PGMPhys.cpp@ 24349

Last change on this file since 24349 was 24349, checked in by vboxsync, 15 years ago
PGMR3PhysWriteExternal: Instrumented it to track down who is writing after PGM has saved it's state.
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 118.0 KB

Line
1	/* $Id: PGMPhys.cpp 24349 2009-11-04 17:37:15Z vboxsync $ */
2	/** @file
3	* PGM - Page Manager and Monitor, Physical Memory Addressing.
4	*/
5
6	/*
7	* Copyright (C) 2006-2007 Sun Microsystems, Inc.
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
18	* Clara, CA 95054 USA or visit http://www.sun.com if you need
19	* additional information or have any questions.
20	*/
21
22
23	/*******************************************************************************
24	* Header Files *
25	*******************************************************************************/
26	#define LOG_GROUP LOG_GROUP_PGM_PHYS
27	#include <VBox/pgm.h>
28	#include <VBox/iom.h>
29	#include <VBox/mm.h>
30	#include <VBox/stam.h>
31	#include <VBox/rem.h>
32	#include <VBox/pdmdev.h>
33	#include "PGMInternal.h"
34	#include <VBox/vm.h>
35	#include <VBox/sup.h>
36	#include <VBox/param.h>
37	#include <VBox/err.h>
38	#include <VBox/log.h>
39	#include <iprt/assert.h>
40	#include <iprt/alloc.h>
41	#include <iprt/asm.h>
42	#include <iprt/thread.h>
43	#include <iprt/string.h>
44
45
46	/*******************************************************************************
47	* Defined Constants And Macros *
48	*******************************************************************************/
49	/** The number of pages to free in one batch. */
50	#define PGMPHYS_FREE_PAGE_BATCH_SIZE 128
51
52
53	/*******************************************************************************
54	* Internal Functions *
55	*******************************************************************************/
56	static DECLCALLBACK(int) pgmR3PhysRomWriteHandler(PVM pVM, RTGCPHYS GCPhys, void pvPhys, void pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType, void *pvUser);
57	static int pgmPhysFreePage(PVM pVM, PGMMFREEPAGESREQ pReq, uint32_t *pcPendingPages, PPGMPAGE pPage, RTGCPHYS GCPhys);
58
59
60	/*
61	* PGMR3PhysReadU8-64
62	* PGMR3PhysWriteU8-64
63	*/
64	#define PGMPHYSFN_READNAME PGMR3PhysReadU8
65	#define PGMPHYSFN_WRITENAME PGMR3PhysWriteU8
66	#define PGMPHYS_DATASIZE 1
67	#define PGMPHYS_DATATYPE uint8_t
68	#include "PGMPhysRWTmpl.h"
69
70	#define PGMPHYSFN_READNAME PGMR3PhysReadU16
71	#define PGMPHYSFN_WRITENAME PGMR3PhysWriteU16
72	#define PGMPHYS_DATASIZE 2
73	#define PGMPHYS_DATATYPE uint16_t
74	#include "PGMPhysRWTmpl.h"
75
76	#define PGMPHYSFN_READNAME PGMR3PhysReadU32
77	#define PGMPHYSFN_WRITENAME PGMR3PhysWriteU32
78	#define PGMPHYS_DATASIZE 4
79	#define PGMPHYS_DATATYPE uint32_t
80	#include "PGMPhysRWTmpl.h"
81
82	#define PGMPHYSFN_READNAME PGMR3PhysReadU64
83	#define PGMPHYSFN_WRITENAME PGMR3PhysWriteU64
84	#define PGMPHYS_DATASIZE 8
85	#define PGMPHYS_DATATYPE uint64_t
86	#include "PGMPhysRWTmpl.h"
87
88
89	/**
90	* EMT worker for PGMR3PhysReadExternal.
91	*/
92	static DECLCALLBACK(int) pgmR3PhysReadExternalEMT(PVM pVM, PRTGCPHYS pGCPhys, void *pvBuf, size_t cbRead)
93	{
94	PGMPhysRead(pVM, *pGCPhys, pvBuf, cbRead);
95	return VINF_SUCCESS;
96	}
97
98
99	/**
100	* Write to physical memory, external users.
101	*
102	* @returns VBox status code.
103	* @retval VINF_SUCCESS.
104	*
105	* @param pVM VM Handle.
106	* @param GCPhys Physical address to write to.
107	* @param pvBuf What to write.
108	* @param cbWrite How many bytes to write.
109	*
110	* @thread Any but EMTs.
111	*/
112	VMMR3DECL(int) PGMR3PhysReadExternal(PVM pVM, RTGCPHYS GCPhys, void *pvBuf, size_t cbRead)
113	{
114	VM_ASSERT_OTHER_THREAD(pVM);
115
116	AssertMsgReturn(cbRead > 0, ("don't even think about reading zero bytes!\n"), VINF_SUCCESS);
117	LogFlow(("PGMR3PhysReadExternal: %RGp %d\n", GCPhys, cbRead));
118
119	pgmLock(pVM);
120
121	/*
122	* Copy loop on ram ranges.
123	*/
124	PPGMRAMRANGE pRam = pVM->pgm.s.CTX_SUFF(pRamRanges);
125	for (;;)
126	{
127	/* Find range. */
128	while (pRam && GCPhys > pRam->GCPhysLast)
129	pRam = pRam->CTX_SUFF(pNext);
130	/* Inside range or not? */
131	if (pRam && GCPhys >= pRam->GCPhys)
132	{
133	/*
134	* Must work our way thru this page by page.
135	*/
136	RTGCPHYS off = GCPhys - pRam->GCPhys;
137	while (off < pRam->cb)
138	{
139	unsigned iPage = off >> PAGE_SHIFT;
140	PPGMPAGE pPage = &pRam->aPages[iPage];
141
142	/*
143	* If the page has an ALL access handler, we'll have to
144	* delegate the job to EMT.
145	*/
146	if (PGM_PAGE_HAS_ACTIVE_ALL_HANDLERS(pPage))
147	{
148	pgmUnlock(pVM);
149
150	return VMR3ReqCallWait(pVM, VMCPUID_ANY, (PFNRT)pgmR3PhysReadExternalEMT, 4,
151	pVM, &GCPhys, pvBuf, cbRead);
152	}
153	Assert(!PGM_PAGE_IS_MMIO(pPage));
154
155	/*
156	* Simple stuff, go ahead.
157	*/
158	size_t cb = PAGE_SIZE - (off & PAGE_OFFSET_MASK);
159	if (cb > cbRead)
160	cb = cbRead;
161	const void *pvSrc;
162	int rc = pgmPhysGCPhys2CCPtrInternalReadOnly(pVM, pPage, pRam->GCPhys + off, &pvSrc);
163	if (RT_SUCCESS(rc))
164	memcpy(pvBuf, pvSrc, cb);
165	else
166	{
167	AssertLogRelMsgFailed(("pgmPhysGCPhys2CCPtrInternalReadOnly failed on %RGp / %R[pgmpage] -> %Rrc\n",
168	pRam->GCPhys + off, pPage, rc));
169	memset(pvBuf, 0xff, cb);
170	}
171
172	/* next page */
173	if (cb >= cbRead)
174	{
175	pgmUnlock(pVM);
176	return VINF_SUCCESS;
177	}
178	cbRead -= cb;
179	off += cb;
180	GCPhys += cb;
181	pvBuf = (char *)pvBuf + cb;
182	} /* walk pages in ram range. */
183	}
184	else
185	{
186	LogFlow(("PGMPhysRead: Unassigned %RGp size=%u\n", GCPhys, cbRead));
187
188	/*
189	* Unassigned address space.
190	*/
191	if (!pRam)
192	break;
193	size_t cb = pRam->GCPhys - GCPhys;
194	if (cb >= cbRead)
195	{
196	memset(pvBuf, 0xff, cbRead);
197	break;
198	}
199	memset(pvBuf, 0xff, cb);
200
201	cbRead -= cb;
202	pvBuf = (char *)pvBuf + cb;
203	GCPhys += cb;
204	}
205	} /* Ram range walk */
206
207	pgmUnlock(pVM);
208
209	return VINF_SUCCESS;
210	}
211
212
213	/**
214	* EMT worker for PGMR3PhysWriteExternal.
215	*/
216	static DECLCALLBACK(int) pgmR3PhysWriteExternalEMT(PVM pVM, PRTGCPHYS pGCPhys, const void *pvBuf, size_t cbWrite)
217	{
218	/** @todo VERR_EM_NO_MEMORY */
219	PGMPhysWrite(pVM, *pGCPhys, pvBuf, cbWrite);
220	return VINF_SUCCESS;
221	}
222
223
224	/**
225	* Write to physical memory, external users.
226	*
227	* @returns VBox status code.
228	* @retval VINF_SUCCESS.
229	* @retval VERR_EM_NO_MEMORY.
230	*
231	* @param pVM VM Handle.
232	* @param GCPhys Physical address to write to.
233	* @param pvBuf What to write.
234	* @param cbWrite How many bytes to write.
235	* @param pszWho Who is writing. For tracking down who is writing
236	* after we've saved the state.
237	*
238	* @thread Any but EMTs.
239	*/
240	VMMDECL(int) PGMR3PhysWriteExternal(PVM pVM, RTGCPHYS GCPhys, const void pvBuf, size_t cbWrite, const char pszWho)
241	{
242	VM_ASSERT_OTHER_THREAD(pVM);
243
244	AssertMsg(!pVM->pgm.s.fNoMorePhysWrites,
245	("Calling PGMR3PhysWriteExternal after pgmR3Save()! GCPhys=%RGp cbWrite=%#x pszWho=%s\n",
246	GCPhys, cbWrite, pszWho));
247	AssertMsgReturn(cbWrite > 0, ("don't even think about writing zero bytes!\n"), VINF_SUCCESS);
248	LogFlow(("PGMR3PhysWriteExternal: %RGp %d\n", GCPhys, cbWrite));
249
250	pgmLock(pVM);
251
252	/*
253	* Copy loop on ram ranges, stop when we hit something difficult.
254	*/
255	PPGMRAMRANGE pRam = pVM->pgm.s.CTX_SUFF(pRamRanges);
256	for (;;)
257	{
258	/* Find range. */
259	while (pRam && GCPhys > pRam->GCPhysLast)
260	pRam = pRam->CTX_SUFF(pNext);
261	/* Inside range or not? */
262	if (pRam && GCPhys >= pRam->GCPhys)
263	{
264	/*
265	* Must work our way thru this page by page.
266	*/
267	RTGCPTR off = GCPhys - pRam->GCPhys;
268	while (off < pRam->cb)
269	{
270	RTGCPTR iPage = off >> PAGE_SHIFT;
271	PPGMPAGE pPage = &pRam->aPages[iPage];
272
273	/*
274	* It the page is in any way problematic, we have to
275	* do the work on the EMT. Anything that needs to be made
276	* writable or involves access handlers is problematic.
277	*/
278	if ( PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage)
279	\|\| PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED)
280	{
281	pgmUnlock(pVM);
282
283	return VMR3ReqCallWait(pVM, VMCPUID_ANY, (PFNRT)pgmR3PhysWriteExternalEMT, 4,
284	pVM, &GCPhys, pvBuf, cbWrite);
285	}
286	Assert(!PGM_PAGE_IS_MMIO(pPage));
287
288	/*
289	* Simple stuff, go ahead.
290	*/
291	size_t cb = PAGE_SIZE - (off & PAGE_OFFSET_MASK);
292	if (cb > cbWrite)
293	cb = cbWrite;
294	void *pvDst;
295	int rc = pgmPhysGCPhys2CCPtrInternal(pVM, pPage, pRam->GCPhys + off, &pvDst);
296	if (RT_SUCCESS(rc))
297	memcpy(pvDst, pvBuf, cb);
298	else
299	AssertLogRelMsgFailed(("pgmPhysGCPhys2CCPtrInternal failed on %RGp / %R[pgmpage] -> %Rrc\n",
300	pRam->GCPhys + off, pPage, rc));
301
302	/* next page */
303	if (cb >= cbWrite)
304	{
305	pgmUnlock(pVM);
306	return VINF_SUCCESS;
307	}
308
309	cbWrite -= cb;
310	off += cb;
311	GCPhys += cb;
312	pvBuf = (const char *)pvBuf + cb;
313	} /* walk pages in ram range */
314	}
315	else
316	{
317	/*
318	* Unassigned address space, skip it.
319	*/
320	if (!pRam)
321	break;
322	size_t cb = pRam->GCPhys - GCPhys;
323	if (cb >= cbWrite)
324	break;
325	cbWrite -= cb;
326	pvBuf = (const char *)pvBuf + cb;
327	GCPhys += cb;
328	}
329	} /* Ram range walk */
330
331	pgmUnlock(pVM);
332	return VINF_SUCCESS;
333	}
334
335
336	/**
337	* VMR3ReqCall worker for PGMR3PhysGCPhys2CCPtrExternal to make pages writable.
338	*
339	* @returns see PGMR3PhysGCPhys2CCPtrExternal
340	* @param pVM The VM handle.
341	* @param pGCPhys Pointer to the guest physical address.
342	* @param ppv Where to store the mapping address.
343	* @param pLock Where to store the lock.
344	*/
345	static DECLCALLBACK(int) pgmR3PhysGCPhys2CCPtrDelegated(PVM pVM, PRTGCPHYS pGCPhys, void **ppv, PPGMPAGEMAPLOCK pLock)
346	{
347	/*
348	* Just hand it to PGMPhysGCPhys2CCPtr and check that it's not a page with
349	* an access handler after it succeeds.
350	*/
351	int rc = pgmLock(pVM);
352	AssertRCReturn(rc, rc);
353
354	rc = PGMPhysGCPhys2CCPtr(pVM, *pGCPhys, ppv, pLock);
355	if (RT_SUCCESS(rc))
356	{
357	PPGMPAGEMAPTLBE pTlbe;
358	int rc2 = pgmPhysPageQueryTlbe(&pVM->pgm.s, *pGCPhys, &pTlbe);
359	AssertFatalRC(rc2);
360	PPGMPAGE pPage = pTlbe->pPage;
361	if (PGM_PAGE_IS_MMIO(pPage))
362	{
363	PGMPhysReleasePageMappingLock(pVM, pLock);
364	rc = VERR_PGM_PHYS_PAGE_RESERVED;
365	}
366	else if ( PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage)
367	#ifdef PGMPOOL_WITH_OPTIMIZED_DIRTY_PT
368	\|\| pgmPoolIsDirtyPage(pVM, *pGCPhys)
369	#endif
370	)
371	{
372	/* We must flush any corresponding pgm pool page here, otherwise we'll
373	* not be informed about writes and keep bogus gst->shw mappings around.
374	*/
375	pgmPoolFlushPageByGCPhys(pVM, *pGCPhys);
376	Assert(!PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage));
377	/** @todo r=bird: return VERR_PGM_PHYS_PAGE_RESERVED here if it still has
378	* active handlers, see the PGMR3PhysGCPhys2CCPtrExternal docs. */
379	}
380	}
381
382	pgmUnlock(pVM);
383	return rc;
384	}
385
386
387	/**
388	* Requests the mapping of a guest page into ring-3, external threads.
389	*
390	* When you're done with the page, call PGMPhysReleasePageMappingLock() ASAP to
391	* release it.
392	*
393	* This API will assume your intention is to write to the page, and will
394	* therefore replace shared and zero pages. If you do not intend to modify the
395	* page, use the PGMR3PhysGCPhys2CCPtrReadOnlyExternal() API.
396	*
397	* @returns VBox status code.
398	* @retval VINF_SUCCESS on success.
399	* @retval VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical
400	* backing or if the page has any active access handlers. The caller
401	* must fall back on using PGMR3PhysWriteExternal.
402	* @retval VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid physical address.
403	*
404	* @param pVM The VM handle.
405	* @param GCPhys The guest physical address of the page that should be mapped.
406	* @param ppv Where to store the address corresponding to GCPhys.
407	* @param pLock Where to store the lock information that PGMPhysReleasePageMappingLock needs.
408	*
409	* @remark Avoid calling this API from within critical sections (other than the
410	* PGM one) because of the deadlock risk when we have to delegating the
411	* task to an EMT.
412	* @thread Any.
413	*/
414	VMMR3DECL(int) PGMR3PhysGCPhys2CCPtrExternal(PVM pVM, RTGCPHYS GCPhys, void **ppv, PPGMPAGEMAPLOCK pLock)
415	{
416	AssertPtr(ppv);
417	AssertPtr(pLock);
418
419	Assert(VM_IS_EMT(pVM) \|\| !PGMIsLockOwner(pVM));
420
421	int rc = pgmLock(pVM);
422	AssertRCReturn(rc, rc);
423
424	/*
425	* Query the Physical TLB entry for the page (may fail).
426	*/
427	PPGMPAGEMAPTLBE pTlbe;
428	rc = pgmPhysPageQueryTlbe(&pVM->pgm.s, GCPhys, &pTlbe);
429	if (RT_SUCCESS(rc))
430	{
431	PPGMPAGE pPage = pTlbe->pPage;
432	if (PGM_PAGE_IS_MMIO(pPage))
433	rc = VERR_PGM_PHYS_PAGE_RESERVED;
434	else
435	{
436	/*
437	* If the page is shared, the zero page, or being write monitored
438	* it must be converted to an page that's writable if possible.
439	* This has to be done on an EMT.
440	*/
441	if ( PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage)
442	#ifdef PGMPOOL_WITH_OPTIMIZED_DIRTY_PT
443	\|\| pgmPoolIsDirtyPage(pVM, GCPhys)
444	#endif
445	\|\| RT_UNLIKELY(PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED))
446	{
447	pgmUnlock(pVM);
448
449	return VMR3ReqCallWait(pVM, VMCPUID_ANY, (PFNRT)pgmR3PhysGCPhys2CCPtrDelegated, 4,
450	pVM, &GCPhys, ppv, pLock);
451	}
452
453	/*
454	* Now, just perform the locking and calculate the return address.
455	*/
456	PPGMPAGEMAP pMap = pTlbe->pMap;
457	if (pMap)
458	pMap->cRefs++;
459
460	unsigned cLocks = PGM_PAGE_GET_WRITE_LOCKS(pPage);
461	if (RT_LIKELY(cLocks < PGM_PAGE_MAX_LOCKS - 1))
462	{
463	if (cLocks == 0)
464	pVM->pgm.s.cWriteLockedPages++;
465	PGM_PAGE_INC_WRITE_LOCKS(pPage);
466	}
467	else if (cLocks != PGM_PAGE_GET_WRITE_LOCKS(pPage))
468	{
469	PGM_PAGE_INC_WRITE_LOCKS(pPage);
470	AssertMsgFailed(("%RGp / %R[pgmpage] is entering permanent write locked state!\n", GCPhys, pPage));
471	if (pMap)
472	pMap->cRefs++; /* Extra ref to prevent it from going away. */
473	}
474
475	ppv = (void )((uintptr_t)pTlbe->pv \| (GCPhys & PAGE_OFFSET_MASK));
476	pLock->uPageAndType = (uintptr_t)pPage \| PGMPAGEMAPLOCK_TYPE_WRITE;
477	pLock->pvMap = pMap;
478	}
479	}
480
481	pgmUnlock(pVM);
482	return rc;
483	}
484
485
486	/**
487	* Requests the mapping of a guest page into ring-3, external threads.
488	*
489	* When you're done with the page, call PGMPhysReleasePageMappingLock() ASAP to
490	* release it.
491	*
492	* @returns VBox status code.
493	* @retval VINF_SUCCESS on success.
494	* @retval VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical
495	* backing or if the page as an active ALL access handler. The caller
496	* must fall back on using PGMPhysRead.
497	* @retval VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid physical address.
498	*
499	* @param pVM The VM handle.
500	* @param GCPhys The guest physical address of the page that should be mapped.
501	* @param ppv Where to store the address corresponding to GCPhys.
502	* @param pLock Where to store the lock information that PGMPhysReleasePageMappingLock needs.
503	*
504	* @remark Avoid calling this API from within critical sections (other than
505	* the PGM one) because of the deadlock risk.
506	* @thread Any.
507	*/
508	VMMR3DECL(int) PGMR3PhysGCPhys2CCPtrReadOnlyExternal(PVM pVM, RTGCPHYS GCPhys, void const **ppv, PPGMPAGEMAPLOCK pLock)
509	{
510	int rc = pgmLock(pVM);
511	AssertRCReturn(rc, rc);
512
513	/*
514	* Query the Physical TLB entry for the page (may fail).
515	*/
516	PPGMPAGEMAPTLBE pTlbe;
517	rc = pgmPhysPageQueryTlbe(&pVM->pgm.s, GCPhys, &pTlbe);
518	if (RT_SUCCESS(rc))
519	{
520	PPGMPAGE pPage = pTlbe->pPage;
521	#if 1
522	/* MMIO pages doesn't have any readable backing. */
523	if (PGM_PAGE_IS_MMIO(pPage))
524	rc = VERR_PGM_PHYS_PAGE_RESERVED;
525	#else
526	if (PGM_PAGE_HAS_ACTIVE_ALL_HANDLERS(pPage))
527	rc = VERR_PGM_PHYS_PAGE_RESERVED;
528	#endif
529	else
530	{
531	/*
532	* Now, just perform the locking and calculate the return address.
533	*/
534	PPGMPAGEMAP pMap = pTlbe->pMap;
535	if (pMap)
536	pMap->cRefs++;
537
538	unsigned cLocks = PGM_PAGE_GET_READ_LOCKS(pPage);
539	if (RT_LIKELY(cLocks < PGM_PAGE_MAX_LOCKS - 1))
540	{
541	if (cLocks == 0)
542	pVM->pgm.s.cReadLockedPages++;
543	PGM_PAGE_INC_READ_LOCKS(pPage);
544	}
545	else if (cLocks != PGM_PAGE_GET_READ_LOCKS(pPage))
546	{
547	PGM_PAGE_INC_READ_LOCKS(pPage);
548	AssertMsgFailed(("%RGp / %R[pgmpage] is entering permanent readonly locked state!\n", GCPhys, pPage));
549	if (pMap)
550	pMap->cRefs++; /* Extra ref to prevent it from going away. */
551	}
552
553	ppv = (void )((uintptr_t)pTlbe->pv \| (GCPhys & PAGE_OFFSET_MASK));
554	pLock->uPageAndType = (uintptr_t)pPage \| PGMPAGEMAPLOCK_TYPE_READ;
555	pLock->pvMap = pMap;
556	}
557	}
558
559	pgmUnlock(pVM);
560	return rc;
561	}
562
563
564	/**
565	* Relinks the RAM ranges using the pSelfRC and pSelfR0 pointers.
566	*
567	* Called when anything was relocated.
568	*
569	* @param pVM Pointer to the shared VM structure.
570	*/
571	void pgmR3PhysRelinkRamRanges(PVM pVM)
572	{
573	PPGMRAMRANGE pCur;
574
575	#ifdef VBOX_STRICT
576	for (pCur = pVM->pgm.s.pRamRangesR3; pCur; pCur = pCur->pNextR3)
577	{
578	Assert((pCur->fFlags & PGM_RAM_RANGE_FLAGS_FLOATING) \|\| pCur->pSelfR0 == MMHyperCCToR0(pVM, pCur));
579	Assert((pCur->fFlags & PGM_RAM_RANGE_FLAGS_FLOATING) \|\| pCur->pSelfRC == MMHyperCCToRC(pVM, pCur));
580	Assert((pCur->GCPhys & PAGE_OFFSET_MASK) == 0);
581	Assert((pCur->GCPhysLast & PAGE_OFFSET_MASK) == PAGE_OFFSET_MASK);
582	Assert((pCur->cb & PAGE_OFFSET_MASK) == 0);
583	Assert(pCur->cb == pCur->GCPhysLast - pCur->GCPhys + 1);
584	for (PPGMRAMRANGE pCur2 = pVM->pgm.s.pRamRangesR3; pCur2; pCur2 = pCur2->pNextR3)
585	Assert( pCur2 == pCur
586	\|\| strcmp(pCur2->pszDesc, pCur->pszDesc)); /** @todo fix MMIO ranges!! */
587	}
588	#endif
589
590	pCur = pVM->pgm.s.pRamRangesR3;
591	if (pCur)
592	{
593	pVM->pgm.s.pRamRangesR0 = pCur->pSelfR0;
594	pVM->pgm.s.pRamRangesRC = pCur->pSelfRC;
595
596	for (; pCur->pNextR3; pCur = pCur->pNextR3)
597	{
598	pCur->pNextR0 = pCur->pNextR3->pSelfR0;
599	pCur->pNextRC = pCur->pNextR3->pSelfRC;
600	}
601
602	Assert(pCur->pNextR0 == NIL_RTR0PTR);
603	Assert(pCur->pNextRC == NIL_RTRCPTR);
604	}
605	else
606	{
607	Assert(pVM->pgm.s.pRamRangesR0 == NIL_RTR0PTR);
608	Assert(pVM->pgm.s.pRamRangesRC == NIL_RTRCPTR);
609	}
610	ASMAtomicIncU32(&pVM->pgm.s.idRamRangesGen);
611	}
612
613
614	/**
615	* Links a new RAM range into the list.
616	*
617	* @param pVM Pointer to the shared VM structure.
618	* @param pNew Pointer to the new list entry.
619	* @param pPrev Pointer to the previous list entry. If NULL, insert as head.
620	*/
621	static void pgmR3PhysLinkRamRange(PVM pVM, PPGMRAMRANGE pNew, PPGMRAMRANGE pPrev)
622	{
623	AssertMsg(pNew->pszDesc, ("%RGp-%RGp\n", pNew->GCPhys, pNew->GCPhysLast));
624	Assert((pNew->fFlags & PGM_RAM_RANGE_FLAGS_FLOATING) \|\| pNew->pSelfR0 == MMHyperCCToR0(pVM, pNew));
625	Assert((pNew->fFlags & PGM_RAM_RANGE_FLAGS_FLOATING) \|\| pNew->pSelfRC == MMHyperCCToRC(pVM, pNew));
626
627	pgmLock(pVM);
628
629	PPGMRAMRANGE pRam = pPrev ? pPrev->pNextR3 : pVM->pgm.s.pRamRangesR3;
630	pNew->pNextR3 = pRam;
631	pNew->pNextR0 = pRam ? pRam->pSelfR0 : NIL_RTR0PTR;
632	pNew->pNextRC = pRam ? pRam->pSelfRC : NIL_RTRCPTR;
633
634	if (pPrev)
635	{
636	pPrev->pNextR3 = pNew;
637	pPrev->pNextR0 = pNew->pSelfR0;
638	pPrev->pNextRC = pNew->pSelfRC;
639	}
640	else
641	{
642	pVM->pgm.s.pRamRangesR3 = pNew;
643	pVM->pgm.s.pRamRangesR0 = pNew->pSelfR0;
644	pVM->pgm.s.pRamRangesRC = pNew->pSelfRC;
645	}
646	ASMAtomicIncU32(&pVM->pgm.s.idRamRangesGen);
647
648	pgmUnlock(pVM);
649	}
650
651
652	/**
653	* Unlink an existing RAM range from the list.
654	*
655	* @param pVM Pointer to the shared VM structure.
656	* @param pRam Pointer to the new list entry.
657	* @param pPrev Pointer to the previous list entry. If NULL, insert as head.
658	*/
659	static void pgmR3PhysUnlinkRamRange2(PVM pVM, PPGMRAMRANGE pRam, PPGMRAMRANGE pPrev)
660	{
661	Assert(pPrev ? pPrev->pNextR3 == pRam : pVM->pgm.s.pRamRangesR3 == pRam);
662	Assert((pRam->fFlags & PGM_RAM_RANGE_FLAGS_FLOATING) \|\| pRam->pSelfR0 == MMHyperCCToR0(pVM, pRam));
663	Assert((pRam->fFlags & PGM_RAM_RANGE_FLAGS_FLOATING) \|\| pRam->pSelfRC == MMHyperCCToRC(pVM, pRam));
664
665	pgmLock(pVM);
666
667	PPGMRAMRANGE pNext = pRam->pNextR3;
668	if (pPrev)
669	{
670	pPrev->pNextR3 = pNext;
671	pPrev->pNextR0 = pNext ? pNext->pSelfR0 : NIL_RTR0PTR;
672	pPrev->pNextRC = pNext ? pNext->pSelfRC : NIL_RTRCPTR;
673	}
674	else
675	{
676	Assert(pVM->pgm.s.pRamRangesR3 == pRam);
677	pVM->pgm.s.pRamRangesR3 = pNext;
678	pVM->pgm.s.pRamRangesR0 = pNext ? pNext->pSelfR0 : NIL_RTR0PTR;
679	pVM->pgm.s.pRamRangesRC = pNext ? pNext->pSelfRC : NIL_RTRCPTR;
680	}
681	ASMAtomicIncU32(&pVM->pgm.s.idRamRangesGen);
682
683	pgmUnlock(pVM);
684	}
685
686
687	/**
688	* Unlink an existing RAM range from the list.
689	*
690	* @param pVM Pointer to the shared VM structure.
691	* @param pRam Pointer to the new list entry.
692	*/
693	static void pgmR3PhysUnlinkRamRange(PVM pVM, PPGMRAMRANGE pRam)
694	{
695	pgmLock(pVM);
696
697	/* find prev. */
698	PPGMRAMRANGE pPrev = NULL;
699	PPGMRAMRANGE pCur = pVM->pgm.s.pRamRangesR3;
700	while (pCur != pRam)
701	{
702	pPrev = pCur;
703	pCur = pCur->pNextR3;
704	}
705	AssertFatal(pCur);
706
707	pgmR3PhysUnlinkRamRange2(pVM, pRam, pPrev);
708
709	pgmUnlock(pVM);
710	}
711
712
713	/**
714	* Frees a range of pages, replacing them with ZERO pages of the specified type.
715	*
716	* @returns VBox status code.
717	* @param pVM The VM handle.
718	* @param pRam The RAM range in which the pages resides.
719	* @param GCPhys The address of the first page.
720	* @param GCPhysLast The address of the last page.
721	* @param uType The page type to replace then with.
722	*/
723	static int pgmR3PhysFreePageRange(PVM pVM, PPGMRAMRANGE pRam, RTGCPHYS GCPhys, RTGCPHYS GCPhysLast, uint8_t uType)
724	{
725	uint32_t cPendingPages = 0;
726	PGMMFREEPAGESREQ pReq;
727	int rc = GMMR3FreePagesPrepare(pVM, &pReq, PGMPHYS_FREE_PAGE_BATCH_SIZE, GMMACCOUNT_BASE);
728	AssertLogRelRCReturn(rc, rc);
729
730	/* Itegerate the pages. */
731	PPGMPAGE pPageDst = &pRam->aPages[(GCPhys - pRam->GCPhys) >> PAGE_SHIFT];
732	uint32_t cPagesLeft = ((GCPhysLast - GCPhys) >> PAGE_SHIFT) + 1;
733	while (cPagesLeft-- > 0)
734	{
735	rc = pgmPhysFreePage(pVM, pReq, &cPendingPages, pPageDst, GCPhys);
736	AssertLogRelRCReturn(rc, rc); /* We're done for if this goes wrong. */
737
738	PGM_PAGE_SET_TYPE(pPageDst, uType);
739
740	GCPhys += PAGE_SIZE;
741	pPageDst++;
742	}
743
744	if (cPendingPages)
745	{
746	rc = GMMR3FreePagesPerform(pVM, pReq, cPendingPages);
747	AssertLogRelRCReturn(rc, rc);
748	}
749	GMMR3FreePagesCleanup(pReq);
750
751	return rc;
752	}
753
754
755	/**
756	* PGMR3PhysRegisterRam worker that initializes and links a RAM range.
757	*
758	* @param pVM The VM handle.
759	* @param pNew The new RAM range.
760	* @param GCPhys The address of the RAM range.
761	* @param GCPhysLast The last address of the RAM range.
762	* @param RCPtrNew The RC address if the range is floating. NIL_RTRCPTR
763	* if in HMA.
764	* @param R0PtrNew Ditto for R0.
765	* @param pszDesc The description.
766	* @param pPrev The previous RAM range (for linking).
767	*/
768	static void pgmR3PhysInitAndLinkRamRange(PVM pVM, PPGMRAMRANGE pNew, RTGCPHYS GCPhys, RTGCPHYS GCPhysLast,
769	RTRCPTR RCPtrNew, RTR0PTR R0PtrNew, const char *pszDesc, PPGMRAMRANGE pPrev)
770	{
771	/*
772	* Initialize the range.
773	*/
774	pNew->pSelfR0 = R0PtrNew != NIL_RTR0PTR ? R0PtrNew : MMHyperCCToR0(pVM, pNew);
775	pNew->pSelfRC = RCPtrNew != NIL_RTRCPTR ? RCPtrNew : MMHyperCCToRC(pVM, pNew);
776	pNew->GCPhys = GCPhys;
777	pNew->GCPhysLast = GCPhysLast;
778	pNew->cb = GCPhysLast - GCPhys + 1;
779	pNew->pszDesc = pszDesc;
780	pNew->fFlags = RCPtrNew != NIL_RTRCPTR ? PGM_RAM_RANGE_FLAGS_FLOATING : 0;
781	pNew->pvR3 = NULL;
782	pNew->paLSPages = NULL;
783
784	uint32_t const cPages = pNew->cb >> PAGE_SHIFT;
785	RTGCPHYS iPage = cPages;
786	while (iPage-- > 0)
787	PGM_PAGE_INIT_ZERO(&pNew->aPages[iPage], pVM, PGMPAGETYPE_RAM);
788
789	/* Update the page count stats. */
790	pVM->pgm.s.cZeroPages += cPages;
791	pVM->pgm.s.cAllPages += cPages;
792
793	/*
794	* Link it.
795	*/
796	pgmR3PhysLinkRamRange(pVM, pNew, pPrev);
797	}
798
799
800	/**
801	* Relocate a floating RAM range.
802	*
803	* @copydoc FNPGMRELOCATE.
804	*/
805	static DECLCALLBACK(bool) pgmR3PhysRamRangeRelocate(PVM pVM, RTGCPTR GCPtrOld, RTGCPTR GCPtrNew, PGMRELOCATECALL enmMode, void *pvUser)
806	{
807	PPGMRAMRANGE pRam = (PPGMRAMRANGE)pvUser;
808	Assert(pRam->fFlags & PGM_RAM_RANGE_FLAGS_FLOATING);
809	Assert(pRam->pSelfRC == GCPtrOld + PAGE_SIZE);
810
811	switch (enmMode)
812	{
813	case PGMRELOCATECALL_SUGGEST:
814	return true;
815	case PGMRELOCATECALL_RELOCATE:
816	{
817	/* Update myself and then relink all the ranges. */
818	pgmLock(pVM);
819	pRam->pSelfRC = (RTRCPTR)(GCPtrNew + PAGE_SIZE);
820	pgmR3PhysRelinkRamRanges(pVM);
821	pgmUnlock(pVM);
822	return true;
823	}
824
825	default:
826	AssertFailedReturn(false);
827	}
828	}
829
830
831	/**
832	* PGMR3PhysRegisterRam worker that registers a high chunk.
833	*
834	* @returns VBox status code.
835	* @param pVM The VM handle.
836	* @param GCPhys The address of the RAM.
837	* @param cRamPages The number of RAM pages to register.
838	* @param cbChunk The size of the PGMRAMRANGE guest mapping.
839	* @param iChunk The chunk number.
840	* @param pszDesc The RAM range description.
841	* @param ppPrev Previous RAM range pointer. In/Out.
842	*/
843	static int pgmR3PhysRegisterHighRamChunk(PVM pVM, RTGCPHYS GCPhys, uint32_t cRamPages,
844	uint32_t cbChunk, uint32_t iChunk, const char *pszDesc,
845	PPGMRAMRANGE *ppPrev)
846	{
847	const char *pszDescChunk = iChunk == 0
848	? pszDesc
849	: MMR3HeapAPrintf(pVM, MM_TAG_PGM_PHYS, "%s (#%u)", pszDesc, iChunk + 1);
850	AssertReturn(pszDescChunk, VERR_NO_MEMORY);
851
852	/*
853	* Allocate memory for the new chunk.
854	*/
855	size_t const cChunkPages = RT_ALIGN_Z(RT_UOFFSETOF(PGMRAMRANGE, aPages[cRamPages]), PAGE_SIZE) >> PAGE_SHIFT;
856	PSUPPAGE paChunkPages = (PSUPPAGE)RTMemTmpAllocZ(sizeof(SUPPAGE) * cChunkPages);
857	AssertReturn(paChunkPages, VERR_NO_TMP_MEMORY);
858	RTR0PTR R0PtrChunk = NIL_RTR0PTR;
859	void *pvChunk = NULL;
860	int rc = SUPR3PageAllocEx(cChunkPages, 0 /fFlags/, &pvChunk,
861	#ifdef VBOX_WITH_2X_4GB_ADDR_SPACE
862	VMMIsHwVirtExtForced(pVM) ? &R0PtrChunk : NULL,
863	#else
864	NULL,
865	#endif
866	paChunkPages);
867	if (RT_SUCCESS(rc))
868	{
869	#ifdef VBOX_WITH_2X_4GB_ADDR_SPACE
870	if (!VMMIsHwVirtExtForced(pVM))
871	R0PtrChunk = NIL_RTR0PTR;
872	#else
873	R0PtrChunk = (uintptr_t)pvChunk;
874	#endif
875	memset(pvChunk, 0, cChunkPages << PAGE_SHIFT);
876
877	PPGMRAMRANGE pNew = (PPGMRAMRANGE)pvChunk;
878
879	/*
880	* Create a mapping and map the pages into it.
881	* We push these in below the HMA.
882	*/
883	RTGCPTR GCPtrChunkMap = pVM->pgm.s.GCPtrPrevRamRangeMapping - cbChunk;
884	rc = PGMR3MapPT(pVM, GCPtrChunkMap, cbChunk, 0 /fFlags/, pgmR3PhysRamRangeRelocate, pNew, pszDescChunk);
885	if (RT_SUCCESS(rc))
886	{
887	pVM->pgm.s.GCPtrPrevRamRangeMapping = GCPtrChunkMap;
888
889	RTGCPTR const GCPtrChunk = GCPtrChunkMap + PAGE_SIZE;
890	RTGCPTR GCPtrPage = GCPtrChunk;
891	for (uint32_t iPage = 0; iPage < cChunkPages && RT_SUCCESS(rc); iPage++, GCPtrPage += PAGE_SIZE)
892	rc = PGMMap(pVM, GCPtrPage, paChunkPages[iPage].Phys, PAGE_SIZE, 0);
893	if (RT_SUCCESS(rc))
894	{
895	/*
896	* Ok, init and link the range.
897	*/
898	pgmR3PhysInitAndLinkRamRange(pVM, pNew, GCPhys, GCPhys + ((RTGCPHYS)cRamPages << PAGE_SHIFT) - 1,
899	(RTRCPTR)GCPtrChunk, R0PtrChunk, pszDescChunk, *ppPrev);
900	*ppPrev = pNew;
901	}
902	}
903
904	if (RT_FAILURE(rc))
905	SUPR3PageFreeEx(pvChunk, cChunkPages);
906	}
907
908	RTMemTmpFree(paChunkPages);
909	return rc;
910	}
911
912
913	/**
914	* Sets up a range RAM.
915	*
916	* This will check for conflicting registrations, make a resource
917	* reservation for the memory (with GMM), and setup the per-page
918	* tracking structures (PGMPAGE).
919	*
920	* @returns VBox stutus code.
921	* @param pVM Pointer to the shared VM structure.
922	* @param GCPhys The physical address of the RAM.
923	* @param cb The size of the RAM.
924	* @param pszDesc The description - not copied, so, don't free or change it.
925	*/
926	VMMR3DECL(int) PGMR3PhysRegisterRam(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, const char *pszDesc)
927	{
928	/*
929	* Validate input.
930	*/
931	Log(("PGMR3PhysRegisterRam: GCPhys=%RGp cb=%RGp pszDesc=%s\n", GCPhys, cb, pszDesc));
932	AssertReturn(RT_ALIGN_T(GCPhys, PAGE_SIZE, RTGCPHYS) == GCPhys, VERR_INVALID_PARAMETER);
933	AssertReturn(RT_ALIGN_T(cb, PAGE_SIZE, RTGCPHYS) == cb, VERR_INVALID_PARAMETER);
934	AssertReturn(cb > 0, VERR_INVALID_PARAMETER);
935	RTGCPHYS GCPhysLast = GCPhys + (cb - 1);
936	AssertMsgReturn(GCPhysLast > GCPhys, ("The range wraps! GCPhys=%RGp cb=%RGp\n", GCPhys, cb), VERR_INVALID_PARAMETER);
937	AssertPtrReturn(pszDesc, VERR_INVALID_POINTER);
938	VM_ASSERT_EMT_RETURN(pVM, VERR_VM_THREAD_NOT_EMT);
939
940	pgmLock(pVM);
941
942	/*
943	* Find range location and check for conflicts.
944	* (We don't lock here because the locking by EMT is only required on update.)
945	*/
946	PPGMRAMRANGE pPrev = NULL;
947	PPGMRAMRANGE pRam = pVM->pgm.s.pRamRangesR3;
948	while (pRam && GCPhysLast >= pRam->GCPhys)
949	{
950	if ( GCPhysLast >= pRam->GCPhys
951	&& GCPhys <= pRam->GCPhysLast)
952	AssertLogRelMsgFailedReturn(("%RGp-%RGp (%s) conflicts with existing %RGp-%RGp (%s)\n",
953	GCPhys, GCPhysLast, pszDesc,
954	pRam->GCPhys, pRam->GCPhysLast, pRam->pszDesc),
955	VERR_PGM_RAM_CONFLICT);
956
957	/* next */
958	pPrev = pRam;
959	pRam = pRam->pNextR3;
960	}
961
962	/*
963	* Register it with GMM (the API bitches).
964	*/
965	const RTGCPHYS cPages = cb >> PAGE_SHIFT;
966	int rc = MMR3IncreaseBaseReservation(pVM, cPages);
967	if (RT_FAILURE(rc))
968	{
969	pgmUnlock(pVM);
970	return rc;
971	}
972
973	if ( GCPhys >= _4G
974	&& cPages > 256)
975	{
976	/*
977	* The PGMRAMRANGE structures for the high memory can get very big.
978	* In order to avoid SUPR3PageAllocEx allocation failures due to the
979	* allocation size limit there and also to avoid being unable to find
980	* guest mapping space for them, we split this memory up into 4MB in
981	* (potential) raw-mode configs and 16MB chunks in forced AMD-V/VT-x
982	* mode.
983	*
984	* The first and last page of each mapping are guard pages and marked
985	* not-present. So, we've got 4186112 and 16769024 bytes available for
986	* the PGMRAMRANGE structure.
987	*
988	* Note! The sizes used here will influence the saved state.
989	*/
990	uint32_t cbChunk;
991	uint32_t cPagesPerChunk;
992	if (VMMIsHwVirtExtForced(pVM))
993	{
994	cbChunk = 16U*_1M;
995	cPagesPerChunk = 1048048; /* max ~1048059 */
996	AssertCompile(sizeof(PGMRAMRANGE) + sizeof(PGMPAGE) * 1048048 < 16U_1M - PAGE_SIZE 2);
997	}
998	else
999	{
1000	cbChunk = 4U*_1M;
1001	cPagesPerChunk = 261616; /* max ~261627 */
1002	AssertCompile(sizeof(PGMRAMRANGE) + sizeof(PGMPAGE) * 261616 < 4U_1M - PAGE_SIZE 2);
1003	}
1004	AssertRelease(RT_UOFFSETOF(PGMRAMRANGE, aPages[cPagesPerChunk]) + PAGE_SIZE * 2 <= cbChunk);
1005
1006	RTGCPHYS cPagesLeft = cPages;
1007	RTGCPHYS GCPhysChunk = GCPhys;
1008	uint32_t iChunk = 0;
1009	while (cPagesLeft > 0)
1010	{
1011	uint32_t cPagesInChunk = cPagesLeft;
1012	if (cPagesInChunk > cPagesPerChunk)
1013	cPagesInChunk = cPagesPerChunk;
1014
1015	rc = pgmR3PhysRegisterHighRamChunk(pVM, GCPhysChunk, cPagesInChunk, cbChunk, iChunk, pszDesc, &pPrev);
1016	AssertRCReturn(rc, rc);
1017
1018	/* advance */
1019	GCPhysChunk += (RTGCPHYS)cPagesInChunk << PAGE_SHIFT;
1020	cPagesLeft -= cPagesInChunk;
1021	iChunk++;
1022	}
1023	}
1024	else
1025	{
1026	/*
1027	* Allocate, initialize and link the new RAM range.
1028	*/
1029	const size_t cbRamRange = RT_OFFSETOF(PGMRAMRANGE, aPages[cPages]);
1030	PPGMRAMRANGE pNew;
1031	rc = MMR3HyperAllocOnceNoRel(pVM, cbRamRange, 0, MM_TAG_PGM_PHYS, (void **)&pNew);
1032	AssertLogRelMsgRCReturn(rc, ("cbRamRange=%zu\n", cbRamRange), rc);
1033
1034	pgmR3PhysInitAndLinkRamRange(pVM, pNew, GCPhys, GCPhysLast, NIL_RTRCPTR, NIL_RTR0PTR, pszDesc, pPrev);
1035	}
1036	pgmUnlock(pVM);
1037
1038	/*
1039	* Notify REM.
1040	*/
1041	REMR3NotifyPhysRamRegister(pVM, GCPhys, cb, REM_NOTIFY_PHYS_RAM_FLAGS_RAM);
1042
1043	return VINF_SUCCESS;
1044	}
1045
1046
1047	/**
1048	* Worker called by PGMR3InitFinalize if we're configured to pre-allocate RAM.
1049	*
1050	* We do this late in the init process so that all the ROM and MMIO ranges have
1051	* been registered already and we don't go wasting memory on them.
1052	*
1053	* @returns VBox status code.
1054	*
1055	* @param pVM Pointer to the shared VM structure.
1056	*/
1057	int pgmR3PhysRamPreAllocate(PVM pVM)
1058	{
1059	Assert(pVM->pgm.s.fRamPreAlloc);
1060	Log(("pgmR3PhysRamPreAllocate: enter\n"));
1061
1062	/*
1063	* Walk the RAM ranges and allocate all RAM pages, halt at
1064	* the first allocation error.
1065	*/
1066	uint64_t cPages = 0;
1067	uint64_t NanoTS = RTTimeNanoTS();
1068	pgmLock(pVM);
1069	for (PPGMRAMRANGE pRam = pVM->pgm.s.pRamRangesR3; pRam; pRam = pRam->pNextR3)
1070	{
1071	PPGMPAGE pPage = &pRam->aPages[0];
1072	RTGCPHYS GCPhys = pRam->GCPhys;
1073	uint32_t cLeft = pRam->cb >> PAGE_SHIFT;
1074	while (cLeft-- > 0)
1075	{
1076	if (PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_RAM)
1077	{
1078	switch (PGM_PAGE_GET_STATE(pPage))
1079	{
1080	case PGM_PAGE_STATE_ZERO:
1081	{
1082	int rc = pgmPhysAllocPage(pVM, pPage, GCPhys);
1083	if (RT_FAILURE(rc))
1084	{
1085	LogRel(("PGM: RAM Pre-allocation failed at %RGp (in %s) with rc=%Rrc\n", GCPhys, pRam->pszDesc, rc));
1086	pgmUnlock(pVM);
1087	return rc;
1088	}
1089	cPages++;
1090	break;
1091	}
1092
1093	case PGM_PAGE_STATE_ALLOCATED:
1094	case PGM_PAGE_STATE_WRITE_MONITORED:
1095	case PGM_PAGE_STATE_SHARED:
1096	/* nothing to do here. */
1097	break;
1098	}
1099	}
1100
1101	/* next */
1102	pPage++;
1103	GCPhys += PAGE_SIZE;
1104	}
1105	}
1106	pgmUnlock(pVM);
1107	NanoTS = RTTimeNanoTS() - NanoTS;
1108
1109	LogRel(("PGM: Pre-allocated %llu pages in %llu ms\n", cPages, NanoTS / 1000000));
1110	Log(("pgmR3PhysRamPreAllocate: returns VINF_SUCCESS\n"));
1111	return VINF_SUCCESS;
1112	}
1113
1114
1115	/**
1116	* Resets (zeros) the RAM.
1117	*
1118	* ASSUMES that the caller owns the PGM lock.
1119	*
1120	* @returns VBox status code.
1121	* @param pVM Pointer to the shared VM structure.
1122	*/
1123	int pgmR3PhysRamReset(PVM pVM)
1124	{
1125	Assert(PGMIsLockOwner(pVM));
1126	/*
1127	* We batch up pages before freeing them.
1128	*/
1129	uint32_t cPendingPages = 0;
1130	PGMMFREEPAGESREQ pReq;
1131	int rc = GMMR3FreePagesPrepare(pVM, &pReq, PGMPHYS_FREE_PAGE_BATCH_SIZE, GMMACCOUNT_BASE);
1132	AssertLogRelRCReturn(rc, rc);
1133
1134	/*
1135	* Walk the ram ranges.
1136	*/
1137	for (PPGMRAMRANGE pRam = pVM->pgm.s.pRamRangesR3; pRam; pRam = pRam->pNextR3)
1138	{
1139	uint32_t iPage = pRam->cb >> PAGE_SHIFT;
1140	AssertMsg(((RTGCPHYS)iPage << PAGE_SHIFT) == pRam->cb, ("%RGp %RGp\n", (RTGCPHYS)iPage << PAGE_SHIFT, pRam->cb));
1141
1142	if (!pVM->pgm.s.fRamPreAlloc)
1143	{
1144	/* Replace all RAM pages by ZERO pages. */
1145	while (iPage-- > 0)
1146	{
1147	PPGMPAGE pPage = &pRam->aPages[iPage];
1148	switch (PGM_PAGE_GET_TYPE(pPage))
1149	{
1150	case PGMPAGETYPE_RAM:
1151	if (!PGM_PAGE_IS_ZERO(pPage))
1152	{
1153	rc = pgmPhysFreePage(pVM, pReq, &cPendingPages, pPage, pRam->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT));
1154	AssertLogRelRCReturn(rc, rc);
1155	}
1156	break;
1157
1158	case PGMPAGETYPE_MMIO2_ALIAS_MMIO:
1159	pgmHandlerPhysicalResetAliasedPage(pVM, pPage, pRam->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT));
1160	break;
1161
1162	case PGMPAGETYPE_MMIO2:
1163	case PGMPAGETYPE_ROM_SHADOW: /* handled by pgmR3PhysRomReset. */
1164	case PGMPAGETYPE_ROM:
1165	case PGMPAGETYPE_MMIO:
1166	break;
1167	default:
1168	AssertFailed();
1169	}
1170	} /* for each page */
1171	}
1172	else
1173	{
1174	/* Zero the memory. */
1175	while (iPage-- > 0)
1176	{
1177	PPGMPAGE pPage = &pRam->aPages[iPage];
1178	switch (PGM_PAGE_GET_TYPE(pPage))
1179	{
1180	case PGMPAGETYPE_RAM:
1181	switch (PGM_PAGE_GET_STATE(pPage))
1182	{
1183	case PGM_PAGE_STATE_ZERO:
1184	break;
1185	case PGM_PAGE_STATE_SHARED:
1186	case PGM_PAGE_STATE_WRITE_MONITORED:
1187	rc = pgmPhysPageMakeWritable(pVM, pPage, pRam->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT));
1188	AssertLogRelRCReturn(rc, rc);
1189	case PGM_PAGE_STATE_ALLOCATED:
1190	{
1191	void *pvPage;
1192	rc = pgmPhysPageMap(pVM, pPage, pRam->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT), &pvPage);
1193	AssertLogRelRCReturn(rc, rc);
1194	ASMMemZeroPage(pvPage);
1195	break;
1196	}
1197	}
1198	break;
1199
1200	case PGMPAGETYPE_MMIO2_ALIAS_MMIO:
1201	pgmHandlerPhysicalResetAliasedPage(pVM, pPage, pRam->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT));
1202	break;
1203
1204	case PGMPAGETYPE_MMIO2:
1205	case PGMPAGETYPE_ROM_SHADOW:
1206	case PGMPAGETYPE_ROM:
1207	case PGMPAGETYPE_MMIO:
1208	break;
1209	default:
1210	AssertFailed();
1211
1212	}
1213	} /* for each page */
1214	}
1215
1216	}
1217
1218	/*
1219	* Finish off any pages pending freeing.
1220	*/
1221	if (cPendingPages)
1222	{
1223	rc = GMMR3FreePagesPerform(pVM, pReq, cPendingPages);
1224	AssertLogRelRCReturn(rc, rc);
1225	}
1226	GMMR3FreePagesCleanup(pReq);
1227
1228	return VINF_SUCCESS;
1229	}
1230
1231
1232	/**
1233	* This is the interface IOM is using to register an MMIO region.
1234	*
1235	* It will check for conflicts and ensure that a RAM range structure
1236	* is present before calling the PGMR3HandlerPhysicalRegister API to
1237	* register the callbacks.
1238	*
1239	* @returns VBox status code.
1240	*
1241	* @param pVM Pointer to the shared VM structure.
1242	* @param GCPhys The start of the MMIO region.
1243	* @param cb The size of the MMIO region.
1244	* @param pfnHandlerR3 The address of the ring-3 handler. (IOMR3MMIOHandler)
1245	* @param pvUserR3 The user argument for R3.
1246	* @param pfnHandlerR0 The address of the ring-0 handler. (IOMMMIOHandler)
1247	* @param pvUserR0 The user argument for R0.
1248	* @param pfnHandlerRC The address of the RC handler. (IOMMMIOHandler)
1249	* @param pvUserRC The user argument for RC.
1250	* @param pszDesc The description of the MMIO region.
1251	*/
1252	VMMR3DECL(int) PGMR3PhysMMIORegister(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb,
1253	R3PTRTYPE(PFNPGMR3PHYSHANDLER) pfnHandlerR3, RTR3PTR pvUserR3,
1254	R0PTRTYPE(PFNPGMR0PHYSHANDLER) pfnHandlerR0, RTR0PTR pvUserR0,
1255	RCPTRTYPE(PFNPGMRCPHYSHANDLER) pfnHandlerRC, RTRCPTR pvUserRC,
1256	R3PTRTYPE(const char *) pszDesc)
1257	{
1258	/*
1259	* Assert on some assumption.
1260	*/
1261	VM_ASSERT_EMT(pVM);
1262	AssertReturn(!(cb & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
1263	AssertReturn(!(GCPhys & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
1264	AssertPtrReturn(pszDesc, VERR_INVALID_POINTER);
1265	AssertReturn(*pszDesc, VERR_INVALID_PARAMETER);
1266
1267	/*
1268	* Make sure there's a RAM range structure for the region.
1269	*/
1270	int rc;
1271	RTGCPHYS GCPhysLast = GCPhys + (cb - 1);
1272	bool fRamExists = false;
1273	PPGMRAMRANGE pRamPrev = NULL;
1274	PPGMRAMRANGE pRam = pVM->pgm.s.pRamRangesR3;
1275	while (pRam && GCPhysLast >= pRam->GCPhys)
1276	{
1277	if ( GCPhysLast >= pRam->GCPhys
1278	&& GCPhys <= pRam->GCPhysLast)
1279	{
1280	/* Simplification: all within the same range. */
1281	AssertLogRelMsgReturn( GCPhys >= pRam->GCPhys
1282	&& GCPhysLast <= pRam->GCPhysLast,
1283	("%RGp-%RGp (MMIO/%s) falls partly outside %RGp-%RGp (%s)\n",
1284	GCPhys, GCPhysLast, pszDesc,
1285	pRam->GCPhys, pRam->GCPhysLast, pRam->pszDesc),
1286	VERR_PGM_RAM_CONFLICT);
1287
1288	/* Check that it's all RAM or MMIO pages. */
1289	PCPGMPAGE pPage = &pRam->aPages[(GCPhys - pRam->GCPhys) >> PAGE_SHIFT];
1290	uint32_t cLeft = cb >> PAGE_SHIFT;
1291	while (cLeft-- > 0)
1292	{
1293	AssertLogRelMsgReturn( PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_RAM
1294	\|\| PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_MMIO,
1295	("%RGp-%RGp (MMIO/%s): %RGp is not a RAM or MMIO page - type=%d desc=%s\n",
1296	GCPhys, GCPhysLast, pszDesc, PGM_PAGE_GET_TYPE(pPage), pRam->pszDesc),
1297	VERR_PGM_RAM_CONFLICT);
1298	pPage++;
1299	}
1300
1301	/* Looks good. */
1302	fRamExists = true;
1303	break;
1304	}
1305
1306	/* next */
1307	pRamPrev = pRam;
1308	pRam = pRam->pNextR3;
1309	}
1310	PPGMRAMRANGE pNew;
1311	if (fRamExists)
1312	{
1313	pNew = NULL;
1314
1315	/*
1316	* Make all the pages in the range MMIO/ZERO pages, freeing any
1317	* RAM pages currently mapped here. This might not be 100% correct
1318	* for PCI memory, but we're doing the same thing for MMIO2 pages.
1319	*/
1320	rc = pgmLock(pVM);
1321	if (RT_SUCCESS(rc))
1322	{
1323	rc = pgmR3PhysFreePageRange(pVM, pRam, GCPhys, GCPhysLast, PGMPAGETYPE_MMIO);
1324	pgmUnlock(pVM);
1325	}
1326	AssertRCReturn(rc, rc);
1327	}
1328	else
1329	{
1330	pgmLock(pVM);
1331
1332	/*
1333	* No RAM range, insert an ad hoc one.
1334	*
1335	* Note that we don't have to tell REM about this range because
1336	* PGMHandlerPhysicalRegisterEx will do that for us.
1337	*/
1338	Log(("PGMR3PhysMMIORegister: Adding ad hoc MMIO range for %RGp-%RGp %s\n", GCPhys, GCPhysLast, pszDesc));
1339
1340	const uint32_t cPages = cb >> PAGE_SHIFT;
1341	const size_t cbRamRange = RT_OFFSETOF(PGMRAMRANGE, aPages[cPages]);
1342	rc = MMHyperAlloc(pVM, RT_OFFSETOF(PGMRAMRANGE, aPages[cPages]), 16, MM_TAG_PGM_PHYS, (void **)&pNew);
1343	AssertLogRelMsgRCReturn(rc, ("cbRamRange=%zu\n", cbRamRange), rc);
1344
1345	/* Initialize the range. */
1346	pNew->pSelfR0 = MMHyperCCToR0(pVM, pNew);
1347	pNew->pSelfRC = MMHyperCCToRC(pVM, pNew);
1348	pNew->GCPhys = GCPhys;
1349	pNew->GCPhysLast = GCPhysLast;
1350	pNew->cb = cb;
1351	pNew->pszDesc = pszDesc;
1352	pNew->fFlags = PGM_RAM_RANGE_FLAGS_AD_HOC_MMIO;
1353	pNew->pvR3 = NULL;
1354	pNew->paLSPages = NULL;
1355
1356	uint32_t iPage = cPages;
1357	while (iPage-- > 0)
1358	PGM_PAGE_INIT_ZERO(&pNew->aPages[iPage], pVM, PGMPAGETYPE_MMIO);
1359	Assert(PGM_PAGE_GET_TYPE(&pNew->aPages[0]) == PGMPAGETYPE_MMIO);
1360
1361	/* update the page count stats. */
1362	pVM->pgm.s.cZeroPages += cPages;
1363	pVM->pgm.s.cAllPages += cPages;
1364
1365	/* link it */
1366	pgmR3PhysLinkRamRange(pVM, pNew, pRamPrev);
1367
1368	pgmUnlock(pVM);
1369	}
1370
1371	/*
1372	* Register the access handler.
1373	*/
1374	rc = PGMHandlerPhysicalRegisterEx(pVM, PGMPHYSHANDLERTYPE_MMIO, GCPhys, GCPhysLast,
1375	pfnHandlerR3, pvUserR3,
1376	pfnHandlerR0, pvUserR0,
1377	pfnHandlerRC, pvUserRC, pszDesc);
1378	if ( RT_FAILURE(rc)
1379	&& !fRamExists)
1380	{
1381	pVM->pgm.s.cZeroPages -= cb >> PAGE_SHIFT;
1382	pVM->pgm.s.cAllPages -= cb >> PAGE_SHIFT;
1383
1384	/* remove the ad hoc range. */
1385	pgmR3PhysUnlinkRamRange2(pVM, pNew, pRamPrev);
1386	pNew->cb = pNew->GCPhys = pNew->GCPhysLast = NIL_RTGCPHYS;
1387	MMHyperFree(pVM, pRam);
1388	}
1389
1390	return rc;
1391	}
1392
1393
1394	/**
1395	* This is the interface IOM is using to register an MMIO region.
1396	*
1397	* It will take care of calling PGMHandlerPhysicalDeregister and clean up
1398	* any ad hoc PGMRAMRANGE left behind.
1399	*
1400	* @returns VBox status code.
1401	* @param pVM Pointer to the shared VM structure.
1402	* @param GCPhys The start of the MMIO region.
1403	* @param cb The size of the MMIO region.
1404	*/
1405	VMMR3DECL(int) PGMR3PhysMMIODeregister(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb)
1406	{
1407	VM_ASSERT_EMT(pVM);
1408
1409	/*
1410	* First deregister the handler, then check if we should remove the ram range.
1411	*/
1412	int rc = PGMHandlerPhysicalDeregister(pVM, GCPhys);
1413	if (RT_SUCCESS(rc))
1414	{
1415	RTGCPHYS GCPhysLast = GCPhys + (cb - 1);
1416	PPGMRAMRANGE pRamPrev = NULL;
1417	PPGMRAMRANGE pRam = pVM->pgm.s.pRamRangesR3;
1418	while (pRam && GCPhysLast >= pRam->GCPhys)
1419	{
1420	/** @todo We're being a bit too careful here. rewrite. */
1421	if ( GCPhysLast == pRam->GCPhysLast
1422	&& GCPhys == pRam->GCPhys)
1423	{
1424	Assert(pRam->cb == cb);
1425
1426	/*
1427	* See if all the pages are dead MMIO pages.
1428	*/
1429	uint32_t const cPages = cb >> PAGE_SHIFT;
1430	bool fAllMMIO = true;
1431	uint32_t iPage = 0;
1432	uint32_t cLeft = cPages;
1433	while (cLeft-- > 0)
1434	{
1435	PPGMPAGE pPage = &pRam->aPages[iPage];
1436	if ( PGM_PAGE_GET_TYPE(pPage) != PGMPAGETYPE_MMIO
1437	/\|\| not-out-of-action later /)
1438	{
1439	fAllMMIO = false;
1440	Assert(PGM_PAGE_GET_TYPE(pPage) != PGMPAGETYPE_MMIO2_ALIAS_MMIO);
1441	AssertMsgFailed(("%RGp %R[pgmpage]\n", pRam->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT), pPage));
1442	break;
1443	}
1444	Assert(PGM_PAGE_IS_ZERO(pPage));
1445	pPage++;
1446	}
1447	if (fAllMMIO)
1448	{
1449	/*
1450	* Ad-hoc range, unlink and free it.
1451	*/
1452	Log(("PGMR3PhysMMIODeregister: Freeing ad hoc MMIO range for %RGp-%RGp %s\n",
1453	GCPhys, GCPhysLast, pRam->pszDesc));
1454
1455	pVM->pgm.s.cAllPages -= cPages;
1456	pVM->pgm.s.cZeroPages -= cPages;
1457
1458	pgmR3PhysUnlinkRamRange2(pVM, pRam, pRamPrev);
1459	pRam->cb = pRam->GCPhys = pRam->GCPhysLast = NIL_RTGCPHYS;
1460	MMHyperFree(pVM, pRam);
1461	break;
1462	}
1463	}
1464
1465	/*
1466	* Range match? It will all be within one range (see PGMAllHandler.cpp).
1467	*/
1468	if ( GCPhysLast >= pRam->GCPhys
1469	&& GCPhys <= pRam->GCPhysLast)
1470	{
1471	Assert(GCPhys >= pRam->GCPhys);
1472	Assert(GCPhysLast <= pRam->GCPhysLast);
1473
1474	/*
1475	* Turn the pages back into RAM pages.
1476	*/
1477	uint32_t iPage = (GCPhys - pRam->GCPhys) >> PAGE_SHIFT;
1478	uint32_t cLeft = cb >> PAGE_SHIFT;
1479	while (cLeft--)
1480	{
1481	PPGMPAGE pPage = &pRam->aPages[iPage];
1482	AssertMsg(PGM_PAGE_IS_MMIO(pPage), ("%RGp %R[pgmpage]\n", pRam->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT), pPage));
1483	AssertMsg(PGM_PAGE_IS_ZERO(pPage), ("%RGp %R[pgmpage]\n", pRam->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT), pPage));
1484	if (PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_MMIO)
1485	PGM_PAGE_SET_TYPE(pPage, PGMPAGETYPE_RAM);
1486	}
1487	break;
1488	}
1489
1490	/* next */
1491	pRamPrev = pRam;
1492	pRam = pRam->pNextR3;
1493	}
1494	}
1495
1496	return rc;
1497	}
1498
1499
1500	/**
1501	* Locate a MMIO2 range.
1502	*
1503	* @returns Pointer to the MMIO2 range.
1504	* @param pVM Pointer to the shared VM structure.
1505	* @param pDevIns The device instance owning the region.
1506	* @param iRegion The region.
1507	*/
1508	DECLINLINE(PPGMMMIO2RANGE) pgmR3PhysMMIO2Find(PVM pVM, PPDMDEVINS pDevIns, uint32_t iRegion)
1509	{
1510	/*
1511	* Search the list.
1512	*/
1513	for (PPGMMMIO2RANGE pCur = pVM->pgm.s.pMmio2RangesR3; pCur; pCur = pCur->pNextR3)
1514	if ( pCur->pDevInsR3 == pDevIns
1515	&& pCur->iRegion == iRegion)
1516	return pCur;
1517	return NULL;
1518	}
1519
1520
1521	/**
1522	* Allocate and register an MMIO2 region.
1523	*
1524	* As mentioned elsewhere, MMIO2 is just RAM spelled differently. It's
1525	* RAM associated with a device. It is also non-shared memory with a
1526	* permanent ring-3 mapping and page backing (presently).
1527	*
1528	* A MMIO2 range may overlap with base memory if a lot of RAM
1529	* is configured for the VM, in which case we'll drop the base
1530	* memory pages. Presently we will make no attempt to preserve
1531	* anything that happens to be present in the base memory that
1532	* is replaced, this is of course incorrectly but it's too much
1533	* effort.
1534	*
1535	* @returns VBox status code.
1536	* @retval VINF_SUCCESS on success, *ppv pointing to the R3 mapping of the memory.
1537	* @retval VERR_ALREADY_EXISTS if the region already exists.
1538	*
1539	* @param pVM Pointer to the shared VM structure.
1540	* @param pDevIns The device instance owning the region.
1541	* @param iRegion The region number. If the MMIO2 memory is a PCI I/O region
1542	* this number has to be the number of that region. Otherwise
1543	* it can be any number safe UINT8_MAX.
1544	* @param cb The size of the region. Must be page aligned.
1545	* @param fFlags Reserved for future use, must be zero.
1546	* @param ppv Where to store the pointer to the ring-3 mapping of the memory.
1547	* @param pszDesc The description.
1548	*/
1549	VMMR3DECL(int) PGMR3PhysMMIO2Register(PVM pVM, PPDMDEVINS pDevIns, uint32_t iRegion, RTGCPHYS cb, uint32_t fFlags, void *ppv, const char pszDesc)
1550	{
1551	/*
1552	* Validate input.
1553	*/
1554	VM_ASSERT_EMT_RETURN(pVM, VERR_VM_THREAD_NOT_EMT);
1555	AssertPtrReturn(pDevIns, VERR_INVALID_PARAMETER);
1556	AssertReturn(iRegion <= UINT8_MAX, VERR_INVALID_PARAMETER);
1557	AssertPtrReturn(ppv, VERR_INVALID_POINTER);
1558	AssertPtrReturn(pszDesc, VERR_INVALID_POINTER);
1559	AssertReturn(*pszDesc, VERR_INVALID_PARAMETER);
1560	AssertReturn(pgmR3PhysMMIO2Find(pVM, pDevIns, iRegion) == NULL, VERR_ALREADY_EXISTS);
1561	AssertReturn(!(cb & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
1562	AssertReturn(cb, VERR_INVALID_PARAMETER);
1563	AssertReturn(!fFlags, VERR_INVALID_PARAMETER);
1564
1565	const uint32_t cPages = cb >> PAGE_SHIFT;
1566	AssertLogRelReturn(((RTGCPHYS)cPages << PAGE_SHIFT) == cb, VERR_INVALID_PARAMETER);
1567	AssertLogRelReturn(cPages <= INT32_MAX / 2, VERR_NO_MEMORY);
1568
1569	/*
1570	* For the 2nd+ instance, mangle the description string so it's unique.
1571	*/
1572	if (pDevIns->iInstance > 0) /** @todo Move to PDMDevHlp.cpp and use a real string cache. */
1573	{
1574	pszDesc = MMR3HeapAPrintf(pVM, MM_TAG_PGM_PHYS, "%s [%u]", pszDesc, pDevIns->iInstance);
1575	if (!pszDesc)
1576	return VERR_NO_MEMORY;
1577	}
1578
1579	/*
1580	* Try reserve and allocate the backing memory first as this is what is
1581	* most likely to fail.
1582	*/
1583	int rc = MMR3AdjustFixedReservation(pVM, cPages, pszDesc);
1584	if (RT_SUCCESS(rc))
1585	{
1586	void *pvPages;
1587	PSUPPAGE paPages = (PSUPPAGE)RTMemTmpAlloc(cPages * sizeof(SUPPAGE));
1588	if (RT_SUCCESS(rc))
1589	rc = SUPR3PageAllocEx(cPages, 0 /fFlags/, &pvPages, NULL /pR0Ptr/, paPages);
1590	if (RT_SUCCESS(rc))
1591	{
1592	memset(pvPages, 0, cPages * PAGE_SIZE);
1593
1594	/*
1595	* Create the MMIO2 range record for it.
1596	*/
1597	const size_t cbRange = RT_OFFSETOF(PGMMMIO2RANGE, RamRange.aPages[cPages]);
1598	PPGMMMIO2RANGE pNew;
1599	rc = MMR3HyperAllocOnceNoRel(pVM, cbRange, 0, MM_TAG_PGM_PHYS, (void **)&pNew);
1600	AssertLogRelMsgRC(rc, ("cbRamRange=%zu\n", cbRange));
1601	if (RT_SUCCESS(rc))
1602	{
1603	pNew->pDevInsR3 = pDevIns;
1604	pNew->pvR3 = pvPages;
1605	//pNew->pNext = NULL;
1606	//pNew->fMapped = false;
1607	//pNew->fOverlapping = false;
1608	pNew->iRegion = iRegion;
1609	pNew->idSavedState = UINT8_MAX;
1610	pNew->RamRange.pSelfR0 = MMHyperCCToR0(pVM, &pNew->RamRange);
1611	pNew->RamRange.pSelfRC = MMHyperCCToRC(pVM, &pNew->RamRange);
1612	pNew->RamRange.GCPhys = NIL_RTGCPHYS;
1613	pNew->RamRange.GCPhysLast = NIL_RTGCPHYS;
1614	pNew->RamRange.pszDesc = pszDesc;
1615	pNew->RamRange.cb = cb;
1616	pNew->RamRange.fFlags = PGM_RAM_RANGE_FLAGS_AD_HOC_MMIO2;
1617	pNew->RamRange.pvR3 = pvPages;
1618	//pNew->RamRange.paLSPages = NULL;
1619
1620	uint32_t iPage = cPages;
1621	while (iPage-- > 0)
1622	{
1623	PGM_PAGE_INIT(&pNew->RamRange.aPages[iPage],
1624	paPages[iPage].Phys, NIL_GMM_PAGEID,
1625	PGMPAGETYPE_MMIO2, PGM_PAGE_STATE_ALLOCATED);
1626	}
1627
1628	/* update page count stats */
1629	pVM->pgm.s.cAllPages += cPages;
1630	pVM->pgm.s.cPrivatePages += cPages;
1631
1632	/*
1633	* Link it into the list.
1634	* Since there is no particular order, just push it.
1635	*/
1636	pgmLock(pVM);
1637	pNew->pNextR3 = pVM->pgm.s.pMmio2RangesR3;
1638	pVM->pgm.s.pMmio2RangesR3 = pNew;
1639	pgmUnlock(pVM);
1640
1641	*ppv = pvPages;
1642	RTMemTmpFree(paPages);
1643	return VINF_SUCCESS;
1644	}
1645
1646	SUPR3PageFreeEx(pvPages, cPages);
1647	}
1648	RTMemTmpFree(paPages);
1649	MMR3AdjustFixedReservation(pVM, -(int32_t)cPages, pszDesc);
1650	}
1651	if (pDevIns->iInstance > 0)
1652	MMR3HeapFree((void *)pszDesc);
1653	return rc;
1654	}
1655
1656
1657	/**
1658	* Deregisters and frees an MMIO2 region.
1659	*
1660	* Any physical (and virtual) access handlers registered for the region must
1661	* be deregistered before calling this function.
1662	*
1663	* @returns VBox status code.
1664	* @param pVM Pointer to the shared VM structure.
1665	* @param pDevIns The device instance owning the region.
1666	* @param iRegion The region. If it's UINT32_MAX it'll be a wildcard match.
1667	*/
1668	VMMR3DECL(int) PGMR3PhysMMIO2Deregister(PVM pVM, PPDMDEVINS pDevIns, uint32_t iRegion)
1669	{
1670	/*
1671	* Validate input.
1672	*/
1673	VM_ASSERT_EMT_RETURN(pVM, VERR_VM_THREAD_NOT_EMT);
1674	AssertPtrReturn(pDevIns, VERR_INVALID_PARAMETER);
1675	AssertReturn(iRegion <= UINT8_MAX \|\| iRegion == UINT32_MAX, VERR_INVALID_PARAMETER);
1676
1677	pgmLock(pVM);
1678	int rc = VINF_SUCCESS;
1679	unsigned cFound = 0;
1680	PPGMMMIO2RANGE pPrev = NULL;
1681	PPGMMMIO2RANGE pCur = pVM->pgm.s.pMmio2RangesR3;
1682	while (pCur)
1683	{
1684	if ( pCur->pDevInsR3 == pDevIns
1685	&& ( iRegion == UINT32_MAX
1686	\|\| pCur->iRegion == iRegion))
1687	{
1688	cFound++;
1689
1690	/*
1691	* Unmap it if it's mapped.
1692	*/
1693	if (pCur->fMapped)
1694	{
1695	int rc2 = PGMR3PhysMMIO2Unmap(pVM, pCur->pDevInsR3, pCur->iRegion, pCur->RamRange.GCPhys);
1696	AssertRC(rc2);
1697	if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
1698	rc = rc2;
1699	}
1700
1701	/*
1702	* Unlink it
1703	*/
1704	PPGMMMIO2RANGE pNext = pCur->pNextR3;
1705	if (pPrev)
1706	pPrev->pNextR3 = pNext;
1707	else
1708	pVM->pgm.s.pMmio2RangesR3 = pNext;
1709	pCur->pNextR3 = NULL;
1710
1711	/*
1712	* Free the memory.
1713	*/
1714	int rc2 = SUPR3PageFreeEx(pCur->pvR3, pCur->RamRange.cb >> PAGE_SHIFT);
1715	AssertRC(rc2);
1716	if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
1717	rc = rc2;
1718
1719	uint32_t const cPages = pCur->RamRange.cb >> PAGE_SHIFT;
1720	rc2 = MMR3AdjustFixedReservation(pVM, -(int32_t)cPages, pCur->RamRange.pszDesc);
1721	AssertRC(rc2);
1722	if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
1723	rc = rc2;
1724
1725	/* we're leaking hyper memory here if done at runtime. */
1726	#ifdef VBOX_STRICT
1727	VMSTATE const enmState = VMR3GetState(pVM);
1728	AssertMsg( enmState == VMSTATE_POWERING_OFF
1729	\|\| enmState == VMSTATE_POWERING_OFF_LS
1730	\|\| enmState == VMSTATE_OFF
1731	\|\| enmState == VMSTATE_OFF_LS
1732	\|\| enmState == VMSTATE_DESTROYING
1733	\|\| enmState == VMSTATE_TERMINATED
1734	\|\| enmState == VMSTATE_CREATING
1735	, ("%s\n", VMR3GetStateName(enmState)));
1736	#endif
1737	/*rc = MMHyperFree(pVM, pCur);
1738	AssertRCReturn(rc, rc); - not safe, see the alloc call. */
1739
1740
1741	/* update page count stats */
1742	pVM->pgm.s.cAllPages -= cPages;
1743	pVM->pgm.s.cPrivatePages -= cPages;
1744
1745	/* next */
1746	pCur = pNext;
1747	}
1748	else
1749	{
1750	pPrev = pCur;
1751	pCur = pCur->pNextR3;
1752	}
1753	}
1754	pgmUnlock(pVM);
1755	return !cFound && iRegion != UINT32_MAX ? VERR_NOT_FOUND : rc;
1756	}
1757
1758
1759	/**
1760	* Maps a MMIO2 region.
1761	*
1762	* This is done when a guest / the bios / state loading changes the
1763	* PCI config. The replacing of base memory has the same restrictions
1764	* as during registration, of course.
1765	*
1766	* @returns VBox status code.
1767	*
1768	* @param pVM Pointer to the shared VM structure.
1769	* @param pDevIns The
1770	*/
1771	VMMR3DECL(int) PGMR3PhysMMIO2Map(PVM pVM, PPDMDEVINS pDevIns, uint32_t iRegion, RTGCPHYS GCPhys)
1772	{
1773	/*
1774	* Validate input
1775	*/
1776	VM_ASSERT_EMT_RETURN(pVM, VERR_VM_THREAD_NOT_EMT);
1777	AssertPtrReturn(pDevIns, VERR_INVALID_PARAMETER);
1778	AssertReturn(iRegion <= UINT8_MAX, VERR_INVALID_PARAMETER);
1779	AssertReturn(GCPhys != NIL_RTGCPHYS, VERR_INVALID_PARAMETER);
1780	AssertReturn(GCPhys != 0, VERR_INVALID_PARAMETER);
1781	AssertReturn(!(GCPhys & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
1782
1783	PPGMMMIO2RANGE pCur = pgmR3PhysMMIO2Find(pVM, pDevIns, iRegion);
1784	AssertReturn(pCur, VERR_NOT_FOUND);
1785	AssertReturn(!pCur->fMapped, VERR_WRONG_ORDER);
1786	Assert(pCur->RamRange.GCPhys == NIL_RTGCPHYS);
1787	Assert(pCur->RamRange.GCPhysLast == NIL_RTGCPHYS);
1788
1789	const RTGCPHYS GCPhysLast = GCPhys + pCur->RamRange.cb - 1;
1790	AssertReturn(GCPhysLast > GCPhys, VERR_INVALID_PARAMETER);
1791
1792	/*
1793	* Find our location in the ram range list, checking for
1794	* restriction we don't bother implementing yet (partially overlapping).
1795	*/
1796	bool fRamExists = false;
1797	PPGMRAMRANGE pRamPrev = NULL;
1798	PPGMRAMRANGE pRam = pVM->pgm.s.pRamRangesR3;
1799	while (pRam && GCPhysLast >= pRam->GCPhys)
1800	{
1801	if ( GCPhys <= pRam->GCPhysLast
1802	&& GCPhysLast >= pRam->GCPhys)
1803	{
1804	/* completely within? */
1805	AssertLogRelMsgReturn( GCPhys >= pRam->GCPhys
1806	&& GCPhysLast <= pRam->GCPhysLast,
1807	("%RGp-%RGp (MMIO2/%s) falls partly outside %RGp-%RGp (%s)\n",
1808	GCPhys, GCPhysLast, pCur->RamRange.pszDesc,
1809	pRam->GCPhys, pRam->GCPhysLast, pRam->pszDesc),
1810	VERR_PGM_RAM_CONFLICT);
1811	fRamExists = true;
1812	break;
1813	}
1814
1815	/* next */
1816	pRamPrev = pRam;
1817	pRam = pRam->pNextR3;
1818	}
1819	if (fRamExists)
1820	{
1821	PPGMPAGE pPage = &pRam->aPages[(GCPhys - pRam->GCPhys) >> PAGE_SHIFT];
1822	uint32_t cPagesLeft = pCur->RamRange.cb >> PAGE_SHIFT;
1823	while (cPagesLeft-- > 0)
1824	{
1825	AssertLogRelMsgReturn(PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_RAM,
1826	("%RGp isn't a RAM page (%d) - mapping %RGp-%RGp (MMIO2/%s).\n",
1827	GCPhys, PGM_PAGE_GET_TYPE(pPage), GCPhys, GCPhysLast, pCur->RamRange.pszDesc),
1828	VERR_PGM_RAM_CONFLICT);
1829	pPage++;
1830	}
1831	}
1832	Log(("PGMR3PhysMMIO2Map: %RGp-%RGp fRamExists=%RTbool %s\n",
1833	GCPhys, GCPhysLast, fRamExists, pCur->RamRange.pszDesc));
1834
1835	/*
1836	* Make the changes.
1837	*/
1838	pgmLock(pVM);
1839
1840	pCur->RamRange.GCPhys = GCPhys;
1841	pCur->RamRange.GCPhysLast = GCPhysLast;
1842	pCur->fMapped = true;
1843	pCur->fOverlapping = fRamExists;
1844
1845	if (fRamExists)
1846	{
1847	/** @todo use pgmR3PhysFreePageRange here. */
1848	uint32_t cPendingPages = 0;
1849	PGMMFREEPAGESREQ pReq;
1850	int rc = GMMR3FreePagesPrepare(pVM, &pReq, PGMPHYS_FREE_PAGE_BATCH_SIZE, GMMACCOUNT_BASE);
1851	AssertLogRelRCReturn(rc, rc);
1852
1853	/* replace the pages, freeing all present RAM pages. */
1854	PPGMPAGE pPageSrc = &pCur->RamRange.aPages[0];
1855	PPGMPAGE pPageDst = &pRam->aPages[(GCPhys - pRam->GCPhys) >> PAGE_SHIFT];
1856	uint32_t cPagesLeft = pCur->RamRange.cb >> PAGE_SHIFT;
1857	while (cPagesLeft-- > 0)
1858	{
1859	rc = pgmPhysFreePage(pVM, pReq, &cPendingPages, pPageDst, GCPhys);
1860	AssertLogRelRCReturn(rc, rc); /* We're done for if this goes wrong. */
1861
1862	RTHCPHYS const HCPhys = PGM_PAGE_GET_HCPHYS(pPageSrc);
1863	PGM_PAGE_SET_HCPHYS(pPageDst, HCPhys);
1864	PGM_PAGE_SET_TYPE(pPageDst, PGMPAGETYPE_MMIO2);
1865	PGM_PAGE_SET_STATE(pPageDst, PGM_PAGE_STATE_ALLOCATED);
1866
1867	pVM->pgm.s.cZeroPages--;
1868	GCPhys += PAGE_SIZE;
1869	pPageSrc++;
1870	pPageDst++;
1871	}
1872
1873	if (cPendingPages)
1874	{
1875	rc = GMMR3FreePagesPerform(pVM, pReq, cPendingPages);
1876	AssertLogRelRCReturn(rc, rc);
1877	}
1878	GMMR3FreePagesCleanup(pReq);
1879	pgmUnlock(pVM);
1880	}
1881	else
1882	{
1883	RTGCPHYS cb = pCur->RamRange.cb;
1884
1885	/* link in the ram range */
1886	pgmR3PhysLinkRamRange(pVM, &pCur->RamRange, pRamPrev);
1887	pgmUnlock(pVM);
1888
1889	REMR3NotifyPhysRamRegister(pVM, GCPhys, cb, REM_NOTIFY_PHYS_RAM_FLAGS_MMIO2);
1890	}
1891
1892	return VINF_SUCCESS;
1893	}
1894
1895
1896	/**
1897	* Unmaps a MMIO2 region.
1898	*
1899	* This is done when a guest / the bios / state loading changes the
1900	* PCI config. The replacing of base memory has the same restrictions
1901	* as during registration, of course.
1902	*/
1903	VMMR3DECL(int) PGMR3PhysMMIO2Unmap(PVM pVM, PPDMDEVINS pDevIns, uint32_t iRegion, RTGCPHYS GCPhys)
1904	{
1905	/*
1906	* Validate input
1907	*/
1908	VM_ASSERT_EMT_RETURN(pVM, VERR_VM_THREAD_NOT_EMT);
1909	AssertPtrReturn(pDevIns, VERR_INVALID_PARAMETER);
1910	AssertReturn(iRegion <= UINT8_MAX, VERR_INVALID_PARAMETER);
1911	AssertReturn(GCPhys != NIL_RTGCPHYS, VERR_INVALID_PARAMETER);
1912	AssertReturn(GCPhys != 0, VERR_INVALID_PARAMETER);
1913	AssertReturn(!(GCPhys & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
1914
1915	PPGMMMIO2RANGE pCur = pgmR3PhysMMIO2Find(pVM, pDevIns, iRegion);
1916	AssertReturn(pCur, VERR_NOT_FOUND);
1917	AssertReturn(pCur->fMapped, VERR_WRONG_ORDER);
1918	AssertReturn(pCur->RamRange.GCPhys == GCPhys, VERR_INVALID_PARAMETER);
1919	Assert(pCur->RamRange.GCPhysLast != NIL_RTGCPHYS);
1920
1921	Log(("PGMR3PhysMMIO2Unmap: %RGp-%RGp %s\n",
1922	pCur->RamRange.GCPhys, pCur->RamRange.GCPhysLast, pCur->RamRange.pszDesc));
1923
1924	/*
1925	* Unmap it.
1926	*/
1927	pgmLock(pVM);
1928
1929	RTGCPHYS GCPhysRangeREM;
1930	RTGCPHYS cbRangeREM;
1931	bool fInformREM;
1932	if (pCur->fOverlapping)
1933	{
1934	/* Restore the RAM pages we've replaced. */
1935	PPGMRAMRANGE pRam = pVM->pgm.s.pRamRangesR3;
1936	while (pRam->GCPhys > pCur->RamRange.GCPhysLast)
1937	pRam = pRam->pNextR3;
1938
1939	RTHCPHYS const HCPhysZeroPg = pVM->pgm.s.HCPhysZeroPg;
1940	Assert(HCPhysZeroPg != 0 && HCPhysZeroPg != NIL_RTHCPHYS);
1941	PPGMPAGE pPageDst = &pRam->aPages[(pCur->RamRange.GCPhys - pRam->GCPhys) >> PAGE_SHIFT];
1942	uint32_t cPagesLeft = pCur->RamRange.cb >> PAGE_SHIFT;
1943	while (cPagesLeft-- > 0)
1944	{
1945	PGM_PAGE_SET_HCPHYS(pPageDst, HCPhysZeroPg);
1946	PGM_PAGE_SET_TYPE(pPageDst, PGMPAGETYPE_RAM);
1947	PGM_PAGE_SET_STATE(pPageDst, PGM_PAGE_STATE_ZERO);
1948	PGM_PAGE_SET_PAGEID(pPageDst, NIL_GMM_PAGEID);
1949
1950	pVM->pgm.s.cZeroPages++;
1951	pPageDst++;
1952	}
1953
1954	GCPhysRangeREM = NIL_RTGCPHYS; /* shuts up gcc */
1955	cbRangeREM = RTGCPHYS_MAX; /* ditto */
1956	fInformREM = false;
1957	}
1958	else
1959	{
1960	GCPhysRangeREM = pCur->RamRange.GCPhys;
1961	cbRangeREM = pCur->RamRange.cb;
1962	fInformREM = true;
1963
1964	pgmR3PhysUnlinkRamRange(pVM, &pCur->RamRange);
1965	}
1966
1967	pCur->RamRange.GCPhys = NIL_RTGCPHYS;
1968	pCur->RamRange.GCPhysLast = NIL_RTGCPHYS;
1969	pCur->fOverlapping = false;
1970	pCur->fMapped = false;
1971
1972	pgmUnlock(pVM);
1973
1974	if (fInformREM)
1975	REMR3NotifyPhysRamDeregister(pVM, GCPhysRangeREM, cbRangeREM);
1976
1977	return VINF_SUCCESS;
1978	}
1979
1980
1981	/**
1982	* Checks if the given address is an MMIO2 base address or not.
1983	*
1984	* @returns true/false accordingly.
1985	* @param pVM Pointer to the shared VM structure.
1986	* @param pDevIns The owner of the memory, optional.
1987	* @param GCPhys The address to check.
1988	*/
1989	VMMR3DECL(bool) PGMR3PhysMMIO2IsBase(PVM pVM, PPDMDEVINS pDevIns, RTGCPHYS GCPhys)
1990	{
1991	/*
1992	* Validate input
1993	*/
1994	VM_ASSERT_EMT_RETURN(pVM, false);
1995	AssertPtrReturn(pDevIns, false);
1996	AssertReturn(GCPhys != NIL_RTGCPHYS, false);
1997	AssertReturn(GCPhys != 0, false);
1998	AssertReturn(!(GCPhys & PAGE_OFFSET_MASK), false);
1999
2000	/*
2001	* Search the list.
2002	*/
2003	pgmLock(pVM);
2004	for (PPGMMMIO2RANGE pCur = pVM->pgm.s.pMmio2RangesR3; pCur; pCur = pCur->pNextR3)
2005	if (pCur->RamRange.GCPhys == GCPhys)
2006	{
2007	Assert(pCur->fMapped);
2008	pgmUnlock(pVM);
2009	return true;
2010	}
2011	pgmUnlock(pVM);
2012	return false;
2013	}
2014
2015
2016	/**
2017	* Gets the HC physical address of a page in the MMIO2 region.
2018	*
2019	* This is API is intended for MMHyper and shouldn't be called
2020	* by anyone else...
2021	*
2022	* @returns VBox status code.
2023	* @param pVM Pointer to the shared VM structure.
2024	* @param pDevIns The owner of the memory, optional.
2025	* @param iRegion The region.
2026	* @param off The page expressed an offset into the MMIO2 region.
2027	* @param pHCPhys Where to store the result.
2028	*/
2029	VMMR3DECL(int) PGMR3PhysMMIO2GetHCPhys(PVM pVM, PPDMDEVINS pDevIns, uint32_t iRegion, RTGCPHYS off, PRTHCPHYS pHCPhys)
2030	{
2031	/*
2032	* Validate input
2033	*/
2034	VM_ASSERT_EMT_RETURN(pVM, VERR_VM_THREAD_NOT_EMT);
2035	AssertPtrReturn(pDevIns, VERR_INVALID_PARAMETER);
2036	AssertReturn(iRegion <= UINT8_MAX, VERR_INVALID_PARAMETER);
2037
2038	pgmLock(pVM);
2039	PPGMMMIO2RANGE pCur = pgmR3PhysMMIO2Find(pVM, pDevIns, iRegion);
2040	AssertReturn(pCur, VERR_NOT_FOUND);
2041	AssertReturn(off < pCur->RamRange.cb, VERR_INVALID_PARAMETER);
2042
2043	PCPGMPAGE pPage = &pCur->RamRange.aPages[off >> PAGE_SHIFT];
2044	*pHCPhys = PGM_PAGE_GET_HCPHYS(pPage);
2045	pgmUnlock(pVM);
2046	return VINF_SUCCESS;
2047	}
2048
2049
2050	/**
2051	* Maps a portion of an MMIO2 region into kernel space (host).
2052	*
2053	* The kernel mapping will become invalid when the MMIO2 memory is deregistered
2054	* or the VM is terminated.
2055	*
2056	* @return VBox status code.
2057	*
2058	* @param pVM Pointer to the shared VM structure.
2059	* @param pDevIns The device owning the MMIO2 memory.
2060	* @param iRegion The region.
2061	* @param off The offset into the region. Must be page aligned.
2062	* @param cb The number of bytes to map. Must be page aligned.
2063	* @param pszDesc Mapping description.
2064	* @param pR0Ptr Where to store the R0 address.
2065	*/
2066	VMMR3DECL(int) PGMR3PhysMMIO2MapKernel(PVM pVM, PPDMDEVINS pDevIns, uint32_t iRegion, RTGCPHYS off, RTGCPHYS cb,
2067	const char *pszDesc, PRTR0PTR pR0Ptr)
2068	{
2069	/*
2070	* Validate input.
2071	*/
2072	VM_ASSERT_EMT_RETURN(pVM, VERR_VM_THREAD_NOT_EMT);
2073	AssertPtrReturn(pDevIns, VERR_INVALID_PARAMETER);
2074	AssertReturn(iRegion <= UINT8_MAX, VERR_INVALID_PARAMETER);
2075
2076	PPGMMMIO2RANGE pCur = pgmR3PhysMMIO2Find(pVM, pDevIns, iRegion);
2077	AssertReturn(pCur, VERR_NOT_FOUND);
2078	AssertReturn(off < pCur->RamRange.cb, VERR_INVALID_PARAMETER);
2079	AssertReturn(cb <= pCur->RamRange.cb, VERR_INVALID_PARAMETER);
2080	AssertReturn(off + cb <= pCur->RamRange.cb, VERR_INVALID_PARAMETER);
2081
2082	/*
2083	* Pass the request on to the support library/driver.
2084	*/
2085	int rc = SUPR3PageMapKernel(pCur->pvR3, off, cb, 0, pR0Ptr);
2086
2087	return rc;
2088	}
2089
2090
2091	/**
2092	* Registers a ROM image.
2093	*
2094	* Shadowed ROM images requires double the amount of backing memory, so,
2095	* don't use that unless you have to. Shadowing of ROM images is process
2096	* where we can select where the reads go and where the writes go. On real
2097	* hardware the chipset provides means to configure this. We provide
2098	* PGMR3PhysProtectROM() for this purpose.
2099	*
2100	* A read-only copy of the ROM image will always be kept around while we
2101	* will allocate RAM pages for the changes on demand (unless all memory
2102	* is configured to be preallocated).
2103	*
2104	* @returns VBox status.
2105	* @param pVM VM Handle.
2106	* @param pDevIns The device instance owning the ROM.
2107	* @param GCPhys First physical address in the range.
2108	* Must be page aligned!
2109	* @param cbRange The size of the range (in bytes).
2110	* Must be page aligned!
2111	* @param pvBinary Pointer to the binary data backing the ROM image.
2112	* This must be exactly \a cbRange in size.
2113	* @param fFlags Mask of flags. PGMPHYS_ROM_FLAGS_SHADOWED
2114	* and/or PGMPHYS_ROM_FLAGS_PERMANENT_BINARY.
2115	* @param pszDesc Pointer to description string. This must not be freed.
2116	*
2117	* @remark There is no way to remove the rom, automatically on device cleanup or
2118	* manually from the device yet. This isn't difficult in any way, it's
2119	* just not something we expect to be necessary for a while.
2120	*/
2121	VMMR3DECL(int) PGMR3PhysRomRegister(PVM pVM, PPDMDEVINS pDevIns, RTGCPHYS GCPhys, RTGCPHYS cb,
2122	const void pvBinary, uint32_t fFlags, const char pszDesc)
2123	{
2124	Log(("PGMR3PhysRomRegister: pDevIns=%p GCPhys=%RGp(-%RGp) cb=%RGp pvBinary=%p fFlags=%#x pszDesc=%s\n",
2125	pDevIns, GCPhys, GCPhys + cb, cb, pvBinary, fFlags, pszDesc));
2126
2127	/*
2128	* Validate input.
2129	*/
2130	AssertPtrReturn(pDevIns, VERR_INVALID_PARAMETER);
2131	AssertReturn(RT_ALIGN_T(GCPhys, PAGE_SIZE, RTGCPHYS) == GCPhys, VERR_INVALID_PARAMETER);
2132	AssertReturn(RT_ALIGN_T(cb, PAGE_SIZE, RTGCPHYS) == cb, VERR_INVALID_PARAMETER);
2133	RTGCPHYS GCPhysLast = GCPhys + (cb - 1);
2134	AssertReturn(GCPhysLast > GCPhys, VERR_INVALID_PARAMETER);
2135	AssertPtrReturn(pvBinary, VERR_INVALID_PARAMETER);
2136	AssertPtrReturn(pszDesc, VERR_INVALID_POINTER);
2137	AssertReturn(!(fFlags & ~(PGMPHYS_ROM_FLAGS_SHADOWED \| PGMPHYS_ROM_FLAGS_PERMANENT_BINARY)), VERR_INVALID_PARAMETER);
2138	VM_ASSERT_STATE_RETURN(pVM, VMSTATE_CREATING, VERR_VM_INVALID_VM_STATE);
2139
2140	const uint32_t cPages = cb >> PAGE_SHIFT;
2141
2142	/*
2143	* Find the ROM location in the ROM list first.
2144	*/
2145	PPGMROMRANGE pRomPrev = NULL;
2146	PPGMROMRANGE pRom = pVM->pgm.s.pRomRangesR3;
2147	while (pRom && GCPhysLast >= pRom->GCPhys)
2148	{
2149	if ( GCPhys <= pRom->GCPhysLast
2150	&& GCPhysLast >= pRom->GCPhys)
2151	AssertLogRelMsgFailedReturn(("%RGp-%RGp (%s) conflicts with existing %RGp-%RGp (%s)\n",
2152	GCPhys, GCPhysLast, pszDesc,
2153	pRom->GCPhys, pRom->GCPhysLast, pRom->pszDesc),
2154	VERR_PGM_RAM_CONFLICT);
2155	/* next */
2156	pRomPrev = pRom;
2157	pRom = pRom->pNextR3;
2158	}
2159
2160	/*
2161	* Find the RAM location and check for conflicts.
2162	*
2163	* Conflict detection is a bit different than for RAM
2164	* registration since a ROM can be located within a RAM
2165	* range. So, what we have to check for is other memory
2166	* types (other than RAM that is) and that we don't span
2167	* more than one RAM range (layz).
2168	*/
2169	bool fRamExists = false;
2170	PPGMRAMRANGE pRamPrev = NULL;
2171	PPGMRAMRANGE pRam = pVM->pgm.s.pRamRangesR3;
2172	while (pRam && GCPhysLast >= pRam->GCPhys)
2173	{
2174	if ( GCPhys <= pRam->GCPhysLast
2175	&& GCPhysLast >= pRam->GCPhys)
2176	{
2177	/* completely within? */
2178	AssertLogRelMsgReturn( GCPhys >= pRam->GCPhys
2179	&& GCPhysLast <= pRam->GCPhysLast,
2180	("%RGp-%RGp (%s) falls partly outside %RGp-%RGp (%s)\n",
2181	GCPhys, GCPhysLast, pszDesc,
2182	pRam->GCPhys, pRam->GCPhysLast, pRam->pszDesc),
2183	VERR_PGM_RAM_CONFLICT);
2184	fRamExists = true;
2185	break;
2186	}
2187
2188	/* next */
2189	pRamPrev = pRam;
2190	pRam = pRam->pNextR3;
2191	}
2192	if (fRamExists)
2193	{
2194	PPGMPAGE pPage = &pRam->aPages[(GCPhys - pRam->GCPhys) >> PAGE_SHIFT];
2195	uint32_t cPagesLeft = cPages;
2196	while (cPagesLeft-- > 0)
2197	{
2198	AssertLogRelMsgReturn(PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_RAM,
2199	("%RGp (%R[pgmpage]) isn't a RAM page - registering %RGp-%RGp (%s).\n",
2200	pRam->GCPhys + ((RTGCPHYS)(uintptr_t)(pPage - &pRam->aPages[0]) << PAGE_SHIFT),
2201	pPage, GCPhys, GCPhysLast, pszDesc), VERR_PGM_RAM_CONFLICT);
2202	Assert(PGM_PAGE_IS_ZERO(pPage));
2203	pPage++;
2204	}
2205	}
2206
2207	/*
2208	* Update the base memory reservation if necessary.
2209	*/
2210	uint32_t cExtraBaseCost = fRamExists ? cPages : 0;
2211	if (fFlags & PGMPHYS_ROM_FLAGS_SHADOWED)
2212	cExtraBaseCost += cPages;
2213	if (cExtraBaseCost)
2214	{
2215	int rc = MMR3IncreaseBaseReservation(pVM, cExtraBaseCost);
2216	if (RT_FAILURE(rc))
2217	return rc;
2218	}
2219
2220	/*
2221	* Allocate memory for the virgin copy of the RAM.
2222	*/
2223	PGMMALLOCATEPAGESREQ pReq;
2224	int rc = GMMR3AllocatePagesPrepare(pVM, &pReq, cPages, GMMACCOUNT_BASE);
2225	AssertRCReturn(rc, rc);
2226
2227	for (uint32_t iPage = 0; iPage < cPages; iPage++)
2228	{
2229	pReq->aPages[iPage].HCPhysGCPhys = GCPhys + (iPage << PAGE_SHIFT);
2230	pReq->aPages[iPage].idPage = NIL_GMM_PAGEID;
2231	pReq->aPages[iPage].idSharedPage = NIL_GMM_PAGEID;
2232	}
2233
2234	pgmLock(pVM);
2235	rc = GMMR3AllocatePagesPerform(pVM, pReq);
2236	pgmUnlock(pVM);
2237	if (RT_FAILURE(rc))
2238	{
2239	GMMR3AllocatePagesCleanup(pReq);
2240	return rc;
2241	}
2242
2243	/*
2244	* Allocate the new ROM range and RAM range (if necessary).
2245	*/
2246	PPGMROMRANGE pRomNew;
2247	rc = MMHyperAlloc(pVM, RT_OFFSETOF(PGMROMRANGE, aPages[cPages]), 0, MM_TAG_PGM_PHYS, (void **)&pRomNew);
2248	if (RT_SUCCESS(rc))
2249	{
2250	PPGMRAMRANGE pRamNew = NULL;
2251	if (!fRamExists)
2252	rc = MMHyperAlloc(pVM, RT_OFFSETOF(PGMRAMRANGE, aPages[cPages]), sizeof(PGMPAGE), MM_TAG_PGM_PHYS, (void **)&pRamNew);
2253	if (RT_SUCCESS(rc))
2254	{
2255	pgmLock(pVM);
2256
2257	/*
2258	* Initialize and insert the RAM range (if required).
2259	*/
2260	PPGMROMPAGE pRomPage = &pRomNew->aPages[0];
2261	if (!fRamExists)
2262	{
2263	pRamNew->pSelfR0 = MMHyperCCToR0(pVM, pRamNew);
2264	pRamNew->pSelfRC = MMHyperCCToRC(pVM, pRamNew);
2265	pRamNew->GCPhys = GCPhys;
2266	pRamNew->GCPhysLast = GCPhysLast;
2267	pRamNew->cb = cb;
2268	pRamNew->pszDesc = pszDesc;
2269	pRamNew->fFlags = PGM_RAM_RANGE_FLAGS_AD_HOC_ROM;
2270	pRamNew->pvR3 = NULL;
2271	pRamNew->paLSPages = NULL;
2272
2273	PPGMPAGE pPage = &pRamNew->aPages[0];
2274	for (uint32_t iPage = 0; iPage < cPages; iPage++, pPage++, pRomPage++)
2275	{
2276	PGM_PAGE_INIT(pPage,
2277	pReq->aPages[iPage].HCPhysGCPhys,
2278	pReq->aPages[iPage].idPage,
2279	PGMPAGETYPE_ROM,
2280	PGM_PAGE_STATE_ALLOCATED);
2281
2282	pRomPage->Virgin = *pPage;
2283	}
2284
2285	pVM->pgm.s.cAllPages += cPages;
2286	pgmR3PhysLinkRamRange(pVM, pRamNew, pRamPrev);
2287	}
2288	else
2289	{
2290	PPGMPAGE pPage = &pRam->aPages[(GCPhys - pRam->GCPhys) >> PAGE_SHIFT];
2291	for (uint32_t iPage = 0; iPage < cPages; iPage++, pPage++, pRomPage++)
2292	{
2293	PGM_PAGE_SET_TYPE(pPage, PGMPAGETYPE_ROM);
2294	PGM_PAGE_SET_HCPHYS(pPage, pReq->aPages[iPage].HCPhysGCPhys);
2295	PGM_PAGE_SET_STATE(pPage, PGM_PAGE_STATE_ALLOCATED);
2296	PGM_PAGE_SET_PAGEID(pPage, pReq->aPages[iPage].idPage);
2297
2298	pRomPage->Virgin = *pPage;
2299	}
2300
2301	pRamNew = pRam;
2302
2303	pVM->pgm.s.cZeroPages -= cPages;
2304	}
2305	pVM->pgm.s.cPrivatePages += cPages;
2306
2307	pgmUnlock(pVM);
2308
2309
2310	/*
2311	* !HACK ALERT! REM + (Shadowed) ROM ==> mess.
2312	*
2313	* If it's shadowed we'll register the handler after the ROM notification
2314	* so we get the access handler callbacks that we should. If it isn't
2315	* shadowed we'll do it the other way around to make REM use the built-in
2316	* ROM behavior and not the handler behavior (which is to route all access
2317	* to PGM atm).
2318	*/
2319	if (fFlags & PGMPHYS_ROM_FLAGS_SHADOWED)
2320	{
2321	REMR3NotifyPhysRomRegister(pVM, GCPhys, cb, NULL, true /* fShadowed */);
2322	rc = PGMR3HandlerPhysicalRegister(pVM,
2323	fFlags & PGMPHYS_ROM_FLAGS_SHADOWED
2324	? PGMPHYSHANDLERTYPE_PHYSICAL_ALL
2325	: PGMPHYSHANDLERTYPE_PHYSICAL_WRITE,
2326	GCPhys, GCPhysLast,
2327	pgmR3PhysRomWriteHandler, pRomNew,
2328	NULL, "pgmPhysRomWriteHandler", MMHyperCCToR0(pVM, pRomNew),
2329	NULL, "pgmPhysRomWriteHandler", MMHyperCCToRC(pVM, pRomNew), pszDesc);
2330	}
2331	else
2332	{
2333	rc = PGMR3HandlerPhysicalRegister(pVM,
2334	fFlags & PGMPHYS_ROM_FLAGS_SHADOWED
2335	? PGMPHYSHANDLERTYPE_PHYSICAL_ALL
2336	: PGMPHYSHANDLERTYPE_PHYSICAL_WRITE,
2337	GCPhys, GCPhysLast,
2338	pgmR3PhysRomWriteHandler, pRomNew,
2339	NULL, "pgmPhysRomWriteHandler", MMHyperCCToR0(pVM, pRomNew),
2340	NULL, "pgmPhysRomWriteHandler", MMHyperCCToRC(pVM, pRomNew), pszDesc);
2341	REMR3NotifyPhysRomRegister(pVM, GCPhys, cb, NULL, false /* fShadowed */);
2342	}
2343	if (RT_SUCCESS(rc))
2344	{
2345	pgmLock(pVM);
2346
2347	/*
2348	* Copy the image over to the virgin pages.
2349	* This must be done after linking in the RAM range.
2350	*/
2351	PPGMPAGE pRamPage = &pRamNew->aPages[(GCPhys - pRamNew->GCPhys) >> PAGE_SHIFT];
2352	for (uint32_t iPage = 0; iPage < cPages; iPage++, pRamPage++)
2353	{
2354	void *pvDstPage;
2355	rc = pgmPhysPageMap(pVM, pRamPage, GCPhys + (iPage << PAGE_SHIFT), &pvDstPage);
2356	if (RT_FAILURE(rc))
2357	{
2358	VMSetError(pVM, rc, RT_SRC_POS, "Failed to map virgin ROM page at %RGp", GCPhys);
2359	break;
2360	}
2361	memcpy(pvDstPage, (const uint8_t *)pvBinary + (iPage << PAGE_SHIFT), PAGE_SIZE);
2362	}
2363	if (RT_SUCCESS(rc))
2364	{
2365	/*
2366	* Initialize the ROM range.
2367	* Note that the Virgin member of the pages has already been initialized above.
2368	*/
2369	pRomNew->GCPhys = GCPhys;
2370	pRomNew->GCPhysLast = GCPhysLast;
2371	pRomNew->cb = cb;
2372	pRomNew->fFlags = fFlags;
2373	pRomNew->idSavedState = UINT8_MAX;
2374	pRomNew->pvOriginal = fFlags & PGMPHYS_ROM_FLAGS_PERMANENT_BINARY ? pvBinary : NULL;
2375	pRomNew->pszDesc = pszDesc;
2376
2377	for (unsigned iPage = 0; iPage < cPages; iPage++)
2378	{
2379	PPGMROMPAGE pPage = &pRomNew->aPages[iPage];
2380	pPage->enmProt = PGMROMPROT_READ_ROM_WRITE_IGNORE;
2381	PGM_PAGE_INIT_ZERO(&pPage->Shadow, pVM, PGMPAGETYPE_ROM_SHADOW);
2382	}
2383
2384	/* update the page count stats */
2385	pVM->pgm.s.cZeroPages += cPages;
2386	pVM->pgm.s.cAllPages += cPages;
2387
2388	/*
2389	* Insert the ROM range, tell REM and return successfully.
2390	*/
2391	pRomNew->pNextR3 = pRom;
2392	pRomNew->pNextR0 = pRom ? MMHyperCCToR0(pVM, pRom) : NIL_RTR0PTR;
2393	pRomNew->pNextRC = pRom ? MMHyperCCToRC(pVM, pRom) : NIL_RTRCPTR;
2394
2395	if (pRomPrev)
2396	{
2397	pRomPrev->pNextR3 = pRomNew;
2398	pRomPrev->pNextR0 = MMHyperCCToR0(pVM, pRomNew);
2399	pRomPrev->pNextRC = MMHyperCCToRC(pVM, pRomNew);
2400	}
2401	else
2402	{
2403	pVM->pgm.s.pRomRangesR3 = pRomNew;
2404	pVM->pgm.s.pRomRangesR0 = MMHyperCCToR0(pVM, pRomNew);
2405	pVM->pgm.s.pRomRangesRC = MMHyperCCToRC(pVM, pRomNew);
2406	}
2407
2408	GMMR3AllocatePagesCleanup(pReq);
2409	pgmUnlock(pVM);
2410	return VINF_SUCCESS;
2411	}
2412
2413	/* bail out */
2414
2415	pgmUnlock(pVM);
2416	int rc2 = PGMHandlerPhysicalDeregister(pVM, GCPhys);
2417	AssertRC(rc2);
2418	pgmLock(pVM);
2419	}
2420
2421	if (!fRamExists)
2422	{
2423	pgmR3PhysUnlinkRamRange2(pVM, pRamNew, pRamPrev);
2424	MMHyperFree(pVM, pRamNew);
2425	}
2426	}
2427	MMHyperFree(pVM, pRomNew);
2428	}
2429
2430	/** @todo Purge the mapping cache or something... */
2431	GMMR3FreeAllocatedPages(pVM, pReq);
2432	GMMR3AllocatePagesCleanup(pReq);
2433	pgmUnlock(pVM);
2434	return rc;
2435	}
2436
2437
2438	/**
2439	* \#PF Handler callback for ROM write accesses.
2440	*
2441	* @returns VINF_SUCCESS if the handler have carried out the operation.
2442	* @returns VINF_PGM_HANDLER_DO_DEFAULT if the caller should carry out the access operation.
2443	* @param pVM VM Handle.
2444	* @param GCPhys The physical address the guest is writing to.
2445	* @param pvPhys The HC mapping of that address.
2446	* @param pvBuf What the guest is reading/writing.
2447	* @param cbBuf How much it's reading/writing.
2448	* @param enmAccessType The access type.
2449	* @param pvUser User argument.
2450	*/
2451	static DECLCALLBACK(int) pgmR3PhysRomWriteHandler(PVM pVM, RTGCPHYS GCPhys, void pvPhys, void pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType, void *pvUser)
2452	{
2453	PPGMROMRANGE pRom = (PPGMROMRANGE)pvUser;
2454	const uint32_t iPage = (GCPhys - pRom->GCPhys) >> PAGE_SHIFT;
2455	Assert(iPage < (pRom->cb >> PAGE_SHIFT));
2456	PPGMROMPAGE pRomPage = &pRom->aPages[iPage];
2457	Log5(("pgmR3PhysRomWriteHandler: %d %c %#08RGp %#04zx\n", pRomPage->enmProt, enmAccessType == PGMACCESSTYPE_READ ? 'R' : 'W', GCPhys, cbBuf));
2458
2459	if (enmAccessType == PGMACCESSTYPE_READ)
2460	{
2461	switch (pRomPage->enmProt)
2462	{
2463	/*
2464	* Take the default action.
2465	*/
2466	case PGMROMPROT_READ_ROM_WRITE_IGNORE:
2467	case PGMROMPROT_READ_RAM_WRITE_IGNORE:
2468	case PGMROMPROT_READ_ROM_WRITE_RAM:
2469	case PGMROMPROT_READ_RAM_WRITE_RAM:
2470	return VINF_PGM_HANDLER_DO_DEFAULT;
2471
2472	default:
2473	AssertMsgFailedReturn(("enmProt=%d iPage=%d GCPhys=%RGp\n",
2474	pRom->aPages[iPage].enmProt, iPage, GCPhys),
2475	VERR_INTERNAL_ERROR);
2476	}
2477	}
2478	else
2479	{
2480	Assert(enmAccessType == PGMACCESSTYPE_WRITE);
2481	switch (pRomPage->enmProt)
2482	{
2483	/*
2484	* Ignore writes.
2485	*/
2486	case PGMROMPROT_READ_ROM_WRITE_IGNORE:
2487	case PGMROMPROT_READ_RAM_WRITE_IGNORE:
2488	return VINF_SUCCESS;
2489
2490	/*
2491	* Write to the ram page.
2492	*/
2493	case PGMROMPROT_READ_ROM_WRITE_RAM:
2494	case PGMROMPROT_READ_RAM_WRITE_RAM: /* yes this will get here too, it's way simpler that way. */
2495	{
2496	/* This should be impossible now, pvPhys doesn't work cross page anylonger. */
2497	Assert(((GCPhys - pRom->GCPhys + cbBuf - 1) >> PAGE_SHIFT) == iPage);
2498
2499	/*
2500	* Take the lock, do lazy allocation, map the page and copy the data.
2501	*
2502	* Note that we have to bypass the mapping TLB since it works on
2503	* guest physical addresses and entering the shadow page would
2504	* kind of screw things up...
2505	*/
2506	int rc = pgmLock(pVM);
2507	AssertRC(rc);
2508
2509	PPGMPAGE pShadowPage = &pRomPage->Shadow;
2510	if (!PGMROMPROT_IS_ROM(pRomPage->enmProt))
2511	{
2512	pShadowPage = pgmPhysGetPage(&pVM->pgm.s, GCPhys);
2513	AssertLogRelReturn(pShadowPage, VERR_INTERNAL_ERROR);
2514	}
2515
2516	void *pvDstPage;
2517	rc = pgmPhysPageMakeWritableAndMap(pVM, pShadowPage, GCPhys & X86_PTE_PG_MASK, &pvDstPage);
2518	if (RT_SUCCESS(rc))
2519	{
2520	memcpy((uint8_t *)pvDstPage + (GCPhys & PAGE_OFFSET_MASK), pvBuf, cbBuf);
2521	pRomPage->LiveSave.fWrittenTo = true;
2522	}
2523
2524	pgmUnlock(pVM);
2525	return rc;
2526	}
2527
2528	default:
2529	AssertMsgFailedReturn(("enmProt=%d iPage=%d GCPhys=%RGp\n",
2530	pRom->aPages[iPage].enmProt, iPage, GCPhys),
2531	VERR_INTERNAL_ERROR);
2532	}
2533	}
2534	}
2535
2536
2537	/**
2538	* Called by PGMR3Reset to reset the shadow, switch to the virgin,
2539	* and verify that the virgin part is untouched.
2540	*
2541	* This is done after the normal memory has been cleared.
2542	*
2543	* ASSUMES that the caller owns the PGM lock.
2544	*
2545	* @param pVM The VM handle.
2546	*/
2547	int pgmR3PhysRomReset(PVM pVM)
2548	{
2549	Assert(PGMIsLockOwner(pVM));
2550	for (PPGMROMRANGE pRom = pVM->pgm.s.pRomRangesR3; pRom; pRom = pRom->pNextR3)
2551	{
2552	const uint32_t cPages = pRom->cb >> PAGE_SHIFT;
2553
2554	if (pRom->fFlags & PGMPHYS_ROM_FLAGS_SHADOWED)
2555	{
2556	/*
2557	* Reset the physical handler.
2558	*/
2559	int rc = PGMR3PhysRomProtect(pVM, pRom->GCPhys, pRom->cb, PGMROMPROT_READ_ROM_WRITE_IGNORE);
2560	AssertRCReturn(rc, rc);
2561
2562	/*
2563	* What we do with the shadow pages depends on the memory
2564	* preallocation option. If not enabled, we'll just throw
2565	* out all the dirty pages and replace them by the zero page.
2566	*/
2567	if (!pVM->pgm.s.fRamPreAlloc)
2568	{
2569	/* Free the dirty pages. */
2570	uint32_t cPendingPages = 0;
2571	PGMMFREEPAGESREQ pReq;
2572	rc = GMMR3FreePagesPrepare(pVM, &pReq, PGMPHYS_FREE_PAGE_BATCH_SIZE, GMMACCOUNT_BASE);
2573	AssertRCReturn(rc, rc);
2574
2575	for (uint32_t iPage = 0; iPage < cPages; iPage++)
2576	if (PGM_PAGE_GET_STATE(&pRom->aPages[iPage].Shadow) != PGM_PAGE_STATE_ZERO)
2577	{
2578	Assert(PGM_PAGE_GET_STATE(&pRom->aPages[iPage].Shadow) == PGM_PAGE_STATE_ALLOCATED);
2579	rc = pgmPhysFreePage(pVM, pReq, &cPendingPages, &pRom->aPages[iPage].Shadow, pRom->GCPhys + (iPage << PAGE_SHIFT));
2580	AssertLogRelRCReturn(rc, rc);
2581	}
2582
2583	if (cPendingPages)
2584	{
2585	rc = GMMR3FreePagesPerform(pVM, pReq, cPendingPages);
2586	AssertLogRelRCReturn(rc, rc);
2587	}
2588	GMMR3FreePagesCleanup(pReq);
2589	}
2590	else
2591	{
2592	/* clear all the shadow pages. */
2593	for (uint32_t iPage = 0; iPage < cPages; iPage++)
2594	{
2595	Assert(PGM_PAGE_GET_STATE(&pRom->aPages[iPage].Shadow) != PGM_PAGE_STATE_ZERO);
2596	void *pvDstPage;
2597	const RTGCPHYS GCPhys = pRom->GCPhys + (iPage << PAGE_SHIFT);
2598	rc = pgmPhysPageMakeWritableAndMap(pVM, &pRom->aPages[iPage].Shadow, GCPhys, &pvDstPage);
2599	if (RT_FAILURE(rc))
2600	break;
2601	ASMMemZeroPage(pvDstPage);
2602	}
2603	AssertRCReturn(rc, rc);
2604	}
2605	}
2606
2607	#ifdef VBOX_STRICT
2608	/*
2609	* Verify that the virgin page is unchanged if possible.
2610	*/
2611	if (pRom->pvOriginal)
2612	{
2613	uint8_t const pbSrcPage = (uint8_t const )pRom->pvOriginal;
2614	for (uint32_t iPage = 0; iPage < cPages; iPage++, pbSrcPage += PAGE_SIZE)
2615	{
2616	const RTGCPHYS GCPhys = pRom->GCPhys + (iPage << PAGE_SHIFT);
2617	void const *pvDstPage;
2618	int rc = pgmPhysPageMapReadOnly(pVM, &pRom->aPages[iPage].Virgin, GCPhys, &pvDstPage);
2619	if (RT_FAILURE(rc))
2620	break;
2621	if (memcmp(pvDstPage, pbSrcPage, PAGE_SIZE))
2622	LogRel(("pgmR3PhysRomReset: %RGp rom page changed (%s) - loaded saved state?\n",
2623	GCPhys, pRom->pszDesc));
2624	}
2625	}
2626	#endif
2627	}
2628
2629	return VINF_SUCCESS;
2630	}
2631
2632
2633	/**
2634	* Change the shadowing of a range of ROM pages.
2635	*
2636	* This is intended for implementing chipset specific memory registers
2637	* and will not be very strict about the input. It will silently ignore
2638	* any pages that are not the part of a shadowed ROM.
2639	*
2640	* @returns VBox status code.
2641	* @retval VINF_PGM_SYNC_CR3
2642	*
2643	* @param pVM Pointer to the shared VM structure.
2644	* @param GCPhys Where to start. Page aligned.
2645	* @param cb How much to change. Page aligned.
2646	* @param enmProt The new ROM protection.
2647	*/
2648	VMMR3DECL(int) PGMR3PhysRomProtect(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, PGMROMPROT enmProt)
2649	{
2650	/*
2651	* Check input
2652	*/
2653	if (!cb)
2654	return VINF_SUCCESS;
2655	AssertReturn(!(GCPhys & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
2656	AssertReturn(!(cb & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
2657	RTGCPHYS GCPhysLast = GCPhys + (cb - 1);
2658	AssertReturn(GCPhysLast > GCPhys, VERR_INVALID_PARAMETER);
2659	AssertReturn(enmProt >= PGMROMPROT_INVALID && enmProt <= PGMROMPROT_END, VERR_INVALID_PARAMETER);
2660
2661	/*
2662	* Process the request.
2663	*/
2664	pgmLock(pVM);
2665	int rc = VINF_SUCCESS;
2666	bool fFlushTLB = false;
2667	for (PPGMROMRANGE pRom = pVM->pgm.s.pRomRangesR3; pRom; pRom = pRom->pNextR3)
2668	{
2669	if ( GCPhys <= pRom->GCPhysLast
2670	&& GCPhysLast >= pRom->GCPhys
2671	&& (pRom->fFlags & PGMPHYS_ROM_FLAGS_SHADOWED))
2672	{
2673	/*
2674	* Iterate the relevant pages and make necessary the changes.
2675	*/
2676	bool fChanges = false;
2677	uint32_t const cPages = pRom->GCPhysLast <= GCPhysLast
2678	? pRom->cb >> PAGE_SHIFT
2679	: (GCPhysLast - pRom->GCPhys + 1) >> PAGE_SHIFT;
2680	for (uint32_t iPage = (GCPhys - pRom->GCPhys) >> PAGE_SHIFT;
2681	iPage < cPages;
2682	iPage++)
2683	{
2684	PPGMROMPAGE pRomPage = &pRom->aPages[iPage];
2685	if (PGMROMPROT_IS_ROM(pRomPage->enmProt) != PGMROMPROT_IS_ROM(enmProt))
2686	{
2687	fChanges = true;
2688
2689	/* flush references to the page. */
2690	PPGMPAGE pRamPage = pgmPhysGetPage(&pVM->pgm.s, pRom->GCPhys + (iPage << PAGE_SHIFT));
2691	int rc2 = pgmPoolTrackFlushGCPhys(pVM, pRamPage, &fFlushTLB);
2692	if (rc2 != VINF_SUCCESS && (rc == VINF_SUCCESS \|\| RT_FAILURE(rc2)))
2693	rc = rc2;
2694
2695	PPGMPAGE pOld = PGMROMPROT_IS_ROM(pRomPage->enmProt) ? &pRomPage->Virgin : &pRomPage->Shadow;
2696	PPGMPAGE pNew = PGMROMPROT_IS_ROM(pRomPage->enmProt) ? &pRomPage->Shadow : &pRomPage->Virgin;
2697
2698	pOld = pRamPage;
2699	pRamPage = pNew;
2700	/** @todo preserve the volatile flags (handlers) when these have been moved out of HCPhys! */
2701	}
2702	pRomPage->enmProt = enmProt;
2703	}
2704
2705	/*
2706	* Reset the access handler if we made changes, no need
2707	* to optimize this.
2708	*/
2709	if (fChanges)
2710	{
2711	int rc = PGMHandlerPhysicalReset(pVM, pRom->GCPhys);
2712	if (RT_FAILURE(rc))
2713	{
2714	pgmUnlock(pVM);
2715	AssertRC(rc);
2716	return rc;
2717	}
2718	}
2719
2720	/* Advance - cb isn't updated. */
2721	GCPhys = pRom->GCPhys + (cPages << PAGE_SHIFT);
2722	}
2723	}
2724	pgmUnlock(pVM);
2725	if (fFlushTLB)
2726	PGM_INVL_ALL_VCPU_TLBS(pVM);
2727
2728	return rc;
2729	}
2730
2731
2732	/**
2733	* Sets the Address Gate 20 state.
2734	*
2735	* @param pVCpu The VCPU to operate on.
2736	* @param fEnable True if the gate should be enabled.
2737	* False if the gate should be disabled.
2738	*/
2739	VMMDECL(void) PGMR3PhysSetA20(PVMCPU pVCpu, bool fEnable)
2740	{
2741	LogFlow(("PGMR3PhysSetA20 %d (was %d)\n", fEnable, pVCpu->pgm.s.fA20Enabled));
2742	if (pVCpu->pgm.s.fA20Enabled != fEnable)
2743	{
2744	pVCpu->pgm.s.fA20Enabled = fEnable;
2745	pVCpu->pgm.s.GCPhysA20Mask = ~(RTGCPHYS)(!fEnable << 20);
2746	REMR3A20Set(pVCpu->pVMR3, pVCpu, fEnable);
2747	/** @todo we're not handling this correctly for VT-x / AMD-V. See #2911 */
2748	}
2749	}
2750
2751
2752	/**
2753	* Tree enumeration callback for dealing with age rollover.
2754	* It will perform a simple compression of the current age.
2755	*/
2756	static DECLCALLBACK(int) pgmR3PhysChunkAgeingRolloverCallback(PAVLU32NODECORE pNode, void *pvUser)
2757	{
2758	Assert(PGMIsLockOwner((PVM)pvUser));
2759	/* Age compression - ASSUMES iNow == 4. */
2760	PPGMCHUNKR3MAP pChunk = (PPGMCHUNKR3MAP)pNode;
2761	if (pChunk->iAge >= UINT32_C(0xffffff00))
2762	pChunk->iAge = 3;
2763	else if (pChunk->iAge >= UINT32_C(0xfffff000))
2764	pChunk->iAge = 2;
2765	else if (pChunk->iAge)
2766	pChunk->iAge = 1;
2767	else /* iAge = 0 */
2768	pChunk->iAge = 4;
2769
2770	/* reinsert */
2771	PVM pVM = (PVM)pvUser;
2772	RTAvllU32Remove(&pVM->pgm.s.ChunkR3Map.pAgeTree, pChunk->AgeCore.Key);
2773	pChunk->AgeCore.Key = pChunk->iAge;
2774	RTAvllU32Insert(&pVM->pgm.s.ChunkR3Map.pAgeTree, &pChunk->AgeCore);
2775	return 0;
2776	}
2777
2778
2779	/**
2780	* Tree enumeration callback that updates the chunks that have
2781	* been used since the last
2782	*/
2783	static DECLCALLBACK(int) pgmR3PhysChunkAgeingCallback(PAVLU32NODECORE pNode, void *pvUser)
2784	{
2785	PPGMCHUNKR3MAP pChunk = (PPGMCHUNKR3MAP)pNode;
2786	if (!pChunk->iAge)
2787	{
2788	PVM pVM = (PVM)pvUser;
2789	RTAvllU32Remove(&pVM->pgm.s.ChunkR3Map.pAgeTree, pChunk->AgeCore.Key);
2790	pChunk->AgeCore.Key = pChunk->iAge = pVM->pgm.s.ChunkR3Map.iNow;
2791	RTAvllU32Insert(&pVM->pgm.s.ChunkR3Map.pAgeTree, &pChunk->AgeCore);
2792	}
2793
2794	return 0;
2795	}
2796
2797
2798	/**
2799	* Performs ageing of the ring-3 chunk mappings.
2800	*
2801	* @param pVM The VM handle.
2802	*/
2803	VMMR3DECL(void) PGMR3PhysChunkAgeing(PVM pVM)
2804	{
2805	pgmLock(pVM);
2806	pVM->pgm.s.ChunkR3Map.AgeingCountdown = RT_MIN(pVM->pgm.s.ChunkR3Map.cMax / 4, 1024);
2807	pVM->pgm.s.ChunkR3Map.iNow++;
2808	if (pVM->pgm.s.ChunkR3Map.iNow == 0)
2809	{
2810	pVM->pgm.s.ChunkR3Map.iNow = 4;
2811	RTAvlU32DoWithAll(&pVM->pgm.s.ChunkR3Map.pTree, true /fFromLeft/, pgmR3PhysChunkAgeingRolloverCallback, pVM);
2812	}
2813	else
2814	RTAvlU32DoWithAll(&pVM->pgm.s.ChunkR3Map.pTree, true /fFromLeft/, pgmR3PhysChunkAgeingCallback, pVM);
2815	pgmUnlock(pVM);
2816	}
2817
2818
2819	/**
2820	* The structure passed in the pvUser argument of pgmR3PhysChunkUnmapCandidateCallback().
2821	*/
2822	typedef struct PGMR3PHYSCHUNKUNMAPCB
2823	{
2824	PVM pVM; /*< The VM handle. /
2825	PPGMCHUNKR3MAP pChunk; /*< The chunk to unmap. /
2826	} PGMR3PHYSCHUNKUNMAPCB, *PPGMR3PHYSCHUNKUNMAPCB;
2827
2828
2829	/**
2830	* Callback used to find the mapping that's been unused for
2831	* the longest time.
2832	*/
2833	static DECLCALLBACK(int) pgmR3PhysChunkUnmapCandidateCallback(PAVLLU32NODECORE pNode, void *pvUser)
2834	{
2835	do
2836	{
2837	PPGMCHUNKR3MAP pChunk = (PPGMCHUNKR3MAP)((uint8_t *)pNode - RT_OFFSETOF(PGMCHUNKR3MAP, AgeCore));
2838	if ( pChunk->iAge
2839	&& !pChunk->cRefs)
2840	{
2841	/*
2842	* Check that it's not in any of the TLBs.
2843	*/
2844	PVM pVM = ((PPGMR3PHYSCHUNKUNMAPCB)pvUser)->pVM;
2845	for (unsigned i = 0; i < RT_ELEMENTS(pVM->pgm.s.ChunkR3Map.Tlb.aEntries); i++)
2846	if (pVM->pgm.s.ChunkR3Map.Tlb.aEntries[i].pChunk == pChunk)
2847	{
2848	pChunk = NULL;
2849	break;
2850	}
2851	if (pChunk)
2852	for (unsigned i = 0; i < RT_ELEMENTS(pVM->pgm.s.PhysTlbHC.aEntries); i++)
2853	if (pVM->pgm.s.PhysTlbHC.aEntries[i].pMap == pChunk)
2854	{
2855	pChunk = NULL;
2856	break;
2857	}
2858	if (pChunk)
2859	{
2860	((PPGMR3PHYSCHUNKUNMAPCB)pvUser)->pChunk = pChunk;
2861	return 1; /* done */
2862	}
2863	}
2864
2865	/* next with the same age - this version of the AVL API doesn't enumerate the list, so we have to do it. */
2866	pNode = pNode->pList;
2867	} while (pNode);
2868	return 0;
2869	}
2870
2871
2872	/**
2873	* Finds a good candidate for unmapping when the ring-3 mapping cache is full.
2874	*
2875	* The candidate will not be part of any TLBs, so no need to flush
2876	* anything afterwards.
2877	*
2878	* @returns Chunk id.
2879	* @param pVM The VM handle.
2880	*/
2881	static int32_t pgmR3PhysChunkFindUnmapCandidate(PVM pVM)
2882	{
2883	Assert(PGMIsLockOwner(pVM));
2884
2885	/*
2886	* Do tree ageing first?
2887	*/
2888	if (pVM->pgm.s.ChunkR3Map.AgeingCountdown-- == 0)
2889	PGMR3PhysChunkAgeing(pVM);
2890
2891	/*
2892	* Enumerate the age tree starting with the left most node.
2893	*/
2894	PGMR3PHYSCHUNKUNMAPCB Args;
2895	Args.pVM = pVM;
2896	Args.pChunk = NULL;
2897	if (RTAvllU32DoWithAll(&pVM->pgm.s.ChunkR3Map.pAgeTree, true /fFromLeft/, pgmR3PhysChunkUnmapCandidateCallback, pVM))
2898	return Args.pChunk->Core.Key;
2899	return INT32_MAX;
2900	}
2901
2902
2903	/**
2904	* Maps the given chunk into the ring-3 mapping cache.
2905	*
2906	* This will call ring-0.
2907	*
2908	* @returns VBox status code.
2909	* @param pVM The VM handle.
2910	* @param idChunk The chunk in question.
2911	* @param ppChunk Where to store the chunk tracking structure.
2912	*
2913	* @remarks Called from within the PGM critical section.
2914	*/
2915	int pgmR3PhysChunkMap(PVM pVM, uint32_t idChunk, PPPGMCHUNKR3MAP ppChunk)
2916	{
2917	int rc;
2918
2919	Assert(PGMIsLockOwner(pVM));
2920	/*
2921	* Allocate a new tracking structure first.
2922	*/
2923	#ifdef VBOX_WITH_2X_4GB_ADDR_SPACE
2924	PPGMCHUNKR3MAP pChunk = (PPGMCHUNKR3MAP)MMR3HeapAlloc(pVM, MM_TAG_PGM_CHUNK_MAPPING, sizeof(*pChunk));
2925	#else
2926	PPGMCHUNKR3MAP pChunk = (PPGMCHUNKR3MAP)MMR3UkHeapAlloc(pVM, MM_TAG_PGM_CHUNK_MAPPING, sizeof(*pChunk), NULL);
2927	#endif
2928	AssertReturn(pChunk, VERR_NO_MEMORY);
2929	pChunk->Core.Key = idChunk;
2930	pChunk->AgeCore.Key = pVM->pgm.s.ChunkR3Map.iNow;
2931	pChunk->iAge = 0;
2932	pChunk->cRefs = 0;
2933	pChunk->cPermRefs = 0;
2934	pChunk->pv = NULL;
2935
2936	/*
2937	* Request the ring-0 part to map the chunk in question and if
2938	* necessary unmap another one to make space in the mapping cache.
2939	*/
2940	GMMMAPUNMAPCHUNKREQ Req;
2941	Req.Hdr.u32Magic = SUPVMMR0REQHDR_MAGIC;
2942	Req.Hdr.cbReq = sizeof(Req);
2943	Req.pvR3 = NULL;
2944	Req.idChunkMap = idChunk;
2945	Req.idChunkUnmap = NIL_GMM_CHUNKID;
2946	if (pVM->pgm.s.ChunkR3Map.c >= pVM->pgm.s.ChunkR3Map.cMax)
2947	Req.idChunkUnmap = pgmR3PhysChunkFindUnmapCandidate(pVM);
2948	/** @todo This is wrong. Any thread in the VM process should be able to do this,
2949	* there are depenenecies on this. What currently saves the day is that
2950	* we don't unmap anything and that all non-zero memory will therefore
2951	* be present when non-EMTs tries to access it. */
2952	rc = VMMR3CallR0(pVM, VMMR0_DO_GMM_MAP_UNMAP_CHUNK, 0, &Req.Hdr);
2953	if (RT_SUCCESS(rc))
2954	{
2955	/*
2956	* Update the tree.
2957	*/
2958	/* insert the new one. */
2959	AssertPtr(Req.pvR3);
2960	pChunk->pv = Req.pvR3;
2961	bool fRc = RTAvlU32Insert(&pVM->pgm.s.ChunkR3Map.pTree, &pChunk->Core);
2962	AssertRelease(fRc);
2963	pVM->pgm.s.ChunkR3Map.c++;
2964
2965	fRc = RTAvllU32Insert(&pVM->pgm.s.ChunkR3Map.pAgeTree, &pChunk->AgeCore);
2966	AssertRelease(fRc);
2967
2968	/* remove the unmapped one. */
2969	if (Req.idChunkUnmap != NIL_GMM_CHUNKID)
2970	{
2971	PPGMCHUNKR3MAP pUnmappedChunk = (PPGMCHUNKR3MAP)RTAvlU32Remove(&pVM->pgm.s.ChunkR3Map.pTree, Req.idChunkUnmap);
2972	AssertRelease(pUnmappedChunk);
2973	pUnmappedChunk->pv = NULL;
2974	pUnmappedChunk->Core.Key = UINT32_MAX;
2975	#ifdef VBOX_WITH_2X_4GB_ADDR_SPACE
2976	MMR3HeapFree(pUnmappedChunk);
2977	#else
2978	MMR3UkHeapFree(pVM, pUnmappedChunk, MM_TAG_PGM_CHUNK_MAPPING);
2979	#endif
2980	pVM->pgm.s.ChunkR3Map.c--;
2981	}
2982	}
2983	else
2984	{
2985	AssertRC(rc);
2986	#ifdef VBOX_WITH_2X_4GB_ADDR_SPACE
2987	MMR3HeapFree(pChunk);
2988	#else
2989	MMR3UkHeapFree(pVM, pChunk, MM_TAG_PGM_CHUNK_MAPPING);
2990	#endif
2991	pChunk = NULL;
2992	}
2993
2994	*ppChunk = pChunk;
2995	return rc;
2996	}
2997
2998
2999	/**
3000	* For VMMCALLRING3_PGM_MAP_CHUNK, considered internal.
3001	*
3002	* @returns see pgmR3PhysChunkMap.
3003	* @param pVM The VM handle.
3004	* @param idChunk The chunk to map.
3005	*/
3006	VMMR3DECL(int) PGMR3PhysChunkMap(PVM pVM, uint32_t idChunk)
3007	{
3008	PPGMCHUNKR3MAP pChunk;
3009	int rc;
3010
3011	pgmLock(pVM);
3012	rc = pgmR3PhysChunkMap(pVM, idChunk, &pChunk);
3013	pgmUnlock(pVM);
3014	return rc;
3015	}
3016
3017
3018	/**
3019	* Invalidates the TLB for the ring-3 mapping cache.
3020	*
3021	* @param pVM The VM handle.
3022	*/
3023	VMMR3DECL(void) PGMR3PhysChunkInvalidateTLB(PVM pVM)
3024	{
3025	pgmLock(pVM);
3026	for (unsigned i = 0; i < RT_ELEMENTS(pVM->pgm.s.ChunkR3Map.Tlb.aEntries); i++)
3027	{
3028	pVM->pgm.s.ChunkR3Map.Tlb.aEntries[i].idChunk = NIL_GMM_CHUNKID;
3029	pVM->pgm.s.ChunkR3Map.Tlb.aEntries[i].pChunk = NULL;
3030	}
3031	pgmUnlock(pVM);
3032	}
3033
3034
3035	/**
3036	* Response to VM_FF_PGM_NEED_HANDY_PAGES and VMMCALLRING3_PGM_ALLOCATE_HANDY_PAGES.
3037	*
3038	* This function will also work the VM_FF_PGM_NO_MEMORY force action flag, to
3039	* signal and clear the out of memory condition. When contracted, this API is
3040	* used to try clear the condition when the user wants to resume.
3041	*
3042	* @returns The following VBox status codes.
3043	* @retval VINF_SUCCESS on success. FFs cleared.
3044	* @retval VINF_EM_NO_MEMORY if we're out of memory. The FF is not cleared in
3045	* this case and it gets accompanied by VM_FF_PGM_NO_MEMORY.
3046	*
3047	* @param pVM The VM handle.
3048	*
3049	* @remarks The VINF_EM_NO_MEMORY status is for the benefit of the FF processing
3050	* in EM.cpp and shouldn't be propagated outside TRPM, HWACCM, EM and
3051	* pgmPhysEnsureHandyPage. There is one exception to this in the \#PF
3052	* handler.
3053	*/
3054	VMMR3DECL(int) PGMR3PhysAllocateHandyPages(PVM pVM)
3055	{
3056	pgmLock(pVM);
3057
3058	/*
3059	* Allocate more pages, noting down the index of the first new page.
3060	*/
3061	uint32_t iClear = pVM->pgm.s.cHandyPages;
3062	AssertMsgReturn(iClear <= RT_ELEMENTS(pVM->pgm.s.aHandyPages), ("%d", iClear), VERR_INTERNAL_ERROR);
3063	Log(("PGMR3PhysAllocateHandyPages: %d -> %d\n", iClear, RT_ELEMENTS(pVM->pgm.s.aHandyPages)));
3064	int rcAlloc = VINF_SUCCESS;
3065	int rcSeed = VINF_SUCCESS;
3066	int rc = VMMR3CallR0(pVM, VMMR0_DO_PGM_ALLOCATE_HANDY_PAGES, 0, NULL);
3067	while (rc == VERR_GMM_SEED_ME)
3068	{
3069	void *pvChunk;
3070	rcAlloc = rc = SUPR3PageAlloc(GMM_CHUNK_SIZE >> PAGE_SHIFT, &pvChunk);
3071	if (RT_SUCCESS(rc))
3072	{
3073	rcSeed = rc = VMMR3CallR0(pVM, VMMR0_DO_GMM_SEED_CHUNK, (uintptr_t)pvChunk, NULL);
3074	if (RT_FAILURE(rc))
3075	SUPR3PageFree(pvChunk, GMM_CHUNK_SIZE >> PAGE_SHIFT);
3076	}
3077	if (RT_SUCCESS(rc))
3078	rc = VMMR3CallR0(pVM, VMMR0_DO_PGM_ALLOCATE_HANDY_PAGES, 0, NULL);
3079	}
3080
3081	if (RT_SUCCESS(rc))
3082	{
3083	AssertMsg(rc == VINF_SUCCESS, ("%Rrc\n", rc));
3084	Assert(pVM->pgm.s.cHandyPages > 0);
3085	VM_FF_CLEAR(pVM, VM_FF_PGM_NEED_HANDY_PAGES);
3086	VM_FF_CLEAR(pVM, VM_FF_PGM_NO_MEMORY);
3087
3088	/*
3089	* Clear the pages.
3090	*/
3091	while (iClear < pVM->pgm.s.cHandyPages)
3092	{
3093	PGMMPAGEDESC pPage = &pVM->pgm.s.aHandyPages[iClear];
3094	void *pv;
3095	rc = pgmPhysPageMapByPageID(pVM, pPage->idPage, pPage->HCPhysGCPhys, &pv);
3096	AssertLogRelMsgBreak(RT_SUCCESS(rc), ("idPage=%#x HCPhysGCPhys=%RHp rc=%Rrc", pPage->idPage, pPage->HCPhysGCPhys, rc));
3097	ASMMemZeroPage(pv);
3098	iClear++;
3099	Log3(("PGMR3PhysAllocateHandyPages: idPage=%#x HCPhys=%RGp\n", pPage->idPage, pPage->HCPhysGCPhys));
3100	}
3101	}
3102	else
3103	{
3104	/*
3105	* We should never get here unless there is a genuine shortage of
3106	* memory (or some internal error). Flag the error so the VM can be
3107	* suspended ASAP and the user informed. If we're totally out of
3108	* handy pages we will return failure.
3109	*/
3110	/* Report the failure. */
3111	LogRel(("PGM: Failed to procure handy pages; rc=%Rrc rcAlloc=%Rrc rcSeed=%Rrc cHandyPages=%#x\n"
3112	" cAllPages=%#x cPrivatePages=%#x cSharedPages=%#x cZeroPages=%#x\n",
3113	rc, rcAlloc, rcSeed,
3114	pVM->pgm.s.cHandyPages,
3115	pVM->pgm.s.cAllPages,
3116	pVM->pgm.s.cPrivatePages,
3117	pVM->pgm.s.cSharedPages,
3118	pVM->pgm.s.cZeroPages));
3119	if ( rc != VERR_NO_MEMORY
3120	&& rc != VERR_LOCK_FAILED)
3121	{
3122	for (uint32_t i = 0; i < RT_ELEMENTS(pVM->pgm.s.aHandyPages); i++)
3123	{
3124	LogRel(("PGM: aHandyPages[#%#04x] = {.HCPhysGCPhys=%RHp, .idPage=%#08x, .idSharedPage=%#08x}\n",
3125	i, pVM->pgm.s.aHandyPages[i].HCPhysGCPhys, pVM->pgm.s.aHandyPages[i].idPage,
3126	pVM->pgm.s.aHandyPages[i].idSharedPage));
3127	uint32_t const idPage = pVM->pgm.s.aHandyPages[i].idPage;
3128	if (idPage != NIL_GMM_PAGEID)
3129	{
3130	for (PPGMRAMRANGE pRam = pVM->pgm.s.pRamRangesR3;
3131	pRam;
3132	pRam = pRam->pNextR3)
3133	{
3134	uint32_t const cPages = pRam->cb >> PAGE_SHIFT;
3135	for (uint32_t iPage = 0; iPage < cPages; iPage++)
3136	if (PGM_PAGE_GET_PAGEID(&pRam->aPages[iPage]) == idPage)
3137	LogRel(("PGM: Used by %RGp %R[pgmpage] (%s)\n",
3138	pRam->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT), &pRam->aPages[iPage], pRam->pszDesc));
3139	}
3140	}
3141	}
3142	}
3143
3144	/* Set the FFs and adjust rc. */
3145	VM_FF_SET(pVM, VM_FF_PGM_NEED_HANDY_PAGES);
3146	VM_FF_SET(pVM, VM_FF_PGM_NO_MEMORY);
3147	if ( rc == VERR_NO_MEMORY
3148	\|\| rc == VERR_LOCK_FAILED)
3149	rc = VINF_EM_NO_MEMORY;
3150	}
3151
3152	pgmUnlock(pVM);
3153	return rc;
3154	}
3155
3156
3157	/**
3158	* Frees the specified RAM page and replaces it with the ZERO page.
3159	*
3160	* This is used by ballooning, remapping MMIO2 and RAM reset.
3161	*
3162	* @param pVM Pointer to the shared VM structure.
3163	* @param pReq Pointer to the request.
3164	* @param pPage Pointer to the page structure.
3165	* @param GCPhys The guest physical address of the page, if applicable.
3166	*
3167	* @remarks The caller must own the PGM lock.
3168	*/
3169	static int pgmPhysFreePage(PVM pVM, PGMMFREEPAGESREQ pReq, uint32_t *pcPendingPages, PPGMPAGE pPage, RTGCPHYS GCPhys)
3170	{
3171	/*
3172	* Assert sanity.
3173	*/
3174	Assert(PGMIsLockOwner(pVM));
3175	if (RT_UNLIKELY( PGM_PAGE_GET_TYPE(pPage) != PGMPAGETYPE_RAM
3176	&& PGM_PAGE_GET_TYPE(pPage) != PGMPAGETYPE_ROM_SHADOW))
3177	{
3178	AssertMsgFailed(("GCPhys=%RGp pPage=%R[pgmpage]\n", GCPhys, pPage));
3179	return VMSetError(pVM, VERR_PGM_PHYS_NOT_RAM, RT_SRC_POS, "GCPhys=%RGp type=%d", GCPhys, PGM_PAGE_GET_TYPE(pPage));
3180	}
3181
3182	if (PGM_PAGE_GET_STATE(pPage) == PGM_PAGE_STATE_ZERO)
3183	return VINF_SUCCESS;
3184
3185	const uint32_t idPage = PGM_PAGE_GET_PAGEID(pPage);
3186	Log3(("pgmPhysFreePage: idPage=%#x HCPhys=%RGp pPage=%R[pgmpage]\n", idPage, pPage));
3187	if (RT_UNLIKELY( idPage == NIL_GMM_PAGEID
3188	\|\| idPage > GMM_PAGEID_LAST
3189	\|\| PGM_PAGE_GET_CHUNKID(pPage) == NIL_GMM_CHUNKID))
3190	{
3191	AssertMsgFailed(("GCPhys=%RGp pPage=%R[pgmpage]\n", GCPhys, pPage));
3192	return VMSetError(pVM, VERR_PGM_PHYS_INVALID_PAGE_ID, RT_SRC_POS, "GCPhys=%RGp idPage=%#x", GCPhys, pPage);
3193	}
3194
3195	/* update page count stats. */
3196	if (PGM_PAGE_IS_SHARED(pPage))
3197	pVM->pgm.s.cSharedPages--;
3198	else
3199	pVM->pgm.s.cPrivatePages--;
3200	pVM->pgm.s.cZeroPages++;
3201
3202	/*
3203	* pPage = ZERO page.
3204	*/
3205	PGM_PAGE_SET_HCPHYS(pPage, pVM->pgm.s.HCPhysZeroPg);
3206	PGM_PAGE_SET_STATE(pPage, PGM_PAGE_STATE_ZERO);
3207	PGM_PAGE_SET_PAGEID(pPage, NIL_GMM_PAGEID);
3208
3209	/*
3210	* Make sure it's not in the handy page array.
3211	*/
3212	for (uint32_t i = pVM->pgm.s.cHandyPages; i < RT_ELEMENTS(pVM->pgm.s.aHandyPages); i++)
3213	{
3214	if (pVM->pgm.s.aHandyPages[i].idPage == idPage)
3215	{
3216	pVM->pgm.s.aHandyPages[i].idPage = NIL_GMM_PAGEID;
3217	break;
3218	}
3219	if (pVM->pgm.s.aHandyPages[i].idSharedPage == idPage)
3220	{
3221	pVM->pgm.s.aHandyPages[i].idSharedPage = NIL_GMM_PAGEID;
3222	break;
3223	}
3224	}
3225
3226	/*
3227	* Push it onto the page array.
3228	*/
3229	uint32_t iPage = *pcPendingPages;
3230	Assert(iPage < PGMPHYS_FREE_PAGE_BATCH_SIZE);
3231	*pcPendingPages += 1;
3232
3233	pReq->aPages[iPage].idPage = idPage;
3234
3235	if (iPage + 1 < PGMPHYS_FREE_PAGE_BATCH_SIZE)
3236	return VINF_SUCCESS;
3237
3238	/*
3239	* Flush the pages.
3240	*/
3241	int rc = GMMR3FreePagesPerform(pVM, pReq, PGMPHYS_FREE_PAGE_BATCH_SIZE);
3242	if (RT_SUCCESS(rc))
3243	{
3244	GMMR3FreePagesRePrep(pVM, pReq, PGMPHYS_FREE_PAGE_BATCH_SIZE, GMMACCOUNT_BASE);
3245	*pcPendingPages = 0;
3246	}
3247	return rc;
3248	}
3249
3250
3251	/**
3252	* Converts a GC physical address to a HC ring-3 pointer, with some
3253	* additional checks.
3254	*
3255	* @returns VBox status code.
3256	* @retval VINF_SUCCESS on success.
3257	* @retval VINF_PGM_PHYS_TLB_CATCH_WRITE and *ppv set if the page has a write
3258	* access handler of some kind.
3259	* @retval VERR_PGM_PHYS_TLB_CATCH_ALL if the page has a handler catching all
3260	* accesses or is odd in any way.
3261	* @retval VERR_PGM_PHYS_TLB_UNASSIGNED if the page doesn't exist.
3262	*
3263	* @param pVM The VM handle.
3264	* @param GCPhys The GC physical address to convert.
3265	* @param fWritable Whether write access is required.
3266	* @param ppv Where to store the pointer corresponding to GCPhys on
3267	* success.
3268	*/
3269	VMMR3DECL(int) PGMR3PhysTlbGCPhys2Ptr(PVM pVM, RTGCPHYS GCPhys, bool fWritable, void **ppv)
3270	{
3271	pgmLock(pVM);
3272
3273	PPGMRAMRANGE pRam;
3274	PPGMPAGE pPage;
3275	int rc = pgmPhysGetPageAndRangeEx(&pVM->pgm.s, GCPhys, &pPage, &pRam);
3276	if (RT_SUCCESS(rc))
3277	{
3278	if (!PGM_PAGE_HAS_ANY_HANDLERS(pPage))
3279	rc = VINF_SUCCESS;
3280	else
3281	{
3282	if (PGM_PAGE_HAS_ACTIVE_ALL_HANDLERS(pPage)) /* catches MMIO */
3283	rc = VERR_PGM_PHYS_TLB_CATCH_ALL;
3284	else if (PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage))
3285	{
3286	/** @todo Handle TLB loads of virtual handlers so ./test.sh can be made to work
3287	* in -norawr0 mode. */
3288	if (fWritable)
3289	rc = VINF_PGM_PHYS_TLB_CATCH_WRITE;
3290	}
3291	else
3292	{
3293	/* Temporarily disabled physical handler(s), since the recompiler
3294	doesn't get notified when it's reset we'll have to pretend it's
3295	operating normally. */
3296	if (pgmHandlerPhysicalIsAll(pVM, GCPhys))
3297	rc = VERR_PGM_PHYS_TLB_CATCH_ALL;
3298	else
3299	rc = VINF_PGM_PHYS_TLB_CATCH_WRITE;
3300	}
3301	}
3302	if (RT_SUCCESS(rc))
3303	{
3304	int rc2;
3305
3306	/* Make sure what we return is writable. */
3307	if (fWritable && rc != VINF_PGM_PHYS_TLB_CATCH_WRITE)
3308	switch (PGM_PAGE_GET_STATE(pPage))
3309	{
3310	case PGM_PAGE_STATE_ALLOCATED:
3311	break;
3312	case PGM_PAGE_STATE_ZERO:
3313	case PGM_PAGE_STATE_SHARED:
3314	case PGM_PAGE_STATE_WRITE_MONITORED:
3315	rc2 = pgmPhysPageMakeWritable(pVM, pPage, GCPhys & ~(RTGCPHYS)PAGE_OFFSET_MASK);
3316	AssertLogRelRCReturn(rc2, rc2);
3317	break;
3318	}
3319
3320	/* Get a ring-3 mapping of the address. */
3321	PPGMPAGER3MAPTLBE pTlbe;
3322	rc2 = pgmPhysPageQueryTlbe(&pVM->pgm.s, GCPhys, &pTlbe);
3323	AssertLogRelRCReturn(rc2, rc2);
3324	ppv = (void )((uintptr_t)pTlbe->pv \| (GCPhys & PAGE_OFFSET_MASK));
3325	/** @todo mapping/locking hell; this isn't horribly efficient since
3326	* pgmPhysPageLoadIntoTlb will repeat the lookup we've done here. */
3327
3328	Log6(("PGMR3PhysTlbGCPhys2Ptr: GCPhys=%RGp rc=%Rrc pPage=%R[pgmpage] ppv=%p\n", GCPhys, rc, pPage, ppv));
3329	}
3330	else
3331	Log6(("PGMR3PhysTlbGCPhys2Ptr: GCPhys=%RGp rc=%Rrc pPage=%R[pgmpage]\n", GCPhys, rc, pPage));
3332
3333	/* else: handler catching all access, no pointer returned. */
3334	}
3335	else
3336	rc = VERR_PGM_PHYS_TLB_UNASSIGNED;
3337
3338	pgmUnlock(pVM);
3339	return rc;
3340	}
3341

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/PGMPhys.cpp@ 24349

Download in other formats: