PGMAllBth.h@ 24442

Last change on this file since 24442 was 24216, checked in by vboxsync, 15 years ago
VMM: Backed out r54155 & r54154 due to XP breakage.
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 197.9 KB

Line
1	/* $Id: PGMAllBth.h 24216 2009-10-30 18:35:43Z vboxsync $ */
2	/** @file
3	* VBox - Page Manager, Shadow+Guest Paging Template - All context code.
4	*
5	* This file is a big challenge!
6	*/
7
8	/*
9	* Copyright (C) 2006-2007 Sun Microsystems, Inc.
10	*
11	* This file is part of VirtualBox Open Source Edition (OSE), as
12	* available from http://www.virtualbox.org. This file is free software;
13	* you can redistribute it and/or modify it under the terms of the GNU
14	* General Public License (GPL) as published by the Free Software
15	* Foundation, in version 2 as it comes in the "COPYING" file of the
16	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
17	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
18	*
19	* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
20	* Clara, CA 95054 USA or visit http://www.sun.com if you need
21	* additional information or have any questions.
22	*/
23
24	/*******************************************************************************
25	* Internal Functions *
26	*******************************************************************************/
27	RT_C_DECLS_BEGIN
28	PGM_BTH_DECL(int, Trap0eHandler)(PVMCPU pVCpu, RTGCUINT uErr, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault);
29	PGM_BTH_DECL(int, InvalidatePage)(PVMCPU pVCpu, RTGCPTR GCPtrPage);
30	PGM_BTH_DECL(int, SyncPage)(PVMCPU pVCpu, GSTPDE PdeSrc, RTGCPTR GCPtrPage, unsigned cPages, unsigned uErr);
31	PGM_BTH_DECL(int, CheckPageFault)(PVMCPU pVCpu, uint32_t uErr, PSHWPDE pPdeDst, PGSTPDE pPdeSrc, RTGCPTR GCPtrPage);
32	PGM_BTH_DECL(int, SyncPT)(PVMCPU pVCpu, unsigned iPD, PGSTPD pPDSrc, RTGCPTR GCPtrPage);
33	PGM_BTH_DECL(int, VerifyAccessSyncPage)(PVMCPU pVCpu, RTGCPTR Addr, unsigned fPage, unsigned uErr);
34	PGM_BTH_DECL(int, PrefetchPage)(PVMCPU pVCpu, RTGCPTR GCPtrPage);
35	PGM_BTH_DECL(int, SyncCR3)(PVMCPU pVCpu, uint64_t cr0, uint64_t cr3, uint64_t cr4, bool fGlobal);
36	#ifdef VBOX_STRICT
37	PGM_BTH_DECL(unsigned, AssertCR3)(PVMCPU pVCpu, uint64_t cr3, uint64_t cr4, RTGCPTR GCPtr = 0, RTGCPTR cb = ~(RTGCPTR)0);
38	#endif
39	#ifdef PGMPOOL_WITH_USER_TRACKING
40	DECLINLINE(void) PGM_BTH_NAME(SyncPageWorkerTrackDeref)(PVMCPU pVCpu, PPGMPOOLPAGE pShwPage, RTHCPHYS HCPhys);
41	#endif
42	PGM_BTH_DECL(int, MapCR3)(PVMCPU pVCpu, RTGCPHYS GCPhysCR3);
43	PGM_BTH_DECL(int, UnmapCR3)(PVMCPU pVCpu);
44	RT_C_DECLS_END
45
46
47	/* Filter out some illegal combinations of guest and shadow paging, so we can remove redundant checks inside functions. */
48	#if PGM_GST_TYPE == PGM_TYPE_PAE && PGM_SHW_TYPE != PGM_TYPE_PAE && PGM_SHW_TYPE != PGM_TYPE_NESTED && PGM_SHW_TYPE != PGM_TYPE_EPT
49	# error "Invalid combination; PAE guest implies PAE shadow"
50	#endif
51
52	#if (PGM_GST_TYPE == PGM_TYPE_REAL \|\| PGM_GST_TYPE == PGM_TYPE_PROT) \
53	&& !(PGM_SHW_TYPE == PGM_TYPE_32BIT \|\| PGM_SHW_TYPE == PGM_TYPE_PAE \|\| PGM_SHW_TYPE == PGM_TYPE_AMD64 \|\| PGM_SHW_TYPE == PGM_TYPE_NESTED \|\| PGM_SHW_TYPE == PGM_TYPE_EPT)
54	# error "Invalid combination; real or protected mode without paging implies 32 bits or PAE shadow paging."
55	#endif
56
57	#if (PGM_GST_TYPE == PGM_TYPE_32BIT \|\| PGM_GST_TYPE == PGM_TYPE_PAE) \
58	&& !(PGM_SHW_TYPE == PGM_TYPE_32BIT \|\| PGM_SHW_TYPE == PGM_TYPE_PAE \|\| PGM_SHW_TYPE == PGM_TYPE_NESTED \|\| PGM_SHW_TYPE == PGM_TYPE_EPT)
59	# error "Invalid combination; 32 bits guest paging or PAE implies 32 bits or PAE shadow paging."
60	#endif
61
62	#if (PGM_GST_TYPE == PGM_TYPE_AMD64 && PGM_SHW_TYPE != PGM_TYPE_AMD64 && PGM_SHW_TYPE != PGM_TYPE_NESTED && PGM_SHW_TYPE != PGM_TYPE_EPT) \
63	\|\| (PGM_SHW_TYPE == PGM_TYPE_AMD64 && PGM_GST_TYPE != PGM_TYPE_AMD64 && PGM_GST_TYPE != PGM_TYPE_PROT)
64	# error "Invalid combination; AMD64 guest implies AMD64 shadow and vice versa"
65	#endif
66
67	#ifdef IN_RING0 /* no mappings in VT-x and AMD-V mode */
68	# define PGM_WITHOUT_MAPPINGS
69	#endif
70
71
72	#ifndef IN_RING3
73	/**
74	* #PF Handler for raw-mode guest execution.
75	*
76	* @returns VBox status code (appropriate for trap handling and GC return).
77	*
78	* @param pVCpu VMCPU Handle.
79	* @param uErr The trap error code.
80	* @param pRegFrame Trap register frame.
81	* @param pvFault The fault address.
82	*/
83	PGM_BTH_DECL(int, Trap0eHandler)(PVMCPU pVCpu, RTGCUINT uErr, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault)
84	{
85	PVM pVM = pVCpu->CTX_SUFF(pVM);
86
87	# if defined(IN_RC) && defined(VBOX_STRICT)
88	PGMDynCheckLocks(pVM);
89	# endif
90
91	# if (PGM_GST_TYPE == PGM_TYPE_32BIT \|\| PGM_GST_TYPE == PGM_TYPE_REAL \|\| PGM_GST_TYPE == PGM_TYPE_PROT \|\| PGM_GST_TYPE == PGM_TYPE_PAE \|\| PGM_GST_TYPE == PGM_TYPE_AMD64) \
92	&& PGM_SHW_TYPE != PGM_TYPE_NESTED \
93	&& (PGM_SHW_TYPE != PGM_TYPE_EPT \|\| PGM_GST_TYPE == PGM_TYPE_PROT)
94
95	# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE != PGM_TYPE_PAE
96	/*
97	* Hide the instruction fetch trap indicator for now.
98	*/
99	/** @todo NXE will change this and we must fix NXE in the switcher too! */
100	if (uErr & X86_TRAP_PF_ID)
101	{
102	uErr &= ~X86_TRAP_PF_ID;
103	TRPMSetErrorCode(pVCpu, uErr);
104	}
105	# endif
106
107	/*
108	* Get PDs.
109	*/
110	int rc;
111	# if PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE)
112	# if PGM_GST_TYPE == PGM_TYPE_32BIT
113	const unsigned iPDSrc = pvFault >> GST_PD_SHIFT;
114	PGSTPD pPDSrc = pgmGstGet32bitPDPtr(&pVCpu->pgm.s);
115
116	# elif PGM_GST_TYPE == PGM_TYPE_PAE \|\| PGM_GST_TYPE == PGM_TYPE_AMD64
117
118	# if PGM_GST_TYPE == PGM_TYPE_PAE
119	unsigned iPDSrc = 0; /* initialized to shut up gcc */
120	X86PDPE PdpeSrc;
121	PGSTPD pPDSrc = pgmGstGetPaePDPtr(&pVCpu->pgm.s, pvFault, &iPDSrc, &PdpeSrc);
122
123	# elif PGM_GST_TYPE == PGM_TYPE_AMD64
124	unsigned iPDSrc = 0; /* initialized to shut up gcc */
125	PX86PML4E pPml4eSrc;
126	X86PDPE PdpeSrc;
127	PGSTPD pPDSrc;
128
129	pPDSrc = pgmGstGetLongModePDPtr(&pVCpu->pgm.s, pvFault, &pPml4eSrc, &PdpeSrc, &iPDSrc);
130	Assert(pPml4eSrc);
131	# endif
132
133	/* Quick check for a valid guest trap. (PAE & AMD64) */
134	if (!pPDSrc)
135	{
136	# if PGM_GST_TYPE == PGM_TYPE_AMD64 && GC_ARCH_BITS == 64
137	LogFlow(("Trap0eHandler: guest PML4 %d not present CR3=%RGp\n", (int)((pvFault >> X86_PML4_SHIFT) & X86_PML4_MASK), CPUMGetGuestCR3(pVCpu) & X86_CR3_PAGE_MASK));
138	# else
139	LogFlow(("Trap0eHandler: guest iPDSrc=%u not present CR3=%RGp\n", iPDSrc, CPUMGetGuestCR3(pVCpu) & X86_CR3_PAGE_MASK));
140	# endif
141	STAM_STATS({ pVCpu->pgm.s.CTX_SUFF(pStatTrap0eAttribution) = &pVCpu->pgm.s.StatRZTrap0eTime2GuestTrap; });
142	TRPMSetErrorCode(pVCpu, uErr);
143	return VINF_EM_RAW_GUEST_TRAP;
144	}
145	# endif
146
147	# else /* !PGM_WITH_PAGING */
148	PGSTPD pPDSrc = NULL;
149	const unsigned iPDSrc = 0;
150	# endif /* !PGM_WITH_PAGING */
151
152	/* Fetch the guest PDE */
153	# if PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE)
154	GSTPDE PdeSrc = pPDSrc->a[iPDSrc];
155	# else
156	GSTPDE PdeSrc;
157	PdeSrc.au32[0] = 0; /* faked so we don't have to #ifdef everything */
158	PdeSrc.n.u1Present = 1;
159	PdeSrc.n.u1Write = 1;
160	PdeSrc.n.u1Accessed = 1;
161	PdeSrc.n.u1User = 1;
162	# endif
163
164	# if PGM_SHW_TYPE == PGM_TYPE_32BIT
165	const unsigned iPDDst = pvFault >> SHW_PD_SHIFT;
166	PX86PD pPDDst = pgmShwGet32BitPDPtr(&pVCpu->pgm.s);
167
168	# elif PGM_SHW_TYPE == PGM_TYPE_PAE
169	const unsigned iPDDst = (pvFault >> SHW_PD_SHIFT) & SHW_PD_MASK; /* pPDDst index, not used with the pool. */
170
171	PX86PDPAE pPDDst;
172	# if PGM_GST_TYPE != PGM_TYPE_PAE
173	X86PDPE PdpeSrc;
174
175	/* Fake PDPT entry; access control handled on the page table level, so allow everything. */
176	PdpeSrc.u = X86_PDPE_P; /* rw/us are reserved for PAE pdpte's; accessed bit causes invalid VT-x guest state errors */
177	# endif
178	rc = pgmShwSyncPaePDPtr(pVCpu, pvFault, &PdpeSrc, &pPDDst);
179	if (rc != VINF_SUCCESS)
180	{
181	AssertRC(rc);
182	return rc;
183	}
184	Assert(pPDDst);
185
186	# elif PGM_SHW_TYPE == PGM_TYPE_AMD64
187	const unsigned iPDDst = ((pvFault >> SHW_PD_SHIFT) & SHW_PD_MASK);
188	PX86PDPAE pPDDst;
189	# if PGM_GST_TYPE == PGM_TYPE_PROT
190	/* AMD-V nested paging */
191	X86PML4E Pml4eSrc;
192	X86PDPE PdpeSrc;
193	PX86PML4E pPml4eSrc = &Pml4eSrc;
194
195	/* Fake PML4 & PDPT entry; access control handled on the page table level, so allow everything. */
196	Pml4eSrc.u = X86_PML4E_P \| X86_PML4E_RW \| X86_PML4E_US \| X86_PML4E_A;
197	PdpeSrc.u = X86_PDPE_P \| X86_PDPE_RW \| X86_PDPE_US \| X86_PDPE_A;
198	# endif
199
200	rc = pgmShwSyncLongModePDPtr(pVCpu, pvFault, pPml4eSrc, &PdpeSrc, &pPDDst);
201	if (rc != VINF_SUCCESS)
202	{
203	AssertRC(rc);
204	return rc;
205	}
206	Assert(pPDDst);
207
208	# elif PGM_SHW_TYPE == PGM_TYPE_EPT
209	const unsigned iPDDst = ((pvFault >> SHW_PD_SHIFT) & SHW_PD_MASK);
210	PEPTPD pPDDst;
211
212	rc = pgmShwGetEPTPDPtr(pVCpu, pvFault, NULL, &pPDDst);
213	if (rc != VINF_SUCCESS)
214	{
215	AssertRC(rc);
216	return rc;
217	}
218	Assert(pPDDst);
219	# endif
220
221	# if PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE)
222	/*
223	* If we successfully correct the write protection fault due to dirty bit
224	* tracking, or this page fault is a genuine one, then return immediately.
225	*/
226	STAM_PROFILE_START(&pVCpu->pgm.s.StatRZTrap0eTimeCheckPageFault, e);
227	rc = PGM_BTH_NAME(CheckPageFault)(pVCpu, uErr, &pPDDst->a[iPDDst], &pPDSrc->a[iPDSrc], pvFault);
228	STAM_PROFILE_STOP(&pVCpu->pgm.s.StatRZTrap0eTimeCheckPageFault, e);
229	if ( rc == VINF_PGM_HANDLED_DIRTY_BIT_FAULT
230	\|\| rc == VINF_EM_RAW_GUEST_TRAP)
231	{
232	STAM_STATS({ pVCpu->pgm.s.CTX_SUFF(pStatTrap0eAttribution)
233	= rc == VINF_PGM_HANDLED_DIRTY_BIT_FAULT ? &pVCpu->pgm.s.StatRZTrap0eTime2DirtyAndAccessed : &pVCpu->pgm.s.StatRZTrap0eTime2GuestTrap; });
234	LogBird(("Trap0eHandler: returns %s\n", rc == VINF_PGM_HANDLED_DIRTY_BIT_FAULT ? "VINF_SUCCESS" : "VINF_EM_RAW_GUEST_TRAP"));
235	return rc == VINF_PGM_HANDLED_DIRTY_BIT_FAULT ? VINF_SUCCESS : rc;
236	}
237
238	# if 0 /* rarely useful; leave for debugging. */
239	STAM_COUNTER_INC(&pVCpu->pgm.s.StatRZTrap0ePD[iPDSrc]);
240	# endif
241	# endif /* PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE) */
242
243	/*
244	* A common case is the not-present error caused by lazy page table syncing.
245	*
246	* It is IMPORTANT that we weed out any access to non-present shadow PDEs here
247	* so we can safely assume that the shadow PT is present when calling SyncPage later.
248	*
249	* On failure, we ASSUME that SyncPT is out of memory or detected some kind
250	* of mapping conflict and defer to SyncCR3 in R3.
251	* (Again, we do NOT support access handlers for non-present guest pages.)
252	*
253	*/
254	if ( !(uErr & X86_TRAP_PF_P) /* not set means page not present instead of page protection violation */
255	&& !pPDDst->a[iPDDst].n.u1Present
256	&& PdeSrc.n.u1Present
257	)
258	{
259	STAM_STATS({ pVCpu->pgm.s.CTX_SUFF(pStatTrap0eAttribution) = &pVCpu->pgm.s.StatRZTrap0eTime2SyncPT; });
260	STAM_PROFILE_START(&pVCpu->pgm.s.StatRZTrap0eTimeSyncPT, f);
261	LogFlow(("=>SyncPT %04x = %08x\n", iPDSrc, PdeSrc.au32[0]));
262	rc = PGM_BTH_NAME(SyncPT)(pVCpu, iPDSrc, pPDSrc, pvFault);
263	if (RT_SUCCESS(rc))
264	{
265	STAM_PROFILE_STOP(&pVCpu->pgm.s.StatRZTrap0eTimeSyncPT, f);
266	return rc;
267	}
268	Log(("SyncPT: %d failed!! rc=%d\n", iPDSrc, rc));
269	VMCPU_FF_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3); /** @todo no need to do global sync, right? */
270	STAM_PROFILE_STOP(&pVCpu->pgm.s.StatRZTrap0eTimeSyncPT, f);
271	return VINF_PGM_SYNC_CR3;
272	}
273
274	# if PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE) && !defined(PGM_WITHOUT_MAPPINGS)
275	/*
276	* Check if this address is within any of our mappings.
277	*
278	* This is very fast and it's gonna save us a bit of effort below and prevent
279	* us from screwing ourself with MMIO2 pages which have a GC Mapping (VRam).
280	* (BTW, it's impossible to have physical access handlers in a mapping.)
281	*/
282	if (pgmMapAreMappingsEnabled(&pVM->pgm.s))
283	{
284	STAM_PROFILE_START(&pVCpu->pgm.s.StatRZTrap0eTimeMapping, a);
285	PPGMMAPPING pMapping = pVM->pgm.s.CTX_SUFF(pMappings);
286	for ( ; pMapping; pMapping = pMapping->CTX_SUFF(pNext))
287	{
288	if (pvFault < pMapping->GCPtr)
289	break;
290	if (pvFault - pMapping->GCPtr < pMapping->cb)
291	{
292	/*
293	* The first thing we check is if we've got an undetected conflict.
294	*/
295	if (!pVM->pgm.s.fMappingsFixed)
296	{
297	unsigned iPT = pMapping->cb >> GST_PD_SHIFT;
298	while (iPT-- > 0)
299	if (pPDSrc->a[iPDSrc + iPT].n.u1Present)
300	{
301	STAM_COUNTER_INC(&pVCpu->pgm.s.StatRZTrap0eConflicts);
302	Log(("Trap0e: Detected Conflict %RGv-%RGv\n", pMapping->GCPtr, pMapping->GCPtrLast));
303	VMCPU_FF_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3); /** @todo no need to do global sync,right? */
304	STAM_PROFILE_STOP(&pVCpu->pgm.s.StatRZTrap0eTimeMapping, a);
305	return VINF_PGM_SYNC_CR3;
306	}
307	}
308
309	/*
310	* Check if the fault address is in a virtual page access handler range.
311	*/
312	PPGMVIRTHANDLER pCur = (PPGMVIRTHANDLER)RTAvlroGCPtrRangeGet(&pVM->pgm.s.CTX_SUFF(pTrees)->HyperVirtHandlers, pvFault);
313	if ( pCur
314	&& pvFault - pCur->Core.Key < pCur->cb
315	&& uErr & X86_TRAP_PF_RW)
316	{
317	# ifdef IN_RC
318	STAM_PROFILE_START(&pCur->Stat, h);
319	pgmUnlock(pVM);
320	rc = pCur->CTX_SUFF(pfnHandler)(pVM, uErr, pRegFrame, pvFault, pCur->Core.Key, pvFault - pCur->Core.Key);
321	pgmLock(pVM);
322	STAM_PROFILE_STOP(&pCur->Stat, h);
323	# else
324	AssertFailed();
325	rc = VINF_EM_RAW_EMULATE_INSTR; /* can't happen with VMX */
326	# endif
327	STAM_COUNTER_INC(&pVCpu->pgm.s.StatRZTrap0eHandlersMapping);
328	STAM_PROFILE_STOP(&pVCpu->pgm.s.StatRZTrap0eTimeMapping, a);
329	return rc;
330	}
331
332	/*
333	* Pretend we're not here and let the guest handle the trap.
334	*/
335	TRPMSetErrorCode(pVCpu, uErr & ~X86_TRAP_PF_P);
336	STAM_COUNTER_INC(&pVCpu->pgm.s.StatRZTrap0eGuestPFMapping);
337	LogFlow(("PGM: Mapping access -> route trap to recompiler!\n"));
338	STAM_PROFILE_STOP(&pVCpu->pgm.s.StatRZTrap0eTimeMapping, a);
339	return VINF_EM_RAW_GUEST_TRAP;
340	}
341	}
342	STAM_PROFILE_STOP(&pVCpu->pgm.s.StatRZTrap0eTimeMapping, a);
343	} /* pgmAreMappingsEnabled(&pVM->pgm.s) */
344	# endif /* PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE) */
345
346	/*
347	* Check if this fault address is flagged for special treatment,
348	* which means we'll have to figure out the physical address and
349	* check flags associated with it.
350	*
351	* ASSUME that we can limit any special access handling to pages
352	* in page tables which the guest believes to be present.
353	*/
354	if (PdeSrc.n.u1Present)
355	{
356	RTGCPHYS GCPhys = NIL_RTGCPHYS;
357
358	# if PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE)
359	# if PGM_GST_TYPE == PGM_TYPE_AMD64
360	bool fBigPagesSupported = true;
361	# else
362	bool fBigPagesSupported = !!(CPUMGetGuestCR4(pVCpu) & X86_CR4_PSE);
363	# endif
364	if ( PdeSrc.b.u1Size
365	&& fBigPagesSupported)
366	GCPhys = GST_GET_PDE_BIG_PG_GCPHYS(PdeSrc)
367	\| ((RTGCPHYS)pvFault & (GST_BIG_PAGE_OFFSET_MASK ^ PAGE_OFFSET_MASK));
368	else
369	{
370	PGSTPT pPTSrc;
371	rc = PGM_GCPHYS_2_PTR(pVM, PdeSrc.u & GST_PDE_PG_MASK, &pPTSrc);
372	if (RT_SUCCESS(rc))
373	{
374	unsigned iPTESrc = (pvFault >> GST_PT_SHIFT) & GST_PT_MASK;
375	if (pPTSrc->a[iPTESrc].n.u1Present)
376	GCPhys = pPTSrc->a[iPTESrc].u & GST_PTE_PG_MASK;
377	}
378	}
379	# else
380	/* No paging so the fault address is the physical address */
381	GCPhys = (RTGCPHYS)(pvFault & ~PAGE_OFFSET_MASK);
382	# endif /* PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE) */
383
384	/*
385	* If we have a GC address we'll check if it has any flags set.
386	*/
387	if (GCPhys != NIL_RTGCPHYS)
388	{
389	STAM_PROFILE_START(&pVCpu->pgm.s.StatRZTrap0eTimeHandlers, b);
390
391	PPGMPAGE pPage;
392	rc = pgmPhysGetPageEx(&pVM->pgm.s, GCPhys, &pPage);
393	if (RT_SUCCESS(rc)) /** just handle the failure immediate (it returns) and make things easier to read. */
394	{
395	if (PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage))
396	{
397	if (PGM_PAGE_HAS_ANY_PHYSICAL_HANDLERS(pPage))
398	{
399	/*
400	* Physical page access handler.
401	*/
402	const RTGCPHYS GCPhysFault = GCPhys \| (pvFault & PAGE_OFFSET_MASK);
403	PPGMPHYSHANDLER pCur = (PPGMPHYSHANDLER)RTAvlroGCPhysRangeGet(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers, GCPhysFault);
404	if (pCur)
405	{
406	# ifdef PGM_SYNC_N_PAGES
407	/*
408	* If the region is write protected and we got a page not present fault, then sync
409	* the pages. If the fault was caused by a read, then restart the instruction.
410	* In case of write access continue to the GC write handler.
411	*
412	* ASSUMES that there is only one handler per page or that they have similar write properties.
413	*/
414	if ( pCur->enmType == PGMPHYSHANDLERTYPE_PHYSICAL_WRITE
415	&& !(uErr & X86_TRAP_PF_P))
416	{
417	rc = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrc, pvFault, PGM_SYNC_NR_PAGES, uErr);
418	if ( RT_FAILURE(rc)
419	\|\| !(uErr & X86_TRAP_PF_RW)
420	\|\| rc == VINF_PGM_SYNCPAGE_MODIFIED_PDE)
421	{
422	AssertRC(rc);
423	STAM_COUNTER_INC(&pVCpu->pgm.s.StatRZTrap0eHandlersOutOfSync);
424	STAM_PROFILE_STOP(&pVCpu->pgm.s.StatRZTrap0eTimeHandlers, b);
425	STAM_STATS({ pVCpu->pgm.s.CTX_SUFF(pStatTrap0eAttribution) = &pVCpu->pgm.s.StatRZTrap0eTime2OutOfSyncHndPhys; });
426	return rc;
427	}
428	}
429	# endif
430
431	AssertMsg( pCur->enmType != PGMPHYSHANDLERTYPE_PHYSICAL_WRITE
432	\|\| (pCur->enmType == PGMPHYSHANDLERTYPE_PHYSICAL_WRITE && (uErr & X86_TRAP_PF_RW)),
433	("Unexpected trap for physical handler: %08X (phys=%08x) pPage=%R[pgmpage] uErr=%X, enum=%d\n", pvFault, GCPhys, pPage, uErr, pCur->enmType));
434
435	# if defined(IN_RC) \|\| defined(IN_RING0)
436	if (pCur->CTX_SUFF(pfnHandler))
437	{
438	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
439	# ifdef IN_RING0
440	PFNPGMR0PHYSHANDLER pfnHandler = pCur->CTX_SUFF(pfnHandler);
441	# else
442	PFNPGMRCPHYSHANDLER pfnHandler = pCur->CTX_SUFF(pfnHandler);
443	# endif
444	bool fLeaveLock = (pfnHandler != pPool->CTX_SUFF(pfnAccessHandler));
445	void *pvUser = pCur->CTX_SUFF(pvUser);
446
447	STAM_PROFILE_START(&pCur->Stat, h);
448	if (fLeaveLock)
449	pgmUnlock(pVM); /* @todo: Not entirely safe. */
450
451	rc = pfnHandler(pVM, uErr, pRegFrame, pvFault, GCPhysFault, pvUser);
452	if (fLeaveLock)
453	pgmLock(pVM);
454	# ifdef VBOX_WITH_STATISTICS
455	pCur = (PPGMPHYSHANDLER)RTAvlroGCPhysRangeGet(&pVM->pgm.s.CTX_SUFF(pTrees)->PhysHandlers, GCPhysFault);
456	if (pCur)
457	STAM_PROFILE_STOP(&pCur->Stat, h);
458	# else
459	pCur = NULL; /* might be invalid by now. */
460	# endif
461
462	}
463	else
464	# endif
465	rc = VINF_EM_RAW_EMULATE_INSTR;
466
467	STAM_COUNTER_INC(&pVCpu->pgm.s.StatRZTrap0eHandlersPhysical);
468	STAM_PROFILE_STOP(&pVCpu->pgm.s.StatRZTrap0eTimeHandlers, b);
469	STAM_STATS({ pVCpu->pgm.s.CTX_SUFF(pStatTrap0eAttribution) = &pVCpu->pgm.s.StatRZTrap0eTime2HndPhys; });
470	return rc;
471	}
472	}
473	# if PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE)
474	else
475	{
476	# ifdef PGM_SYNC_N_PAGES
477	/*
478	* If the region is write protected and we got a page not present fault, then sync
479	* the pages. If the fault was caused by a read, then restart the instruction.
480	* In case of write access continue to the GC write handler.
481	*/
482	if ( PGM_PAGE_GET_HNDL_VIRT_STATE(pPage) < PGM_PAGE_HNDL_PHYS_STATE_ALL
483	&& !(uErr & X86_TRAP_PF_P))
484	{
485	rc = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrc, pvFault, PGM_SYNC_NR_PAGES, uErr);
486	if ( RT_FAILURE(rc)
487	\|\| rc == VINF_PGM_SYNCPAGE_MODIFIED_PDE
488	\|\| !(uErr & X86_TRAP_PF_RW))
489	{
490	AssertRC(rc);
491	STAM_COUNTER_INC(&pVCpu->pgm.s.StatRZTrap0eHandlersOutOfSync);
492	STAM_PROFILE_STOP(&pVCpu->pgm.s.StatRZTrap0eTimeHandlers, b);
493	STAM_STATS({ pVCpu->pgm.s.CTX_SUFF(pStatTrap0eAttribution) = &pVCpu->pgm.s.StatRZTrap0eTime2OutOfSyncHndVirt; });
494	return rc;
495	}
496	}
497	# endif
498	/*
499	* Ok, it's an virtual page access handler.
500	*
501	* Since it's faster to search by address, we'll do that first
502	* and then retry by GCPhys if that fails.
503	*/
504	/** @todo r=bird: perhaps we should consider looking up by physical address directly now? */
505	/** @note r=svl: true, but lookup on virtual address should remain as a fallback as phys & virt trees might be out of sync, because the
506	* page was changed without us noticing it (not-present -> present without invlpg or mov cr3, xxx)
507	*/
508	PPGMVIRTHANDLER pCur = (PPGMVIRTHANDLER)RTAvlroGCPtrRangeGet(&pVM->pgm.s.CTX_SUFF(pTrees)->VirtHandlers, pvFault);
509	if (pCur)
510	{
511	AssertMsg(!(pvFault - pCur->Core.Key < pCur->cb)
512	\|\| ( pCur->enmType != PGMVIRTHANDLERTYPE_WRITE
513	\|\| !(uErr & X86_TRAP_PF_P)
514	\|\| (pCur->enmType == PGMVIRTHANDLERTYPE_WRITE && (uErr & X86_TRAP_PF_RW))),
515	("Unexpected trap for virtual handler: %RGv (phys=%RGp) pPage=%R[pgmpage] uErr=%X, enum=%d\n", pvFault, GCPhys, pPage, uErr, pCur->enmType));
516
517	if ( pvFault - pCur->Core.Key < pCur->cb
518	&& ( uErr & X86_TRAP_PF_RW
519	\|\| pCur->enmType != PGMVIRTHANDLERTYPE_WRITE ) )
520	{
521	# ifdef IN_RC
522	STAM_PROFILE_START(&pCur->Stat, h);
523	pgmUnlock(pVM);
524	rc = pCur->CTX_SUFF(pfnHandler)(pVM, uErr, pRegFrame, pvFault, pCur->Core.Key, pvFault - pCur->Core.Key);
525	pgmLock(pVM);
526	STAM_PROFILE_STOP(&pCur->Stat, h);
527	# else
528	rc = VINF_EM_RAW_EMULATE_INSTR; /** @todo for VMX */
529	# endif
530	STAM_COUNTER_INC(&pVCpu->pgm.s.StatRZTrap0eHandlersVirtual);
531	STAM_PROFILE_STOP(&pVCpu->pgm.s.StatRZTrap0eTimeHandlers, b);
532	STAM_STATS({ pVCpu->pgm.s.CTX_SUFF(pStatTrap0eAttribution) = &pVCpu->pgm.s.StatRZTrap0eTime2HndVirt; });
533	return rc;
534	}
535	/* Unhandled part of a monitored page */
536	}
537	else
538	{
539	/* Check by physical address. */
540	PPGMVIRTHANDLER pCur;
541	unsigned iPage;
542	rc = pgmHandlerVirtualFindByPhysAddr(pVM, GCPhys + (pvFault & PAGE_OFFSET_MASK),
543	&pCur, &iPage);
544	Assert(RT_SUCCESS(rc) \|\| !pCur);
545	if ( pCur
546	&& ( uErr & X86_TRAP_PF_RW
547	\|\| pCur->enmType != PGMVIRTHANDLERTYPE_WRITE ) )
548	{
549	Assert((pCur->aPhysToVirt[iPage].Core.Key & X86_PTE_PAE_PG_MASK) == GCPhys);
550	# ifdef IN_RC
551	RTGCPTR off = (iPage << PAGE_SHIFT) + (pvFault & PAGE_OFFSET_MASK) - (pCur->Core.Key & PAGE_OFFSET_MASK);
552	Assert(off < pCur->cb);
553	STAM_PROFILE_START(&pCur->Stat, h);
554	pgmUnlock(pVM);
555	rc = pCur->CTX_SUFF(pfnHandler)(pVM, uErr, pRegFrame, pvFault, pCur->Core.Key, off);
556	pgmLock(pVM);
557	STAM_PROFILE_STOP(&pCur->Stat, h);
558	# else
559	rc = VINF_EM_RAW_EMULATE_INSTR; /** @todo for VMX */
560	# endif
561	STAM_COUNTER_INC(&pVCpu->pgm.s.StatRZTrap0eHandlersVirtualByPhys);
562	STAM_PROFILE_STOP(&pVCpu->pgm.s.StatRZTrap0eTimeHandlers, b);
563	STAM_STATS({ pVCpu->pgm.s.CTX_SUFF(pStatTrap0eAttribution) = &pVCpu->pgm.s.StatRZTrap0eTime2HndVirt; });
564	return rc;
565	}
566	}
567	}
568	# endif /* PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE) */
569
570	/*
571	* There is a handled area of the page, but this fault doesn't belong to it.
572	* We must emulate the instruction.
573	*
574	* To avoid crashing (non-fatal) in the interpreter and go back to the recompiler
575	* we first check if this was a page-not-present fault for a page with only
576	* write access handlers. Restart the instruction if it wasn't a write access.
577	*/
578	STAM_COUNTER_INC(&pVCpu->pgm.s.StatRZTrap0eHandlersUnhandled);
579
580	if ( !PGM_PAGE_HAS_ACTIVE_ALL_HANDLERS(pPage)
581	&& !(uErr & X86_TRAP_PF_P))
582	{
583	rc = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrc, pvFault, PGM_SYNC_NR_PAGES, uErr);
584	if ( RT_FAILURE(rc)
585	\|\| rc == VINF_PGM_SYNCPAGE_MODIFIED_PDE
586	\|\| !(uErr & X86_TRAP_PF_RW))
587	{
588	AssertRC(rc);
589	STAM_COUNTER_INC(&pVCpu->pgm.s.StatRZTrap0eHandlersOutOfSync);
590	STAM_PROFILE_STOP(&pVCpu->pgm.s.StatRZTrap0eTimeHandlers, b);
591	STAM_STATS({ pVCpu->pgm.s.CTX_SUFF(pStatTrap0eAttribution) = &pVCpu->pgm.s.StatRZTrap0eTime2OutOfSyncHndPhys; });
592	return rc;
593	}
594	}
595
596	/** @todo This particular case can cause quite a lot of overhead. E.g. early stage of kernel booting in Ubuntu 6.06
597	* It's writing to an unhandled part of the LDT page several million times.
598	*/
599	rc = PGMInterpretInstruction(pVM, pVCpu, pRegFrame, pvFault);
600	LogFlow(("PGM: PGMInterpretInstruction -> rc=%d pPage=%R[pgmpage]\n", rc, pPage));
601	STAM_PROFILE_STOP(&pVCpu->pgm.s.StatRZTrap0eTimeHandlers, b);
602	STAM_STATS({ pVCpu->pgm.s.CTX_SUFF(pStatTrap0eAttribution) = &pVCpu->pgm.s.StatRZTrap0eTime2HndUnhandled; });
603	return rc;
604	} /* if any kind of handler */
605
606	# if PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE)
607	if (uErr & X86_TRAP_PF_P)
608	{
609	/*
610	* The page isn't marked, but it might still be monitored by a virtual page access handler.
611	* (ASSUMES no temporary disabling of virtual handlers.)
612	*/
613	/** @todo r=bird: Since the purpose is to catch out of sync pages with virtual handler(s) here,
614	* we should correct both the shadow page table and physical memory flags, and not only check for
615	* accesses within the handler region but for access to pages with virtual handlers. */
616	PPGMVIRTHANDLER pCur = (PPGMVIRTHANDLER)RTAvlroGCPtrRangeGet(&pVM->pgm.s.CTX_SUFF(pTrees)->VirtHandlers, pvFault);
617	if (pCur)
618	{
619	AssertMsg( !(pvFault - pCur->Core.Key < pCur->cb)
620	\|\| ( pCur->enmType != PGMVIRTHANDLERTYPE_WRITE
621	\|\| !(uErr & X86_TRAP_PF_P)
622	\|\| (pCur->enmType == PGMVIRTHANDLERTYPE_WRITE && (uErr & X86_TRAP_PF_RW))),
623	("Unexpected trap for virtual handler: %08X (phys=%08x) %R[pgmpage] uErr=%X, enum=%d\n", pvFault, GCPhys, pPage, uErr, pCur->enmType));
624
625	if ( pvFault - pCur->Core.Key < pCur->cb
626	&& ( uErr & X86_TRAP_PF_RW
627	\|\| pCur->enmType != PGMVIRTHANDLERTYPE_WRITE ) )
628	{
629	# ifdef IN_RC
630	STAM_PROFILE_START(&pCur->Stat, h);
631	pgmUnlock(pVM);
632	rc = pCur->CTX_SUFF(pfnHandler)(pVM, uErr, pRegFrame, pvFault, pCur->Core.Key, pvFault - pCur->Core.Key);
633	pgmLock(pVM);
634	STAM_PROFILE_STOP(&pCur->Stat, h);
635	# else
636	rc = VINF_EM_RAW_EMULATE_INSTR; /** @todo for VMX */
637	# endif
638	STAM_COUNTER_INC(&pVCpu->pgm.s.StatRZTrap0eHandlersVirtualUnmarked);
639	STAM_PROFILE_STOP(&pVCpu->pgm.s.StatRZTrap0eTimeHandlers, b);
640	STAM_STATS({ pVCpu->pgm.s.CTX_SUFF(pStatTrap0eAttribution) = &pVCpu->pgm.s.StatRZTrap0eTime2HndVirt; });
641	return rc;
642	}
643	}
644	}
645	# endif /* PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE) */
646	}
647	else
648	{
649	/*
650	* When the guest accesses invalid physical memory (e.g. probing
651	* of RAM or accessing a remapped MMIO range), then we'll fall
652	* back to the recompiler to emulate the instruction.
653	*/
654	LogFlow(("PGM #PF: pgmPhysGetPageEx(%RGp) failed with %Rrc\n", GCPhys, rc));
655	STAM_COUNTER_INC(&pVCpu->pgm.s.StatRZTrap0eHandlersInvalid);
656	STAM_PROFILE_STOP(&pVCpu->pgm.s.StatRZTrap0eTimeHandlers, b);
657	return VINF_EM_RAW_EMULATE_INSTR;
658	}
659
660	STAM_PROFILE_STOP(&pVCpu->pgm.s.StatRZTrap0eTimeHandlers, b);
661
662	# ifdef PGM_OUT_OF_SYNC_IN_GC /** @todo remove this bugger. */
663	/*
664	* We are here only if page is present in Guest page tables and
665	* trap is not handled by our handlers.
666	*
667	* Check it for page out-of-sync situation.
668	*/
669	STAM_PROFILE_START(&pVCpu->pgm.s.StatRZTrap0eTimeOutOfSync, c);
670
671	if (!(uErr & X86_TRAP_PF_P))
672	{
673	/*
674	* Page is not present in our page tables.
675	* Try to sync it!
676	* BTW, fPageShw is invalid in this branch!
677	*/
678	if (uErr & X86_TRAP_PF_US)
679	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,PageOutOfSyncUser));
680	else /* supervisor */
681	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,PageOutOfSyncSupervisor));
682
683	# if defined(LOG_ENABLED) && !defined(IN_RING0)
684	RTGCPHYS GCPhys;
685	uint64_t fPageGst;
686	PGMGstGetPage(pVCpu, pvFault, &fPageGst, &GCPhys);
687	Log(("Page out of sync: %RGv eip=%08x PdeSrc.n.u1User=%d fPageGst=%08llx GCPhys=%RGp scan=%d\n",
688	pvFault, pRegFrame->eip, PdeSrc.n.u1User, fPageGst, GCPhys, CSAMDoesPageNeedScanning(pVM, (RTRCPTR)pRegFrame->eip)));
689	# endif /* LOG_ENABLED */
690
691	# if PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE) && !defined(IN_RING0)
692	if (CPUMGetGuestCPL(pVCpu, pRegFrame) == 0)
693	{
694	uint64_t fPageGst;
695	rc = PGMGstGetPage(pVCpu, pvFault, &fPageGst, NULL);
696	if ( RT_SUCCESS(rc)
697	&& !(fPageGst & X86_PTE_US))
698	{
699	/* Note: can't check for X86_TRAP_ID bit, because that requires execute disable support on the CPU */
700	if ( pvFault == (RTGCPTR)pRegFrame->eip
701	\|\| pvFault - pRegFrame->eip < 8 /* instruction crossing a page boundary */
702	# ifdef CSAM_DETECT_NEW_CODE_PAGES
703	\|\| ( !PATMIsPatchGCAddr(pVM, (RTGCPTR)pRegFrame->eip)
704	&& CSAMDoesPageNeedScanning(pVM, (RTRCPTR)pRegFrame->eip)) /* any new code we encounter here */
705	# endif /* CSAM_DETECT_NEW_CODE_PAGES */
706	)
707	{
708	LogFlow(("CSAMExecFault %RX32\n", pRegFrame->eip));
709	rc = CSAMExecFault(pVM, (RTRCPTR)pRegFrame->eip);
710	if (rc != VINF_SUCCESS)
711	{
712	/*
713	* CSAM needs to perform a job in ring 3.
714	*
715	* Sync the page before going to the host context; otherwise we'll end up in a loop if
716	* CSAM fails (e.g. instruction crosses a page boundary and the next page is not present)
717	*/
718	LogFlow(("CSAM ring 3 job\n"));
719	int rc2 = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrc, pvFault, 1, uErr);
720	AssertRC(rc2);
721
722	STAM_PROFILE_STOP(&pVCpu->pgm.s.StatRZTrap0eTimeOutOfSync, c);
723	STAM_STATS({ pVCpu->pgm.s.CTX_SUFF(pStatTrap0eAttribution) = &pVCpu->pgm.s.StatRZTrap0eTime2CSAM; });
724	return rc;
725	}
726	}
727	# ifdef CSAM_DETECT_NEW_CODE_PAGES
728	else if ( uErr == X86_TRAP_PF_RW
729	&& pRegFrame->ecx >= 0x100 /* early check for movswd count */
730	&& pRegFrame->ecx < 0x10000)
731	{
732	/* In case of a write to a non-present supervisor shadow page, we'll take special precautions
733	* to detect loading of new code pages.
734	*/
735
736	/*
737	* Decode the instruction.
738	*/
739	RTGCPTR PC;
740	rc = SELMValidateAndConvertCSAddr(pVM, pRegFrame->eflags, pRegFrame->ss, pRegFrame->cs, &pRegFrame->csHid, (RTGCPTR)pRegFrame->eip, &PC);
741	if (rc == VINF_SUCCESS)
742	{
743	PDISCPUSTATE pDis = &pVCpu->pgm.s.DisState;
744	uint32_t cbOp;
745	rc = EMInterpretDisasOneEx(pVM, pVCpu, PC, pRegFrame, pDis, &cbOp);
746
747	/* For now we'll restrict this to rep movsw/d instructions */
748	if ( rc == VINF_SUCCESS
749	&& pDis->pCurInstr->opcode == OP_MOVSWD
750	&& (pDis->prefix & PREFIX_REP))
751	{
752	CSAMMarkPossibleCodePage(pVM, pvFault);
753	}
754	}
755	}
756	# endif /* CSAM_DETECT_NEW_CODE_PAGES */
757
758	/*
759	* Mark this page as safe.
760	*/
761	/** @todo not correct for pages that contain both code and data!! */
762	Log2(("CSAMMarkPage %RGv; scanned=%d\n", pvFault, true));
763	CSAMMarkPage(pVM, (RTRCPTR)pvFault, true);
764	}
765	}
766	# endif /* PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE) && !defined(IN_RING0) */
767	rc = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrc, pvFault, PGM_SYNC_NR_PAGES, uErr);
768	if (RT_SUCCESS(rc))
769	{
770	/* The page was successfully synced, return to the guest. */
771	STAM_PROFILE_STOP(&pVCpu->pgm.s.StatRZTrap0eTimeOutOfSync, c);
772	STAM_STATS({ pVCpu->pgm.s.CTX_SUFF(pStatTrap0eAttribution) = &pVCpu->pgm.s.StatRZTrap0eTime2OutOfSync; });
773	return VINF_SUCCESS;
774	}
775	}
776	else /* uErr & X86_TRAP_PF_P: */
777	{
778	/*
779	* Write protected pages are make writable when the guest makes the first
780	* write to it. This happens for pages that are shared, write monitored
781	* and not yet allocated.
782	*
783	* Also, a side effect of not flushing global PDEs are out of sync pages due
784	* to physical monitored regions, that are no longer valid.
785	* Assume for now it only applies to the read/write flag.
786	*/
787	if (RT_SUCCESS(rc) && (uErr & X86_TRAP_PF_RW))
788	{
789	if (PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED)
790	{
791	Log(("PGM #PF: Make writable: %RGp %R[pgmpage] pvFault=%RGp uErr=%#x\n",
792	GCPhys, pPage, pvFault, uErr));
793	rc = pgmPhysPageMakeWritableUnlocked(pVM, pPage, GCPhys);
794	if (rc != VINF_SUCCESS)
795	{
796	AssertMsg(rc == VINF_PGM_SYNC_CR3 \|\| RT_FAILURE(rc), ("%Rrc\n", rc));
797	return rc;
798	}
799	if (RT_UNLIKELY(VM_FF_ISPENDING(pVM, VM_FF_PGM_NO_MEMORY)))
800	return VINF_EM_NO_MEMORY;
801	}
802
803	# if PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE)
804	/* Check to see if we need to emulate the instruction as X86_CR0_WP has been cleared. */
805	if ( CPUMGetGuestCPL(pVCpu, pRegFrame) == 0
806	&& ((CPUMGetGuestCR0(pVCpu) & (X86_CR0_WP \| X86_CR0_PG)) == X86_CR0_PG))
807	{
808	Assert((uErr & (X86_TRAP_PF_RW \| X86_TRAP_PF_P)) == (X86_TRAP_PF_RW \| X86_TRAP_PF_P));
809	uint64_t fPageGst;
810	rc = PGMGstGetPage(pVCpu, pvFault, &fPageGst, NULL);
811	if ( RT_SUCCESS(rc)
812	&& !(fPageGst & X86_PTE_RW))
813	{
814	rc = PGMInterpretInstruction(pVM, pVCpu, pRegFrame, pvFault);
815	if (RT_SUCCESS(rc))
816	STAM_COUNTER_INC(&pVCpu->pgm.s.StatRZTrap0eWPEmulInRZ);
817	else
818	STAM_COUNTER_INC(&pVCpu->pgm.s.StatRZTrap0eWPEmulToR3);
819	return rc;
820	}
821	AssertMsg(RT_SUCCESS(rc), ("Unexpected r/w page %RGv flag=%x rc=%Rrc\n", pvFault, (uint32_t)fPageGst, rc));
822	}
823	# endif
824	/// @todo count the above case; else
825	if (uErr & X86_TRAP_PF_US)
826	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,PageOutOfSyncUserWrite));
827	else /* supervisor */
828	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,PageOutOfSyncSupervisorWrite));
829
830	/*
831	* Note: Do NOT use PGM_SYNC_NR_PAGES here. That only works if the
832	* page is not present, which is not true in this case.
833	*/
834	rc = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrc, pvFault, 1, uErr);
835	if (RT_SUCCESS(rc))
836	{
837	/*
838	* Page was successfully synced, return to guest.
839	* First invalidate the page as it might be in the TLB.
840	*/
841	# if PGM_SHW_TYPE == PGM_TYPE_EPT
842	HWACCMInvalidatePhysPage(pVM, (RTGCPHYS)pvFault);
843	# else
844	PGM_INVL_PG_ALL_VCPU(pVM, pvFault);
845	# endif
846	# ifdef VBOX_STRICT
847	RTGCPHYS GCPhys;
848	uint64_t fPageGst;
849	if (!HWACCMIsNestedPagingActive(pVM))
850	{
851	rc = PGMGstGetPage(pVCpu, pvFault, &fPageGst, &GCPhys);
852	AssertMsg(RT_SUCCESS(rc) && (fPageGst & X86_PTE_RW), ("rc=%d fPageGst=%RX64\n"));
853	LogFlow(("Obsolete physical monitor page out of sync %RGv - phys %RGp flags=%08llx\n", pvFault, GCPhys, (uint64_t)fPageGst));
854	}
855	uint64_t fPageShw;
856	rc = PGMShwGetPage(pVCpu, pvFault, &fPageShw, NULL);
857	AssertMsg((RT_SUCCESS(rc) && (fPageShw & X86_PTE_RW)) \|\| pVM->cCpus > 1 /* new monitor can be installed/page table flushed between the trap exit and PGMTrap0eHandler */, ("rc=%Rrc fPageShw=%RX64\n", rc, fPageShw));
858	# endif /* VBOX_STRICT */
859	STAM_PROFILE_STOP(&pVCpu->pgm.s.StatRZTrap0eTimeOutOfSync, c);
860	STAM_STATS({ pVCpu->pgm.s.CTX_SUFF(pStatTrap0eAttribution) = &pVCpu->pgm.s.StatRZTrap0eTime2OutOfSyncHndObs; });
861	return VINF_SUCCESS;
862	}
863	}
864
865	# if PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE)
866	# ifdef VBOX_STRICT
867	/*
868	* Check for VMM page flags vs. Guest page flags consistency.
869	* Currently only for debug purposes.
870	*/
871	if (RT_SUCCESS(rc))
872	{
873	/* Get guest page flags. */
874	uint64_t fPageGst;
875	rc = PGMGstGetPage(pVCpu, pvFault, &fPageGst, NULL);
876	if (RT_SUCCESS(rc))
877	{
878	uint64_t fPageShw;
879	rc = PGMShwGetPage(pVCpu, pvFault, &fPageShw, NULL);
880
881	/*
882	* Compare page flags.
883	* Note: we have AVL, A, D bits desynched.
884	*/
885	AssertMsg((fPageShw & ~(X86_PTE_A \| X86_PTE_D \| X86_PTE_AVL_MASK)) == (fPageGst & ~(X86_PTE_A \| X86_PTE_D \| X86_PTE_AVL_MASK)),
886	("Page flags mismatch! pvFault=%RGv uErr=%x GCPhys=%RGp fPageShw=%RX64 fPageGst=%RX64\n", pvFault, (uint32_t)uErr, GCPhys, fPageShw, fPageGst));
887	}
888	else
889	AssertMsgFailed(("PGMGstGetPage rc=%Rrc\n", rc));
890	}
891	else
892	AssertMsgFailed(("PGMGCGetPage rc=%Rrc\n", rc));
893	# endif /* VBOX_STRICT */
894	# endif /* PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE) */
895	}
896	STAM_PROFILE_STOP(&pVCpu->pgm.s.StatRZTrap0eTimeOutOfSync, c);
897	# endif /* PGM_OUT_OF_SYNC_IN_GC */
898	}
899	else /* GCPhys == NIL_RTGCPHYS */
900	{
901	/*
902	* Page not present in Guest OS or invalid page table address.
903	* This is potential virtual page access handler food.
904	*
905	* For the present we'll say that our access handlers don't
906	* work for this case - we've already discarded the page table
907	* not present case which is identical to this.
908	*
909	* When we perchance find we need this, we will probably have AVL
910	* trees (offset based) to operate on and we can measure their speed
911	* agains mapping a page table and probably rearrange this handling
912	* a bit. (Like, searching virtual ranges before checking the
913	* physical address.)
914	*/
915	}
916	}
917	/* else: !present (guest) */
918
919
920	# if PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE)
921	/*
922	* Conclusion, this is a guest trap.
923	*/
924	LogFlow(("PGM: Unhandled #PF -> route trap to recompiler!\n"));
925	STAM_COUNTER_INC(&pVCpu->pgm.s.StatRZTrap0eGuestPFUnh);
926	return VINF_EM_RAW_GUEST_TRAP;
927	# else
928	/* present, but not a monitored page; perhaps the guest is probing physical memory */
929	return VINF_EM_RAW_EMULATE_INSTR;
930	# endif /* PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE) */
931
932
933	# else /* PGM_GST_TYPE != PGM_TYPE_32BIT */
934
935	AssertReleaseMsgFailed(("Shw=%d Gst=%d is not implemented!\n", PGM_GST_TYPE, PGM_SHW_TYPE));
936	return VERR_INTERNAL_ERROR;
937	# endif /* PGM_GST_TYPE != PGM_TYPE_32BIT */
938	}
939	#endif /* !IN_RING3 */
940
941
942	/**
943	* Emulation of the invlpg instruction.
944	*
945	*
946	* @returns VBox status code.
947	*
948	* @param pVCpu The VMCPU handle.
949	* @param GCPtrPage Page to invalidate.
950	*
951	* @remark ASSUMES that the guest is updating before invalidating. This order
952	* isn't required by the CPU, so this is speculative and could cause
953	* trouble.
954	* @remark No TLB shootdown is done on any other VCPU as we assume that
955	* invlpg emulation is the only reason for calling this function.
956	* (The guest has to shoot down TLB entries on other CPUs itself)
957	* Currently true, but keep in mind!
958	*
959	* @todo Flush page or page directory only if necessary!
960	* @todo Add a #define for simply invalidating the page.
961	*/
962	PGM_BTH_DECL(int, InvalidatePage)(PVMCPU pVCpu, RTGCPTR GCPtrPage)
963	{
964	#if PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE) \
965	&& PGM_SHW_TYPE != PGM_TYPE_NESTED \
966	&& PGM_SHW_TYPE != PGM_TYPE_EPT
967	int rc;
968	PVM pVM = pVCpu->CTX_SUFF(pVM);
969	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
970
971	Assert(PGMIsLockOwner(pVM));
972
973	LogFlow(("InvalidatePage %RGv\n", GCPtrPage));
974
975	# ifdef PGMPOOL_WITH_OPTIMIZED_DIRTY_PT
976	if (pPool->cDirtyPages)
977	pgmPoolResetDirtyPages(pVM);
978	# endif
979
980	/*
981	* Get the shadow PD entry and skip out if this PD isn't present.
982	* (Guessing that it is frequent for a shadow PDE to not be present, do this first.)
983	*/
984	# if PGM_SHW_TYPE == PGM_TYPE_32BIT
985	const unsigned iPDDst = (GCPtrPage >> SHW_PD_SHIFT) & SHW_PD_MASK;
986	PX86PDE pPdeDst = pgmShwGet32BitPDEPtr(&pVCpu->pgm.s, GCPtrPage);
987
988	/* Fetch the pgm pool shadow descriptor. */
989	PPGMPOOLPAGE pShwPde = pVCpu->pgm.s.CTX_SUFF(pShwPageCR3);
990	Assert(pShwPde);
991
992	# elif PGM_SHW_TYPE == PGM_TYPE_PAE
993	const unsigned iPdpt = (GCPtrPage >> X86_PDPT_SHIFT);
994	PX86PDPT pPdptDst = pgmShwGetPaePDPTPtr(&pVCpu->pgm.s);
995
996	/* If the shadow PDPE isn't present, then skip the invalidate. */
997	if (!pPdptDst->a[iPdpt].n.u1Present)
998	{
999	Assert(!(pPdptDst->a[iPdpt].u & PGM_PLXFLAGS_MAPPING));
1000	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,InvalidatePageSkipped));
1001	return VINF_SUCCESS;
1002	}
1003
1004	const unsigned iPDDst = (GCPtrPage >> SHW_PD_SHIFT) & SHW_PD_MASK;
1005	PPGMPOOLPAGE pShwPde = NULL;
1006	PX86PDPAE pPDDst;
1007
1008	/* Fetch the pgm pool shadow descriptor. */
1009	rc = pgmShwGetPaePoolPagePD(&pVCpu->pgm.s, GCPtrPage, &pShwPde);
1010	AssertRCSuccessReturn(rc, rc);
1011	Assert(pShwPde);
1012
1013	pPDDst = (PX86PDPAE)PGMPOOL_PAGE_2_PTR_BY_PGM(&pVM->pgm.s, pShwPde);
1014	PX86PDEPAE pPdeDst = &pPDDst->a[iPDDst];
1015
1016	# else /* PGM_SHW_TYPE == PGM_TYPE_AMD64 */
1017	/* PML4 */
1018	const unsigned iPml4 = (GCPtrPage >> X86_PML4_SHIFT) & X86_PML4_MASK;
1019	const unsigned iPdpt = (GCPtrPage >> X86_PDPT_SHIFT) & X86_PDPT_MASK_AMD64;
1020	const unsigned iPDDst = (GCPtrPage >> SHW_PD_SHIFT) & SHW_PD_MASK;
1021	PX86PDPAE pPDDst;
1022	PX86PDPT pPdptDst;
1023	PX86PML4E pPml4eDst;
1024	rc = pgmShwGetLongModePDPtr(pVCpu, GCPtrPage, &pPml4eDst, &pPdptDst, &pPDDst);
1025	if (rc != VINF_SUCCESS)
1026	{
1027	AssertMsg(rc == VERR_PAGE_DIRECTORY_PTR_NOT_PRESENT \|\| rc == VERR_PAGE_MAP_LEVEL4_NOT_PRESENT, ("Unexpected rc=%Rrc\n", rc));
1028	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,InvalidatePageSkipped));
1029	if (!VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3))
1030	PGM_INVL_VCPU_TLBS(pVCpu);
1031	return VINF_SUCCESS;
1032	}
1033	Assert(pPDDst);
1034
1035	PX86PDEPAE pPdeDst = &pPDDst->a[iPDDst];
1036	PX86PDPE pPdpeDst = &pPdptDst->a[iPdpt];
1037
1038	if (!pPdpeDst->n.u1Present)
1039	{
1040	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,InvalidatePageSkipped));
1041	if (!VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3))
1042	PGM_INVL_VCPU_TLBS(pVCpu);
1043	return VINF_SUCCESS;
1044	}
1045
1046	# endif /* PGM_SHW_TYPE == PGM_TYPE_AMD64 */
1047
1048	const SHWPDE PdeDst = *pPdeDst;
1049	if (!PdeDst.n.u1Present)
1050	{
1051	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,InvalidatePageSkipped));
1052	return VINF_SUCCESS;
1053	}
1054
1055	# if defined(IN_RC)
1056	/* Make sure the dynamic pPdeDst mapping will not be reused during this function. */
1057	PGMDynLockHCPage(pVM, (uint8_t *)pPdeDst);
1058	# endif
1059
1060	/*
1061	* Get the guest PD entry and calc big page.
1062	*/
1063	# if PGM_GST_TYPE == PGM_TYPE_32BIT
1064	PGSTPD pPDSrc = pgmGstGet32bitPDPtr(&pVCpu->pgm.s);
1065	const unsigned iPDSrc = GCPtrPage >> GST_PD_SHIFT;
1066	GSTPDE PdeSrc = pPDSrc->a[iPDSrc];
1067	# else /* PGM_GST_TYPE != PGM_TYPE_32BIT */
1068	unsigned iPDSrc = 0;
1069	# if PGM_GST_TYPE == PGM_TYPE_PAE
1070	X86PDPE PdpeSrc;
1071	PX86PDPAE pPDSrc = pgmGstGetPaePDPtr(&pVCpu->pgm.s, GCPtrPage, &iPDSrc, &PdpeSrc);
1072	# else /* AMD64 */
1073	PX86PML4E pPml4eSrc;
1074	X86PDPE PdpeSrc;
1075	PX86PDPAE pPDSrc = pgmGstGetLongModePDPtr(&pVCpu->pgm.s, GCPtrPage, &pPml4eSrc, &PdpeSrc, &iPDSrc);
1076	# endif
1077	GSTPDE PdeSrc;
1078
1079	if (pPDSrc)
1080	PdeSrc = pPDSrc->a[iPDSrc];
1081	else
1082	PdeSrc.u = 0;
1083	# endif /* PGM_GST_TYPE != PGM_TYPE_32BIT */
1084
1085	# if PGM_GST_TYPE == PGM_TYPE_AMD64
1086	const bool fIsBigPage = PdeSrc.b.u1Size;
1087	# else
1088	const bool fIsBigPage = PdeSrc.b.u1Size && (CPUMGetGuestCR4(pVCpu) & X86_CR4_PSE);
1089	# endif
1090
1091	# ifdef IN_RING3
1092	/*
1093	* If a CR3 Sync is pending we may ignore the invalidate page operation
1094	* depending on the kind of sync and if it's a global page or not.
1095	* This doesn't make sense in GC/R0 so we'll skip it entirely there.
1096	*/
1097	# ifdef PGM_SKIP_GLOBAL_PAGEDIRS_ON_NONGLOBAL_FLUSH
1098	if ( VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3)
1099	\|\| ( VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL)
1100	&& fIsBigPage
1101	&& PdeSrc.b.u1Global
1102	)
1103	)
1104	# else
1105	if (VM_FF_ISPENDING(pVM, VM_FF_PGM_SYNC_CR3 \| VM_FF_PGM_SYNC_CR3_NON_GLOBAL) )
1106	# endif
1107	{
1108	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,InvalidatePageSkipped));
1109	return VINF_SUCCESS;
1110	}
1111	# endif /* IN_RING3 */
1112
1113	# if PGM_GST_TYPE == PGM_TYPE_AMD64
1114	/* Fetch the pgm pool shadow descriptor. */
1115	PPGMPOOLPAGE pShwPdpt = pgmPoolGetPage(pPool, pPml4eDst->u & X86_PML4E_PG_MASK);
1116	Assert(pShwPdpt);
1117
1118	/* Fetch the pgm pool shadow descriptor. */
1119	PPGMPOOLPAGE pShwPde = pgmPoolGetPage(pPool, pPdptDst->a[iPdpt].u & SHW_PDPE_PG_MASK);
1120	Assert(pShwPde);
1121
1122	Assert(pPml4eDst->n.u1Present && (pPml4eDst->u & SHW_PDPT_MASK));
1123	RTGCPHYS GCPhysPdpt = pPml4eSrc->u & X86_PML4E_PG_MASK;
1124
1125	if ( !pPml4eSrc->n.u1Present
1126	\|\| pShwPdpt->GCPhys != GCPhysPdpt)
1127	{
1128	LogFlow(("InvalidatePage: Out-of-sync PML4E (P/GCPhys) at %RGv GCPhys=%RGp vs %RGp Pml4eSrc=%RX64 Pml4eDst=%RX64\n",
1129	GCPtrPage, pShwPdpt->GCPhys, GCPhysPdpt, (uint64_t)pPml4eSrc->u, (uint64_t)pPml4eDst->u));
1130	pgmPoolFreeByPage(pPool, pShwPdpt, pVCpu->pgm.s.CTX_SUFF(pShwPageCR3)->idx, iPml4);
1131	ASMAtomicWriteSize(pPml4eDst, 0);
1132	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,InvalidatePagePDNPs));
1133	PGM_INVL_VCPU_TLBS(pVCpu);
1134	return VINF_SUCCESS;
1135	}
1136	if ( pPml4eSrc->n.u1User != pPml4eDst->n.u1User
1137	\|\| (!pPml4eSrc->n.u1Write && pPml4eDst->n.u1Write))
1138	{
1139	/*
1140	* Mark not present so we can resync the PML4E when it's used.
1141	*/
1142	LogFlow(("InvalidatePage: Out-of-sync PML4E at %RGv Pml4eSrc=%RX64 Pml4eDst=%RX64\n",
1143	GCPtrPage, (uint64_t)pPml4eSrc->u, (uint64_t)pPml4eDst->u));
1144	pgmPoolFreeByPage(pPool, pShwPdpt, pVCpu->pgm.s.CTX_SUFF(pShwPageCR3)->idx, iPml4);
1145	ASMAtomicWriteSize(pPml4eDst, 0);
1146	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,InvalidatePagePDOutOfSync));
1147	PGM_INVL_VCPU_TLBS(pVCpu);
1148	}
1149	else if (!pPml4eSrc->n.u1Accessed)
1150	{
1151	/*
1152	* Mark not present so we can set the accessed bit.
1153	*/
1154	LogFlow(("InvalidatePage: Out-of-sync PML4E (A) at %RGv Pml4eSrc=%RX64 Pml4eDst=%RX64\n",
1155	GCPtrPage, (uint64_t)pPml4eSrc->u, (uint64_t)pPml4eDst->u));
1156	pgmPoolFreeByPage(pPool, pShwPdpt, pVCpu->pgm.s.CTX_SUFF(pShwPageCR3)->idx, iPml4);
1157	ASMAtomicWriteSize(pPml4eDst, 0);
1158	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,InvalidatePagePDNAs));
1159	PGM_INVL_VCPU_TLBS(pVCpu);
1160	}
1161
1162	/* Check if the PDPT entry has changed. */
1163	Assert(pPdpeDst->n.u1Present && pPdpeDst->u & SHW_PDPT_MASK);
1164	RTGCPHYS GCPhysPd = PdpeSrc.u & GST_PDPE_PG_MASK;
1165	if ( !PdpeSrc.n.u1Present
1166	\|\| pShwPde->GCPhys != GCPhysPd)
1167	{
1168	LogFlow(("InvalidatePage: Out-of-sync PDPE (P/GCPhys) at %RGv GCPhys=%RGp vs %RGp PdpeSrc=%RX64 PdpeDst=%RX64\n",
1169	GCPtrPage, pShwPde->GCPhys, GCPhysPd, (uint64_t)PdpeSrc.u, (uint64_t)pPdpeDst->u));
1170	pgmPoolFreeByPage(pPool, pShwPde, pShwPdpt->idx, iPdpt);
1171	ASMAtomicWriteSize(pPdpeDst, 0);
1172	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,InvalidatePagePDNPs));
1173	PGM_INVL_VCPU_TLBS(pVCpu);
1174	return VINF_SUCCESS;
1175	}
1176	if ( PdpeSrc.lm.u1User != pPdpeDst->lm.u1User
1177	\|\| (!PdpeSrc.lm.u1Write && pPdpeDst->lm.u1Write))
1178	{
1179	/*
1180	* Mark not present so we can resync the PDPTE when it's used.
1181	*/
1182	LogFlow(("InvalidatePage: Out-of-sync PDPE at %RGv PdpeSrc=%RX64 PdpeDst=%RX64\n",
1183	GCPtrPage, (uint64_t)PdpeSrc.u, (uint64_t)pPdpeDst->u));
1184	pgmPoolFreeByPage(pPool, pShwPde, pShwPdpt->idx, iPdpt);
1185	ASMAtomicWriteSize(pPdpeDst, 0);
1186	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,InvalidatePagePDOutOfSync));
1187	PGM_INVL_VCPU_TLBS(pVCpu);
1188	}
1189	else if (!PdpeSrc.lm.u1Accessed)
1190	{
1191	/*
1192	* Mark not present so we can set the accessed bit.
1193	*/
1194	LogFlow(("InvalidatePage: Out-of-sync PDPE (A) at %RGv PdpeSrc=%RX64 PdpeDst=%RX64\n",
1195	GCPtrPage, (uint64_t)PdpeSrc.u, (uint64_t)pPdpeDst->u));
1196	pgmPoolFreeByPage(pPool, pShwPde, pShwPdpt->idx, iPdpt);
1197	ASMAtomicWriteSize(pPdpeDst, 0);
1198	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,InvalidatePagePDNAs));
1199	PGM_INVL_VCPU_TLBS(pVCpu);
1200	}
1201	# endif /* PGM_GST_TYPE == PGM_TYPE_AMD64 */
1202
1203	/*
1204	* Deal with the Guest PDE.
1205	*/
1206	rc = VINF_SUCCESS;
1207	if (PdeSrc.n.u1Present)
1208	{
1209	# ifndef PGM_WITHOUT_MAPPING
1210	if (PdeDst.u & PGM_PDFLAGS_MAPPING)
1211	{
1212	/*
1213	* Conflict - Let SyncPT deal with it to avoid duplicate code.
1214	*/
1215	Assert(pgmMapAreMappingsEnabled(&pVM->pgm.s));
1216	Assert(PGMGetGuestMode(pVCpu) <= PGMMODE_PAE);
1217	pgmLock(pVM);
1218	rc = PGM_BTH_NAME(SyncPT)(pVCpu, iPDSrc, pPDSrc, GCPtrPage);
1219	pgmUnlock(pVM);
1220	}
1221	else
1222	# endif /* !PGM_WITHOUT_MAPPING */
1223	if ( PdeSrc.n.u1User != PdeDst.n.u1User
1224	\|\| (!PdeSrc.n.u1Write && PdeDst.n.u1Write))
1225	{
1226	/*
1227	* Mark not present so we can resync the PDE when it's used.
1228	*/
1229	LogFlow(("InvalidatePage: Out-of-sync at %RGp PdeSrc=%RX64 PdeDst=%RX64\n",
1230	GCPtrPage, (uint64_t)PdeSrc.u, (uint64_t)PdeDst.u));
1231	pgmPoolFree(pVM, PdeDst.u & SHW_PDE_PG_MASK, pShwPde->idx, iPDDst);
1232	ASMAtomicWriteSize(pPdeDst, 0);
1233	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,InvalidatePagePDOutOfSync));
1234	PGM_INVL_VCPU_TLBS(pVCpu);
1235	}
1236	else if (!PdeSrc.n.u1Accessed)
1237	{
1238	/*
1239	* Mark not present so we can set the accessed bit.
1240	*/
1241	LogFlow(("InvalidatePage: Out-of-sync (A) at %RGp PdeSrc=%RX64 PdeDst=%RX64\n",
1242	GCPtrPage, (uint64_t)PdeSrc.u, (uint64_t)PdeDst.u));
1243	pgmPoolFree(pVM, PdeDst.u & SHW_PDE_PG_MASK, pShwPde->idx, iPDDst);
1244	ASMAtomicWriteSize(pPdeDst, 0);
1245	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,InvalidatePagePDNAs));
1246	PGM_INVL_VCPU_TLBS(pVCpu);
1247	}
1248	else if (!fIsBigPage)
1249	{
1250	/*
1251	* 4KB - page.
1252	*/
1253	PPGMPOOLPAGE pShwPage = pgmPoolGetPage(pPool, PdeDst.u & SHW_PDE_PG_MASK);
1254	RTGCPHYS GCPhys = PdeSrc.u & GST_PDE_PG_MASK;
1255	# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
1256	/* Select the right PDE as we're emulating a 4kb page table with 2 shadow page tables. */
1257	GCPhys \|= (iPDDst & 1) * (PAGE_SIZE/2);
1258	# endif
1259	if (pShwPage->GCPhys == GCPhys)
1260	{
1261	# if 0 /* likely cause of a major performance regression; must be SyncPageWorkerTrackDeref then */
1262	const unsigned iPTEDst = (GCPtrPage >> SHW_PT_SHIFT) & SHW_PT_MASK;
1263	PSHWPT pPT = (PSHWPT)PGMPOOL_PAGE_2_PTR(pVM, pShwPage);
1264	if (pPT->a[iPTEDst].n.u1Present)
1265	{
1266	# ifdef PGMPOOL_WITH_USER_TRACKING
1267	/* This is very unlikely with caching/monitoring enabled. */
1268	PGM_BTH_NAME(SyncPageWorkerTrackDeref)(pShwPage, pPT->a[iPTEDst].u & SHW_PTE_PG_MASK);
1269	# endif
1270	ASMAtomicWriteSize(&pPT->a[iPTEDst], 0);
1271	}
1272	# else /* Syncing it here isn't 100% safe and it's probably not worth spending time syncing it. */
1273	rc = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrc, GCPtrPage, 1, 0);
1274	if (RT_SUCCESS(rc))
1275	rc = VINF_SUCCESS;
1276	# endif
1277	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,InvalidatePage4KBPages));
1278	PGM_INVL_PG(pVCpu, GCPtrPage);
1279	}
1280	else
1281	{
1282	/*
1283	* The page table address changed.
1284	*/
1285	LogFlow(("InvalidatePage: Out-of-sync at %RGp PdeSrc=%RX64 PdeDst=%RX64 ShwGCPhys=%RGp iPDDst=%#x\n",
1286	GCPtrPage, (uint64_t)PdeSrc.u, (uint64_t)PdeDst.u, pShwPage->GCPhys, iPDDst));
1287	pgmPoolFree(pVM, PdeDst.u & SHW_PDE_PG_MASK, pShwPde->idx, iPDDst);
1288	ASMAtomicWriteSize(pPdeDst, 0);
1289	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,InvalidatePagePDOutOfSync));
1290	PGM_INVL_VCPU_TLBS(pVCpu);
1291	}
1292	}
1293	else
1294	{
1295	/*
1296	* 2/4MB - page.
1297	*/
1298	/* Before freeing the page, check if anything really changed. */
1299	PPGMPOOLPAGE pShwPage = pgmPoolGetPage(pPool, PdeDst.u & SHW_PDE_PG_MASK);
1300	RTGCPHYS GCPhys = GST_GET_PDE_BIG_PG_GCPHYS(PdeSrc);
1301	# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
1302	/* Select the right PDE as we're emulating a 4MB page directory with two 2 MB shadow PDEs.*/
1303	GCPhys \|= GCPtrPage & (1 << X86_PD_PAE_SHIFT);
1304	# endif
1305	if ( pShwPage->GCPhys == GCPhys
1306	&& pShwPage->enmKind == BTH_PGMPOOLKIND_PT_FOR_BIG)
1307	{
1308	/* ASSUMES a the given bits are identical for 4M and normal PDEs */
1309	/** @todo PAT */
1310	if ( (PdeSrc.u & (X86_PDE_P \| X86_PDE_RW \| X86_PDE_US \| X86_PDE_PWT \| X86_PDE_PCD))
1311	== (PdeDst.u & (X86_PDE_P \| X86_PDE_RW \| X86_PDE_US \| X86_PDE_PWT \| X86_PDE_PCD))
1312	&& ( PdeSrc.b.u1Dirty /** @todo rainy day: What about read-only 4M pages? not very common, but still... */
1313	\|\| (PdeDst.u & PGM_PDFLAGS_TRACK_DIRTY)))
1314	{
1315	LogFlow(("Skipping flush for big page containing %RGv (PD=%X .u=%RX64)-> nothing has changed!\n", GCPtrPage, iPDSrc, PdeSrc.u));
1316	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,InvalidatePage4MBPagesSkip));
1317	# if defined(IN_RC)
1318	/* Make sure the dynamic pPdeDst mapping will not be reused during this function. */
1319	PGMDynUnlockHCPage(pVM, (uint8_t *)pPdeDst);
1320	# endif
1321	return VINF_SUCCESS;
1322	}
1323	}
1324
1325	/*
1326	* Ok, the page table is present and it's been changed in the guest.
1327	* If we're in host context, we'll just mark it as not present taking the lazy approach.
1328	* We could do this for some flushes in GC too, but we need an algorithm for
1329	* deciding which 4MB pages containing code likely to be executed very soon.
1330	*/
1331	LogFlow(("InvalidatePage: Out-of-sync PD at %RGp PdeSrc=%RX64 PdeDst=%RX64\n",
1332	GCPtrPage, (uint64_t)PdeSrc.u, (uint64_t)PdeDst.u));
1333	pgmPoolFree(pVM, PdeDst.u & SHW_PDE_PG_MASK, pShwPde->idx, iPDDst);
1334	ASMAtomicWriteSize(pPdeDst, 0);
1335	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,InvalidatePage4MBPages));
1336	PGM_INVL_BIG_PG(pVCpu, GCPtrPage);
1337	}
1338	}
1339	else
1340	{
1341	/*
1342	* Page directory is not present, mark shadow PDE not present.
1343	*/
1344	if (!(PdeDst.u & PGM_PDFLAGS_MAPPING))
1345	{
1346	pgmPoolFree(pVM, PdeDst.u & SHW_PDE_PG_MASK, pShwPde->idx, iPDDst);
1347	ASMAtomicWriteSize(pPdeDst, 0);
1348	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,InvalidatePagePDNPs));
1349	PGM_INVL_PG(pVCpu, GCPtrPage);
1350	}
1351	else
1352	{
1353	Assert(pgmMapAreMappingsEnabled(&pVM->pgm.s));
1354	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,InvalidatePagePDMappings));
1355	}
1356	}
1357	# if defined(IN_RC)
1358	/* Make sure the dynamic pPdeDst mapping will not be reused during this function. */
1359	PGMDynUnlockHCPage(pVM, (uint8_t *)pPdeDst);
1360	# endif
1361	return rc;
1362
1363	#else /* guest real and protected mode */
1364	/* There's no such thing as InvalidatePage when paging is disabled, so just ignore. */
1365	return VINF_SUCCESS;
1366	#endif
1367	}
1368
1369
1370	#ifdef PGMPOOL_WITH_USER_TRACKING
1371	/**
1372	* Update the tracking of shadowed pages.
1373	*
1374	* @param pVCpu The VMCPU handle.
1375	* @param pShwPage The shadow page.
1376	* @param HCPhys The physical page we is being dereferenced.
1377	*/
1378	DECLINLINE(void) PGM_BTH_NAME(SyncPageWorkerTrackDeref)(PVMCPU pVCpu, PPGMPOOLPAGE pShwPage, RTHCPHYS HCPhys)
1379	{
1380	# ifdef PGMPOOL_WITH_GCPHYS_TRACKING
1381	PVM pVM = pVCpu->CTX_SUFF(pVM);
1382
1383	STAM_PROFILE_START(&pVM->pgm.s.StatTrackDeref, a);
1384	LogFlow(("SyncPageWorkerTrackDeref: Damn HCPhys=%RHp pShwPage->idx=%#x!!!\n", HCPhys, pShwPage->idx));
1385
1386	/** @todo If this turns out to be a bottle neck (very likely) two things can be done:
1387	* 1. have a medium sized HCPhys -> GCPhys TLB (hash?)
1388	* 2. write protect all shadowed pages. I.e. implement caching.
1389	*/
1390	/*
1391	* Find the guest address.
1392	*/
1393	for (PPGMRAMRANGE pRam = pVM->pgm.s.CTX_SUFF(pRamRanges);
1394	pRam;
1395	pRam = pRam->CTX_SUFF(pNext))
1396	{
1397	unsigned iPage = pRam->cb >> PAGE_SHIFT;
1398	while (iPage-- > 0)
1399	{
1400	if (PGM_PAGE_GET_HCPHYS(&pRam->aPages[iPage]) == HCPhys)
1401	{
1402	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
1403	pgmTrackDerefGCPhys(pPool, pShwPage, &pRam->aPages[iPage]);
1404	pShwPage->cPresent--;
1405	pPool->cPresent--;
1406	STAM_PROFILE_STOP(&pVM->pgm.s.StatTrackDeref, a);
1407	return;
1408	}
1409	}
1410	}
1411
1412	for (;;)
1413	AssertReleaseMsgFailed(("HCPhys=%RHp wasn't found!\n", HCPhys));
1414	# else /* !PGMPOOL_WITH_GCPHYS_TRACKING */
1415	pShwPage->cPresent--;
1416	pVM->pgm.s.CTX_SUFF(pPool)->cPresent--;
1417	# endif /* !PGMPOOL_WITH_GCPHYS_TRACKING */
1418	}
1419
1420
1421	/**
1422	* Update the tracking of shadowed pages.
1423	*
1424	* @param pVCpu The VMCPU handle.
1425	* @param pShwPage The shadow page.
1426	* @param u16 The top 16-bit of the pPage->HCPhys.
1427	* @param pPage Pointer to the guest page. this will be modified.
1428	* @param iPTDst The index into the shadow table.
1429	*/
1430	DECLINLINE(void) PGM_BTH_NAME(SyncPageWorkerTrackAddref)(PVMCPU pVCpu, PPGMPOOLPAGE pShwPage, uint16_t u16, PPGMPAGE pPage, const unsigned iPTDst)
1431	{
1432	PVM pVM = pVCpu->CTX_SUFF(pVM);
1433	# ifdef PGMPOOL_WITH_GCPHYS_TRACKING
1434	/*
1435	* Just deal with the simple first time here.
1436	*/
1437	if (!u16)
1438	{
1439	STAM_COUNTER_INC(&pVM->pgm.s.StatTrackVirgin);
1440	u16 = PGMPOOL_TD_MAKE(1, pShwPage->idx);
1441	}
1442	else
1443	u16 = pgmPoolTrackPhysExtAddref(pVM, u16, pShwPage->idx);
1444
1445	/* write back */
1446	Log2(("SyncPageWorkerTrackAddRef: u16=%#x->%#x iPTDst=%#x\n", u16, PGM_PAGE_GET_TRACKING(pPage), iPTDst));
1447	PGM_PAGE_SET_TRACKING(pPage, u16);
1448
1449	# endif /* PGMPOOL_WITH_GCPHYS_TRACKING */
1450
1451	/* update statistics. */
1452	pVM->pgm.s.CTX_SUFF(pPool)->cPresent++;
1453	pShwPage->cPresent++;
1454	if (pShwPage->iFirstPresent > iPTDst)
1455	pShwPage->iFirstPresent = iPTDst;
1456	}
1457	#endif /* PGMPOOL_WITH_USER_TRACKING */
1458
1459
1460	/**
1461	* Creates a 4K shadow page for a guest page.
1462	*
1463	* For 4M pages the caller must convert the PDE4M to a PTE, this includes adjusting the
1464	* physical address. The PdeSrc argument only the flags are used. No page structured
1465	* will be mapped in this function.
1466	*
1467	* @param pVCpu The VMCPU handle.
1468	* @param pPteDst Destination page table entry.
1469	* @param PdeSrc Source page directory entry (i.e. Guest OS page directory entry).
1470	* Can safely assume that only the flags are being used.
1471	* @param PteSrc Source page table entry (i.e. Guest OS page table entry).
1472	* @param pShwPage Pointer to the shadow page.
1473	* @param iPTDst The index into the shadow table.
1474	*
1475	* @remark Not used for 2/4MB pages!
1476	*/
1477	DECLINLINE(void) PGM_BTH_NAME(SyncPageWorker)(PVMCPU pVCpu, PSHWPTE pPteDst, GSTPDE PdeSrc, GSTPTE PteSrc, PPGMPOOLPAGE pShwPage, unsigned iPTDst)
1478	{
1479	if (PteSrc.n.u1Present)
1480	{
1481	PVM pVM = pVCpu->CTX_SUFF(pVM);
1482
1483	# if defined(PGMPOOL_WITH_OPTIMIZED_DIRTY_PT) \
1484	&& PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE) \
1485	&& (PGM_GST_TYPE == PGM_TYPE_PAE \|\| PGM_GST_TYPE == PGM_TYPE_AMD64)
1486	if (pShwPage->fDirty)
1487	{
1488	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
1489	PX86PTPAE pGstPT;
1490
1491	pGstPT = (PX86PTPAE)&pPool->aDirtyPages[pShwPage->idxDirty][0];
1492	pGstPT->a[iPTDst].u = PteSrc.u;
1493	}
1494	# endif
1495	/*
1496	* Find the ram range.
1497	*/
1498	PPGMPAGE pPage;
1499	int rc = pgmPhysGetPageEx(&pVM->pgm.s, PteSrc.u & GST_PTE_PG_MASK, &pPage);
1500	if (RT_SUCCESS(rc))
1501	{
1502	#ifndef VBOX_WITH_NEW_LAZY_PAGE_ALLOC
1503	/* Try make the page writable if necessary. */
1504	if ( PteSrc.n.u1Write
1505	&& PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED
1506	&& PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_RAM)
1507	{
1508	rc = pgmPhysPageMakeWritableUnlocked(pVM, pPage, PteSrc.u & GST_PTE_PG_MASK);
1509	AssertRC(rc);
1510	}
1511	#endif
1512
1513	/** @todo investiage PWT, PCD and PAT. */
1514	/*
1515	* Make page table entry.
1516	*/
1517	SHWPTE PteDst;
1518	if (PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage))
1519	{
1520	/** @todo r=bird: Are we actually handling dirty and access bits for pages with access handlers correctly? No. */
1521	if (!PGM_PAGE_HAS_ACTIVE_ALL_HANDLERS(pPage))
1522	{
1523	#if PGM_SHW_TYPE == PGM_TYPE_EPT
1524	PteDst.u = PGM_PAGE_GET_HCPHYS(pPage);
1525	PteDst.n.u1Present = 1;
1526	PteDst.n.u1Execute = 1;
1527	PteDst.n.u1IgnorePAT = 1;
1528	PteDst.n.u3EMT = VMX_EPT_MEMTYPE_WB;
1529	/* PteDst.n.u1Write = 0 && PteDst.n.u1Size = 0 */
1530	#else
1531	PteDst.u = (PteSrc.u & ~(X86_PTE_PAE_PG_MASK \| X86_PTE_AVL_MASK \| X86_PTE_PAT \| X86_PTE_PCD \| X86_PTE_PWT \| X86_PTE_RW))
1532	\| PGM_PAGE_GET_HCPHYS(pPage);
1533	#endif
1534	}
1535	else
1536	{
1537	LogFlow(("SyncPageWorker: monitored page (%RHp) -> mark not present\n", PGM_PAGE_GET_HCPHYS(pPage)));
1538	PteDst.u = 0;
1539	}
1540	/** @todo count these two kinds. */
1541	}
1542	else
1543	{
1544	#if PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE)
1545	/*
1546	* If the page or page directory entry is not marked accessed,
1547	* we mark the page not present.
1548	*/
1549	if (!PteSrc.n.u1Accessed \|\| !PdeSrc.n.u1Accessed)
1550	{
1551	LogFlow(("SyncPageWorker: page and or page directory not accessed -> mark not present\n"));
1552	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,AccessedPage));
1553	PteDst.u = 0;
1554	}
1555	else
1556	/*
1557	* If the page is not flagged as dirty and is writable, then make it read-only, so we can set the dirty bit
1558	* when the page is modified.
1559	*/
1560	if (!PteSrc.n.u1Dirty && (PdeSrc.n.u1Write & PteSrc.n.u1Write))
1561	{
1562	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtyPage));
1563	PteDst.u = (PteSrc.u & ~(X86_PTE_PAE_PG_MASK \| X86_PTE_AVL_MASK \| X86_PTE_PAT \| X86_PTE_PCD \| X86_PTE_PWT \| X86_PTE_RW))
1564	\| PGM_PAGE_GET_HCPHYS(pPage)
1565	\| PGM_PTFLAGS_TRACK_DIRTY;
1566	}
1567	else
1568	#endif
1569	{
1570	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtyPageSkipped));
1571	#if PGM_SHW_TYPE == PGM_TYPE_EPT
1572	PteDst.u = PGM_PAGE_GET_HCPHYS(pPage);
1573	PteDst.n.u1Present = 1;
1574	PteDst.n.u1Write = 1;
1575	PteDst.n.u1Execute = 1;
1576	PteDst.n.u1IgnorePAT = 1;
1577	PteDst.n.u3EMT = VMX_EPT_MEMTYPE_WB;
1578	/* PteDst.n.u1Size = 0 */
1579	#else
1580	PteDst.u = (PteSrc.u & ~(X86_PTE_PAE_PG_MASK \| X86_PTE_AVL_MASK \| X86_PTE_PAT \| X86_PTE_PCD \| X86_PTE_PWT))
1581	\| PGM_PAGE_GET_HCPHYS(pPage);
1582	#endif
1583	}
1584	}
1585
1586	/*
1587	* Make sure only allocated pages are mapped writable.
1588	*/
1589	if ( PteDst.n.u1Write
1590	&& PteDst.n.u1Present
1591	&& PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED)
1592	{
1593	PteDst.n.u1Write = 0; /** @todo this isn't quite working yet. */
1594	Log3(("SyncPageWorker: write-protecting %RGp pPage=%R[pgmpage]at iPTDst=%d\n", (RTGCPHYS)(PteSrc.u & X86_PTE_PAE_PG_MASK), pPage, iPTDst));
1595	}
1596
1597	#ifdef PGMPOOL_WITH_USER_TRACKING
1598	/*
1599	* Keep user track up to date.
1600	*/
1601	if (PteDst.n.u1Present)
1602	{
1603	if (!pPteDst->n.u1Present)
1604	PGM_BTH_NAME(SyncPageWorkerTrackAddref)(pVCpu, pShwPage, PGM_PAGE_GET_TRACKING(pPage), pPage, iPTDst);
1605	else if ((pPteDst->u & SHW_PTE_PG_MASK) != (PteDst.u & SHW_PTE_PG_MASK))
1606	{
1607	Log2(("SyncPageWorker: deref! *pPteDst=%RX64 PteDst=%RX64\n", (uint64_t)pPteDst->u, (uint64_t)PteDst.u));
1608	PGM_BTH_NAME(SyncPageWorkerTrackDeref)(pVCpu, pShwPage, pPteDst->u & SHW_PTE_PG_MASK);
1609	PGM_BTH_NAME(SyncPageWorkerTrackAddref)(pVCpu, pShwPage, PGM_PAGE_GET_TRACKING(pPage), pPage, iPTDst);
1610	}
1611	}
1612	else if (pPteDst->n.u1Present)
1613	{
1614	Log2(("SyncPageWorker: deref! *pPteDst=%RX64\n", (uint64_t)pPteDst->u));
1615	PGM_BTH_NAME(SyncPageWorkerTrackDeref)(pVCpu, pShwPage, pPteDst->u & SHW_PTE_PG_MASK);
1616	}
1617	#endif /* PGMPOOL_WITH_USER_TRACKING */
1618
1619	/*
1620	* Update statistics and commit the entry.
1621	*/
1622	#if PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE)
1623	if (!PteSrc.n.u1Global)
1624	pShwPage->fSeenNonGlobal = true;
1625	#endif
1626	ASMAtomicWriteSize(pPteDst, PteDst.u);
1627	}
1628	/* else MMIO or invalid page, we must handle them manually in the #PF handler. */
1629	/** @todo count these. */
1630	}
1631	else
1632	{
1633	/*
1634	* Page not-present.
1635	*/
1636	Log2(("SyncPageWorker: page not present in Pte\n"));
1637	#ifdef PGMPOOL_WITH_USER_TRACKING
1638	/* Keep user track up to date. */
1639	if (pPteDst->n.u1Present)
1640	{
1641	Log2(("SyncPageWorker: deref! *pPteDst=%RX64\n", (uint64_t)pPteDst->u));
1642	PGM_BTH_NAME(SyncPageWorkerTrackDeref)(pVCpu, pShwPage, pPteDst->u & SHW_PTE_PG_MASK);
1643	}
1644	#endif /* PGMPOOL_WITH_USER_TRACKING */
1645	ASMAtomicWriteSize(pPteDst, 0);
1646	/** @todo count these. */
1647	}
1648	}
1649
1650
1651	/**
1652	* Syncs a guest OS page.
1653	*
1654	* There are no conflicts at this point, neither is there any need for
1655	* page table allocations.
1656	*
1657	* @returns VBox status code.
1658	* @returns VINF_PGM_SYNCPAGE_MODIFIED_PDE if it modifies the PDE in any way.
1659	* @param pVCpu The VMCPU handle.
1660	* @param PdeSrc Page directory entry of the guest.
1661	* @param GCPtrPage Guest context page address.
1662	* @param cPages Number of pages to sync (PGM_SYNC_N_PAGES) (default=1).
1663	* @param uErr Fault error (X86_TRAP_PF_*).
1664	*/
1665	PGM_BTH_DECL(int, SyncPage)(PVMCPU pVCpu, GSTPDE PdeSrc, RTGCPTR GCPtrPage, unsigned cPages, unsigned uErr)
1666	{
1667	PVM pVM = pVCpu->CTX_SUFF(pVM);
1668	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
1669	LogFlow(("SyncPage: GCPtrPage=%RGv cPages=%u uErr=%#x\n", GCPtrPage, cPages, uErr));
1670
1671	Assert(PGMIsLockOwner(pVM));
1672
1673	#if ( PGM_GST_TYPE == PGM_TYPE_32BIT \
1674	\|\| PGM_GST_TYPE == PGM_TYPE_PAE \
1675	\|\| PGM_GST_TYPE == PGM_TYPE_AMD64) \
1676	&& PGM_SHW_TYPE != PGM_TYPE_NESTED \
1677	&& PGM_SHW_TYPE != PGM_TYPE_EPT
1678
1679	# if PGM_WITH_NX(PGM_GST_TYPE, PGM_SHW_TYPE)
1680	bool fNoExecuteBitValid = !!(CPUMGetGuestEFER(pVCpu) & MSR_K6_EFER_NXE);
1681	# endif
1682
1683	/*
1684	* Assert preconditions.
1685	*/
1686	Assert(PdeSrc.n.u1Present);
1687	Assert(cPages);
1688	# if 0 /* rarely useful; leave for debugging. */
1689	STAM_COUNTER_INC(&pVCpu->pgm.s.StatSyncPagePD[(GCPtrPage >> GST_PD_SHIFT) & GST_PD_MASK]);
1690	# endif
1691
1692	/*
1693	* Get the shadow PDE, find the shadow page table in the pool.
1694	*/
1695	# if PGM_SHW_TYPE == PGM_TYPE_32BIT
1696	const unsigned iPDDst = (GCPtrPage >> SHW_PD_SHIFT) & SHW_PD_MASK;
1697	PX86PDE pPdeDst = pgmShwGet32BitPDEPtr(&pVCpu->pgm.s, GCPtrPage);
1698
1699	/* Fetch the pgm pool shadow descriptor. */
1700	PPGMPOOLPAGE pShwPde = pVCpu->pgm.s.CTX_SUFF(pShwPageCR3);
1701	Assert(pShwPde);
1702
1703	# elif PGM_SHW_TYPE == PGM_TYPE_PAE
1704	const unsigned iPDDst = (GCPtrPage >> SHW_PD_SHIFT) & SHW_PD_MASK;
1705	PPGMPOOLPAGE pShwPde = NULL;
1706	PX86PDPAE pPDDst;
1707
1708	/* Fetch the pgm pool shadow descriptor. */
1709	int rc = pgmShwGetPaePoolPagePD(&pVCpu->pgm.s, GCPtrPage, &pShwPde);
1710	AssertRCSuccessReturn(rc, rc);
1711	Assert(pShwPde);
1712
1713	pPDDst = (PX86PDPAE)PGMPOOL_PAGE_2_PTR_BY_PGM(&pVM->pgm.s, pShwPde);
1714	PX86PDEPAE pPdeDst = &pPDDst->a[iPDDst];
1715
1716	# elif PGM_SHW_TYPE == PGM_TYPE_AMD64
1717	const unsigned iPDDst = (GCPtrPage >> SHW_PD_SHIFT) & SHW_PD_MASK;
1718	const unsigned iPdpt = (GCPtrPage >> X86_PDPT_SHIFT) & X86_PDPT_MASK_AMD64;
1719	PX86PDPAE pPDDst = NULL; /* initialized to shut up gcc */
1720	PX86PDPT pPdptDst = NULL; /* initialized to shut up gcc */
1721
1722	int rc = pgmShwGetLongModePDPtr(pVCpu, GCPtrPage, NULL, &pPdptDst, &pPDDst);
1723	AssertRCSuccessReturn(rc, rc);
1724	Assert(pPDDst && pPdptDst);
1725	PX86PDEPAE pPdeDst = &pPDDst->a[iPDDst];
1726	# endif
1727	SHWPDE PdeDst = *pPdeDst;
1728	if (!PdeDst.n.u1Present)
1729	{
1730	AssertMsg(pVM->cCpus > 1, ("%Unexpected missing PDE p=%llx\n", pPdeDst, (uint64_t)PdeDst.u));
1731	Log(("CPU%d: SyncPage: Pde at %RGv changed behind our back!\n", GCPtrPage));
1732	return VINF_SUCCESS; /* force the instruction to be executed again. */
1733	}
1734
1735	PPGMPOOLPAGE pShwPage = pgmPoolGetPage(pPool, PdeDst.u & SHW_PDE_PG_MASK);
1736	Assert(pShwPage);
1737
1738	# if PGM_GST_TYPE == PGM_TYPE_AMD64
1739	/* Fetch the pgm pool shadow descriptor. */
1740	PPGMPOOLPAGE pShwPde = pgmPoolGetPage(pPool, pPdptDst->a[iPdpt].u & X86_PDPE_PG_MASK);
1741	Assert(pShwPde);
1742	# endif
1743
1744	# if defined(IN_RC)
1745	/* Make sure the dynamic pPdeDst mapping will not be reused during this function. */
1746	PGMDynLockHCPage(pVM, (uint8_t *)pPdeDst);
1747	# endif
1748
1749	/*
1750	* Check that the page is present and that the shadow PDE isn't out of sync.
1751	*/
1752	# if PGM_GST_TYPE == PGM_TYPE_AMD64
1753	const bool fBigPage = PdeSrc.b.u1Size;
1754	# else
1755	const bool fBigPage = PdeSrc.b.u1Size && (CPUMGetGuestCR4(pVCpu) & X86_CR4_PSE);
1756	# endif
1757	RTGCPHYS GCPhys;
1758	if (!fBigPage)
1759	{
1760	GCPhys = PdeSrc.u & GST_PDE_PG_MASK;
1761	# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
1762	/* Select the right PDE as we're emulating a 4kb page table with 2 shadow page tables. */
1763	GCPhys \|= (iPDDst & 1) * (PAGE_SIZE/2);
1764	# endif
1765	}
1766	else
1767	{
1768	GCPhys = GST_GET_PDE_BIG_PG_GCPHYS(PdeSrc);
1769	# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
1770	/* Select the right PDE as we're emulating a 4MB page directory with two 2 MB shadow PDEs.*/
1771	GCPhys \|= GCPtrPage & (1 << X86_PD_PAE_SHIFT);
1772	# endif
1773	}
1774	if ( pShwPage->GCPhys == GCPhys
1775	&& PdeSrc.n.u1Present
1776	&& (PdeSrc.n.u1User == PdeDst.n.u1User)
1777	&& (PdeSrc.n.u1Write == PdeDst.n.u1Write \|\| !PdeDst.n.u1Write)
1778	# if PGM_WITH_NX(PGM_GST_TYPE, PGM_SHW_TYPE)
1779	&& (!fNoExecuteBitValid \|\| PdeSrc.n.u1NoExecute == PdeDst.n.u1NoExecute)
1780	# endif
1781	)
1782	{
1783	/*
1784	* Check that the PDE is marked accessed already.
1785	* Since we set the accessed bit before getting here on a #PF, this
1786	* check is only meant for dealing with non-#PF'ing paths.
1787	*/
1788	if (PdeSrc.n.u1Accessed)
1789	{
1790	PSHWPT pPTDst = (PSHWPT)PGMPOOL_PAGE_2_PTR(pVM, pShwPage);
1791	if (!fBigPage)
1792	{
1793	/*
1794	* 4KB Page - Map the guest page table.
1795	*/
1796	PGSTPT pPTSrc;
1797	int rc = PGM_GCPHYS_2_PTR(pVM, PdeSrc.u & GST_PDE_PG_MASK, &pPTSrc);
1798	if (RT_SUCCESS(rc))
1799	{
1800	# ifdef PGM_SYNC_N_PAGES
1801	Assert(cPages == 1 \|\| !(uErr & X86_TRAP_PF_P));
1802	if ( cPages > 1
1803	&& !(uErr & X86_TRAP_PF_P)
1804	&& !VM_FF_ISPENDING(pVM, VM_FF_PGM_NO_MEMORY))
1805	{
1806	/*
1807	* This code path is currently only taken when the caller is PGMTrap0eHandler
1808	* for non-present pages!
1809	*
1810	* We're setting PGM_SYNC_NR_PAGES pages around the faulting page to sync it and
1811	* deal with locality.
1812	*/
1813	unsigned iPTDst = (GCPtrPage >> SHW_PT_SHIFT) & SHW_PT_MASK;
1814	# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
1815	/* Select the right PDE as we're emulating a 4kb page table with 2 shadow page tables. */
1816	const unsigned offPTSrc = ((GCPtrPage >> SHW_PD_SHIFT) & 1) * 512;
1817	# else
1818	const unsigned offPTSrc = 0;
1819	# endif
1820	const unsigned iPTDstEnd = RT_MIN(iPTDst + PGM_SYNC_NR_PAGES / 2, RT_ELEMENTS(pPTDst->a));
1821	if (iPTDst < PGM_SYNC_NR_PAGES / 2)
1822	iPTDst = 0;
1823	else
1824	iPTDst -= PGM_SYNC_NR_PAGES / 2;
1825	for (; iPTDst < iPTDstEnd; iPTDst++)
1826	{
1827	if (!pPTDst->a[iPTDst].n.u1Present)
1828	{
1829	GSTPTE PteSrc = pPTSrc->a[offPTSrc + iPTDst];
1830	RTGCPTR GCPtrCurPage = (GCPtrPage & ~(RTGCPTR)(GST_PT_MASK << GST_PT_SHIFT)) \| ((offPTSrc + iPTDst) << PAGE_SHIFT);
1831	NOREF(GCPtrCurPage);
1832	#ifndef IN_RING0
1833	/*
1834	* Assuming kernel code will be marked as supervisor - and not as user level
1835	* and executed using a conforming code selector - And marked as readonly.
1836	* Also assume that if we're monitoring a page, it's of no interest to CSAM.
1837	*/
1838	PPGMPAGE pPage;
1839	if ( ((PdeSrc.u & PteSrc.u) & (X86_PTE_RW \| X86_PTE_US))
1840	\|\| iPTDst == ((GCPtrPage >> SHW_PT_SHIFT) & SHW_PT_MASK) /* always sync GCPtrPage */
1841	\|\| !CSAMDoesPageNeedScanning(pVM, (RTRCPTR)GCPtrCurPage)
1842	\|\| ( (pPage = pgmPhysGetPage(&pVM->pgm.s, PteSrc.u & GST_PTE_PG_MASK))
1843	&& PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage))
1844	)
1845	#endif /* else: CSAM not active */
1846	PGM_BTH_NAME(SyncPageWorker)(pVCpu, &pPTDst->a[iPTDst], PdeSrc, PteSrc, pShwPage, iPTDst);
1847	Log2(("SyncPage: 4K+ %RGv PteSrc:{P=%d RW=%d U=%d raw=%08llx} PteDst=%08llx%s\n",
1848	GCPtrCurPage, PteSrc.n.u1Present,
1849	PteSrc.n.u1Write & PdeSrc.n.u1Write,
1850	PteSrc.n.u1User & PdeSrc.n.u1User,
1851	(uint64_t)PteSrc.u,
1852	(uint64_t)pPTDst->a[iPTDst].u,
1853	pPTDst->a[iPTDst].u & PGM_PTFLAGS_TRACK_DIRTY ? " Track-Dirty" : ""));
1854	}
1855	}
1856	}
1857	else
1858	# endif /* PGM_SYNC_N_PAGES */
1859	{
1860	const unsigned iPTSrc = (GCPtrPage >> GST_PT_SHIFT) & GST_PT_MASK;
1861	GSTPTE PteSrc = pPTSrc->a[iPTSrc];
1862	const unsigned iPTDst = (GCPtrPage >> SHW_PT_SHIFT) & SHW_PT_MASK;
1863	PGM_BTH_NAME(SyncPageWorker)(pVCpu, &pPTDst->a[iPTDst], PdeSrc, PteSrc, pShwPage, iPTDst);
1864	Log2(("SyncPage: 4K %RGv PteSrc:{P=%d RW=%d U=%d raw=%08llx} PteDst=%08llx %s\n",
1865	GCPtrPage, PteSrc.n.u1Present,
1866	PteSrc.n.u1Write & PdeSrc.n.u1Write,
1867	PteSrc.n.u1User & PdeSrc.n.u1User,
1868	(uint64_t)PteSrc.u,
1869	(uint64_t)pPTDst->a[iPTDst].u,
1870	pPTDst->a[iPTDst].u & PGM_PTFLAGS_TRACK_DIRTY ? " Track-Dirty" : ""));
1871	}
1872	}
1873	else /* MMIO or invalid page: emulated in #PF handler. */
1874	{
1875	LogFlow(("PGM_GCPHYS_2_PTR %RGp failed with %Rrc\n", GCPhys, rc));
1876	Assert(!pPTDst->a[(GCPtrPage >> SHW_PT_SHIFT) & SHW_PT_MASK].n.u1Present);
1877	}
1878	}
1879	else
1880	{
1881	/*
1882	* 4/2MB page - lazy syncing shadow 4K pages.
1883	* (There are many causes of getting here, it's no longer only CSAM.)
1884	*/
1885	/* Calculate the GC physical address of this 4KB shadow page. */
1886	RTGCPHYS GCPhys = GST_GET_PDE_BIG_PG_GCPHYS(PdeSrc) \| (GCPtrPage & GST_BIG_PAGE_OFFSET_MASK);
1887	/* Find ram range. */
1888	PPGMPAGE pPage;
1889	int rc = pgmPhysGetPageEx(&pVM->pgm.s, GCPhys, &pPage);
1890	if (RT_SUCCESS(rc))
1891	{
1892	# ifndef VBOX_WITH_NEW_LAZY_PAGE_ALLOC
1893	/* Try make the page writable if necessary. */
1894	if ( PdeSrc.n.u1Write
1895	&& PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED
1896	&& PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_RAM)
1897	{
1898	rc = pgmPhysPageMakeWritableUnlocked(pVM, pPage, GCPhys);
1899	AssertRC(rc);
1900	}
1901	# endif
1902
1903	/*
1904	* Make shadow PTE entry.
1905	*/
1906	SHWPTE PteDst;
1907	PteDst.u = (PdeSrc.u & ~(X86_PTE_PAE_PG_MASK \| X86_PTE_AVL_MASK \| X86_PTE_PAT \| X86_PTE_PCD \| X86_PTE_PWT))
1908	\| PGM_PAGE_GET_HCPHYS(pPage);
1909	if (PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage))
1910	{
1911	if (!PGM_PAGE_HAS_ACTIVE_ALL_HANDLERS(pPage))
1912	PteDst.n.u1Write = 0;
1913	else
1914	PteDst.u = 0;
1915	}
1916	const unsigned iPTDst = (GCPtrPage >> SHW_PT_SHIFT) & SHW_PT_MASK;
1917	# ifdef PGMPOOL_WITH_USER_TRACKING
1918	if (PteDst.n.u1Present && !pPTDst->a[iPTDst].n.u1Present)
1919	PGM_BTH_NAME(SyncPageWorkerTrackAddref)(pVCpu, pShwPage, PGM_PAGE_GET_TRACKING(pPage), pPage, iPTDst);
1920	# endif
1921	/* Make sure only allocated pages are mapped writable. */
1922	if ( PteDst.n.u1Write
1923	&& PteDst.n.u1Present
1924	&& PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED)
1925	{
1926	PteDst.n.u1Write = 0; /** @todo this isn't quite working yet... */
1927	Log3(("SyncPage: write-protecting %RGp pPage=%R[pgmpage] at %RGv\n", GCPhys, pPage, GCPtrPage));
1928	}
1929
1930	ASMAtomicWriteSize(&pPTDst->a[iPTDst], PteDst.u);
1931
1932	/*
1933	* If the page is not flagged as dirty and is writable, then make it read-only
1934	* at PD level, so we can set the dirty bit when the page is modified.
1935	*
1936	* ASSUMES that page access handlers are implemented on page table entry level.
1937	* Thus we will first catch the dirty access and set PDE.D and restart. If
1938	* there is an access handler, we'll trap again and let it work on the problem.
1939	*/
1940	/** @todo r=bird: figure out why we need this here, SyncPT should've taken care of this already.
1941	* As for invlpg, it simply frees the whole shadow PT.
1942	* ...It's possibly because the guest clears it and the guest doesn't really tell us... */
1943	if (!PdeSrc.b.u1Dirty && PdeSrc.b.u1Write)
1944	{
1945	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtyPageBig));
1946	PdeDst.u \|= PGM_PDFLAGS_TRACK_DIRTY;
1947	PdeDst.n.u1Write = 0;
1948	}
1949	else
1950	{
1951	PdeDst.au32[0] &= ~PGM_PDFLAGS_TRACK_DIRTY;
1952	PdeDst.n.u1Write = PdeSrc.n.u1Write;
1953	}
1954	ASMAtomicWriteSize(pPdeDst, PdeDst.u);
1955	Log2(("SyncPage: BIG %RGv PdeSrc:{P=%d RW=%d U=%d raw=%08llx} GCPhys=%RGp%s\n",
1956	GCPtrPage, PdeSrc.n.u1Present, PdeSrc.n.u1Write, PdeSrc.n.u1User, (uint64_t)PdeSrc.u, GCPhys,
1957	PdeDst.u & PGM_PDFLAGS_TRACK_DIRTY ? " Track-Dirty" : ""));
1958	}
1959	else
1960	LogFlow(("PGM_GCPHYS_2_PTR %RGp (big) failed with %Rrc\n", GCPhys, rc));
1961	}
1962	# if defined(IN_RC)
1963	/* Make sure the dynamic pPdeDst mapping will not be reused during this function. */
1964	PGMDynUnlockHCPage(pVM, (uint8_t *)pPdeDst);
1965	# endif
1966	return VINF_SUCCESS;
1967	}
1968	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,SyncPagePDNAs));
1969	}
1970	else
1971	{
1972	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,SyncPagePDOutOfSync));
1973	Log2(("SyncPage: Out-Of-Sync PDE at %RGp PdeSrc=%RX64 PdeDst=%RX64 (GCPhys %RGp vs %RGp)\n",
1974	GCPtrPage, (uint64_t)PdeSrc.u, (uint64_t)PdeDst.u, pShwPage->GCPhys, GCPhys));
1975	}
1976
1977	/*
1978	* Mark the PDE not present. Restart the instruction and let #PF call SyncPT.
1979	* Yea, I'm lazy.
1980	*/
1981	pgmPoolFreeByPage(pPool, pShwPage, pShwPde->idx, iPDDst);
1982	ASMAtomicWriteSize(pPdeDst, 0);
1983
1984	# if defined(IN_RC)
1985	/* Make sure the dynamic pPdeDst mapping will not be reused during this function. */
1986	PGMDynUnlockHCPage(pVM, (uint8_t *)pPdeDst);
1987	# endif
1988	PGM_INVL_VCPU_TLBS(pVCpu);
1989	return VINF_PGM_SYNCPAGE_MODIFIED_PDE;
1990
1991	#elif (PGM_GST_TYPE == PGM_TYPE_REAL \|\| PGM_GST_TYPE == PGM_TYPE_PROT) \
1992	&& PGM_SHW_TYPE != PGM_TYPE_NESTED \
1993	&& (PGM_SHW_TYPE != PGM_TYPE_EPT \|\| PGM_GST_TYPE == PGM_TYPE_PROT) \
1994	&& !defined(IN_RC)
1995
1996	# ifdef PGM_SYNC_N_PAGES
1997	/*
1998	* Get the shadow PDE, find the shadow page table in the pool.
1999	*/
2000	# if PGM_SHW_TYPE == PGM_TYPE_32BIT
2001	X86PDE PdeDst = pgmShwGet32BitPDE(&pVCpu->pgm.s, GCPtrPage);
2002
2003	# elif PGM_SHW_TYPE == PGM_TYPE_PAE
2004	X86PDEPAE PdeDst = pgmShwGetPaePDE(&pVCpu->pgm.s, GCPtrPage);
2005
2006	# elif PGM_SHW_TYPE == PGM_TYPE_AMD64
2007	const unsigned iPDDst = ((GCPtrPage >> SHW_PD_SHIFT) & SHW_PD_MASK);
2008	const unsigned iPdpt = (GCPtrPage >> X86_PDPT_SHIFT) & X86_PDPT_MASK_AMD64; NOREF(iPdpt);
2009	PX86PDPAE pPDDst = NULL; /* initialized to shut up gcc */
2010	X86PDEPAE PdeDst;
2011	PX86PDPT pPdptDst = NULL; /* initialized to shut up gcc */
2012
2013	int rc = pgmShwGetLongModePDPtr(pVCpu, GCPtrPage, NULL, &pPdptDst, &pPDDst);
2014	AssertRCSuccessReturn(rc, rc);
2015	Assert(pPDDst && pPdptDst);
2016	PdeDst = pPDDst->a[iPDDst];
2017	# elif PGM_SHW_TYPE == PGM_TYPE_EPT
2018	const unsigned iPDDst = ((GCPtrPage >> SHW_PD_SHIFT) & SHW_PD_MASK);
2019	PEPTPD pPDDst;
2020	EPTPDE PdeDst;
2021
2022	int rc = pgmShwGetEPTPDPtr(pVCpu, GCPtrPage, NULL, &pPDDst);
2023	if (rc != VINF_SUCCESS)
2024	{
2025	AssertRC(rc);
2026	return rc;
2027	}
2028	Assert(pPDDst);
2029	PdeDst = pPDDst->a[iPDDst];
2030	# endif
2031	AssertMsg(PdeDst.n.u1Present, ("%#llx\n", (uint64_t)PdeDst.u));
2032	PPGMPOOLPAGE pShwPage = pgmPoolGetPage(pPool, PdeDst.u & SHW_PDE_PG_MASK);
2033	PSHWPT pPTDst = (PSHWPT)PGMPOOL_PAGE_2_PTR(pVM, pShwPage);
2034
2035	Assert(cPages == 1 \|\| !(uErr & X86_TRAP_PF_P));
2036	if ( cPages > 1
2037	&& !(uErr & X86_TRAP_PF_P)
2038	&& !VM_FF_ISPENDING(pVM, VM_FF_PGM_NO_MEMORY))
2039	{
2040	/*
2041	* This code path is currently only taken when the caller is PGMTrap0eHandler
2042	* for non-present pages!
2043	*
2044	* We're setting PGM_SYNC_NR_PAGES pages around the faulting page to sync it and
2045	* deal with locality.
2046	*/
2047	unsigned iPTDst = (GCPtrPage >> SHW_PT_SHIFT) & SHW_PT_MASK;
2048	const unsigned iPTDstEnd = RT_MIN(iPTDst + PGM_SYNC_NR_PAGES / 2, RT_ELEMENTS(pPTDst->a));
2049	if (iPTDst < PGM_SYNC_NR_PAGES / 2)
2050	iPTDst = 0;
2051	else
2052	iPTDst -= PGM_SYNC_NR_PAGES / 2;
2053	for (; iPTDst < iPTDstEnd; iPTDst++)
2054	{
2055	if (!pPTDst->a[iPTDst].n.u1Present)
2056	{
2057	GSTPTE PteSrc;
2058
2059	RTGCPTR GCPtrCurPage = (GCPtrPage & ~(RTGCPTR)(SHW_PT_MASK << SHW_PT_SHIFT)) \| (iPTDst << PAGE_SHIFT);
2060
2061	/* Fake the page table entry */
2062	PteSrc.u = GCPtrCurPage;
2063	PteSrc.n.u1Present = 1;
2064	PteSrc.n.u1Dirty = 1;
2065	PteSrc.n.u1Accessed = 1;
2066	PteSrc.n.u1Write = 1;
2067	PteSrc.n.u1User = 1;
2068
2069	PGM_BTH_NAME(SyncPageWorker)(pVCpu, &pPTDst->a[iPTDst], PdeSrc, PteSrc, pShwPage, iPTDst);
2070
2071	Log2(("SyncPage: 4K+ %RGv PteSrc:{P=%d RW=%d U=%d raw=%08llx} PteDst=%08llx%s\n",
2072	GCPtrCurPage, PteSrc.n.u1Present,
2073	PteSrc.n.u1Write & PdeSrc.n.u1Write,
2074	PteSrc.n.u1User & PdeSrc.n.u1User,
2075	(uint64_t)PteSrc.u,
2076	(uint64_t)pPTDst->a[iPTDst].u,
2077	pPTDst->a[iPTDst].u & PGM_PTFLAGS_TRACK_DIRTY ? " Track-Dirty" : ""));
2078
2079	if (RT_UNLIKELY(VM_FF_ISPENDING(pVM, VM_FF_PGM_NO_MEMORY)))
2080	break;
2081	}
2082	else
2083	Log4(("%RGv iPTDst=%x pPTDst->a[iPTDst] %RX64\n", (GCPtrPage & ~(RTGCPTR)(SHW_PT_MASK << SHW_PT_SHIFT)) \| (iPTDst << PAGE_SHIFT), iPTDst, pPTDst->a[iPTDst].u));
2084	}
2085	}
2086	else
2087	# endif /* PGM_SYNC_N_PAGES */
2088	{
2089	GSTPTE PteSrc;
2090	const unsigned iPTDst = (GCPtrPage >> SHW_PT_SHIFT) & SHW_PT_MASK;
2091	RTGCPTR GCPtrCurPage = (GCPtrPage & ~(RTGCPTR)(SHW_PT_MASK << SHW_PT_SHIFT)) \| (iPTDst << PAGE_SHIFT);
2092
2093	/* Fake the page table entry */
2094	PteSrc.u = GCPtrCurPage;
2095	PteSrc.n.u1Present = 1;
2096	PteSrc.n.u1Dirty = 1;
2097	PteSrc.n.u1Accessed = 1;
2098	PteSrc.n.u1Write = 1;
2099	PteSrc.n.u1User = 1;
2100	PGM_BTH_NAME(SyncPageWorker)(pVCpu, &pPTDst->a[iPTDst], PdeSrc, PteSrc, pShwPage, iPTDst);
2101
2102	Log2(("SyncPage: 4K %RGv PteSrc:{P=%d RW=%d U=%d raw=%08llx}PteDst=%08llx%s\n",
2103	GCPtrPage, PteSrc.n.u1Present,
2104	PteSrc.n.u1Write & PdeSrc.n.u1Write,
2105	PteSrc.n.u1User & PdeSrc.n.u1User,
2106	(uint64_t)PteSrc.u,
2107	(uint64_t)pPTDst->a[iPTDst].u,
2108	pPTDst->a[iPTDst].u & PGM_PTFLAGS_TRACK_DIRTY ? " Track-Dirty" : ""));
2109	}
2110	return VINF_SUCCESS;
2111
2112	#else
2113	AssertReleaseMsgFailed(("Shw=%d Gst=%d is not implemented!\n", PGM_GST_TYPE, PGM_SHW_TYPE));
2114	return VERR_INTERNAL_ERROR;
2115	#endif
2116	}
2117
2118
2119	#if PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE)
2120	/**
2121	* Investigate page fault and handle write protection page faults caused by
2122	* dirty bit tracking.
2123	*
2124	* @returns VBox status code.
2125	* @param pVCpu The VMCPU handle.
2126	* @param uErr Page fault error code.
2127	* @param pPdeDst Shadow page directory entry.
2128	* @param pPdeSrc Guest page directory entry.
2129	* @param GCPtrPage Guest context page address.
2130	*/
2131	PGM_BTH_DECL(int, CheckPageFault)(PVMCPU pVCpu, uint32_t uErr, PSHWPDE pPdeDst, PGSTPDE pPdeSrc, RTGCPTR GCPtrPage)
2132	{
2133	bool fWriteProtect = !!(CPUMGetGuestCR0(pVCpu) & X86_CR0_WP);
2134	bool fUserLevelFault = !!(uErr & X86_TRAP_PF_US);
2135	bool fWriteFault = !!(uErr & X86_TRAP_PF_RW);
2136	# if PGM_GST_TYPE == PGM_TYPE_AMD64
2137	bool fBigPagesSupported = true;
2138	# else
2139	bool fBigPagesSupported = !!(CPUMGetGuestCR4(pVCpu) & X86_CR4_PSE);
2140	# endif
2141	# if PGM_WITH_NX(PGM_GST_TYPE, PGM_SHW_TYPE)
2142	bool fNoExecuteBitValid = !!(CPUMGetGuestEFER(pVCpu) & MSR_K6_EFER_NXE);
2143	# endif
2144	unsigned uPageFaultLevel;
2145	int rc;
2146	PVM pVM = pVCpu->CTX_SUFF(pVM);
2147	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
2148
2149	Assert(PGMIsLockOwner(pVM));
2150
2151	STAM_PROFILE_START(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtyBitTracking), a);
2152	LogFlow(("CheckPageFault: GCPtrPage=%RGv uErr=%#x PdeSrc=%08x\n", GCPtrPage, uErr, pPdeSrc->u));
2153
2154	# if PGM_GST_TYPE == PGM_TYPE_PAE \
2155	\|\| PGM_GST_TYPE == PGM_TYPE_AMD64
2156
2157	# if PGM_GST_TYPE == PGM_TYPE_AMD64
2158	PX86PML4E pPml4eSrc;
2159	PX86PDPE pPdpeSrc;
2160
2161	pPdpeSrc = pgmGstGetLongModePDPTPtr(&pVCpu->pgm.s, GCPtrPage, &pPml4eSrc);
2162	Assert(pPml4eSrc);
2163
2164	/*
2165	* Real page fault? (PML4E level)
2166	*/
2167	if ( (uErr & X86_TRAP_PF_RSVD)
2168	\|\| !pPml4eSrc->n.u1Present
2169	\|\| (fNoExecuteBitValid && (uErr & X86_TRAP_PF_ID) && pPml4eSrc->n.u1NoExecute)
2170	\|\| (fWriteFault && !pPml4eSrc->n.u1Write && (fUserLevelFault \|\| fWriteProtect))
2171	\|\| (fUserLevelFault && !pPml4eSrc->n.u1User)
2172	)
2173	{
2174	uPageFaultLevel = 0;
2175	goto l_UpperLevelPageFault;
2176	}
2177	Assert(pPdpeSrc);
2178
2179	# else /* PAE */
2180	PX86PDPE pPdpeSrc = pgmGstGetPaePDPEPtr(&pVCpu->pgm.s, GCPtrPage);
2181	# endif /* PAE */
2182
2183	/*
2184	* Real page fault? (PDPE level)
2185	*/
2186	if ( (uErr & X86_TRAP_PF_RSVD)
2187	\|\| !pPdpeSrc->n.u1Present
2188	# if PGM_GST_TYPE == PGM_TYPE_AMD64 /* NX, r/w, u/s bits in the PDPE are long mode only */
2189	\|\| (fNoExecuteBitValid && (uErr & X86_TRAP_PF_ID) && pPdpeSrc->lm.u1NoExecute)
2190	\|\| (fWriteFault && !pPdpeSrc->lm.u1Write && (fUserLevelFault \|\| fWriteProtect))
2191	\|\| (fUserLevelFault && !pPdpeSrc->lm.u1User)
2192	# endif
2193	)
2194	{
2195	uPageFaultLevel = 1;
2196	goto l_UpperLevelPageFault;
2197	}
2198	# endif
2199
2200	/*
2201	* Real page fault? (PDE level)
2202	*/
2203	if ( (uErr & X86_TRAP_PF_RSVD)
2204	\|\| !pPdeSrc->n.u1Present
2205	# if PGM_WITH_NX(PGM_GST_TYPE, PGM_SHW_TYPE)
2206	\|\| (fNoExecuteBitValid && (uErr & X86_TRAP_PF_ID) && pPdeSrc->n.u1NoExecute)
2207	# endif
2208	\|\| (fWriteFault && !pPdeSrc->n.u1Write && (fUserLevelFault \|\| fWriteProtect))
2209	\|\| (fUserLevelFault && !pPdeSrc->n.u1User) )
2210	{
2211	uPageFaultLevel = 2;
2212	goto l_UpperLevelPageFault;
2213	}
2214
2215	/*
2216	* First check the easy case where the page directory has been marked read-only to track
2217	* the dirty bit of an emulated BIG page
2218	*/
2219	if (pPdeSrc->b.u1Size && fBigPagesSupported)
2220	{
2221	/* Mark guest page directory as accessed */
2222	# if PGM_GST_TYPE == PGM_TYPE_AMD64
2223	pPml4eSrc->n.u1Accessed = 1;
2224	pPdpeSrc->lm.u1Accessed = 1;
2225	# endif
2226	pPdeSrc->b.u1Accessed = 1;
2227
2228	/*
2229	* Only write protection page faults are relevant here.
2230	*/
2231	if (fWriteFault)
2232	{
2233	/* Mark guest page directory as dirty (BIG page only). */
2234	pPdeSrc->b.u1Dirty = 1;
2235
2236	if (pPdeDst->n.u1Present)
2237	{
2238	if (pPdeDst->u & PGM_PDFLAGS_TRACK_DIRTY)
2239	{
2240	SHWPDE PdeDst = *pPdeDst;
2241
2242	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtyPageTrap));
2243	Assert(pPdeSrc->b.u1Write);
2244
2245	/* Note: No need to invalidate this entry on other VCPUs as a stale TLB entry will not harm; write access will simply
2246	* fault again and take this path to only invalidate the entry.
2247	*/
2248	PdeDst.n.u1Write = 1;
2249	PdeDst.n.u1Accessed = 1;
2250	PdeDst.au32[0] &= ~PGM_PDFLAGS_TRACK_DIRTY;
2251	ASMAtomicWriteSize(pPdeDst, PdeDst.u);
2252	PGM_INVL_BIG_PG(pVCpu, GCPtrPage);
2253	STAM_PROFILE_STOP(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtyBitTracking), a);
2254	return VINF_PGM_HANDLED_DIRTY_BIT_FAULT; /* restarts the instruction. */
2255	}
2256	# ifdef IN_RING0
2257	else
2258	/* Check for stale TLB entry; only applies to the SMP guest case. */
2259	if ( pVM->cCpus > 1
2260	&& pPdeDst->n.u1Write
2261	&& pPdeDst->n.u1Accessed)
2262	{
2263	PPGMPOOLPAGE pShwPage = pgmPoolGetPage(pPool, pPdeDst->u & SHW_PDE_PG_MASK);
2264	if (pShwPage)
2265	{
2266	PSHWPT pPTDst = (PSHWPT)PGMPOOL_PAGE_2_PTR(pVM, pShwPage);
2267	PSHWPTE pPteDst = &pPTDst->a[(GCPtrPage >> SHW_PT_SHIFT) & SHW_PT_MASK];
2268	if ( pPteDst->n.u1Present
2269	&& pPteDst->n.u1Write)
2270	{
2271	/* Stale TLB entry. */
2272	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtyPageStale));
2273	PGM_INVL_PG(pVCpu, GCPtrPage);
2274
2275	STAM_PROFILE_STOP(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtyBitTracking), a);
2276	return VINF_PGM_HANDLED_DIRTY_BIT_FAULT; /* restarts the instruction. */
2277	}
2278	}
2279	}
2280	# endif /* IN_RING0 */
2281	}
2282	}
2283	STAM_PROFILE_STOP(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtyBitTracking), a);
2284	return VINF_PGM_NO_DIRTY_BIT_TRACKING;
2285	}
2286	/* else: 4KB page table */
2287
2288	/*
2289	* Map the guest page table.
2290	*/
2291	PGSTPT pPTSrc;
2292	rc = PGM_GCPHYS_2_PTR(pVM, pPdeSrc->u & GST_PDE_PG_MASK, &pPTSrc);
2293	if (RT_SUCCESS(rc))
2294	{
2295	/*
2296	* Real page fault?
2297	*/
2298	PGSTPTE pPteSrc = &pPTSrc->a[(GCPtrPage >> GST_PT_SHIFT) & GST_PT_MASK];
2299	const GSTPTE PteSrc = *pPteSrc;
2300	if ( !PteSrc.n.u1Present
2301	# if PGM_WITH_NX(PGM_GST_TYPE, PGM_SHW_TYPE)
2302	\|\| (fNoExecuteBitValid && (uErr & X86_TRAP_PF_ID) && PteSrc.n.u1NoExecute)
2303	# endif
2304	\|\| (fWriteFault && !PteSrc.n.u1Write && (fUserLevelFault \|\| fWriteProtect))
2305	\|\| (fUserLevelFault && !PteSrc.n.u1User)
2306	)
2307	{
2308	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtyTrackRealPF));
2309	STAM_PROFILE_STOP(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtyBitTracking), a);
2310	LogFlow(("CheckPageFault: real page fault at %RGv PteSrc.u=%08x (2)\n", GCPtrPage, PteSrc.u));
2311
2312	/* Check the present bit as the shadow tables can cause different error codes by being out of sync.
2313	* See the 2nd case above as well.
2314	*/
2315	if (pPdeSrc->n.u1Present && pPteSrc->n.u1Present)
2316	TRPMSetErrorCode(pVCpu, uErr \| X86_TRAP_PF_P); /* page-level protection violation */
2317
2318	STAM_PROFILE_STOP(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtyBitTracking), a);
2319	return VINF_EM_RAW_GUEST_TRAP;
2320	}
2321	LogFlow(("CheckPageFault: page fault at %RGv PteSrc.u=%08x\n", GCPtrPage, PteSrc.u));
2322
2323	/*
2324	* Set the accessed bits in the page directory and the page table.
2325	*/
2326	# if PGM_GST_TYPE == PGM_TYPE_AMD64
2327	pPml4eSrc->n.u1Accessed = 1;
2328	pPdpeSrc->lm.u1Accessed = 1;
2329	# endif
2330	pPdeSrc->n.u1Accessed = 1;
2331	pPteSrc->n.u1Accessed = 1;
2332
2333	/*
2334	* Only write protection page faults are relevant here.
2335	*/
2336	if (fWriteFault)
2337	{
2338	/* Write access, so mark guest entry as dirty. */
2339	# ifdef VBOX_WITH_STATISTICS
2340	if (!pPteSrc->n.u1Dirty)
2341	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtiedPage));
2342	else
2343	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,PageAlreadyDirty));
2344	# endif
2345
2346	pPteSrc->n.u1Dirty = 1;
2347
2348	if (pPdeDst->n.u1Present)
2349	{
2350	#ifndef IN_RING0
2351	/* Bail out here as pgmPoolGetPageByHCPhys will return NULL and we'll crash below.
2352	* Our individual shadow handlers will provide more information and force a fatal exit.
2353	*/
2354	if (MMHyperIsInsideArea(pVM, (RTGCPTR)GCPtrPage))
2355	{
2356	LogRel(("CheckPageFault: write to hypervisor region %RGv\n", GCPtrPage));
2357	STAM_PROFILE_STOP(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtyBitTracking), a);
2358	return VINF_SUCCESS;
2359	}
2360	#endif
2361	/*
2362	* Map shadow page table.
2363	*/
2364	PPGMPOOLPAGE pShwPage = pgmPoolGetPage(pPool, pPdeDst->u & SHW_PDE_PG_MASK);
2365	if (pShwPage)
2366	{
2367	PSHWPT pPTDst = (PSHWPT)PGMPOOL_PAGE_2_PTR(pVM, pShwPage);
2368	PSHWPTE pPteDst = &pPTDst->a[(GCPtrPage >> SHW_PT_SHIFT) & SHW_PT_MASK];
2369	if (pPteDst->n.u1Present) /** @todo Optimize accessed bit emulation? */
2370	{
2371	if (pPteDst->u & PGM_PTFLAGS_TRACK_DIRTY)
2372	{
2373	PPGMPAGE pPage = pgmPhysGetPage(&pVM->pgm.s, pPteSrc->u & GST_PTE_PG_MASK);
2374	SHWPTE PteDst = *pPteDst;
2375
2376	LogFlow(("DIRTY page trap addr=%RGv\n", GCPtrPage));
2377	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtyPageTrap));
2378
2379	Assert(pPteSrc->n.u1Write);
2380
2381	/* Note: No need to invalidate this entry on other VCPUs as a stale TLB entry will not harm; write access will simply
2382	* fault again and take this path to only invalidate the entry.
2383	*/
2384	if ( pPage
2385	&& PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage))
2386	{
2387	/* Assuming write handlers here as the PTE is present (otherwise we wouldn't be here). */
2388	PteDst.n.u1Write = 0;
2389	}
2390	else
2391	PteDst.n.u1Write = 1;
2392
2393	PteDst.n.u1Dirty = 1;
2394	PteDst.n.u1Accessed = 1;
2395	PteDst.au32[0] &= ~PGM_PTFLAGS_TRACK_DIRTY;
2396	ASMAtomicWriteSize(pPteDst, PteDst.u);
2397	PGM_INVL_PG(pVCpu, GCPtrPage);
2398
2399	STAM_PROFILE_STOP(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtyBitTracking), a);
2400	return VINF_PGM_HANDLED_DIRTY_BIT_FAULT; /* restarts the instruction. */
2401	}
2402	# ifdef IN_RING0
2403	else
2404	/* Check for stale TLB entry; only applies to the SMP guest case. */
2405	if ( pVM->cCpus > 1
2406	&& pPteDst->n.u1Write == 1
2407	&& pPteDst->n.u1Accessed == 1)
2408	{
2409	/* Stale TLB entry. */
2410	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtyPageStale));
2411	PGM_INVL_PG(pVCpu, GCPtrPage);
2412
2413	STAM_PROFILE_STOP(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtyBitTracking), a);
2414	return VINF_PGM_HANDLED_DIRTY_BIT_FAULT; /* restarts the instruction. */
2415	}
2416	# endif
2417	}
2418	}
2419	else
2420	AssertMsgFailed(("pgmPoolGetPageByHCPhys %RGp failed!\n", pPdeDst->u & SHW_PDE_PG_MASK));
2421	}
2422	}
2423	/** @todo Optimize accessed bit emulation? */
2424	# ifdef VBOX_STRICT
2425	/*
2426	* Sanity check.
2427	*/
2428	else if ( !pPteSrc->n.u1Dirty
2429	&& (pPdeSrc->n.u1Write & pPteSrc->n.u1Write)
2430	&& pPdeDst->n.u1Present)
2431	{
2432	PPGMPOOLPAGE pShwPage = pgmPoolGetPage(pPool, pPdeDst->u & SHW_PDE_PG_MASK);
2433	PSHWPT pPTDst = (PSHWPT)PGMPOOL_PAGE_2_PTR(pVM, pShwPage);
2434	PSHWPTE pPteDst = &pPTDst->a[(GCPtrPage >> SHW_PT_SHIFT) & SHW_PT_MASK];
2435	if ( pPteDst->n.u1Present
2436	&& pPteDst->n.u1Write)
2437	LogFlow(("Writable present page %RGv not marked for dirty bit tracking!!!\n", GCPtrPage));
2438	}
2439	# endif /* VBOX_STRICT */
2440	STAM_PROFILE_STOP(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtyBitTracking), a);
2441	return VINF_PGM_NO_DIRTY_BIT_TRACKING;
2442	}
2443	AssertRC(rc);
2444	STAM_PROFILE_STOP(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtyBitTracking), a);
2445	return rc;
2446
2447
2448	l_UpperLevelPageFault:
2449	/*
2450	* Pagefault detected while checking the PML4E, PDPE or PDE.
2451	* Single exit handler to get rid of duplicate code paths.
2452	*/
2453	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtyTrackRealPF));
2454	STAM_PROFILE_STOP(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtyBitTracking), a);
2455	Log(("CheckPageFault: real page fault at %RGv (%d)\n", GCPtrPage, uPageFaultLevel));
2456
2457	if (
2458	# if PGM_GST_TYPE == PGM_TYPE_AMD64
2459	pPml4eSrc->n.u1Present &&
2460	# endif
2461	# if PGM_GST_TYPE == PGM_TYPE_AMD64 \|\| PGM_GST_TYPE == PGM_TYPE_PAE
2462	pPdpeSrc->n.u1Present &&
2463	# endif
2464	pPdeSrc->n.u1Present)
2465	{
2466	/* Check the present bit as the shadow tables can cause different error codes by being out of sync. */
2467	if (pPdeSrc->b.u1Size && fBigPagesSupported)
2468	{
2469	TRPMSetErrorCode(pVCpu, uErr \| X86_TRAP_PF_P); /* page-level protection violation */
2470	}
2471	else
2472	{
2473	/*
2474	* Map the guest page table.
2475	*/
2476	PGSTPT pPTSrc;
2477	rc = PGM_GCPHYS_2_PTR(pVM, pPdeSrc->u & GST_PDE_PG_MASK, &pPTSrc);
2478	if (RT_SUCCESS(rc))
2479	{
2480	PGSTPTE pPteSrc = &pPTSrc->a[(GCPtrPage >> GST_PT_SHIFT) & GST_PT_MASK];
2481	const GSTPTE PteSrc = *pPteSrc;
2482	if (pPteSrc->n.u1Present)
2483	TRPMSetErrorCode(pVCpu, uErr \| X86_TRAP_PF_P); /* page-level protection violation */
2484	}
2485	AssertRC(rc);
2486	}
2487	}
2488	return VINF_EM_RAW_GUEST_TRAP;
2489	}
2490	#endif /* PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE) */
2491
2492
2493	/**
2494	* Sync a shadow page table.
2495	*
2496	* The shadow page table is not present. This includes the case where
2497	* there is a conflict with a mapping.
2498	*
2499	* @returns VBox status code.
2500	* @param pVCpu The VMCPU handle.
2501	* @param iPD Page directory index.
2502	* @param pPDSrc Source page directory (i.e. Guest OS page directory).
2503	* Assume this is a temporary mapping.
2504	* @param GCPtrPage GC Pointer of the page that caused the fault
2505	*/
2506	PGM_BTH_DECL(int, SyncPT)(PVMCPU pVCpu, unsigned iPDSrc, PGSTPD pPDSrc, RTGCPTR GCPtrPage)
2507	{
2508	PVM pVM = pVCpu->CTX_SUFF(pVM);
2509	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
2510
2511	STAM_PROFILE_START(&pVCpu->pgm.s.CTX_MID_Z(Stat,SyncPT), a);
2512	#if 0 /* rarely useful; leave for debugging. */
2513	STAM_COUNTER_INC(&pVCpu->pgm.s.StatSyncPtPD[iPDSrc]);
2514	#endif
2515	LogFlow(("SyncPT: GCPtrPage=%RGv\n", GCPtrPage));
2516
2517	Assert(PGMIsLocked(pVM));
2518
2519	#if ( PGM_GST_TYPE == PGM_TYPE_32BIT \
2520	\|\| PGM_GST_TYPE == PGM_TYPE_PAE \
2521	\|\| PGM_GST_TYPE == PGM_TYPE_AMD64) \
2522	&& PGM_SHW_TYPE != PGM_TYPE_NESTED \
2523	&& PGM_SHW_TYPE != PGM_TYPE_EPT
2524
2525	int rc = VINF_SUCCESS;
2526
2527	/*
2528	* Validate input a little bit.
2529	*/
2530	AssertMsg(iPDSrc == ((GCPtrPage >> GST_PD_SHIFT) & GST_PD_MASK), ("iPDSrc=%x GCPtrPage=%RGv\n", iPDSrc, GCPtrPage));
2531	# if PGM_SHW_TYPE == PGM_TYPE_32BIT
2532	const unsigned iPDDst = GCPtrPage >> SHW_PD_SHIFT;
2533	PSHWPDE pPdeDst = pgmShwGet32BitPDEPtr(&pVCpu->pgm.s, GCPtrPage);
2534
2535	/* Fetch the pgm pool shadow descriptor. */
2536	PPGMPOOLPAGE pShwPde = pVCpu->pgm.s.CTX_SUFF(pShwPageCR3);
2537	Assert(pShwPde);
2538
2539	# elif PGM_SHW_TYPE == PGM_TYPE_PAE
2540	const unsigned iPDDst = (GCPtrPage >> SHW_PD_SHIFT) & SHW_PD_MASK;
2541	PPGMPOOLPAGE pShwPde = NULL;
2542	PX86PDPAE pPDDst;
2543	PSHWPDE pPdeDst;
2544
2545	/* Fetch the pgm pool shadow descriptor. */
2546	rc = pgmShwGetPaePoolPagePD(&pVCpu->pgm.s, GCPtrPage, &pShwPde);
2547	AssertRCSuccessReturn(rc, rc);
2548	Assert(pShwPde);
2549
2550	pPDDst = (PX86PDPAE)PGMPOOL_PAGE_2_PTR_BY_PGM(&pVM->pgm.s, pShwPde);
2551	pPdeDst = &pPDDst->a[iPDDst];
2552
2553	# elif PGM_SHW_TYPE == PGM_TYPE_AMD64
2554	const unsigned iPdpt = (GCPtrPage >> X86_PDPT_SHIFT) & X86_PDPT_MASK_AMD64;
2555	const unsigned iPDDst = (GCPtrPage >> SHW_PD_SHIFT) & SHW_PD_MASK;
2556	PX86PDPAE pPDDst = NULL; /* initialized to shut up gcc */
2557	PX86PDPT pPdptDst = NULL; /* initialized to shut up gcc */
2558	rc = pgmShwGetLongModePDPtr(pVCpu, GCPtrPage, NULL, &pPdptDst, &pPDDst);
2559	AssertRCSuccessReturn(rc, rc);
2560	Assert(pPDDst);
2561	PSHWPDE pPdeDst = &pPDDst->a[iPDDst];
2562	# endif
2563	SHWPDE PdeDst = *pPdeDst;
2564
2565	# if PGM_GST_TYPE == PGM_TYPE_AMD64
2566	/* Fetch the pgm pool shadow descriptor. */
2567	PPGMPOOLPAGE pShwPde = pgmPoolGetPage(pPool, pPdptDst->a[iPdpt].u & X86_PDPE_PG_MASK);
2568	Assert(pShwPde);
2569	# endif
2570
2571	# ifndef PGM_WITHOUT_MAPPINGS
2572	/*
2573	* Check for conflicts.
2574	* GC: In case of a conflict we'll go to Ring-3 and do a full SyncCR3.
2575	* HC: Simply resolve the conflict.
2576	*/
2577	if (PdeDst.u & PGM_PDFLAGS_MAPPING)
2578	{
2579	Assert(pgmMapAreMappingsEnabled(&pVM->pgm.s));
2580	# ifndef IN_RING3
2581	Log(("SyncPT: Conflict at %RGv\n", GCPtrPage));
2582	STAM_PROFILE_STOP(&pVCpu->pgm.s.CTX_MID_Z(Stat,SyncPT), a);
2583	return VERR_ADDRESS_CONFLICT;
2584	# else
2585	PPGMMAPPING pMapping = pgmGetMapping(pVM, (RTGCPTR)GCPtrPage);
2586	Assert(pMapping);
2587	# if PGM_GST_TYPE == PGM_TYPE_32BIT
2588	int rc = pgmR3SyncPTResolveConflict(pVM, pMapping, pPDSrc, GCPtrPage & (GST_PD_MASK << GST_PD_SHIFT));
2589	# elif PGM_GST_TYPE == PGM_TYPE_PAE
2590	int rc = pgmR3SyncPTResolveConflictPAE(pVM, pMapping, GCPtrPage & (GST_PD_MASK << GST_PD_SHIFT));
2591	# else
2592	AssertFailed(); /* can't happen for amd64 */
2593	# endif
2594	if (RT_FAILURE(rc))
2595	{
2596	STAM_PROFILE_STOP(&pVCpu->pgm.s.CTX_MID_Z(Stat,SyncPT), a);
2597	return rc;
2598	}
2599	PdeDst = *pPdeDst;
2600	# endif
2601	}
2602	# else /* PGM_WITHOUT_MAPPINGS */
2603	Assert(!pgmMapAreMappingsEnabled(&pVM->pgm.s));
2604	# endif /* PGM_WITHOUT_MAPPINGS */
2605	Assert(!PdeDst.n.u1Present); /* We're only supposed to call SyncPT on PDE!P and conflicts.*/
2606
2607	# if defined(IN_RC)
2608	/* Make sure the dynamic pPdeDst mapping will not be reused during this function. */
2609	PGMDynLockHCPage(pVM, (uint8_t *)pPdeDst);
2610	# endif
2611
2612	/*
2613	* Sync page directory entry.
2614	*/
2615	GSTPDE PdeSrc = pPDSrc->a[iPDSrc];
2616	if (PdeSrc.n.u1Present)
2617	{
2618	/*
2619	* Allocate & map the page table.
2620	*/
2621	PSHWPT pPTDst;
2622	# if PGM_GST_TYPE == PGM_TYPE_AMD64
2623	const bool fPageTable = !PdeSrc.b.u1Size;
2624	# else
2625	const bool fPageTable = !PdeSrc.b.u1Size \|\| !(CPUMGetGuestCR4(pVCpu) & X86_CR4_PSE);
2626	# endif
2627	PPGMPOOLPAGE pShwPage;
2628	RTGCPHYS GCPhys;
2629	if (fPageTable)
2630	{
2631	GCPhys = PdeSrc.u & GST_PDE_PG_MASK;
2632	# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
2633	/* Select the right PDE as we're emulating a 4kb page table with 2 shadow page tables. */
2634	GCPhys \|= (iPDDst & 1) * (PAGE_SIZE / 2);
2635	# endif
2636	rc = pgmPoolAlloc(pVM, GCPhys, BTH_PGMPOOLKIND_PT_FOR_PT, pShwPde->idx, iPDDst, &pShwPage);
2637	}
2638	else
2639	{
2640	PGMPOOLACCESS enmAccess;
2641
2642	# if PGM_WITH_NX(PGM_GST_TYPE, PGM_SHW_TYPE)
2643	const bool fNoExecuteBitValid = !!(CPUMGetGuestEFER(pVCpu) & MSR_K6_EFER_NXE);
2644	const bool fNoExecute = fNoExecuteBitValid && PdeSrc.n.u1NoExecute;
2645	# else
2646	const bool fNoExecute = false;
2647	# endif
2648
2649	GCPhys = GST_GET_PDE_BIG_PG_GCPHYS(PdeSrc);
2650	# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
2651	/* Select the right PDE as we're emulating a 4MB page directory with two 2 MB shadow PDEs.*/
2652	GCPhys \|= GCPtrPage & (1 << X86_PD_PAE_SHIFT);
2653	# endif
2654	/* Determine the right kind of large page to avoid incorrect cached entry reuse. */
2655	if (PdeSrc.n.u1User)
2656	{
2657	if (PdeSrc.n.u1Write)
2658	enmAccess = (fNoExecute) ? PGMPOOLACCESS_USER_RW_NX : PGMPOOLACCESS_USER_RW;
2659	else
2660	enmAccess = (fNoExecute) ? PGMPOOLACCESS_USER_R_NX : PGMPOOLACCESS_USER_R;
2661	}
2662	else
2663	{
2664	if (PdeSrc.n.u1Write)
2665	enmAccess = (fNoExecute) ? PGMPOOLACCESS_SUPERVISOR_RW_NX : PGMPOOLACCESS_SUPERVISOR_RW;
2666	else
2667	enmAccess = (fNoExecute) ? PGMPOOLACCESS_SUPERVISOR_R_NX : PGMPOOLACCESS_SUPERVISOR_R;
2668	}
2669	rc = pgmPoolAllocEx(pVM, GCPhys, BTH_PGMPOOLKIND_PT_FOR_BIG, enmAccess, pShwPde->idx, iPDDst, &pShwPage);
2670	}
2671	if (rc == VINF_SUCCESS)
2672	pPTDst = (PSHWPT)PGMPOOL_PAGE_2_PTR(pVM, pShwPage);
2673	else if (rc == VINF_PGM_CACHED_PAGE)
2674	{
2675	/*
2676	* The PT was cached, just hook it up.
2677	*/
2678	if (fPageTable)
2679	PdeDst.u = pShwPage->Core.Key
2680	\| (PdeSrc.u & ~(GST_PDE_PG_MASK \| X86_PDE_AVL_MASK \| X86_PDE_PCD \| X86_PDE_PWT \| X86_PDE_PS \| X86_PDE4M_G \| X86_PDE4M_D));
2681	else
2682	{
2683	PdeDst.u = pShwPage->Core.Key
2684	\| (PdeSrc.u & ~(GST_PDE_PG_MASK \| X86_PDE_AVL_MASK \| X86_PDE_PCD \| X86_PDE_PWT \| X86_PDE_PS \| X86_PDE4M_G \| X86_PDE4M_D));
2685	/* (see explanation and assumptions further down.) */
2686	if (!PdeSrc.b.u1Dirty && PdeSrc.b.u1Write)
2687	{
2688	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtyPageBig));
2689	PdeDst.u \|= PGM_PDFLAGS_TRACK_DIRTY;
2690	PdeDst.b.u1Write = 0;
2691	}
2692	}
2693	ASMAtomicWriteSize(pPdeDst, PdeDst.u);
2694	# if defined(IN_RC)
2695	PGMDynUnlockHCPage(pVM, (uint8_t *)pPdeDst);
2696	# endif
2697	return VINF_SUCCESS;
2698	}
2699	else if (rc == VERR_PGM_POOL_FLUSHED)
2700	{
2701	VMCPU_FF_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3);
2702	# if defined(IN_RC)
2703	PGMDynUnlockHCPage(pVM, (uint8_t *)pPdeDst);
2704	# endif
2705	return VINF_PGM_SYNC_CR3;
2706	}
2707	else
2708	AssertMsgFailedReturn(("rc=%Rrc\n", rc), VERR_INTERNAL_ERROR);
2709	PdeDst.u &= X86_PDE_AVL_MASK;
2710	PdeDst.u \|= pShwPage->Core.Key;
2711
2712	/*
2713	* Page directory has been accessed (this is a fault situation, remember).
2714	*/
2715	pPDSrc->a[iPDSrc].n.u1Accessed = 1;
2716	if (fPageTable)
2717	{
2718	/*
2719	* Page table - 4KB.
2720	*
2721	* Sync all or just a few entries depending on PGM_SYNC_N_PAGES.
2722	*/
2723	Log2(("SyncPT: 4K %RGv PdeSrc:{P=%d RW=%d U=%d raw=%08llx}\n",
2724	GCPtrPage, PdeSrc.b.u1Present, PdeSrc.b.u1Write, PdeSrc.b.u1User, (uint64_t)PdeSrc.u));
2725	PGSTPT pPTSrc;
2726	rc = PGM_GCPHYS_2_PTR(pVM, PdeSrc.u & GST_PDE_PG_MASK, &pPTSrc);
2727	if (RT_SUCCESS(rc))
2728	{
2729	/*
2730	* Start by syncing the page directory entry so CSAM's TLB trick works.
2731	*/
2732	PdeDst.u = (PdeDst.u & (SHW_PDE_PG_MASK \| X86_PDE_AVL_MASK))
2733	\| (PdeSrc.u & ~(GST_PDE_PG_MASK \| X86_PDE_AVL_MASK \| X86_PDE_PCD \| X86_PDE_PWT \| X86_PDE_PS \| X86_PDE4M_G \| X86_PDE4M_D));
2734	ASMAtomicWriteSize(pPdeDst, PdeDst.u);
2735	# if defined(IN_RC)
2736	PGMDynUnlockHCPage(pVM, (uint8_t *)pPdeDst);
2737	# endif
2738
2739	/*
2740	* Directory/page user or supervisor privilege: (same goes for read/write)
2741	*
2742	* Directory Page Combined
2743	* U/S U/S U/S
2744	* 0 0 0
2745	* 0 1 0
2746	* 1 0 0
2747	* 1 1 1
2748	*
2749	* Simple AND operation. Table listed for completeness.
2750	*
2751	*/
2752	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,SyncPT4K));
2753	# ifdef PGM_SYNC_N_PAGES
2754	unsigned iPTBase = (GCPtrPage >> SHW_PT_SHIFT) & SHW_PT_MASK;
2755	unsigned iPTDst = iPTBase;
2756	const unsigned iPTDstEnd = RT_MIN(iPTDst + PGM_SYNC_NR_PAGES / 2, RT_ELEMENTS(pPTDst->a));
2757	if (iPTDst <= PGM_SYNC_NR_PAGES / 2)
2758	iPTDst = 0;
2759	else
2760	iPTDst -= PGM_SYNC_NR_PAGES / 2;
2761	# else /* !PGM_SYNC_N_PAGES */
2762	unsigned iPTDst = 0;
2763	const unsigned iPTDstEnd = RT_ELEMENTS(pPTDst->a);
2764	# endif /* !PGM_SYNC_N_PAGES */
2765	# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
2766	/* Select the right PDE as we're emulating a 4kb page table with 2 shadow page tables. */
2767	const unsigned offPTSrc = ((GCPtrPage >> SHW_PD_SHIFT) & 1) * 512;
2768	# else
2769	const unsigned offPTSrc = 0;
2770	# endif
2771	for (; iPTDst < iPTDstEnd; iPTDst++)
2772	{
2773	const unsigned iPTSrc = iPTDst + offPTSrc;
2774	const GSTPTE PteSrc = pPTSrc->a[iPTSrc];
2775
2776	if (PteSrc.n.u1Present) /* we've already cleared it above */
2777	{
2778	# ifndef IN_RING0
2779	/*
2780	* Assuming kernel code will be marked as supervisor - and not as user level
2781	* and executed using a conforming code selector - And marked as readonly.
2782	* Also assume that if we're monitoring a page, it's of no interest to CSAM.
2783	*/
2784	PPGMPAGE pPage;
2785	if ( ((PdeSrc.u & pPTSrc->a[iPTSrc].u) & (X86_PTE_RW \| X86_PTE_US))
2786	\|\| !CSAMDoesPageNeedScanning(pVM, (RTRCPTR)((iPDSrc << GST_PD_SHIFT) \| (iPTSrc << PAGE_SHIFT)))
2787	\|\| ( (pPage = pgmPhysGetPage(&pVM->pgm.s, PteSrc.u & GST_PTE_PG_MASK))
2788	&& PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage))
2789	)
2790	# endif
2791	PGM_BTH_NAME(SyncPageWorker)(pVCpu, &pPTDst->a[iPTDst], PdeSrc, PteSrc, pShwPage, iPTDst);
2792	Log2(("SyncPT: 4K+ %RGv PteSrc:{P=%d RW=%d U=%d raw=%08llx}%s dst.raw=%08llx iPTSrc=%x PdeSrc.u=%x physpte=%RGp\n",
2793	(RTGCPTR)(((RTGCPTR)iPDSrc << GST_PD_SHIFT) \| ((RTGCPTR)iPTSrc << PAGE_SHIFT)),
2794	PteSrc.n.u1Present,
2795	PteSrc.n.u1Write & PdeSrc.n.u1Write,
2796	PteSrc.n.u1User & PdeSrc.n.u1User,
2797	(uint64_t)PteSrc.u,
2798	pPTDst->a[iPTDst].u & PGM_PTFLAGS_TRACK_DIRTY ? " Track-Dirty" : "", pPTDst->a[iPTDst].u, iPTSrc, PdeSrc.au32[0],
2799	(RTGCPHYS)((PdeSrc.u & GST_PDE_PG_MASK) + iPTSrc*sizeof(PteSrc)) ));
2800	}
2801	} /* for PTEs */
2802	}
2803	}
2804	else
2805	{
2806	/*
2807	* Big page - 2/4MB.
2808	*
2809	* We'll walk the ram range list in parallel and optimize lookups.
2810	* We will only sync on shadow page table at a time.
2811	*/
2812	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,SyncPT4M));
2813
2814	/**
2815	* @todo It might be more efficient to sync only a part of the 4MB page (similar to what we do for 4kb PDs).
2816	*/
2817
2818	/*
2819	* Start by syncing the page directory entry.
2820	*/
2821	PdeDst.u = (PdeDst.u & (SHW_PDE_PG_MASK \| (X86_PDE_AVL_MASK & ~PGM_PDFLAGS_TRACK_DIRTY)))
2822	\| (PdeSrc.u & ~(GST_PDE_PG_MASK \| X86_PDE_AVL_MASK \| X86_PDE_PCD \| X86_PDE_PWT \| X86_PDE_PS \| X86_PDE4M_G \| X86_PDE4M_D));
2823
2824	/*
2825	* If the page is not flagged as dirty and is writable, then make it read-only
2826	* at PD level, so we can set the dirty bit when the page is modified.
2827	*
2828	* ASSUMES that page access handlers are implemented on page table entry level.
2829	* Thus we will first catch the dirty access and set PDE.D and restart. If
2830	* there is an access handler, we'll trap again and let it work on the problem.
2831	*/
2832	/** @todo move the above stuff to a section in the PGM documentation. */
2833	Assert(!(PdeDst.u & PGM_PDFLAGS_TRACK_DIRTY));
2834	if (!PdeSrc.b.u1Dirty && PdeSrc.b.u1Write)
2835	{
2836	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,DirtyPageBig));
2837	PdeDst.u \|= PGM_PDFLAGS_TRACK_DIRTY;
2838	PdeDst.b.u1Write = 0;
2839	}
2840	ASMAtomicWriteSize(pPdeDst, PdeDst.u);
2841	# if defined(IN_RC)
2842	PGMDynUnlockHCPage(pVM, (uint8_t *)pPdeDst);
2843	# endif
2844
2845	/*
2846	* Fill the shadow page table.
2847	*/
2848	/* Get address and flags from the source PDE. */
2849	SHWPTE PteDstBase;
2850	PteDstBase.u = PdeSrc.u & ~(GST_PDE_PG_MASK \| X86_PTE_AVL_MASK \| X86_PTE_PAT \| X86_PTE_PCD \| X86_PTE_PWT);
2851
2852	/* Loop thru the entries in the shadow PT. */
2853	const RTGCPTR GCPtr = (GCPtrPage >> SHW_PD_SHIFT) << SHW_PD_SHIFT; NOREF(GCPtr);
2854	Log2(("SyncPT: BIG %RGv PdeSrc:{P=%d RW=%d U=%d raw=%08llx} Shw=%RGv GCPhys=%RGp %s\n",
2855	GCPtrPage, PdeSrc.b.u1Present, PdeSrc.b.u1Write, PdeSrc.b.u1User, (uint64_t)PdeSrc.u, GCPtr,
2856	GCPhys, PdeDst.u & PGM_PDFLAGS_TRACK_DIRTY ? " Track-Dirty" : ""));
2857	PPGMRAMRANGE pRam = pVM->pgm.s.CTX_SUFF(pRamRanges);
2858	unsigned iPTDst = 0;
2859	while ( iPTDst < RT_ELEMENTS(pPTDst->a)
2860	&& !VM_FF_ISPENDING(pVM, VM_FF_PGM_NO_MEMORY))
2861	{
2862	/* Advance ram range list. */
2863	while (pRam && GCPhys > pRam->GCPhysLast)
2864	pRam = pRam->CTX_SUFF(pNext);
2865	if (pRam && GCPhys >= pRam->GCPhys)
2866	{
2867	unsigned iHCPage = (GCPhys - pRam->GCPhys) >> PAGE_SHIFT;
2868	do
2869	{
2870	/* Make shadow PTE. */
2871	PPGMPAGE pPage = &pRam->aPages[iHCPage];
2872	SHWPTE PteDst;
2873
2874	# ifndef VBOX_WITH_NEW_LAZY_PAGE_ALLOC
2875	/* Try make the page writable if necessary. */
2876	if ( PteDstBase.n.u1Write
2877	&& PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED
2878	&& PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_RAM)
2879	{
2880	rc = pgmPhysPageMakeWritableUnlocked(pVM, pPage, GCPhys);
2881	AssertRCReturn(rc, rc);
2882	if (VM_FF_ISPENDING(pVM, VM_FF_PGM_NO_MEMORY))
2883	break;
2884	}
2885	# endif
2886
2887	if (PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage))
2888	{
2889	if (!PGM_PAGE_HAS_ACTIVE_ALL_HANDLERS(pPage))
2890	{
2891	PteDst.u = PGM_PAGE_GET_HCPHYS(pPage) \| PteDstBase.u;
2892	PteDst.n.u1Write = 0;
2893	}
2894	else
2895	PteDst.u = 0;
2896	}
2897	# ifndef IN_RING0
2898	/*
2899	* Assuming kernel code will be marked as supervisor and not as user level and executed
2900	* using a conforming code selector. Don't check for readonly, as that implies the whole
2901	* 4MB can be code or readonly data. Linux enables write access for its large pages.
2902	*/
2903	else if ( !PdeSrc.n.u1User
2904	&& CSAMDoesPageNeedScanning(pVM, (RTRCPTR)(GCPtr \| (iPTDst << SHW_PT_SHIFT))))
2905	PteDst.u = 0;
2906	# endif
2907	else
2908	PteDst.u = PGM_PAGE_GET_HCPHYS(pPage) \| PteDstBase.u;
2909
2910	/* Only map writable pages writable. */
2911	if ( PteDst.n.u1Write
2912	&& PteDst.n.u1Present
2913	&& PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED)
2914	{
2915	PteDst.n.u1Write = 0; /** @todo this isn't quite working yet... */
2916	Log3(("SyncPT: write-protecting %RGp pPage=%R[pgmpage] at %RGv\n", GCPhys, pPage, (RTGCPTR)(GCPtr \| (iPTDst << SHW_PT_SHIFT))));
2917	}
2918
2919	# ifdef PGMPOOL_WITH_USER_TRACKING
2920	if (PteDst.n.u1Present)
2921	PGM_BTH_NAME(SyncPageWorkerTrackAddref)(pVCpu, pShwPage, PGM_PAGE_GET_TRACKING(pPage), pPage, iPTDst);
2922	# endif
2923	/* commit it */
2924	pPTDst->a[iPTDst] = PteDst;
2925	Log4(("SyncPT: BIG %RGv PteDst:{P=%d RW=%d U=%d raw=%08llx}%s\n",
2926	(RTGCPTR)(GCPtr \| (iPTDst << SHW_PT_SHIFT)), PteDst.n.u1Present, PteDst.n.u1Write, PteDst.n.u1User, (uint64_t)PteDst.u,
2927	PteDst.u & PGM_PTFLAGS_TRACK_DIRTY ? " Track-Dirty" : ""));
2928
2929	/* advance */
2930	GCPhys += PAGE_SIZE;
2931	iHCPage++;
2932	iPTDst++;
2933	} while ( iPTDst < RT_ELEMENTS(pPTDst->a)
2934	&& GCPhys <= pRam->GCPhysLast);
2935	}
2936	else if (pRam)
2937	{
2938	Log(("Invalid pages at %RGp\n", GCPhys));
2939	do
2940	{
2941	pPTDst->a[iPTDst].u = 0; /* MMIO or invalid page, we must handle them manually. */
2942	GCPhys += PAGE_SIZE;
2943	iPTDst++;
2944	} while ( iPTDst < RT_ELEMENTS(pPTDst->a)
2945	&& GCPhys < pRam->GCPhys);
2946	}
2947	else
2948	{
2949	Log(("Invalid pages at %RGp (2)\n", GCPhys));
2950	for ( ; iPTDst < RT_ELEMENTS(pPTDst->a); iPTDst++)
2951	pPTDst->a[iPTDst].u = 0; /* MMIO or invalid page, we must handle them manually. */
2952	}
2953	} /* while more PTEs */
2954	} /* 4KB / 4MB */
2955	}
2956	else
2957	AssertRelease(!PdeDst.n.u1Present);
2958
2959	STAM_PROFILE_STOP(&pVCpu->pgm.s.CTX_MID_Z(Stat,SyncPT), a);
2960	if (RT_FAILURE(rc))
2961	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,SyncPTFailed));
2962	return rc;
2963
2964	#elif (PGM_GST_TYPE == PGM_TYPE_REAL \|\| PGM_GST_TYPE == PGM_TYPE_PROT) \
2965	&& PGM_SHW_TYPE != PGM_TYPE_NESTED \
2966	&& (PGM_SHW_TYPE != PGM_TYPE_EPT \|\| PGM_GST_TYPE == PGM_TYPE_PROT) \
2967	&& !defined(IN_RC)
2968
2969	/*
2970	* Validate input a little bit.
2971	*/
2972	int rc = VINF_SUCCESS;
2973	# if PGM_SHW_TYPE == PGM_TYPE_32BIT
2974	const unsigned iPDDst = (GCPtrPage >> SHW_PD_SHIFT) & SHW_PD_MASK;
2975	PSHWPDE pPdeDst = pgmShwGet32BitPDEPtr(&pVCpu->pgm.s, GCPtrPage);
2976
2977	/* Fetch the pgm pool shadow descriptor. */
2978	PPGMPOOLPAGE pShwPde = pVCpu->pgm.s.CTX_SUFF(pShwPageCR3);
2979	Assert(pShwPde);
2980
2981	# elif PGM_SHW_TYPE == PGM_TYPE_PAE
2982	const unsigned iPDDst = (GCPtrPage >> SHW_PD_SHIFT) & SHW_PD_MASK;
2983	PPGMPOOLPAGE pShwPde = NULL; /* initialized to shut up gcc */
2984	PX86PDPAE pPDDst;
2985	PSHWPDE pPdeDst;
2986
2987	/* Fetch the pgm pool shadow descriptor. */
2988	rc = pgmShwGetPaePoolPagePD(&pVCpu->pgm.s, GCPtrPage, &pShwPde);
2989	AssertRCSuccessReturn(rc, rc);
2990	Assert(pShwPde);
2991
2992	pPDDst = (PX86PDPAE)PGMPOOL_PAGE_2_PTR_BY_PGM(&pVM->pgm.s, pShwPde);
2993	pPdeDst = &pPDDst->a[iPDDst];
2994
2995	# elif PGM_SHW_TYPE == PGM_TYPE_AMD64
2996	const unsigned iPdpt = (GCPtrPage >> X86_PDPT_SHIFT) & X86_PDPT_MASK_AMD64;
2997	const unsigned iPDDst = (GCPtrPage >> SHW_PD_SHIFT) & SHW_PD_MASK;
2998	PX86PDPAE pPDDst = NULL; /* initialized to shut up gcc */
2999	PX86PDPT pPdptDst= NULL; /* initialized to shut up gcc */
3000	rc = pgmShwGetLongModePDPtr(pVCpu, GCPtrPage, NULL, &pPdptDst, &pPDDst);
3001	AssertRCSuccessReturn(rc, rc);
3002	Assert(pPDDst);
3003	PSHWPDE pPdeDst = &pPDDst->a[iPDDst];
3004
3005	/* Fetch the pgm pool shadow descriptor. */
3006	PPGMPOOLPAGE pShwPde = pgmPoolGetPage(pPool, pPdptDst->a[iPdpt].u & X86_PDPE_PG_MASK);
3007	Assert(pShwPde);
3008
3009	# elif PGM_SHW_TYPE == PGM_TYPE_EPT
3010	const unsigned iPdpt = (GCPtrPage >> EPT_PDPT_SHIFT) & EPT_PDPT_MASK;
3011	const unsigned iPDDst = ((GCPtrPage >> SHW_PD_SHIFT) & SHW_PD_MASK);
3012	PEPTPD pPDDst;
3013	PEPTPDPT pPdptDst;
3014
3015	rc = pgmShwGetEPTPDPtr(pVCpu, GCPtrPage, &pPdptDst, &pPDDst);
3016	if (rc != VINF_SUCCESS)
3017	{
3018	AssertRC(rc);
3019	return rc;
3020	}
3021	Assert(pPDDst);
3022	PSHWPDE pPdeDst = &pPDDst->a[iPDDst];
3023
3024	/* Fetch the pgm pool shadow descriptor. */
3025	PPGMPOOLPAGE pShwPde = pgmPoolGetPage(pPool, pPdptDst->a[iPdpt].u & EPT_PDPTE_PG_MASK);
3026	Assert(pShwPde);
3027	# endif
3028	SHWPDE PdeDst = *pPdeDst;
3029
3030	Assert(!(PdeDst.u & PGM_PDFLAGS_MAPPING));
3031	Assert(!PdeDst.n.u1Present); /* We're only supposed to call SyncPT on PDE!P and conflicts.*/
3032
3033	GSTPDE PdeSrc;
3034	PdeSrc.au32[0] = 0; /* faked so we don't have to #ifdef everything */
3035	PdeSrc.n.u1Present = 1;
3036	PdeSrc.n.u1Write = 1;
3037	PdeSrc.n.u1Accessed = 1;
3038	PdeSrc.n.u1User = 1;
3039
3040	/*
3041	* Allocate & map the page table.
3042	*/
3043	PSHWPT pPTDst;
3044	PPGMPOOLPAGE pShwPage;
3045	RTGCPHYS GCPhys;
3046
3047	/* Virtual address = physical address */
3048	GCPhys = GCPtrPage & X86_PAGE_4K_BASE_MASK;
3049	rc = pgmPoolAlloc(pVM, GCPhys & ~(RT_BIT_64(SHW_PD_SHIFT) - 1), BTH_PGMPOOLKIND_PT_FOR_PT, pShwPde->idx, iPDDst, &pShwPage);
3050
3051	if ( rc == VINF_SUCCESS
3052	\|\| rc == VINF_PGM_CACHED_PAGE)
3053	pPTDst = (PSHWPT)PGMPOOL_PAGE_2_PTR(pVM, pShwPage);
3054	else
3055	AssertMsgFailedReturn(("rc=%Rrc\n", rc), VERR_INTERNAL_ERROR);
3056
3057	PdeDst.u &= X86_PDE_AVL_MASK;
3058	PdeDst.u \|= pShwPage->Core.Key;
3059	PdeDst.n.u1Present = 1;
3060	PdeDst.n.u1Write = 1;
3061	# if PGM_SHW_TYPE == PGM_TYPE_EPT
3062	PdeDst.n.u1Execute = 1;
3063	# else
3064	PdeDst.n.u1User = 1;
3065	PdeDst.n.u1Accessed = 1;
3066	# endif
3067	ASMAtomicWriteSize(pPdeDst, PdeDst.u);
3068
3069	pgmLock(pVM);
3070	rc = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrc, GCPtrPage, PGM_SYNC_NR_PAGES, 0 /* page not present */);
3071	pgmUnlock(pVM);
3072	STAM_PROFILE_STOP(&pVCpu->pgm.s.CTX_MID_Z(Stat,SyncPT), a);
3073	return rc;
3074
3075	#else
3076	AssertReleaseMsgFailed(("Shw=%d Gst=%d is not implemented!\n", PGM_SHW_TYPE, PGM_GST_TYPE));
3077	STAM_PROFILE_STOP(&pVCpu->pgm.s.CTX_MID_Z(Stat,SyncPT), a);
3078	return VERR_INTERNAL_ERROR;
3079	#endif
3080	}
3081
3082
3083
3084	/**
3085	* Prefetch a page/set of pages.
3086	*
3087	* Typically used to sync commonly used pages before entering raw mode
3088	* after a CR3 reload.
3089	*
3090	* @returns VBox status code.
3091	* @param pVCpu The VMCPU handle.
3092	* @param GCPtrPage Page to invalidate.
3093	*/
3094	PGM_BTH_DECL(int, PrefetchPage)(PVMCPU pVCpu, RTGCPTR GCPtrPage)
3095	{
3096	#if (PGM_GST_TYPE == PGM_TYPE_32BIT \|\| PGM_GST_TYPE == PGM_TYPE_REAL \|\| PGM_GST_TYPE == PGM_TYPE_PROT \|\| PGM_GST_TYPE == PGM_TYPE_PAE \|\| PGM_GST_TYPE == PGM_TYPE_AMD64) \
3097	&& PGM_SHW_TYPE != PGM_TYPE_NESTED && PGM_SHW_TYPE != PGM_TYPE_EPT
3098	/*
3099	* Check that all Guest levels thru the PDE are present, getting the
3100	* PD and PDE in the processes.
3101	*/
3102	int rc = VINF_SUCCESS;
3103	# if PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE)
3104	# if PGM_GST_TYPE == PGM_TYPE_32BIT
3105	const unsigned iPDSrc = GCPtrPage >> GST_PD_SHIFT;
3106	PGSTPD pPDSrc = pgmGstGet32bitPDPtr(&pVCpu->pgm.s);
3107	# elif PGM_GST_TYPE == PGM_TYPE_PAE
3108	unsigned iPDSrc;
3109	X86PDPE PdpeSrc;
3110	PGSTPD pPDSrc = pgmGstGetPaePDPtr(&pVCpu->pgm.s, GCPtrPage, &iPDSrc, &PdpeSrc);
3111	if (!pPDSrc)
3112	return VINF_SUCCESS; /* not present */
3113	# elif PGM_GST_TYPE == PGM_TYPE_AMD64
3114	unsigned iPDSrc;
3115	PX86PML4E pPml4eSrc;
3116	X86PDPE PdpeSrc;
3117	PGSTPD pPDSrc = pgmGstGetLongModePDPtr(&pVCpu->pgm.s, GCPtrPage, &pPml4eSrc, &PdpeSrc, &iPDSrc);
3118	if (!pPDSrc)
3119	return VINF_SUCCESS; /* not present */
3120	# endif
3121	const GSTPDE PdeSrc = pPDSrc->a[iPDSrc];
3122	# else
3123	PGSTPD pPDSrc = NULL;
3124	const unsigned iPDSrc = 0;
3125	GSTPDE PdeSrc;
3126
3127	PdeSrc.au32[0] = 0; /* faked so we don't have to #ifdef everything */
3128	PdeSrc.n.u1Present = 1;
3129	PdeSrc.n.u1Write = 1;
3130	PdeSrc.n.u1Accessed = 1;
3131	PdeSrc.n.u1User = 1;
3132	# endif
3133
3134	if (PdeSrc.n.u1Present && PdeSrc.n.u1Accessed)
3135	{
3136	PVM pVM = pVCpu->CTX_SUFF(pVM);
3137	pgmLock(pVM);
3138
3139	# if PGM_SHW_TYPE == PGM_TYPE_32BIT
3140	const X86PDE PdeDst = pgmShwGet32BitPDE(&pVCpu->pgm.s, GCPtrPage);
3141	# elif PGM_SHW_TYPE == PGM_TYPE_PAE
3142	const unsigned iPDDst = ((GCPtrPage >> SHW_PD_SHIFT) & SHW_PD_MASK);
3143	PX86PDPAE pPDDst;
3144	X86PDEPAE PdeDst;
3145	# if PGM_GST_TYPE != PGM_TYPE_PAE
3146	X86PDPE PdpeSrc;
3147
3148	/* Fake PDPT entry; access control handled on the page table level, so allow everything. */
3149	PdpeSrc.u = X86_PDPE_P; /* rw/us are reserved for PAE pdpte's; accessed bit causes invalid VT-x guest state errors */
3150	# endif
3151	int rc = pgmShwSyncPaePDPtr(pVCpu, GCPtrPage, &PdpeSrc, &pPDDst);
3152	if (rc != VINF_SUCCESS)
3153	{
3154	pgmUnlock(pVM);
3155	AssertRC(rc);
3156	return rc;
3157	}
3158	Assert(pPDDst);
3159	PdeDst = pPDDst->a[iPDDst];
3160
3161	# elif PGM_SHW_TYPE == PGM_TYPE_AMD64
3162	const unsigned iPDDst = ((GCPtrPage >> SHW_PD_SHIFT) & SHW_PD_MASK);
3163	PX86PDPAE pPDDst;
3164	X86PDEPAE PdeDst;
3165
3166	# if PGM_GST_TYPE == PGM_TYPE_PROT
3167	/* AMD-V nested paging */
3168	X86PML4E Pml4eSrc;
3169	X86PDPE PdpeSrc;
3170	PX86PML4E pPml4eSrc = &Pml4eSrc;
3171
3172	/* Fake PML4 & PDPT entry; access control handled on the page table level, so allow everything. */
3173	Pml4eSrc.u = X86_PML4E_P \| X86_PML4E_RW \| X86_PML4E_US \| X86_PML4E_NX \| X86_PML4E_A;
3174	PdpeSrc.u = X86_PDPE_P \| X86_PDPE_RW \| X86_PDPE_US \| X86_PDPE_NX \| X86_PDPE_A;
3175	# endif
3176
3177	int rc = pgmShwSyncLongModePDPtr(pVCpu, GCPtrPage, pPml4eSrc, &PdpeSrc, &pPDDst);
3178	if (rc != VINF_SUCCESS)
3179	{
3180	pgmUnlock(pVM);
3181	AssertRC(rc);
3182	return rc;
3183	}
3184	Assert(pPDDst);
3185	PdeDst = pPDDst->a[iPDDst];
3186	# endif
3187	if (!(PdeDst.u & PGM_PDFLAGS_MAPPING))
3188	{
3189	if (!PdeDst.n.u1Present)
3190	{
3191	/** r=bird: This guy will set the A bit on the PDE, probably harmless. */
3192	rc = PGM_BTH_NAME(SyncPT)(pVCpu, iPDSrc, pPDSrc, GCPtrPage);
3193	}
3194	else
3195	{
3196	/** @note We used to sync PGM_SYNC_NR_PAGES pages, which triggered assertions in CSAM, because
3197	* R/W attributes of nearby pages were reset. Not sure how that could happen. Anyway, it
3198	* makes no sense to prefetch more than one page.
3199	*/
3200	rc = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrc, GCPtrPage, 1, 0);
3201	if (RT_SUCCESS(rc))
3202	rc = VINF_SUCCESS;
3203	}
3204	}
3205	pgmUnlock(pVM);
3206	}
3207	return rc;
3208
3209	#elif PGM_SHW_TYPE == PGM_TYPE_NESTED \|\| PGM_SHW_TYPE == PGM_TYPE_EPT
3210	return VINF_SUCCESS; /* ignore */
3211	#endif
3212	}
3213
3214
3215
3216
3217	/**
3218	* Syncs a page during a PGMVerifyAccess() call.
3219	*
3220	* @returns VBox status code (informational included).
3221	* @param pVCpu The VMCPU handle.
3222	* @param GCPtrPage The address of the page to sync.
3223	* @param fPage The effective guest page flags.
3224	* @param uErr The trap error code.
3225	*/
3226	PGM_BTH_DECL(int, VerifyAccessSyncPage)(PVMCPU pVCpu, RTGCPTR GCPtrPage, unsigned fPage, unsigned uErr)
3227	{
3228	PVM pVM = pVCpu->CTX_SUFF(pVM);
3229
3230	LogFlow(("VerifyAccessSyncPage: GCPtrPage=%RGv fPage=%#x uErr=%#x\n", GCPtrPage, fPage, uErr));
3231
3232	Assert(!HWACCMIsNestedPagingActive(pVM));
3233	#if (PGM_GST_TYPE == PGM_TYPE_32BIT \|\| PGM_GST_TYPE == PGM_TYPE_REAL \|\| PGM_GST_TYPE == PGM_TYPE_PROT \|\| PGM_GST_TYPE == PGM_TYPE_PAE \|\| PGM_TYPE_AMD64) \
3234	&& PGM_SHW_TYPE != PGM_TYPE_NESTED && PGM_SHW_TYPE != PGM_TYPE_EPT
3235
3236	# ifndef IN_RING0
3237	if (!(fPage & X86_PTE_US))
3238	{
3239	/*
3240	* Mark this page as safe.
3241	*/
3242	/** @todo not correct for pages that contain both code and data!! */
3243	Log(("CSAMMarkPage %RGv; scanned=%d\n", GCPtrPage, true));
3244	CSAMMarkPage(pVM, (RTRCPTR)GCPtrPage, true);
3245	}
3246	# endif
3247
3248	/*
3249	* Get guest PD and index.
3250	*/
3251	# if PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE)
3252	# if PGM_GST_TYPE == PGM_TYPE_32BIT
3253	const unsigned iPDSrc = GCPtrPage >> GST_PD_SHIFT;
3254	PGSTPD pPDSrc = pgmGstGet32bitPDPtr(&pVCpu->pgm.s);
3255	# elif PGM_GST_TYPE == PGM_TYPE_PAE
3256	unsigned iPDSrc = 0;
3257	X86PDPE PdpeSrc;
3258	PGSTPD pPDSrc = pgmGstGetPaePDPtr(&pVCpu->pgm.s, GCPtrPage, &iPDSrc, &PdpeSrc);
3259
3260	if (pPDSrc)
3261	{
3262	Log(("PGMVerifyAccess: access violation for %RGv due to non-present PDPTR\n", GCPtrPage));
3263	return VINF_EM_RAW_GUEST_TRAP;
3264	}
3265	# elif PGM_GST_TYPE == PGM_TYPE_AMD64
3266	unsigned iPDSrc;
3267	PX86PML4E pPml4eSrc;
3268	X86PDPE PdpeSrc;
3269	PGSTPD pPDSrc = pgmGstGetLongModePDPtr(&pVCpu->pgm.s, GCPtrPage, &pPml4eSrc, &PdpeSrc, &iPDSrc);
3270	if (!pPDSrc)
3271	{
3272	Log(("PGMVerifyAccess: access violation for %RGv due to non-present PDPTR\n", GCPtrPage));
3273	return VINF_EM_RAW_GUEST_TRAP;
3274	}
3275	# endif
3276	# else
3277	PGSTPD pPDSrc = NULL;
3278	const unsigned iPDSrc = 0;
3279	# endif
3280	int rc = VINF_SUCCESS;
3281
3282	pgmLock(pVM);
3283
3284	/*
3285	* First check if the shadow pd is present.
3286	*/
3287	# if PGM_SHW_TYPE == PGM_TYPE_32BIT
3288	PX86PDE pPdeDst = pgmShwGet32BitPDEPtr(&pVCpu->pgm.s, GCPtrPage);
3289	# elif PGM_SHW_TYPE == PGM_TYPE_PAE
3290	PX86PDEPAE pPdeDst;
3291	const unsigned iPDDst = ((GCPtrPage >> SHW_PD_SHIFT) & SHW_PD_MASK);
3292	PX86PDPAE pPDDst;
3293	# if PGM_GST_TYPE != PGM_TYPE_PAE
3294	X86PDPE PdpeSrc;
3295
3296	/* Fake PDPT entry; access control handled on the page table level, so allow everything. */
3297	PdpeSrc.u = X86_PDPE_P; /* rw/us are reserved for PAE pdpte's; accessed bit causes invalid VT-x guest state errors */
3298	# endif
3299	rc = pgmShwSyncPaePDPtr(pVCpu, GCPtrPage, &PdpeSrc, &pPDDst);
3300	if (rc != VINF_SUCCESS)
3301	{
3302	pgmUnlock(pVM);
3303	AssertRC(rc);
3304	return rc;
3305	}
3306	Assert(pPDDst);
3307	pPdeDst = &pPDDst->a[iPDDst];
3308
3309	# elif PGM_SHW_TYPE == PGM_TYPE_AMD64
3310	const unsigned iPDDst = ((GCPtrPage >> SHW_PD_SHIFT) & SHW_PD_MASK);
3311	PX86PDPAE pPDDst;
3312	PX86PDEPAE pPdeDst;
3313
3314	# if PGM_GST_TYPE == PGM_TYPE_PROT
3315	/* AMD-V nested paging */
3316	X86PML4E Pml4eSrc;
3317	X86PDPE PdpeSrc;
3318	PX86PML4E pPml4eSrc = &Pml4eSrc;
3319
3320	/* Fake PML4 & PDPT entry; access control handled on the page table level, so allow everything. */
3321	Pml4eSrc.u = X86_PML4E_P \| X86_PML4E_RW \| X86_PML4E_US \| X86_PML4E_NX \| X86_PML4E_A;
3322	PdpeSrc.u = X86_PDPE_P \| X86_PDPE_RW \| X86_PDPE_US \| X86_PDPE_NX \| X86_PDPE_A;
3323	# endif
3324
3325	rc = pgmShwSyncLongModePDPtr(pVCpu, GCPtrPage, pPml4eSrc, &PdpeSrc, &pPDDst);
3326	if (rc != VINF_SUCCESS)
3327	{
3328	pgmUnlock(pVM);
3329	AssertRC(rc);
3330	return rc;
3331	}
3332	Assert(pPDDst);
3333	pPdeDst = &pPDDst->a[iPDDst];
3334	# endif
3335
3336	# if defined(IN_RC)
3337	/* Make sure the dynamic pPdeDst mapping will not be reused during this function. */
3338	PGMDynLockHCPage(pVM, (uint8_t *)pPdeDst);
3339	# endif
3340
3341	if (!pPdeDst->n.u1Present)
3342	{
3343	rc = PGM_BTH_NAME(SyncPT)(pVCpu, iPDSrc, pPDSrc, GCPtrPage);
3344	if (rc != VINF_SUCCESS)
3345	{
3346	# if defined(IN_RC)
3347	/* Make sure the dynamic pPdeDst mapping will not be reused during this function. */
3348	PGMDynUnlockHCPage(pVM, (uint8_t *)pPdeDst);
3349	# endif
3350	pgmUnlock(pVM);
3351	AssertRC(rc);
3352	return rc;
3353	}
3354	}
3355
3356	# if PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE)
3357	/* Check for dirty bit fault */
3358	rc = PGM_BTH_NAME(CheckPageFault)(pVCpu, uErr, pPdeDst, &pPDSrc->a[iPDSrc], GCPtrPage);
3359	if (rc == VINF_PGM_HANDLED_DIRTY_BIT_FAULT)
3360	Log(("PGMVerifyAccess: success (dirty)\n"));
3361	else
3362	{
3363	GSTPDE PdeSrc = pPDSrc->a[iPDSrc];
3364	# else
3365	{
3366	GSTPDE PdeSrc;
3367	PdeSrc.au32[0] = 0; /* faked so we don't have to #ifdef everything */
3368	PdeSrc.n.u1Present = 1;
3369	PdeSrc.n.u1Write = 1;
3370	PdeSrc.n.u1Accessed = 1;
3371	PdeSrc.n.u1User = 1;
3372
3373	# endif /* PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE) */
3374	Assert(rc != VINF_EM_RAW_GUEST_TRAP);
3375	if (uErr & X86_TRAP_PF_US)
3376	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,PageOutOfSyncUser));
3377	else /* supervisor */
3378	STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_MID_Z(Stat,PageOutOfSyncSupervisor));
3379
3380	rc = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrc, GCPtrPage, 1, 0);
3381	if (RT_SUCCESS(rc))
3382	{
3383	/* Page was successfully synced */
3384	Log2(("PGMVerifyAccess: success (sync)\n"));
3385	rc = VINF_SUCCESS;
3386	}
3387	else
3388	{
3389	Log(("PGMVerifyAccess: access violation for %RGv rc=%d\n", GCPtrPage, rc));
3390	rc = VINF_EM_RAW_GUEST_TRAP;
3391	}
3392	}
3393	# if defined(IN_RC)
3394	/* Make sure the dynamic pPdeDst mapping will not be reused during this function. */
3395	PGMDynUnlockHCPage(pVM, (uint8_t *)pPdeDst);
3396	# endif
3397	pgmUnlock(pVM);
3398	return rc;
3399
3400	#else /* PGM_GST_TYPE != PGM_TYPE_32BIT */
3401
3402	AssertReleaseMsgFailed(("Shw=%d Gst=%d is not implemented!\n", PGM_GST_TYPE, PGM_SHW_TYPE));
3403	return VERR_INTERNAL_ERROR;
3404	#endif /* PGM_GST_TYPE != PGM_TYPE_32BIT */
3405	}
3406
3407	#undef MY_STAM_COUNTER_INC
3408	#define MY_STAM_COUNTER_INC(a) do { } while (0)
3409
3410
3411	/**
3412	* Syncs the paging hierarchy starting at CR3.
3413	*
3414	* @returns VBox status code, no specials.
3415	* @param pVCpu The VMCPU handle.
3416	* @param cr0 Guest context CR0 register
3417	* @param cr3 Guest context CR3 register
3418	* @param cr4 Guest context CR4 register
3419	* @param fGlobal Including global page directories or not
3420	*/
3421	PGM_BTH_DECL(int, SyncCR3)(PVMCPU pVCpu, uint64_t cr0, uint64_t cr3, uint64_t cr4, bool fGlobal)
3422	{
3423	PVM pVM = pVCpu->CTX_SUFF(pVM);
3424
3425	if (VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3))
3426	fGlobal = true; /* Change this CR3 reload to be a global one. */
3427
3428	LogFlow(("SyncCR3 %d\n", fGlobal));
3429
3430	#if PGM_SHW_TYPE != PGM_TYPE_NESTED && PGM_SHW_TYPE != PGM_TYPE_EPT
3431
3432	pgmLock(pVM);
3433	# ifdef PGMPOOL_WITH_OPTIMIZED_DIRTY_PT
3434	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
3435	if (pPool->cDirtyPages)
3436	pgmPoolResetDirtyPages(pVM);
3437	# endif
3438
3439	/*
3440	* Update page access handlers.
3441	* The virtual are always flushed, while the physical are only on demand.
3442	* WARNING: We are incorrectly not doing global flushing on Virtual Handler updates. We'll
3443	* have to look into that later because it will have a bad influence on the performance.
3444	* @note SvL: There's no need for that. Just invalidate the virtual range(s).
3445	* bird: Yes, but that won't work for aliases.
3446	*/
3447	/** @todo this MUST go away. See #1557. */
3448	STAM_PROFILE_START(&pVCpu->pgm.s.CTX_MID_Z(Stat,SyncCR3Handlers), h);
3449	PGM_GST_NAME(HandlerVirtualUpdate)(pVM, cr4);
3450	STAM_PROFILE_STOP(&pVCpu->pgm.s.CTX_MID_Z(Stat,SyncCR3Handlers), h);
3451	pgmUnlock(pVM);
3452	#endif
3453
3454	#if PGM_SHW_TYPE == PGM_TYPE_NESTED \|\| PGM_SHW_TYPE == PGM_TYPE_EPT
3455	/*
3456	* Nested / EPT - almost no work.
3457	*/
3458	/** @todo check if this is really necessary; the call does it as well... */
3459	HWACCMFlushTLB(pVCpu);
3460	return VINF_SUCCESS;
3461
3462	#elif PGM_SHW_TYPE == PGM_TYPE_AMD64
3463	/*
3464	* AMD64 (Shw & Gst) - No need to check all paging levels; we zero
3465	* out the shadow parts when the guest modifies its tables.
3466	*/
3467	return VINF_SUCCESS;
3468
3469	#else /* PGM_SHW_TYPE != PGM_TYPE_NESTED && PGM_SHW_TYPE != PGM_TYPE_EPT && PGM_SHW_TYPE != PGM_TYPE_AMD64 */
3470
3471	# ifdef PGM_WITHOUT_MAPPINGS
3472	Assert(pVM->pgm.s.fMappingsFixed);
3473	return VINF_SUCCESS;
3474	# else
3475	/* Nothing to do when mappings are fixed. */
3476	if (pVM->pgm.s.fMappingsFixed)
3477	return VINF_SUCCESS;
3478
3479	int rc = PGMMapResolveConflicts(pVM);
3480	Assert(rc == VINF_SUCCESS \|\| rc == VINF_PGM_SYNC_CR3);
3481	if (rc == VINF_PGM_SYNC_CR3)
3482	{
3483	LogFlow(("SyncCR3: detected conflict -> VINF_PGM_SYNC_CR3\n"));
3484	return VINF_PGM_SYNC_CR3;
3485	}
3486	# endif
3487	return VINF_SUCCESS;
3488	#endif /* PGM_SHW_TYPE != PGM_TYPE_NESTED && PGM_SHW_TYPE != PGM_TYPE_EPT && PGM_SHW_TYPE != PGM_TYPE_AMD64 */
3489	}
3490
3491
3492
3493
3494	#ifdef VBOX_STRICT
3495	#ifdef IN_RC
3496	# undef AssertMsgFailed
3497	# define AssertMsgFailed Log
3498	#endif
3499	#ifdef IN_RING3
3500	# include <VBox/dbgf.h>
3501
3502	/**
3503	* Dumps a page table hierarchy use only physical addresses and cr4/lm flags.
3504	*
3505	* @returns VBox status code (VINF_SUCCESS).
3506	* @param cr3 The root of the hierarchy.
3507	* @param crr The cr4, only PAE and PSE is currently used.
3508	* @param fLongMode Set if long mode, false if not long mode.
3509	* @param cMaxDepth Number of levels to dump.
3510	* @param pHlp Pointer to the output functions.
3511	*/
3512	RT_C_DECLS_BEGIN
3513	VMMR3DECL(int) PGMR3DumpHierarchyHC(PVM pVM, uint32_t cr3, uint32_t cr4, bool fLongMode, unsigned cMaxDepth, PCDBGFINFOHLP pHlp);
3514	RT_C_DECLS_END
3515
3516	#endif
3517
3518	/**
3519	* Checks that the shadow page table is in sync with the guest one.
3520	*
3521	* @returns The number of errors.
3522	* @param pVM The virtual machine.
3523	* @param pVCpu The VMCPU handle.
3524	* @param cr3 Guest context CR3 register
3525	* @param cr4 Guest context CR4 register
3526	* @param GCPtr Where to start. Defaults to 0.
3527	* @param cb How much to check. Defaults to everything.
3528	*/
3529	PGM_BTH_DECL(unsigned, AssertCR3)(PVMCPU pVCpu, uint64_t cr3, uint64_t cr4, RTGCPTR GCPtr, RTGCPTR cb)
3530	{
3531	#if PGM_SHW_TYPE == PGM_TYPE_NESTED \|\| PGM_SHW_TYPE == PGM_TYPE_EPT
3532	return 0;
3533	#else
3534	unsigned cErrors = 0;
3535	PVM pVM = pVCpu->CTX_SUFF(pVM);
3536	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
3537
3538	#if PGM_GST_TYPE == PGM_TYPE_PAE
3539	/** @todo currently broken; crashes below somewhere */
3540	AssertFailed();
3541	#endif
3542
3543	#if PGM_GST_TYPE == PGM_TYPE_32BIT \
3544	\|\| PGM_GST_TYPE == PGM_TYPE_PAE \
3545	\|\| PGM_GST_TYPE == PGM_TYPE_AMD64
3546
3547	# if PGM_GST_TYPE == PGM_TYPE_AMD64
3548	bool fBigPagesSupported = true;
3549	# else
3550	bool fBigPagesSupported = !!(CPUMGetGuestCR4(pVCpu) & X86_CR4_PSE);
3551	# endif
3552	PPGMCPU pPGM = &pVCpu->pgm.s;
3553	RTGCPHYS GCPhysGst; /* page address derived from the guest page tables. */
3554	RTHCPHYS HCPhysShw; /* page address derived from the shadow page tables. */
3555	# ifndef IN_RING0
3556	RTHCPHYS HCPhys; /* general usage. */
3557	# endif
3558	int rc;
3559
3560	/*
3561	* Check that the Guest CR3 and all its mappings are correct.
3562	*/
3563	AssertMsgReturn(pPGM->GCPhysCR3 == (cr3 & GST_CR3_PAGE_MASK),
3564	("Invalid GCPhysCR3=%RGp cr3=%RGp\n", pPGM->GCPhysCR3, (RTGCPHYS)cr3),
3565	false);
3566	# if !defined(IN_RING0) && PGM_GST_TYPE != PGM_TYPE_AMD64
3567	# if PGM_GST_TYPE == PGM_TYPE_32BIT
3568	rc = PGMShwGetPage(pVCpu, (RTGCPTR)pPGM->pGst32BitPdRC, NULL, &HCPhysShw);
3569	# else
3570	rc = PGMShwGetPage(pVCpu, (RTGCPTR)pPGM->pGstPaePdptRC, NULL, &HCPhysShw);
3571	# endif
3572	AssertRCReturn(rc, 1);
3573	HCPhys = NIL_RTHCPHYS;
3574	rc = pgmRamGCPhys2HCPhys(&pVM->pgm.s, cr3 & GST_CR3_PAGE_MASK, &HCPhys);
3575	AssertMsgReturn(HCPhys == HCPhysShw, ("HCPhys=%RHp HCPhyswShw=%RHp (cr3)\n", HCPhys, HCPhysShw), false);
3576	# if PGM_GST_TYPE == PGM_TYPE_32BIT && defined(IN_RING3)
3577	pgmGstGet32bitPDPtr(pPGM);
3578	RTGCPHYS GCPhys;
3579	rc = PGMR3DbgR3Ptr2GCPhys(pVM, pPGM->pGst32BitPdR3, &GCPhys);
3580	AssertRCReturn(rc, 1);
3581	AssertMsgReturn((cr3 & GST_CR3_PAGE_MASK) == GCPhys, ("GCPhys=%RGp cr3=%RGp\n", GCPhys, (RTGCPHYS)cr3), false);
3582	# endif
3583	# endif /* !IN_RING0 */
3584
3585	/*
3586	* Get and check the Shadow CR3.
3587	*/
3588	# if PGM_SHW_TYPE == PGM_TYPE_32BIT
3589	unsigned cPDEs = X86_PG_ENTRIES;
3590	unsigned cIncrement = X86_PG_ENTRIES * PAGE_SIZE;
3591	# elif PGM_SHW_TYPE == PGM_TYPE_PAE
3592	# if PGM_GST_TYPE == PGM_TYPE_32BIT
3593	unsigned cPDEs = X86_PG_PAE_ENTRIES * 4; /* treat it as a 2048 entry table. */
3594	# else
3595	unsigned cPDEs = X86_PG_PAE_ENTRIES;
3596	# endif
3597	unsigned cIncrement = X86_PG_PAE_ENTRIES * PAGE_SIZE;
3598	# elif PGM_SHW_TYPE == PGM_TYPE_AMD64
3599	unsigned cPDEs = X86_PG_PAE_ENTRIES;
3600	unsigned cIncrement = X86_PG_PAE_ENTRIES * PAGE_SIZE;
3601	# endif
3602	if (cb != ~(RTGCPTR)0)
3603	cPDEs = RT_MIN(cb >> SHW_PD_SHIFT, 1);
3604
3605	/** @todo call the other two PGMAssert() functions. /
3606
3607	# if PGM_GST_TYPE == PGM_TYPE_AMD64
3608	unsigned iPml4 = (GCPtr >> X86_PML4_SHIFT) & X86_PML4_MASK;
3609
3610	for (; iPml4 < X86_PG_PAE_ENTRIES; iPml4++)
3611	{
3612	PPGMPOOLPAGE pShwPdpt = NULL;
3613	PX86PML4E pPml4eSrc;
3614	PX86PML4E pPml4eDst;
3615	RTGCPHYS GCPhysPdptSrc;
3616
3617	pPml4eSrc = pgmGstGetLongModePML4EPtr(&pVCpu->pgm.s, iPml4);
3618	pPml4eDst = pgmShwGetLongModePML4EPtr(&pVCpu->pgm.s, iPml4);
3619
3620	/* Fetch the pgm pool shadow descriptor if the shadow pml4e is present. */
3621	if (!pPml4eDst->n.u1Present)
3622	{
3623	GCPtr += _2M * UINT64_C(512) * UINT64_C(512);
3624	continue;
3625	}
3626
3627	pShwPdpt = pgmPoolGetPage(pPool, pPml4eDst->u & X86_PML4E_PG_MASK);
3628	GCPhysPdptSrc = pPml4eSrc->u & X86_PML4E_PG_MASK_FULL;
3629
3630	if (pPml4eSrc->n.u1Present != pPml4eDst->n.u1Present)
3631	{
3632	AssertMsgFailed(("Present bit doesn't match! pPml4eDst.u=%#RX64 pPml4eSrc.u=%RX64\n", pPml4eDst->u, pPml4eSrc->u));
3633	GCPtr += _2M * UINT64_C(512) * UINT64_C(512);
3634	cErrors++;
3635	continue;
3636	}
3637
3638	if (GCPhysPdptSrc != pShwPdpt->GCPhys)
3639	{
3640	AssertMsgFailed(("Physical address doesn't match! iPml4 %d pPml4eDst.u=%#RX64 pPml4eSrc.u=%RX64 Phys %RX64 vs %RX64\n", iPml4, pPml4eDst->u, pPml4eSrc->u, pShwPdpt->GCPhys, GCPhysPdptSrc));
3641	GCPtr += _2M * UINT64_C(512) * UINT64_C(512);
3642	cErrors++;
3643	continue;
3644	}
3645
3646	if ( pPml4eDst->n.u1User != pPml4eSrc->n.u1User
3647	\|\| pPml4eDst->n.u1Write != pPml4eSrc->n.u1Write
3648	\|\| pPml4eDst->n.u1NoExecute != pPml4eSrc->n.u1NoExecute)
3649	{
3650	AssertMsgFailed(("User/Write/NoExec bits don't match! pPml4eDst.u=%#RX64 pPml4eSrc.u=%RX64\n", pPml4eDst->u, pPml4eSrc->u));
3651	GCPtr += _2M * UINT64_C(512) * UINT64_C(512);
3652	cErrors++;
3653	continue;
3654	}
3655	# else /* PGM_GST_TYPE != PGM_TYPE_AMD64 */
3656	{
3657	# endif /* PGM_GST_TYPE != PGM_TYPE_AMD64 */
3658
3659	# if PGM_GST_TYPE == PGM_TYPE_AMD64 \|\| PGM_GST_TYPE == PGM_TYPE_PAE
3660	/*
3661	* Check the PDPTEs too.
3662	*/
3663	unsigned iPdpt = (GCPtr >> SHW_PDPT_SHIFT) & SHW_PDPT_MASK;
3664
3665	for (;iPdpt <= SHW_PDPT_MASK; iPdpt++)
3666	{
3667	unsigned iPDSrc = 0; /* initialized to shut up gcc */
3668	PPGMPOOLPAGE pShwPde = NULL;
3669	PX86PDPE pPdpeDst;
3670	RTGCPHYS GCPhysPdeSrc;
3671	# if PGM_GST_TYPE == PGM_TYPE_PAE
3672	X86PDPE PdpeSrc;
3673	PGSTPD pPDSrc = pgmGstGetPaePDPtr(&pVCpu->pgm.s, GCPtr, &iPDSrc, &PdpeSrc);
3674	PX86PDPT pPdptDst = pgmShwGetPaePDPTPtr(&pVCpu->pgm.s);
3675	# else
3676	PX86PML4E pPml4eSrc;
3677	X86PDPE PdpeSrc;
3678	PX86PDPT pPdptDst;
3679	PX86PDPAE pPDDst;
3680	PGSTPD pPDSrc = pgmGstGetLongModePDPtr(&pVCpu->pgm.s, GCPtr, &pPml4eSrc, &PdpeSrc, &iPDSrc);
3681
3682	rc = pgmShwGetLongModePDPtr(pVCpu, GCPtr, NULL, &pPdptDst, &pPDDst);
3683	if (rc != VINF_SUCCESS)
3684	{
3685	AssertMsg(rc == VERR_PAGE_DIRECTORY_PTR_NOT_PRESENT, ("Unexpected rc=%Rrc\n", rc));
3686	GCPtr += 512 * _2M;
3687	continue; /* next PDPTE */
3688	}
3689	Assert(pPDDst);
3690	# endif
3691	Assert(iPDSrc == 0);
3692
3693	pPdpeDst = &pPdptDst->a[iPdpt];
3694
3695	if (!pPdpeDst->n.u1Present)
3696	{
3697	GCPtr += 512 * _2M;
3698	continue; /* next PDPTE */
3699	}
3700
3701	pShwPde = pgmPoolGetPage(pPool, pPdpeDst->u & X86_PDPE_PG_MASK);
3702	GCPhysPdeSrc = PdpeSrc.u & X86_PDPE_PG_MASK;
3703
3704	if (pPdpeDst->n.u1Present != PdpeSrc.n.u1Present)
3705	{
3706	AssertMsgFailed(("Present bit doesn't match! pPdpeDst.u=%#RX64 pPdpeSrc.u=%RX64\n", pPdpeDst->u, PdpeSrc.u));
3707	GCPtr += 512 * _2M;
3708	cErrors++;
3709	continue;
3710	}
3711
3712	if (GCPhysPdeSrc != pShwPde->GCPhys)
3713	{
3714	# if PGM_GST_TYPE == PGM_TYPE_AMD64
3715	AssertMsgFailed(("Physical address doesn't match! iPml4 %d iPdpt %d pPdpeDst.u=%#RX64 pPdpeSrc.u=%RX64 Phys %RX64 vs %RX64\n", iPml4, iPdpt, pPdpeDst->u, PdpeSrc.u, pShwPde->GCPhys, GCPhysPdeSrc));
3716	# else
3717	AssertMsgFailed(("Physical address doesn't match! iPdpt %d pPdpeDst.u=%#RX64 pPdpeSrc.u=%RX64 Phys %RX64 vs %RX64\n", iPdpt, pPdpeDst->u, PdpeSrc.u, pShwPde->GCPhys, GCPhysPdeSrc));
3718	# endif
3719	GCPtr += 512 * _2M;
3720	cErrors++;
3721	continue;
3722	}
3723
3724	# if PGM_GST_TYPE == PGM_TYPE_AMD64
3725	if ( pPdpeDst->lm.u1User != PdpeSrc.lm.u1User
3726	\|\| pPdpeDst->lm.u1Write != PdpeSrc.lm.u1Write
3727	\|\| pPdpeDst->lm.u1NoExecute != PdpeSrc.lm.u1NoExecute)
3728	{
3729	AssertMsgFailed(("User/Write/NoExec bits don't match! pPdpeDst.u=%#RX64 pPdpeSrc.u=%RX64\n", pPdpeDst->u, PdpeSrc.u));
3730	GCPtr += 512 * _2M;
3731	cErrors++;
3732	continue;
3733	}
3734	# endif
3735
3736	# else /* PGM_GST_TYPE != PGM_TYPE_AMD64 && PGM_GST_TYPE != PGM_TYPE_PAE */
3737	{
3738	# endif /* PGM_GST_TYPE != PGM_TYPE_AMD64 && PGM_GST_TYPE != PGM_TYPE_PAE */
3739	# if PGM_GST_TYPE == PGM_TYPE_32BIT
3740	GSTPD const *pPDSrc = pgmGstGet32bitPDPtr(&pVCpu->pgm.s);
3741	# if PGM_SHW_TYPE == PGM_TYPE_32BIT
3742	PCX86PD pPDDst = pgmShwGet32BitPDPtr(&pVCpu->pgm.s);
3743	# endif
3744	# endif /* PGM_GST_TYPE == PGM_TYPE_32BIT */
3745	/*
3746	* Iterate the shadow page directory.
3747	*/
3748	GCPtr = (GCPtr >> SHW_PD_SHIFT) << SHW_PD_SHIFT;
3749	unsigned iPDDst = (GCPtr >> SHW_PD_SHIFT) & SHW_PD_MASK;
3750
3751	for (;
3752	iPDDst < cPDEs;
3753	iPDDst++, GCPtr += cIncrement)
3754	{
3755	# if PGM_SHW_TYPE == PGM_TYPE_PAE
3756	const SHWPDE PdeDst = *pgmShwGetPaePDEPtr(pPGM, GCPtr);
3757	# else
3758	const SHWPDE PdeDst = pPDDst->a[iPDDst];
3759	# endif
3760	if (PdeDst.u & PGM_PDFLAGS_MAPPING)
3761	{
3762	Assert(pgmMapAreMappingsEnabled(&pVM->pgm.s));
3763	if ((PdeDst.u & X86_PDE_AVL_MASK) != PGM_PDFLAGS_MAPPING)
3764	{
3765	AssertMsgFailed(("Mapping shall only have PGM_PDFLAGS_MAPPING set! PdeDst.u=%#RX64\n", (uint64_t)PdeDst.u));
3766	cErrors++;
3767	continue;
3768	}
3769	}
3770	else if ( (PdeDst.u & X86_PDE_P)
3771	\|\| ((PdeDst.u & (X86_PDE_P \| PGM_PDFLAGS_TRACK_DIRTY)) == (X86_PDE_P \| PGM_PDFLAGS_TRACK_DIRTY))
3772	)
3773	{
3774	HCPhysShw = PdeDst.u & SHW_PDE_PG_MASK;
3775	PPGMPOOLPAGE pPoolPage = pgmPoolGetPage(pPool, HCPhysShw);
3776	if (!pPoolPage)
3777	{
3778	AssertMsgFailed(("Invalid page table address %RHp at %RGv! PdeDst=%#RX64\n",
3779	HCPhysShw, GCPtr, (uint64_t)PdeDst.u));
3780	cErrors++;
3781	continue;
3782	}
3783	const SHWPT pPTDst = (const SHWPT )PGMPOOL_PAGE_2_PTR(pVM, pPoolPage);
3784
3785	if (PdeDst.u & (X86_PDE4M_PWT \| X86_PDE4M_PCD))
3786	{
3787	AssertMsgFailed(("PDE flags PWT and/or PCD is set at %RGv! These flags are not virtualized! PdeDst=%#RX64\n",
3788	GCPtr, (uint64_t)PdeDst.u));
3789	cErrors++;
3790	}
3791
3792	if (PdeDst.u & (X86_PDE4M_G \| X86_PDE4M_D))
3793	{
3794	AssertMsgFailed(("4K PDE reserved flags at %RGv! PdeDst=%#RX64\n",
3795	GCPtr, (uint64_t)PdeDst.u));
3796	cErrors++;
3797	}
3798
3799	const GSTPDE PdeSrc = pPDSrc->a[(iPDDst >> (GST_PD_SHIFT - SHW_PD_SHIFT)) & GST_PD_MASK];
3800	if (!PdeSrc.n.u1Present)
3801	{
3802	AssertMsgFailed(("Guest PDE at %RGv is not present! PdeDst=%#RX64 PdeSrc=%#RX64\n",
3803	GCPtr, (uint64_t)PdeDst.u, (uint64_t)PdeSrc.u));
3804	cErrors++;
3805	continue;
3806	}
3807
3808	if ( !PdeSrc.b.u1Size
3809	\|\| !fBigPagesSupported)
3810	{
3811	GCPhysGst = PdeSrc.u & GST_PDE_PG_MASK;
3812	# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
3813	GCPhysGst \|= (iPDDst & 1) * (PAGE_SIZE / 2);
3814	# endif
3815	}
3816	else
3817	{
3818	# if PGM_GST_TYPE == PGM_TYPE_32BIT
3819	if (PdeSrc.u & X86_PDE4M_PG_HIGH_MASK)
3820	{
3821	AssertMsgFailed(("Guest PDE at %RGv is using PSE36 or similar! PdeSrc=%#RX64\n",
3822	GCPtr, (uint64_t)PdeSrc.u));
3823	cErrors++;
3824	continue;
3825	}
3826	# endif
3827	GCPhysGst = GST_GET_PDE_BIG_PG_GCPHYS(PdeSrc);
3828	# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
3829	GCPhysGst \|= GCPtr & RT_BIT(X86_PAGE_2M_SHIFT);
3830	# endif
3831	}
3832
3833	if ( pPoolPage->enmKind
3834	!= (!PdeSrc.b.u1Size \|\| !fBigPagesSupported ? BTH_PGMPOOLKIND_PT_FOR_PT : BTH_PGMPOOLKIND_PT_FOR_BIG))
3835	{
3836	AssertMsgFailed(("Invalid shadow page table kind %d at %RGv! PdeSrc=%#RX64\n",
3837	pPoolPage->enmKind, GCPtr, (uint64_t)PdeSrc.u));
3838	cErrors++;
3839	}
3840
3841	PPGMPAGE pPhysPage = pgmPhysGetPage(&pVM->pgm.s, GCPhysGst);
3842	if (!pPhysPage)
3843	{
3844	AssertMsgFailed(("Cannot find guest physical address %RGp in the PDE at %RGv! PdeSrc=%#RX64\n",
3845	GCPhysGst, GCPtr, (uint64_t)PdeSrc.u));
3846	cErrors++;
3847	continue;
3848	}
3849
3850	if (GCPhysGst != pPoolPage->GCPhys)
3851	{
3852	AssertMsgFailed(("GCPhysGst=%RGp != pPage->GCPhys=%RGp at %RGv\n",
3853	GCPhysGst, pPoolPage->GCPhys, GCPtr));
3854	cErrors++;
3855	continue;
3856	}
3857
3858	if ( !PdeSrc.b.u1Size
3859	\|\| !fBigPagesSupported)
3860	{
3861	/*
3862	* Page Table.
3863	*/
3864	const GSTPT *pPTSrc;
3865	rc = PGM_GCPHYS_2_PTR(pVM, GCPhysGst & ~(RTGCPHYS)(PAGE_SIZE - 1), &pPTSrc);
3866	if (RT_FAILURE(rc))
3867	{
3868	AssertMsgFailed(("Cannot map/convert guest physical address %RGp in the PDE at %RGv! PdeSrc=%#RX64\n",
3869	GCPhysGst, GCPtr, (uint64_t)PdeSrc.u));
3870	cErrors++;
3871	continue;
3872	}
3873	if ( (PdeSrc.u & (X86_PDE_P \| X86_PDE_US \| X86_PDE_RW/* \| X86_PDE_A*/))
3874	!= (PdeDst.u & (X86_PDE_P \| X86_PDE_US \| X86_PDE_RW/* \| X86_PDE_A*/)))
3875	{
3876	/// @todo We get here a lot on out-of-sync CR3 entries. The access handler should zap them to avoid false alarms here!
3877	// (This problem will go away when/if we shadow multiple CR3s.)
3878	AssertMsgFailed(("4K PDE flags mismatch at %RGv! PdeSrc=%#RX64 PdeDst=%#RX64\n",
3879	GCPtr, (uint64_t)PdeSrc.u, (uint64_t)PdeDst.u));
3880	cErrors++;
3881	continue;
3882	}
3883	if (PdeDst.u & PGM_PDFLAGS_TRACK_DIRTY)
3884	{
3885	AssertMsgFailed(("4K PDEs cannot have PGM_PDFLAGS_TRACK_DIRTY set! GCPtr=%RGv PdeDst=%#RX64\n",
3886	GCPtr, (uint64_t)PdeDst.u));
3887	cErrors++;
3888	continue;
3889	}
3890
3891	/* iterate the page table. */
3892	# if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
3893	/* Select the right PDE as we're emulating a 4kb page table with 2 shadow page tables. */
3894	const unsigned offPTSrc = ((GCPtr >> SHW_PD_SHIFT) & 1) * 512;
3895	# else
3896	const unsigned offPTSrc = 0;
3897	# endif
3898	for (unsigned iPT = 0, off = 0;
3899	iPT < RT_ELEMENTS(pPTDst->a);
3900	iPT++, off += PAGE_SIZE)
3901	{
3902	const SHWPTE PteDst = pPTDst->a[iPT];
3903
3904	/* skip not-present entries. */
3905	if (!(PteDst.u & (X86_PTE_P \| PGM_PTFLAGS_TRACK_DIRTY))) /** @todo deal with ALL handlers and CSAM !P pages! */
3906	continue;
3907	Assert(PteDst.n.u1Present);
3908
3909	const GSTPTE PteSrc = pPTSrc->a[iPT + offPTSrc];
3910	if (!PteSrc.n.u1Present)
3911	{
3912	# ifdef IN_RING3
3913	PGMAssertHandlerAndFlagsInSync(pVM);
3914	PGMR3DumpHierarchyGC(pVM, cr3, cr4, (PdeSrc.u & GST_PDE_PG_MASK));
3915	# endif
3916	AssertMsgFailed(("Out of sync (!P) PTE at %RGv! PteSrc=%#RX64 PteDst=%#RX64 pPTSrc=%RGv iPTSrc=%x PdeSrc=%x physpte=%RGp\n",
3917	GCPtr + off, (uint64_t)PteSrc.u, (uint64_t)PteDst.u, pPTSrc, iPT + offPTSrc, PdeSrc.au32[0],
3918	(PdeSrc.u & GST_PDE_PG_MASK) + (iPT + offPTSrc)*sizeof(PteSrc)));
3919	cErrors++;
3920	continue;
3921	}
3922
3923	uint64_t fIgnoreFlags = GST_PTE_PG_MASK \| X86_PTE_AVL_MASK \| X86_PTE_G \| X86_PTE_D \| X86_PTE_PWT \| X86_PTE_PCD \| X86_PTE_PAT;
3924	# if 1 /** @todo sync accessed bit properly... */
3925	fIgnoreFlags \|= X86_PTE_A;
3926	# endif
3927
3928	/* match the physical addresses */
3929	HCPhysShw = PteDst.u & SHW_PTE_PG_MASK;
3930	GCPhysGst = PteSrc.u & GST_PTE_PG_MASK;
3931
3932	# ifdef IN_RING3
3933	rc = PGMPhysGCPhys2HCPhys(pVM, GCPhysGst, &HCPhys);
3934	if (RT_FAILURE(rc))
3935	{
3936	if (HCPhysShw != MMR3PageDummyHCPhys(pVM)) /** @todo this is wrong. */
3937	{
3938	AssertMsgFailed(("Cannot find guest physical address %RGp at %RGv! PteSrc=%#RX64 PteDst=%#RX64\n",
3939	GCPhysGst, GCPtr + off, (uint64_t)PteSrc.u, (uint64_t)PteDst.u));
3940	cErrors++;
3941	continue;
3942	}
3943	}
3944	else if (HCPhysShw != (HCPhys & SHW_PTE_PG_MASK))
3945	{
3946	AssertMsgFailed(("Out of sync (phys) at %RGv! HCPhysShw=%RHp HCPhys=%RHp GCPhysGst=%RGp PteSrc=%#RX64 PteDst=%#RX64\n",
3947	GCPtr + off, HCPhysShw, HCPhys, GCPhysGst, (uint64_t)PteSrc.u, (uint64_t)PteDst.u));
3948	cErrors++;
3949	continue;
3950	}
3951	# endif
3952
3953	pPhysPage = pgmPhysGetPage(&pVM->pgm.s, GCPhysGst);
3954	if (!pPhysPage)
3955	{
3956	# ifdef IN_RING3 /** @todo make MMR3PageDummyHCPhys an 'All' function! */
3957	if (HCPhysShw != MMR3PageDummyHCPhys(pVM)) /** @todo this is wrong. */
3958	{
3959	AssertMsgFailed(("Cannot find guest physical address %RGp at %RGv! PteSrc=%#RX64 PteDst=%#RX64\n",
3960	GCPhysGst, GCPtr + off, (uint64_t)PteSrc.u, (uint64_t)PteDst.u));
3961	cErrors++;
3962	continue;
3963	}
3964	# endif
3965	if (PteDst.n.u1Write)
3966	{
3967	AssertMsgFailed(("Invalid guest page at %RGv is writable! GCPhysGst=%RGp PteSrc=%#RX64 PteDst=%#RX64\n",
3968	GCPtr + off, GCPhysGst, (uint64_t)PteSrc.u, (uint64_t)PteDst.u));
3969	cErrors++;
3970	}
3971	fIgnoreFlags \|= X86_PTE_RW;
3972	}
3973	else if (HCPhysShw != PGM_PAGE_GET_HCPHYS(pPhysPage))
3974	{
3975	AssertMsgFailed(("Out of sync (phys) at %RGv! HCPhysShw=%RHp pPhysPage:%R[pgmpage] GCPhysGst=%RGp PteSrc=%#RX64 PteDst=%#RX64\n",
3976	GCPtr + off, HCPhysShw, pPhysPage, GCPhysGst, (uint64_t)PteSrc.u, (uint64_t)PteDst.u));
3977	cErrors++;
3978	continue;
3979	}
3980
3981	/* flags */
3982	if (PGM_PAGE_HAS_ACTIVE_HANDLERS(pPhysPage))
3983	{
3984	if (!PGM_PAGE_HAS_ACTIVE_ALL_HANDLERS(pPhysPage))
3985	{
3986	if (PteDst.n.u1Write)
3987	{
3988	AssertMsgFailed(("WRITE access flagged at %RGv but the page is writable! pPhysPage=%R[pgmpage] PteSrc=%#RX64 PteDst=%#RX64\n",
3989	GCPtr + off, pPhysPage, (uint64_t)PteSrc.u, (uint64_t)PteDst.u));
3990	cErrors++;
3991	continue;
3992	}
3993	fIgnoreFlags \|= X86_PTE_RW;
3994	}
3995	else
3996	{
3997	if (PteDst.n.u1Present)
3998	{
3999	AssertMsgFailed(("ALL access flagged at %RGv but the page is present! pPhysPage=%R[pgmpage] PteSrc=%#RX64 PteDst=%#RX64\n",
4000	GCPtr + off, pPhysPage, (uint64_t)PteSrc.u, (uint64_t)PteDst.u));
4001	cErrors++;
4002	continue;
4003	}
4004	fIgnoreFlags \|= X86_PTE_P;
4005	}
4006	}
4007	else
4008	{
4009	if (!PteSrc.n.u1Dirty && PteSrc.n.u1Write)
4010	{
4011	if (PteDst.n.u1Write)
4012	{
4013	AssertMsgFailed(("!DIRTY page at %RGv is writable! PteSrc=%#RX64 PteDst=%#RX64\n",
4014	GCPtr + off, (uint64_t)PteSrc.u, (uint64_t)PteDst.u));
4015	cErrors++;
4016	continue;
4017	}
4018	if (!(PteDst.u & PGM_PTFLAGS_TRACK_DIRTY))
4019	{
4020	AssertMsgFailed(("!DIRTY page at %RGv is not marked TRACK_DIRTY! PteSrc=%#RX64 PteDst=%#RX64\n",
4021	GCPtr + off, (uint64_t)PteSrc.u, (uint64_t)PteDst.u));
4022	cErrors++;
4023	continue;
4024	}
4025	if (PteDst.n.u1Dirty)
4026	{
4027	AssertMsgFailed(("!DIRTY page at %RGv is marked DIRTY! PteSrc=%#RX64 PteDst=%#RX64\n",
4028	GCPtr + off, (uint64_t)PteSrc.u, (uint64_t)PteDst.u));
4029	cErrors++;
4030	}
4031	# if 0 /** @todo sync access bit properly... */
4032	if (PteDst.n.u1Accessed != PteSrc.n.u1Accessed)
4033	{
4034	AssertMsgFailed(("!DIRTY page at %RGv is has mismatching accessed bit! PteSrc=%#RX64 PteDst=%#RX64\n",
4035	GCPtr + off, (uint64_t)PteSrc.u, (uint64_t)PteDst.u));
4036	cErrors++;
4037	}
4038	fIgnoreFlags \|= X86_PTE_RW;
4039	# else
4040	fIgnoreFlags \|= X86_PTE_RW \| X86_PTE_A;
4041	# endif
4042	}
4043	else if (PteDst.u & PGM_PTFLAGS_TRACK_DIRTY)
4044	{
4045	/* access bit emulation (not implemented). */
4046	if (PteSrc.n.u1Accessed \|\| PteDst.n.u1Present)
4047	{
4048	AssertMsgFailed(("PGM_PTFLAGS_TRACK_DIRTY set at %RGv but no accessed bit emulation! PteSrc=%#RX64 PteDst=%#RX64\n",
4049	GCPtr + off, (uint64_t)PteSrc.u, (uint64_t)PteDst.u));
4050	cErrors++;
4051	continue;
4052	}
4053	if (!PteDst.n.u1Accessed)
4054	{
4055	AssertMsgFailed(("!ACCESSED page at %RGv is has the accessed bit set! PteSrc=%#RX64 PteDst=%#RX64\n",
4056	GCPtr + off, (uint64_t)PteSrc.u, (uint64_t)PteDst.u));
4057	cErrors++;
4058	}
4059	fIgnoreFlags \|= X86_PTE_P;
4060	}
4061	# ifdef DEBUG_sandervl
4062	fIgnoreFlags \|= X86_PTE_D \| X86_PTE_A;
4063	# endif
4064	}
4065
4066	if ( (PteSrc.u & ~fIgnoreFlags) != (PteDst.u & ~fIgnoreFlags)
4067	&& (PteSrc.u & ~(fIgnoreFlags \| X86_PTE_RW)) != (PteDst.u & ~fIgnoreFlags)
4068	)
4069	{
4070	AssertMsgFailed(("Flags mismatch at %RGv! %#RX64 != %#RX64 fIgnoreFlags=%#RX64 PteSrc=%#RX64 PteDst=%#RX64\n",
4071	GCPtr + off, (uint64_t)PteSrc.u & ~fIgnoreFlags, (uint64_t)PteDst.u & ~fIgnoreFlags,
4072	fIgnoreFlags, (uint64_t)PteSrc.u, (uint64_t)PteDst.u));
4073	cErrors++;
4074	continue;
4075	}
4076	} /* foreach PTE */
4077	}
4078	else
4079	{
4080	/*
4081	* Big Page.
4082	*/
4083	uint64_t fIgnoreFlags = X86_PDE_AVL_MASK \| GST_PDE_PG_MASK \| X86_PDE4M_G \| X86_PDE4M_D \| X86_PDE4M_PS \| X86_PDE4M_PWT \| X86_PDE4M_PCD;
4084	if (!PdeSrc.b.u1Dirty && PdeSrc.b.u1Write)
4085	{
4086	if (PdeDst.n.u1Write)
4087	{
4088	AssertMsgFailed(("!DIRTY page at %RGv is writable! PdeSrc=%#RX64 PdeDst=%#RX64\n",
4089	GCPtr, (uint64_t)PdeSrc.u, (uint64_t)PdeDst.u));
4090	cErrors++;
4091	continue;
4092	}
4093	if (!(PdeDst.u & PGM_PDFLAGS_TRACK_DIRTY))
4094	{
4095	AssertMsgFailed(("!DIRTY page at %RGv is not marked TRACK_DIRTY! PteSrc=%#RX64 PteDst=%#RX64\n",
4096	GCPtr, (uint64_t)PdeSrc.u, (uint64_t)PdeDst.u));
4097	cErrors++;
4098	continue;
4099	}
4100	# if 0 /** @todo sync access bit properly... */
4101	if (PdeDst.n.u1Accessed != PdeSrc.b.u1Accessed)
4102	{
4103	AssertMsgFailed(("!DIRTY page at %RGv is has mismatching accessed bit! PteSrc=%#RX64 PteDst=%#RX64\n",
4104	GCPtr, (uint64_t)PdeSrc.u, (uint64_t)PdeDst.u));
4105	cErrors++;
4106	}
4107	fIgnoreFlags \|= X86_PTE_RW;
4108	# else
4109	fIgnoreFlags \|= X86_PTE_RW \| X86_PTE_A;
4110	# endif
4111	}
4112	else if (PdeDst.u & PGM_PDFLAGS_TRACK_DIRTY)
4113	{
4114	/* access bit emulation (not implemented). */
4115	if (PdeSrc.b.u1Accessed \|\| PdeDst.n.u1Present)
4116	{
4117	AssertMsgFailed(("PGM_PDFLAGS_TRACK_DIRTY set at %RGv but no accessed bit emulation! PdeSrc=%#RX64 PdeDst=%#RX64\n",
4118	GCPtr, (uint64_t)PdeSrc.u, (uint64_t)PdeDst.u));
4119	cErrors++;
4120	continue;
4121	}
4122	if (!PdeDst.n.u1Accessed)
4123	{
4124	AssertMsgFailed(("!ACCESSED page at %RGv is has the accessed bit set! PdeSrc=%#RX64 PdeDst=%#RX64\n",
4125	GCPtr, (uint64_t)PdeSrc.u, (uint64_t)PdeDst.u));
4126	cErrors++;
4127	}
4128	fIgnoreFlags \|= X86_PTE_P;
4129	}
4130
4131	if ((PdeSrc.u & ~fIgnoreFlags) != (PdeDst.u & ~fIgnoreFlags))
4132	{
4133	AssertMsgFailed(("Flags mismatch (B) at %RGv! %#RX64 != %#RX64 fIgnoreFlags=%#RX64 PdeSrc=%#RX64 PdeDst=%#RX64\n",
4134	GCPtr, (uint64_t)PdeSrc.u & ~fIgnoreFlags, (uint64_t)PdeDst.u & ~fIgnoreFlags,
4135	fIgnoreFlags, (uint64_t)PdeSrc.u, (uint64_t)PdeDst.u));
4136	cErrors++;
4137	}
4138
4139	/* iterate the page table. */
4140	for (unsigned iPT = 0, off = 0;
4141	iPT < RT_ELEMENTS(pPTDst->a);
4142	iPT++, off += PAGE_SIZE, GCPhysGst += PAGE_SIZE)
4143	{
4144	const SHWPTE PteDst = pPTDst->a[iPT];
4145
4146	if (PteDst.u & PGM_PTFLAGS_TRACK_DIRTY)
4147	{
4148	AssertMsgFailed(("The PTE at %RGv emulating a 2/4M page is marked TRACK_DIRTY! PdeSrc=%#RX64 PteDst=%#RX64\n",
4149	GCPtr + off, (uint64_t)PdeSrc.u, (uint64_t)PteDst.u));
4150	cErrors++;
4151	}
4152
4153	/* skip not-present entries. */
4154	if (!PteDst.n.u1Present) /** @todo deal with ALL handlers and CSAM !P pages! */
4155	continue;
4156
4157	fIgnoreFlags = X86_PTE_PAE_PG_MASK \| X86_PTE_AVL_MASK \| X86_PTE_PWT \| X86_PTE_PCD \| X86_PTE_PAT \| X86_PTE_D \| X86_PTE_A \| X86_PTE_G \| X86_PTE_PAE_NX;
4158
4159	/* match the physical addresses */
4160	HCPhysShw = PteDst.u & X86_PTE_PAE_PG_MASK;
4161
4162	# ifdef IN_RING3
4163	rc = PGMPhysGCPhys2HCPhys(pVM, GCPhysGst, &HCPhys);
4164	if (RT_FAILURE(rc))
4165	{
4166	if (HCPhysShw != MMR3PageDummyHCPhys(pVM)) /** @todo this is wrong. */
4167	{
4168	AssertMsgFailed(("Cannot find guest physical address %RGp at %RGv! PdeSrc=%#RX64 PteDst=%#RX64\n",
4169	GCPhysGst, GCPtr + off, (uint64_t)PdeSrc.u, (uint64_t)PteDst.u));
4170	cErrors++;
4171	}
4172	}
4173	else if (HCPhysShw != (HCPhys & X86_PTE_PAE_PG_MASK))
4174	{
4175	AssertMsgFailed(("Out of sync (phys) at %RGv! HCPhysShw=%RHp HCPhys=%RHp GCPhysGst=%RGp PdeSrc=%#RX64 PteDst=%#RX64\n",
4176	GCPtr + off, HCPhysShw, HCPhys, GCPhysGst, (uint64_t)PdeSrc.u, (uint64_t)PteDst.u));
4177	cErrors++;
4178	continue;
4179	}
4180	# endif
4181	pPhysPage = pgmPhysGetPage(&pVM->pgm.s, GCPhysGst);
4182	if (!pPhysPage)
4183	{
4184	# ifdef IN_RING3 /** @todo make MMR3PageDummyHCPhys an 'All' function! */
4185	if (HCPhysShw != MMR3PageDummyHCPhys(pVM)) /** @todo this is wrong. */
4186	{
4187	AssertMsgFailed(("Cannot find guest physical address %RGp at %RGv! PdeSrc=%#RX64 PteDst=%#RX64\n",
4188	GCPhysGst, GCPtr + off, (uint64_t)PdeSrc.u, (uint64_t)PteDst.u));
4189	cErrors++;
4190	continue;
4191	}
4192	# endif
4193	if (PteDst.n.u1Write)
4194	{
4195	AssertMsgFailed(("Invalid guest page at %RGv is writable! GCPhysGst=%RGp PdeSrc=%#RX64 PteDst=%#RX64\n",
4196	GCPtr + off, GCPhysGst, (uint64_t)PdeSrc.u, (uint64_t)PteDst.u));
4197	cErrors++;
4198	}
4199	fIgnoreFlags \|= X86_PTE_RW;
4200	}
4201	else if (HCPhysShw != PGM_PAGE_GET_HCPHYS(pPhysPage))
4202	{
4203	AssertMsgFailed(("Out of sync (phys) at %RGv! HCPhysShw=%RHp pPhysPage=%R[pgmpage] GCPhysGst=%RGp PdeSrc=%#RX64 PteDst=%#RX64\n",
4204	GCPtr + off, HCPhysShw, pPhysPage, GCPhysGst, (uint64_t)PdeSrc.u, (uint64_t)PteDst.u));
4205	cErrors++;
4206	continue;
4207	}
4208
4209	/* flags */
4210	if (PGM_PAGE_HAS_ACTIVE_HANDLERS(pPhysPage))
4211	{
4212	if (!PGM_PAGE_HAS_ACTIVE_ALL_HANDLERS(pPhysPage))
4213	{
4214	if (PGM_PAGE_GET_HNDL_PHYS_STATE(pPhysPage) != PGM_PAGE_HNDL_PHYS_STATE_DISABLED)
4215	{
4216	if (PteDst.n.u1Write)
4217	{
4218	AssertMsgFailed(("WRITE access flagged at %RGv but the page is writable! pPhysPage=%R[pgmpage] PdeSrc=%#RX64 PteDst=%#RX64\n",
4219	GCPtr + off, pPhysPage, (uint64_t)PdeSrc.u, (uint64_t)PteDst.u));
4220	cErrors++;
4221	continue;
4222	}
4223	fIgnoreFlags \|= X86_PTE_RW;
4224	}
4225	}
4226	else
4227	{
4228	if (PteDst.n.u1Present)
4229	{
4230	AssertMsgFailed(("ALL access flagged at %RGv but the page is present! pPhysPage=%R[pgmpage] PdeSrc=%#RX64 PteDst=%#RX64\n",
4231	GCPtr + off, pPhysPage, (uint64_t)PdeSrc.u, (uint64_t)PteDst.u));
4232	cErrors++;
4233	continue;
4234	}
4235	fIgnoreFlags \|= X86_PTE_P;
4236	}
4237	}
4238
4239	if ( (PdeSrc.u & ~fIgnoreFlags) != (PteDst.u & ~fIgnoreFlags)
4240	&& (PdeSrc.u & ~(fIgnoreFlags \| X86_PTE_RW)) != (PteDst.u & ~fIgnoreFlags) /* lazy phys handler dereg. */
4241	)
4242	{
4243	AssertMsgFailed(("Flags mismatch (BT) at %RGv! %#RX64 != %#RX64 fIgnoreFlags=%#RX64 PdeSrc=%#RX64 PteDst=%#RX64\n",
4244	GCPtr + off, (uint64_t)PdeSrc.u & ~fIgnoreFlags, (uint64_t)PteDst.u & ~fIgnoreFlags,
4245	fIgnoreFlags, (uint64_t)PdeSrc.u, (uint64_t)PteDst.u));
4246	cErrors++;
4247	continue;
4248	}
4249	} /* for each PTE */
4250	}
4251	}
4252	/* not present */
4253
4254	} /* for each PDE */
4255
4256	} /* for each PDPTE */
4257
4258	} /* for each PML4E */
4259
4260	# ifdef DEBUG
4261	if (cErrors)
4262	LogFlow(("AssertCR3: cErrors=%d\n", cErrors));
4263	# endif
4264
4265	#endif /* GST == 32BIT, PAE or AMD64 */
4266	return cErrors;
4267
4268	#endif /* PGM_SHW_TYPE != PGM_TYPE_NESTED && PGM_SHW_TYPE != PGM_TYPE_EPT */
4269	}
4270	#endif /* VBOX_STRICT */
4271
4272
4273	/**
4274	* Sets up the CR3 for shadow paging
4275	*
4276	* @returns Strict VBox status code.
4277	* @retval VINF_SUCCESS.
4278	*
4279	* @param pVCpu The VMCPU handle.
4280	* @param GCPhysCR3 The physical address in the CR3 register.
4281	*/
4282	PGM_BTH_DECL(int, MapCR3)(PVMCPU pVCpu, RTGCPHYS GCPhysCR3)
4283	{
4284	PVM pVM = pVCpu->CTX_SUFF(pVM);
4285
4286	/* Update guest paging info. */
4287	#if PGM_GST_TYPE == PGM_TYPE_32BIT \
4288	\|\| PGM_GST_TYPE == PGM_TYPE_PAE \
4289	\|\| PGM_GST_TYPE == PGM_TYPE_AMD64
4290
4291	LogFlow(("MapCR3: %RGp\n", GCPhysCR3));
4292
4293	/*
4294	* Map the page CR3 points at.
4295	*/
4296	RTHCPTR HCPtrGuestCR3;
4297	RTHCPHYS HCPhysGuestCR3;
4298	pgmLock(pVM);
4299	PPGMPAGE pPage = pgmPhysGetPage(&pVM->pgm.s, GCPhysCR3);
4300	AssertReturn(pPage, VERR_INTERNAL_ERROR_2);
4301	HCPhysGuestCR3 = PGM_PAGE_GET_HCPHYS(pPage);
4302	/** @todo this needs some reworking wrt. locking. */
4303	# if defined(IN_RC) \|\| defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
4304	HCPtrGuestCR3 = NIL_RTHCPTR;
4305	int rc = VINF_SUCCESS;
4306	# else
4307	int rc = pgmPhysGCPhys2CCPtrInternal(pVM, pPage, GCPhysCR3 & GST_CR3_PAGE_MASK, (void )&HCPtrGuestCR3); / @todo r=bird: This GCPhysCR3 masking isn't necessary. */
4308	# endif
4309	pgmUnlock(pVM);
4310	if (RT_SUCCESS(rc))
4311	{
4312	rc = PGMMap(pVM, (RTGCPTR)pVM->pgm.s.GCPtrCR3Mapping, HCPhysGuestCR3, PAGE_SIZE, 0);
4313	if (RT_SUCCESS(rc))
4314	{
4315	# ifdef IN_RC
4316	PGM_INVL_PG(pVCpu, pVM->pgm.s.GCPtrCR3Mapping);
4317	# endif
4318	# if PGM_GST_TYPE == PGM_TYPE_32BIT
4319	pVCpu->pgm.s.pGst32BitPdR3 = (R3PTRTYPE(PX86PD))HCPtrGuestCR3;
4320	# ifndef VBOX_WITH_2X_4GB_ADDR_SPACE
4321	pVCpu->pgm.s.pGst32BitPdR0 = (R0PTRTYPE(PX86PD))HCPtrGuestCR3;
4322	# endif
4323	pVCpu->pgm.s.pGst32BitPdRC = (RCPTRTYPE(PX86PD))pVM->pgm.s.GCPtrCR3Mapping;
4324
4325	# elif PGM_GST_TYPE == PGM_TYPE_PAE
4326	unsigned off = GCPhysCR3 & GST_CR3_PAGE_MASK & PAGE_OFFSET_MASK;
4327	pVCpu->pgm.s.pGstPaePdptR3 = (R3PTRTYPE(PX86PDPT))HCPtrGuestCR3;
4328	# ifndef VBOX_WITH_2X_4GB_ADDR_SPACE
4329	pVCpu->pgm.s.pGstPaePdptR0 = (R0PTRTYPE(PX86PDPT))HCPtrGuestCR3;
4330	# endif
4331	pVCpu->pgm.s.pGstPaePdptRC = (RCPTRTYPE(PX86PDPT))((RCPTRTYPE(uint8_t *))pVM->pgm.s.GCPtrCR3Mapping + off);
4332	Log(("Cached mapping %RRv\n", pVCpu->pgm.s.pGstPaePdptRC));
4333
4334	/*
4335	* Map the 4 PDs too.
4336	*/
4337	PX86PDPT pGuestPDPT = pgmGstGetPaePDPTPtr(&pVCpu->pgm.s);
4338	RTGCPTR GCPtr = pVM->pgm.s.GCPtrCR3Mapping + PAGE_SIZE;
4339	for (unsigned i = 0; i < X86_PG_PAE_PDPE_ENTRIES; i++, GCPtr += PAGE_SIZE)
4340	{
4341	if (pGuestPDPT->a[i].n.u1Present)
4342	{
4343	RTHCPTR HCPtr;
4344	RTHCPHYS HCPhys;
4345	RTGCPHYS GCPhys = pGuestPDPT->a[i].u & X86_PDPE_PG_MASK;
4346	pgmLock(pVM);
4347	PPGMPAGE pPage = pgmPhysGetPage(&pVM->pgm.s, GCPhys);
4348	AssertReturn(pPage, VERR_INTERNAL_ERROR_2);
4349	HCPhys = PGM_PAGE_GET_HCPHYS(pPage);
4350	# if defined(IN_RC) \|\| defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
4351	HCPtr = NIL_RTHCPTR;
4352	int rc2 = VINF_SUCCESS;
4353	# else
4354	int rc2 = pgmPhysGCPhys2CCPtrInternal(pVM, pPage, GCPhys, (void **)&HCPtr);
4355	# endif
4356	pgmUnlock(pVM);
4357	if (RT_SUCCESS(rc2))
4358	{
4359	rc = PGMMap(pVM, GCPtr, HCPhys, PAGE_SIZE, 0);
4360	AssertRCReturn(rc, rc);
4361
4362	pVCpu->pgm.s.apGstPaePDsR3[i] = (R3PTRTYPE(PX86PDPAE))HCPtr;
4363	# ifndef VBOX_WITH_2X_4GB_ADDR_SPACE
4364	pVCpu->pgm.s.apGstPaePDsR0[i] = (R0PTRTYPE(PX86PDPAE))HCPtr;
4365	# endif
4366	pVCpu->pgm.s.apGstPaePDsRC[i] = (RCPTRTYPE(PX86PDPAE))GCPtr;
4367	pVCpu->pgm.s.aGCPhysGstPaePDs[i] = GCPhys;
4368	# ifdef IN_RC
4369	PGM_INVL_PG(pVCpu, GCPtr);
4370	# endif
4371	continue;
4372	}
4373	AssertMsgFailed(("pgmR3Gst32BitMapCR3: rc2=%d GCPhys=%RGp i=%d\n", rc2, GCPhys, i));
4374	}
4375
4376	pVCpu->pgm.s.apGstPaePDsR3[i] = 0;
4377	# ifndef VBOX_WITH_2X_4GB_ADDR_SPACE
4378	pVCpu->pgm.s.apGstPaePDsR0[i] = 0;
4379	# endif
4380	pVCpu->pgm.s.apGstPaePDsRC[i] = 0;
4381	pVCpu->pgm.s.aGCPhysGstPaePDs[i] = NIL_RTGCPHYS;
4382	# ifdef IN_RC
4383	PGM_INVL_PG(pVCpu, GCPtr); /** @todo this shouldn't be necessary? */
4384	# endif
4385	}
4386
4387	# elif PGM_GST_TYPE == PGM_TYPE_AMD64
4388	pVCpu->pgm.s.pGstAmd64Pml4R3 = (R3PTRTYPE(PX86PML4))HCPtrGuestCR3;
4389	# ifndef VBOX_WITH_2X_4GB_ADDR_SPACE
4390	pVCpu->pgm.s.pGstAmd64Pml4R0 = (R0PTRTYPE(PX86PML4))HCPtrGuestCR3;
4391	# endif
4392	# endif
4393	}
4394	else
4395	AssertMsgFailed(("rc=%Rrc GCPhysGuestPD=%RGp\n", rc, GCPhysCR3));
4396	}
4397	else
4398	AssertMsgFailed(("rc=%Rrc GCPhysGuestPD=%RGp\n", rc, GCPhysCR3));
4399
4400	#else /* prot/real stub */
4401	int rc = VINF_SUCCESS;
4402	#endif
4403
4404	/* Update shadow paging info for guest modes with paging (32, pae, 64). */
4405	# if ( ( PGM_SHW_TYPE == PGM_TYPE_32BIT \
4406	\|\| PGM_SHW_TYPE == PGM_TYPE_PAE \
4407	\|\| PGM_SHW_TYPE == PGM_TYPE_AMD64) \
4408	&& ( PGM_GST_TYPE != PGM_TYPE_REAL \
4409	&& PGM_GST_TYPE != PGM_TYPE_PROT))
4410
4411	Assert(!HWACCMIsNestedPagingActive(pVM));
4412
4413	/*
4414	* Update the shadow root page as well since that's not fixed.
4415	*/
4416	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
4417	PPGMPOOLPAGE pOldShwPageCR3 = pVCpu->pgm.s.CTX_SUFF(pShwPageCR3);
4418	uint32_t iOldShwUserTable = pVCpu->pgm.s.iShwUserTable;
4419	uint32_t iOldShwUser = pVCpu->pgm.s.iShwUser;
4420	PPGMPOOLPAGE pNewShwPageCR3;
4421
4422	pgmLock(pVM);
4423
4424	# ifdef PGMPOOL_WITH_OPTIMIZED_DIRTY_PT
4425	if (pPool->cDirtyPages)
4426	pgmPoolResetDirtyPages(pVM);
4427	# endif
4428
4429	Assert(!(GCPhysCR3 >> (PAGE_SHIFT + 32)));
4430	rc = pgmPoolAlloc(pVM, GCPhysCR3 & GST_CR3_PAGE_MASK, BTH_PGMPOOLKIND_ROOT, SHW_POOL_ROOT_IDX, GCPhysCR3 >> PAGE_SHIFT, &pNewShwPageCR3, true /* lock page */);
4431	AssertFatalRC(rc);
4432	rc = VINF_SUCCESS;
4433
4434	# ifdef IN_RC
4435	/*
4436	* WARNING! We can't deal with jumps to ring 3 in the code below as the
4437	* state will be inconsistent! Flush important things now while
4438	* we still can and then make sure there are no ring-3 calls.
4439	*/
4440	REMNotifyHandlerPhysicalFlushIfAlmostFull(pVM, pVCpu);
4441	VMMRZCallRing3Disable(pVCpu);
4442	# endif
4443
4444	pVCpu->pgm.s.iShwUser = SHW_POOL_ROOT_IDX;
4445	pVCpu->pgm.s.iShwUserTable = GCPhysCR3 >> PAGE_SHIFT;
4446	pVCpu->pgm.s.CTX_SUFF(pShwPageCR3) = pNewShwPageCR3;
4447	# ifdef IN_RING0
4448	pVCpu->pgm.s.pShwPageCR3R3 = MMHyperCCToR3(pVM, pVCpu->pgm.s.CTX_SUFF(pShwPageCR3));
4449	pVCpu->pgm.s.pShwPageCR3RC = MMHyperCCToRC(pVM, pVCpu->pgm.s.CTX_SUFF(pShwPageCR3));
4450	# elif defined(IN_RC)
4451	pVCpu->pgm.s.pShwPageCR3R3 = MMHyperCCToR3(pVM, pVCpu->pgm.s.CTX_SUFF(pShwPageCR3));
4452	pVCpu->pgm.s.pShwPageCR3R0 = MMHyperCCToR0(pVM, pVCpu->pgm.s.CTX_SUFF(pShwPageCR3));
4453	# else
4454	pVCpu->pgm.s.pShwPageCR3R0 = MMHyperCCToR0(pVM, pVCpu->pgm.s.CTX_SUFF(pShwPageCR3));
4455	pVCpu->pgm.s.pShwPageCR3RC = MMHyperCCToRC(pVM, pVCpu->pgm.s.CTX_SUFF(pShwPageCR3));
4456	# endif
4457
4458	# ifndef PGM_WITHOUT_MAPPINGS
4459	/*
4460	* Apply all hypervisor mappings to the new CR3.
4461	* Note that SyncCR3 will be executed in case CR3 is changed in a guest paging mode; this will
4462	* make sure we check for conflicts in the new CR3 root.
4463	*/
4464	# if PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE)
4465	Assert(VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL) \|\| VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
4466	# endif
4467	rc = pgmMapActivateCR3(pVM, pNewShwPageCR3);
4468	AssertRCReturn(rc, rc);
4469	# endif
4470
4471	/* Set the current hypervisor CR3. */
4472	CPUMSetHyperCR3(pVCpu, PGMGetHyperCR3(pVCpu));
4473	SELMShadowCR3Changed(pVM, pVCpu);
4474
4475	# ifdef IN_RC
4476	/* NOTE: The state is consistent again. */
4477	VMMRZCallRing3Enable(pVCpu);
4478	# endif
4479
4480	/* Clean up the old CR3 root. */
4481	if ( pOldShwPageCR3
4482	&& pOldShwPageCR3 != pNewShwPageCR3 /* @todo can happen due to incorrect syncing between REM & PGM; find the real cause */)
4483	{
4484	Assert(pOldShwPageCR3->enmKind != PGMPOOLKIND_FREE);
4485	# ifndef PGM_WITHOUT_MAPPINGS
4486	/* Remove the hypervisor mappings from the shadow page table. */
4487	pgmMapDeactivateCR3(pVM, pOldShwPageCR3);
4488	# endif
4489	/* Mark the page as unlocked; allow flushing again. */
4490	pgmPoolUnlockPage(pPool, pOldShwPageCR3);
4491
4492	pgmPoolFreeByPage(pPool, pOldShwPageCR3, iOldShwUser, iOldShwUserTable);
4493	}
4494	pgmUnlock(pVM);
4495	# endif
4496
4497	return rc;
4498	}
4499
4500	/**
4501	* Unmaps the shadow CR3.
4502	*
4503	* @returns VBox status, no specials.
4504	* @param pVCpu The VMCPU handle.
4505	*/
4506	PGM_BTH_DECL(int, UnmapCR3)(PVMCPU pVCpu)
4507	{
4508	LogFlow(("UnmapCR3\n"));
4509
4510	int rc = VINF_SUCCESS;
4511	PVM pVM = pVCpu->CTX_SUFF(pVM);
4512
4513	/*
4514	* Update guest paging info.
4515	*/
4516	#if PGM_GST_TYPE == PGM_TYPE_32BIT
4517	pVCpu->pgm.s.pGst32BitPdR3 = 0;
4518	# ifndef VBOX_WITH_2X_4GB_ADDR_SPACE
4519	pVCpu->pgm.s.pGst32BitPdR0 = 0;
4520	# endif
4521	pVCpu->pgm.s.pGst32BitPdRC = 0;
4522
4523	#elif PGM_GST_TYPE == PGM_TYPE_PAE
4524	pVCpu->pgm.s.pGstPaePdptR3 = 0;
4525	# ifndef VBOX_WITH_2X_4GB_ADDR_SPACE
4526	pVCpu->pgm.s.pGstPaePdptR0 = 0;
4527	# endif
4528	pVCpu->pgm.s.pGstPaePdptRC = 0;
4529	for (unsigned i = 0; i < X86_PG_PAE_PDPE_ENTRIES; i++)
4530	{
4531	pVCpu->pgm.s.apGstPaePDsR3[i] = 0;
4532	# ifndef VBOX_WITH_2X_4GB_ADDR_SPACE
4533	pVCpu->pgm.s.apGstPaePDsR0[i] = 0;
4534	# endif
4535	pVCpu->pgm.s.apGstPaePDsRC[i] = 0;
4536	pVCpu->pgm.s.aGCPhysGstPaePDs[i] = NIL_RTGCPHYS;
4537	}
4538
4539	#elif PGM_GST_TYPE == PGM_TYPE_AMD64
4540	pVCpu->pgm.s.pGstAmd64Pml4R3 = 0;
4541	# ifndef VBOX_WITH_2X_4GB_ADDR_SPACE
4542	pVCpu->pgm.s.pGstAmd64Pml4R0 = 0;
4543	# endif
4544
4545	#else /* prot/real mode stub */
4546	/* nothing to do */
4547	#endif
4548
4549	#if !defined(IN_RC) /* In RC we rely on MapCR3 to do the shadow part for us at a safe time */
4550	/*
4551	* Update shadow paging info.
4552	*/
4553	# if ( ( PGM_SHW_TYPE == PGM_TYPE_32BIT \
4554	\|\| PGM_SHW_TYPE == PGM_TYPE_PAE \
4555	\|\| PGM_SHW_TYPE == PGM_TYPE_AMD64))
4556
4557	# if PGM_GST_TYPE != PGM_TYPE_REAL
4558	Assert(!HWACCMIsNestedPagingActive(pVM));
4559	# endif
4560
4561	pgmLock(pVM);
4562
4563	# ifndef PGM_WITHOUT_MAPPINGS
4564	if (pVCpu->pgm.s.CTX_SUFF(pShwPageCR3))
4565	/* Remove the hypervisor mappings from the shadow page table. */
4566	pgmMapDeactivateCR3(pVM, pVCpu->pgm.s.CTX_SUFF(pShwPageCR3));
4567	# endif
4568
4569	if (pVCpu->pgm.s.CTX_SUFF(pShwPageCR3))
4570	{
4571	PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
4572
4573	Assert(pVCpu->pgm.s.iShwUser != PGMPOOL_IDX_NESTED_ROOT);
4574
4575	# ifdef PGMPOOL_WITH_OPTIMIZED_DIRTY_PT
4576	if (pPool->cDirtyPages)
4577	pgmPoolResetDirtyPages(pVM);
4578	# endif
4579
4580	/* Mark the page as unlocked; allow flushing again. */
4581	pgmPoolUnlockPage(pPool, pVCpu->pgm.s.CTX_SUFF(pShwPageCR3));
4582
4583	pgmPoolFreeByPage(pPool, pVCpu->pgm.s.CTX_SUFF(pShwPageCR3), pVCpu->pgm.s.iShwUser, pVCpu->pgm.s.iShwUserTable);
4584	pVCpu->pgm.s.pShwPageCR3R3 = 0;
4585	pVCpu->pgm.s.pShwPageCR3R0 = 0;
4586	pVCpu->pgm.s.pShwPageCR3RC = 0;
4587	pVCpu->pgm.s.iShwUser = 0;
4588	pVCpu->pgm.s.iShwUserTable = 0;
4589	}
4590	pgmUnlock(pVM);
4591	# endif
4592	#endif /* !IN_RC*/
4593
4594	return rc;
4595	}
4596

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/PGMAllBth.h@ 24442

Download in other formats: