGCPtr excep for the PGMGstModifyPage.
2083	*/
2084	if (!cb)
2085	return VINF_SUCCESS;
2086
2087	/* map the 1st page */
2088	void *pvDst;
2089	PGMPAGEMAPLOCK Lock;
2090	int rc = PGMPhysGCPtr2CCPtr(pVM, GCPtrDst, &pvDst, &Lock);
2091	if (RT_FAILURE(rc))
2092	return rc;
2093
2094	/* optimize for the case where access is completely within the first page. */
2095	size_t cbPage = PAGE_SIZE - ((RTGCUINTPTR)GCPtrDst & PAGE_OFFSET_MASK);
2096	if (RT_LIKELY(cb <= cbPage))
2097	{
2098	memcpy(pvDst, pvSrc, cb);
2099	PGMPhysReleasePageMappingLock(pVM, &Lock);
2100	rc = PGMGstModifyPage(pVM, GCPtrDst, 1, X86_PTE_A \| X86_PTE_D, ~(uint64_t)(X86_PTE_A \| X86_PTE_D)); AssertRC(rc);
2101	return VINF_SUCCESS;
2102	}
2103
2104	/* copy to the end of the page. */
2105	memcpy(pvDst, pvSrc, cbPage);
2106	PGMPhysReleasePageMappingLock(pVM, &Lock);
2107	rc = PGMGstModifyPage(pVM, GCPtrDst, 1, X86_PTE_A \| X86_PTE_D, ~(uint64_t)(X86_PTE_A \| X86_PTE_D)); AssertRC(rc);
2108	GCPtrDst = (RTGCPTR)((RTGCUINTPTR)GCPtrDst + cbPage);
2109	pvSrc = (const uint8_t *)pvSrc + cbPage;
2110	cb -= cbPage;
2111
2112	/*
2113	* Page by page.
2114	*/
2115	for (;;)
2116	{
2117	/* map the page */
2118	rc = PGMPhysGCPtr2CCPtr(pVM, GCPtrDst, &pvDst, &Lock);
2119	if (RT_FAILURE(rc))
2120	return rc;
2121
2122	/* last page? */
2123	if (cb <= PAGE_SIZE)
2124	{
2125	memcpy(pvDst, pvSrc, cb);
2126	PGMPhysReleasePageMappingLock(pVM, &Lock);
2127	rc = PGMGstModifyPage(pVM, GCPtrDst, 1, X86_PTE_A \| X86_PTE_D, ~(uint64_t)(X86_PTE_A \| X86_PTE_D)); AssertRC(rc);
2128	return VINF_SUCCESS;
2129	}
2130
2131	/* copy the entire page and advance */
2132	memcpy(pvDst, pvSrc, PAGE_SIZE);
2133	PGMPhysReleasePageMappingLock(pVM, &Lock);
2134	rc = PGMGstModifyPage(pVM, GCPtrDst, 1, X86_PTE_A \| X86_PTE_D, ~(uint64_t)(X86_PTE_A \| X86_PTE_D)); AssertRC(rc);
2135	GCPtrDst = (RTGCPTR)((RTGCUINTPTR)GCPtrDst + PAGE_SIZE);
2136	pvSrc = (const uint8_t *)pvSrc + PAGE_SIZE;
2137	cb -= PAGE_SIZE;
2138	}
2139	/* won't ever get here. */
2140	}
2141
2142
2143	/**
2144	* Read from guest physical memory referenced by GC pointer.
2145	*
2146	* This function uses the current CR3/CR0/CR4 of the guest and will
2147	* respect access handlers and set accessed bits.
2148	*
2149	* @returns VBox status.
2150	* @param pVM VM handle.
2151	* @param pvDst The destination address.
2152	* @param GCPtrSrc The source address (GC pointer).
2153	* @param cb The number of bytes to read.
2154	*/
2155	VMMDECL(int) PGMPhysReadGCPtr(PVM pVM, void *pvDst, RTGCPTR GCPtrSrc, size_t cb)
2156	{
2157	RTGCPHYS GCPhys;
2158	int rc;
2159
2160	/*
2161	* Anything to do?
2162	*/
2163	if (!cb)
2164	return VINF_SUCCESS;
2165
2166	LogFlow(("PGMPhysReadGCPtr: %RGv %zu\n", GCPtrSrc, cb));
2167
2168	/*
2169	* Optimize reads within a single page.
2170	*/
2171	if (((RTGCUINTPTR)GCPtrSrc & PAGE_OFFSET_MASK) + cb <= PAGE_SIZE)
2172	{
2173	/* Convert virtual to physical address */
2174	rc = PGMPhysGCPtr2GCPhys(pVM, GCPtrSrc, &GCPhys);
2175	AssertRCReturn(rc, rc);
2176
2177	/* mark the guest page as accessed. */
2178	rc = PGMGstModifyPage(pVM, GCPtrSrc, 1, X86_PTE_A, ~(uint64_t)(X86_PTE_A));
2179	AssertRC(rc);
2180
2181	PGMPhysRead(pVM, GCPhys, pvDst, cb);
2182	return VINF_SUCCESS;
2183	}
2184
2185	/*
2186	* Page by page.
2187	*/
2188	for (;;)
2189	{
2190	/* Convert virtual to physical address */
2191	rc = PGMPhysGCPtr2GCPhys(pVM, GCPtrSrc, &GCPhys);
2192	AssertRCReturn(rc, rc);
2193
2194	/* mark the guest page as accessed. */
2195	int rc = PGMGstModifyPage(pVM, GCPtrSrc, 1, X86_PTE_A, ~(uint64_t)(X86_PTE_A));
2196	AssertRC(rc);
2197
2198	/* copy */
2199	size_t cbRead = PAGE_SIZE - ((RTGCUINTPTR)GCPtrSrc & PAGE_OFFSET_MASK);
2200	if (cbRead >= cb)
2201	{
2202	PGMPhysRead(pVM, GCPhys, pvDst, cb);
2203	return VINF_SUCCESS;
2204	}
2205	PGMPhysRead(pVM, GCPhys, pvDst, cbRead);
2206
2207	/* next */
2208	cb -= cbRead;
2209	pvDst = (uint8_t *)pvDst + cbRead;
2210	GCPtrSrc += cbRead;
2211	}
2212	}
2213
2214
2215	/**
2216	* Write to guest physical memory referenced by GC pointer.
2217	*
2218	* This function uses the current CR3/CR0/CR4 of the guest and will
2219	* respect access handlers and set dirty and accessed bits.
2220	*
2221	* @returns VBox status.
2222	* @param pVM VM handle.
2223	* @param GCPtrDst The destination address (GC pointer).
2224	* @param pvSrc The source address.
2225	* @param cb The number of bytes to write.
2226	*/
2227	VMMDECL(int) PGMPhysWriteGCPtr(PVM pVM, RTGCPTR GCPtrDst, const void *pvSrc, size_t cb)
2228	{
2229	RTGCPHYS GCPhys;
2230	int rc;
2231
2232	/*
2233	* Anything to do?
2234	*/
2235	if (!cb)
2236	return VINF_SUCCESS;
2237
2238	LogFlow(("PGMPhysWriteGCPtr: %RGv %zu\n", GCPtrDst, cb));
2239
2240	/*
2241	* Optimize writes within a single page.
2242	*/
2243	if (((RTGCUINTPTR)GCPtrDst & PAGE_OFFSET_MASK) + cb <= PAGE_SIZE)
2244	{
2245	/* Convert virtual to physical address */
2246	rc = PGMPhysGCPtr2GCPhys(pVM, GCPtrDst, &GCPhys);
2247	AssertMsgRCReturn(rc, ("PGMPhysGCPtr2GCPhys failed with %Rrc for %RGv\n", rc, GCPtrDst), rc);
2248
2249	/* mark the guest page as accessed and dirty. */
2250	rc = PGMGstModifyPage(pVM, GCPtrDst, 1, X86_PTE_A \| X86_PTE_D, ~(uint64_t)(X86_PTE_A \| X86_PTE_D));
2251	AssertRC(rc);
2252
2253	PGMPhysWrite(pVM, GCPhys, pvSrc, cb);
2254	return VINF_SUCCESS;
2255	}
2256
2257	/*
2258	* Page by page.
2259	*/
2260	for (;;)
2261	{
2262	/* Convert virtual to physical address */
2263	rc = PGMPhysGCPtr2GCPhys(pVM, GCPtrDst, &GCPhys);
2264	AssertRCReturn(rc, rc);
2265
2266	/* mark the guest page as accessed and dirty. */
2267	rc = PGMGstModifyPage(pVM, GCPtrDst, 1, X86_PTE_A \| X86_PTE_D, ~(uint64_t)(X86_PTE_A \| X86_PTE_D));
2268	AssertRC(rc);
2269
2270	/* copy */
2271	size_t cbWrite = PAGE_SIZE - ((RTGCUINTPTR)GCPtrDst & PAGE_OFFSET_MASK);
2272	if (cbWrite >= cb)
2273	{
2274	PGMPhysWrite(pVM, GCPhys, pvSrc, cb);
2275	return VINF_SUCCESS;
2276	}
2277	PGMPhysWrite(pVM, GCPhys, pvSrc, cbWrite);
2278
2279	/* next */
2280	cb -= cbWrite;
2281	pvSrc = (uint8_t *)pvSrc + cbWrite;
2282	GCPtrDst += cbWrite;
2283	}
2284	}
2285
2286	#endif /* !IN_RC */
2287
2288	/**
2289	* Performs a read of guest virtual memory for instruction emulation.
2290	*
2291	* This will check permissions, raise exceptions and update the access bits.
2292	*
2293	* The current implementation will bypass all access handlers. It may later be
2294	* changed to at least respect MMIO.
2295	*
2296	*
2297	* @returns VBox status code suitable to scheduling.
2298	* @retval VINF_SUCCESS if the read was performed successfully.
2299	* @retval VINF_EM_RAW_GUEST_TRAP if an exception was raised but not dispatched yet.
2300	* @retval VINF_TRPM_XCPT_DISPATCHED if an exception was raised and dispatched.
2301	*
2302	* @param pVM The VM handle.
2303	* @param pCtxCore The context core.
2304	* @param pvDst Where to put the bytes we've read.
2305	* @param GCPtrSrc The source address.
2306	* @param cb The number of bytes to read. Not more than a page.
2307	*
2308	* @remark This function will dynamically map physical pages in GC. This may unmap
2309	* mappings done by the caller. Be careful!
2310	*/
2311	VMMDECL(int) PGMPhysInterpretedRead(PVM pVM, PCPUMCTXCORE pCtxCore, void *pvDst, RTGCUINTPTR GCPtrSrc, size_t cb)
2312	{
2313	Assert(cb <= PAGE_SIZE);
2314
2315	/** @todo r=bird: This isn't perfect!
2316	* -# It's not checking for reserved bits being 1.
2317	* -# It's not correctly dealing with the access bit.
2318	* -# It's not respecting MMIO memory or any other access handlers.
2319	*/
2320	/*
2321	* 1. Translate virtual to physical. This may fault.
2322	* 2. Map the physical address.
2323	* 3. Do the read operation.
2324	* 4. Set access bits if required.
2325	*/
2326	int rc;
2327	unsigned cb1 = PAGE_SIZE - (GCPtrSrc & PAGE_OFFSET_MASK);
2328	if (cb <= cb1)
2329	{
2330	/*
2331	* Not crossing pages.
2332	*/
2333	RTGCPHYS GCPhys;
2334	uint64_t fFlags;
2335	rc = PGM_GST_PFN(GetPage,pVM)(pVM, GCPtrSrc, &fFlags, &GCPhys);
2336	if (RT_SUCCESS(rc))
2337	{
2338	/** @todo we should check reserved bits ... */
2339	void *pvSrc;
2340	rc = PGM_GCPHYS_2_PTR(pVM, GCPhys, &pvSrc);
2341	switch (rc)
2342	{
2343	case VINF_SUCCESS:
2344	Log(("PGMPhysInterpretedRead: pvDst=%p pvSrc=%p cb=%d\n", pvDst, (uint8_t *)pvSrc + (GCPtrSrc & PAGE_OFFSET_MASK), cb));
2345	memcpy(pvDst, (uint8_t *)pvSrc + (GCPtrSrc & PAGE_OFFSET_MASK), cb);
2346	break;
2347	case VERR_PGM_PHYS_PAGE_RESERVED:
2348	case VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS:
2349	memset(pvDst, 0, cb); /** @todo this is wrong, it should be 0xff */
2350	break;
2351	default:
2352	return rc;
2353	}
2354
2355	/** @todo access bit emulation isn't 100% correct. */
2356	if (!(fFlags & X86_PTE_A))
2357	{
2358	rc = PGM_GST_PFN(ModifyPage,pVM)(pVM, GCPtrSrc, 1, X86_PTE_A, ~(uint64_t)X86_PTE_A);
2359	AssertRC(rc);
2360	}
2361	return VINF_SUCCESS;
2362	}
2363	}
2364	else
2365	{
2366	/*
2367	* Crosses pages.
2368	*/
2369	size_t cb2 = cb - cb1;
2370	uint64_t fFlags1;
2371	RTGCPHYS GCPhys1;
2372	uint64_t fFlags2;
2373	RTGCPHYS GCPhys2;
2374	rc = PGM_GST_PFN(GetPage,pVM)(pVM, GCPtrSrc, &fFlags1, &GCPhys1);
2375	if (RT_SUCCESS(rc))
2376	rc = PGM_GST_PFN(GetPage,pVM)(pVM, GCPtrSrc + cb1, &fFlags2, &GCPhys2);
2377	if (RT_SUCCESS(rc))
2378	{
2379	/** @todo we should check reserved bits ... */
2380	AssertMsgFailed(("cb=%d cb1=%d cb2=%d GCPtrSrc=%RGv\n", cb, cb1, cb2, GCPtrSrc));
2381	void *pvSrc1;
2382	rc = PGM_GCPHYS_2_PTR(pVM, GCPhys1, &pvSrc1);
2383	switch (rc)
2384	{
2385	case VINF_SUCCESS:
2386	memcpy(pvDst, (uint8_t *)pvSrc1 + (GCPtrSrc & PAGE_OFFSET_MASK), cb1);
2387	break;
2388	case VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS:
2389	memset(pvDst, 0, cb1); /** @todo this is wrong, it should be 0xff */
2390	break;
2391	default:
2392	return rc;
2393	}
2394
2395	void *pvSrc2;
2396	rc = PGM_GCPHYS_2_PTR(pVM, GCPhys2, &pvSrc2);
2397	switch (rc)
2398	{
2399	case VINF_SUCCESS:
2400	memcpy((uint8_t *)pvDst + cb1, pvSrc2, cb2);
2401	break;
2402	case VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS:
2403	memset((uint8_t )pvDst + cb1, 0, cb2); /* @todo this is wrong, it should be 0xff */
2404	break;
2405	default:
2406	return rc;
2407	}
2408
2409	if (!(fFlags1 & X86_PTE_A))
2410	{
2411	rc = PGM_GST_PFN(ModifyPage,pVM)(pVM, GCPtrSrc, 1, X86_PTE_A, ~(uint64_t)X86_PTE_A);
2412	AssertRC(rc);
2413	}
2414	if (!(fFlags2 & X86_PTE_A))
2415	{
2416	rc = PGM_GST_PFN(ModifyPage,pVM)(pVM, GCPtrSrc + cb1, 1, X86_PTE_A, ~(uint64_t)X86_PTE_A);
2417	AssertRC(rc);
2418	}
2419	return VINF_SUCCESS;
2420	}
2421	}
2422
2423	/*
2424	* Raise a #PF.
2425	*/
2426	uint32_t uErr;
2427
2428	/* Get the current privilege level. */
2429	uint32_t cpl = CPUMGetGuestCPL(pVM, pCtxCore);
2430	switch (rc)
2431	{
2432	case VINF_SUCCESS:
2433	uErr = (cpl >= 2) ? X86_TRAP_PF_RSVD \| X86_TRAP_PF_US : X86_TRAP_PF_RSVD;
2434	break;
2435
2436	case VERR_PAGE_NOT_PRESENT:
2437	case VERR_PAGE_TABLE_NOT_PRESENT:
2438	uErr = (cpl >= 2) ? X86_TRAP_PF_US : 0;
2439	break;
2440
2441	default:
2442	AssertMsgFailed(("rc=%Rrc GCPtrSrc=%RGv cb=%#x\n", rc, GCPtrSrc, cb));
2443	return rc;
2444	}
2445	Log(("PGMPhysInterpretedRead: GCPtrSrc=%RGv cb=%#x -> #PF(%#x)\n", GCPtrSrc, cb, uErr));
2446	return TRPMRaiseXcptErrCR2(pVM, pCtxCore, X86_XCPT_PF, uErr, GCPtrSrc);
2447	}
2448
2449	/// @todo VMMDECL(int) PGMPhysInterpretedWrite(PVM pVM, PCPUMCTXCORE pCtxCore, RTGCPTR GCPtrDst, const void *pvSrc, size_t cb)
2450
2451

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp@ 14969

Download in other formats: