PATM.cpp@ 9026

Last change on this file since 9026 was 8984, checked in by vboxsync, 17 years ago
Removed the dtrace experiment. the invalid lock sequences now ends up as OP_ILLUD2 after disassembly.
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 240.7 KB

Line
1	/* $Id: PATM.cpp 8984 2008-05-20 20:59:45Z vboxsync $ */
2	/** @file
3	* PATM - Dynamic Guest OS Patching Manager
4	*
5	* NOTE: Never ever reuse patch memory!!
6	*/
7
8	/*
9	* Copyright (C) 2006-2007 Sun Microsystems, Inc.
10	*
11	* This file is part of VirtualBox Open Source Edition (OSE), as
12	* available from http://www.virtualbox.org. This file is free software;
13	* you can redistribute it and/or modify it under the terms of the GNU
14	* General Public License (GPL) as published by the Free Software
15	* Foundation, in version 2 as it comes in the "COPYING" file of the
16	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
17	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
18	*
19	* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
20	* Clara, CA 95054 USA or visit http://www.sun.com if you need
21	* additional information or have any questions.
22	*/
23
24	/*******************************************************************************
25	* Header Files *
26	*******************************************************************************/
27	#define LOG_GROUP LOG_GROUP_PATM
28	#include <VBox/patm.h>
29	#include <VBox/stam.h>
30	#include <VBox/pgm.h>
31	#include <VBox/cpum.h>
32	#include <VBox/cpumdis.h>
33	#include <VBox/iom.h>
34	#include <VBox/sup.h>
35	#include <VBox/mm.h>
36	#include <VBox/ssm.h>
37	#include <VBox/pdm.h>
38	#include <VBox/trpm.h>
39	#include <VBox/cfgm.h>
40	#include <VBox/param.h>
41	#include <VBox/selm.h>
42	#include <iprt/avl.h>
43	#include "PATMInternal.h"
44	#include "PATMPatch.h"
45	#include <VBox/vm.h>
46	#include <VBox/csam.h>
47
48	#include <VBox/dbg.h>
49	#include <VBox/err.h>
50	#include <VBox/log.h>
51	#include <iprt/assert.h>
52	#include <iprt/asm.h>
53	#include <VBox/dis.h>
54	#include <VBox/disopcode.h>
55
56	#include <iprt/string.h>
57	#include "PATMA.h"
58
59	//#define PATM_REMOVE_PATCH_ON_TOO_MANY_TRAPS
60	//#define PATM_DISABLE_ALL
61
62	/*******************************************************************************
63	* Internal Functions *
64	*******************************************************************************/
65
66	static int patmDisableUnusablePatch(PVM pVM, RTGCPTR pInstrGC, RTGCPTR pConflictAddr, PPATCHINFO pPatch);
67	static int patmActivateInt3Patch(PVM pVM, PPATCHINFO pPatch);
68	static int patmDeactivateInt3Patch(PVM pVM, PPATCHINFO pPatch);
69
70	#ifdef LOG_ENABLED // keep gcc quiet
71	static bool patmIsCommonIDTHandlerPatch(PVM pVM, RTGCPTR pInstrGC);
72	#endif
73	#ifdef VBOX_WITH_STATISTICS
74	static const char *PATMPatchType(PVM pVM, PPATCHINFO pPatch);
75	static void patmResetStat(PVM pVM, void *pvSample);
76	static void patmPrintStat(PVM pVM, void pvSample, char pszBuf, size_t cchBuf);
77	#endif
78
79	#define patmPatchHCPtr2PatchGCPtr(pVM, pHC) (pVM->patm.s.pPatchMemGC + (pHC - pVM->patm.s.pPatchMemHC))
80	#define patmPatchGCPtr2PatchHCPtr(pVM, pGC) (pVM->patm.s.pPatchMemHC + (pGC - pVM->patm.s.pPatchMemGC))
81
82	static int patmReinit(PVM pVM);
83	static DECLCALLBACK(int) RelocatePatches(PAVLOGCPTRNODECORE pNode, void *pParam);
84	static DECLCALLBACK(int) patmVirtPageHandler(PVM pVM, RTGCPTR GCPtr, void pvPtr, void pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType, void *pvUser);
85
86	#ifdef VBOX_WITH_DEBUGGER
87	static DECLCALLBACK(int) DisableAllPatches(PAVLOGCPTRNODECORE pNode, void *pVM);
88	static DECLCALLBACK(int) patmr3CmdOn(PCDBGCCMD pCmd, PDBGCCMDHLP pCmdHlp, PVM pVM, PCDBGCVAR paArgs, unsigned cArgs, PDBGCVAR pResult);
89	static DECLCALLBACK(int) patmr3CmdOff(PCDBGCCMD pCmd, PDBGCCMDHLP pCmdHlp, PVM pVM, PCDBGCVAR paArgs, unsigned cArgs, PDBGCVAR pResult);
90
91	/** Command descriptors. */
92	static const DBGCCMD g_aCmds[] =
93	{
94	/* pszCmd, cArgsMin, cArgsMax, paArgDesc, cArgDescs, pResultDesc, fFlags, pfnHandler pszSyntax, ....pszDescription */
95	{ "patmon", 0, 0, NULL, 0, NULL, 0, patmr3CmdOn, "", "Enable patching." },
96	{ "patmoff", 0, 0, NULL, 0, NULL, 0, patmr3CmdOff, "", "Disable patching." },
97	};
98	#endif
99
100	/**
101	* Initializes the PATM.
102	*
103	* @returns VBox status code.
104	* @param pVM The VM to operate on.
105	*/
106	PATMR3DECL(int) PATMR3Init(PVM pVM)
107	{
108	int rc;
109
110	Log(("PATMR3Init: Patch record size %d\n", sizeof(PATCHINFO)));
111
112	AssertReleaseMsg(PATMInterruptFlag == (VM_FF_INTERRUPT_APIC \| VM_FF_INTERRUPT_PIC \| VM_FF_TIMER \| VM_FF_REQUEST),
113	("Interrupt flags out of sync!! PATMInterruptFlag=%#x expected %#x. broken assembler?\n", PATMInterruptFlag, VM_FF_INTERRUPT_APIC \| VM_FF_INTERRUPT_PIC \| VM_FF_TIMER \| VM_FF_REQUEST));
114
115	/* Allocate patch memory and GC patch state memory. */
116	pVM->patm.s.cbPatchMem = PATCH_MEMORY_SIZE;
117	/* Add another page in case the generated code is much larger than expected. */
118	/** @todo bad safety precaution */
119	rc = MMR3HyperAllocOnceNoRel(pVM, PATCH_MEMORY_SIZE + PAGE_SIZE + PATM_STACK_TOTAL_SIZE + PAGE_SIZE + PATM_STAT_MEMSIZE, PAGE_SIZE, MM_TAG_PATM, (void **)&pVM->patm.s.pPatchMemHC);
120	if (VBOX_FAILURE(rc))
121	{
122	Log(("MMR3HyperAlloc failed with %Vrc\n", rc));
123	return rc;
124	}
125	pVM->patm.s.pPatchMemGC = MMHyperHC2GC(pVM, pVM->patm.s.pPatchMemHC);
126
127	/* PATM stack page for call instruction execution. (2 parts: one for our private stack and one to store the original return address */
128	pVM->patm.s.pGCStackHC = (RTGCPTR *)(pVM->patm.s.pPatchMemHC + PATCH_MEMORY_SIZE + PAGE_SIZE);
129	pVM->patm.s.pGCStackGC = MMHyperHC2GC(pVM, pVM->patm.s.pGCStackHC);
130
131	/*
132	* Hypervisor memory for GC status data (read/write)
133	*
134	* Note1: This is non-critical data; if trashed by the guest, then it will only cause problems for itself
135	* Note2: This doesn't really belong here, but we need access to it for relocation purposes
136	*
137	*/
138	Assert(sizeof(PATMGCSTATE) < PAGE_SIZE); /** @note hardcoded dependencies on this exist. */
139	pVM->patm.s.pGCStateHC = (PPATMGCSTATE)((uint8_t *)pVM->patm.s.pGCStackHC + PATM_STACK_TOTAL_SIZE);
140	pVM->patm.s.pGCStateGC = MMHyperHC2GC(pVM, pVM->patm.s.pGCStateHC);
141
142	/* Hypervisor memory for patch statistics */
143	pVM->patm.s.pStatsHC = (PSTAMRATIOU32)((uint8_t *)pVM->patm.s.pGCStateHC + PAGE_SIZE);
144	pVM->patm.s.pStatsGC = MMHyperHC2GC(pVM, pVM->patm.s.pStatsHC);
145
146	/* Memory for patch lookup trees. */
147	rc = MMHyperAlloc(pVM, sizeof(pVM->patm.s.PatchLookupTreeHC), 0, MM_TAG_PATM, (void *)&pVM->patm.s.PatchLookupTreeHC);
148	AssertRCReturn(rc, rc);
149	pVM->patm.s.PatchLookupTreeGC = MMHyperHC2GC(pVM, pVM->patm.s.PatchLookupTreeHC);
150
151	#ifdef RT_ARCH_AMD64 /* see patmReinit(). */
152	/* Check CFGM option. */
153	rc = CFGMR3QueryBool(CFGMR3GetRoot(pVM), "PATMEnabled", &pVM->fPATMEnabled);
154	if (VBOX_FAILURE(rc))
155	# ifdef PATM_DISABLE_ALL
156	pVM->fPATMEnabled = false;
157	# else
158	pVM->fPATMEnabled = true;
159	# endif
160	#endif
161
162	rc = patmReinit(pVM);
163	AssertRC(rc);
164	if (VBOX_FAILURE(rc))
165	return rc;
166
167	/*
168	* Register save and load state notificators.
169	*/
170	rc = SSMR3RegisterInternal(pVM, "PATM", 0, PATM_SSM_VERSION, sizeof(pVM->patm.s) + PATCH_MEMORY_SIZE + PAGE_SIZE + PATM_STACK_TOTAL_SIZE + PAGE_SIZE,
171	NULL, patmr3Save, NULL,
172	NULL, patmr3Load, NULL);
173	if (VBOX_FAILURE(rc))
174	{
175	AssertRC(rc);
176	return rc;
177	}
178
179	#ifdef VBOX_WITH_DEBUGGER
180	/*
181	* Debugger commands.
182	*/
183	static bool fRegisteredCmds = false;
184	if (!fRegisteredCmds)
185	{
186	int rc = DBGCRegisterCommands(&g_aCmds[0], ELEMENTS(g_aCmds));
187	if (VBOX_SUCCESS(rc))
188	fRegisteredCmds = true;
189	}
190	#endif
191
192	#ifdef VBOX_WITH_STATISTICS
193	STAM_REG(pVM, &pVM->patm.s.StatNrOpcodeRead, STAMTYPE_COUNTER, "/PATM/OpcodeBytesRead", STAMUNIT_OCCURENCES, "The number of opcode bytes read by the recompiler.");
194	STAM_REG(pVM, &pVM->patm.s.StatPATMMemoryUsed,STAMTYPE_COUNTER, "/PATM/MemoryUsed", STAMUNIT_OCCURENCES, "The amount of hypervisor heap used for patches.");
195	STAM_REG(pVM, &pVM->patm.s.StatDisabled, STAMTYPE_COUNTER, "/PATM/Patch/Disabled", STAMUNIT_OCCURENCES, "Number of times patches were disabled.");
196	STAM_REG(pVM, &pVM->patm.s.StatEnabled, STAMTYPE_COUNTER, "/PATM/Patch/Enabled", STAMUNIT_OCCURENCES, "Number of times patches were enabled.");
197	STAM_REG(pVM, &pVM->patm.s.StatDirty, STAMTYPE_COUNTER, "/PATM/Patch/Dirty", STAMUNIT_OCCURENCES, "Number of times patches were marked dirty.");
198	STAM_REG(pVM, &pVM->patm.s.StatUnusable, STAMTYPE_COUNTER, "/PATM/Patch/Unusable", STAMUNIT_OCCURENCES, "Number of unusable patches (conflicts).");
199	STAM_REG(pVM, &pVM->patm.s.StatInstalled, STAMTYPE_COUNTER, "/PATM/Patch/Installed", STAMUNIT_OCCURENCES, "Number of installed patches.");
200	STAM_REG(pVM, &pVM->patm.s.StatInt3Callable, STAMTYPE_COUNTER, "/PATM/Patch/Int3Callable", STAMUNIT_OCCURENCES, "Number of cli patches turned into int3 patches.");
201
202	STAM_REG(pVM, &pVM->patm.s.StatInt3BlockRun, STAMTYPE_COUNTER, "/PATM/Patch/Run/Int3", STAMUNIT_OCCURENCES, "Number of times an int3 block patch was executed.");
203	STAMR3RegisterF(pVM, &pVM->patm.s.pGCStateHC->uPatchCalls, STAMTYPE_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, NULL, "/PATM/Patch/Run/Normal");
204
205	STAM_REG(pVM, &pVM->patm.s.StatInstalledFunctionPatches, STAMTYPE_COUNTER, "/PATM/Patch/Installed/Function", STAMUNIT_OCCURENCES, "Number of installed function duplication patches.");
206	STAM_REG(pVM, &pVM->patm.s.StatInstalledTrampoline, STAMTYPE_COUNTER, "/PATM/Patch/Installed/Trampoline", STAMUNIT_OCCURENCES, "Number of installed trampoline patches.");
207	STAM_REG(pVM, &pVM->patm.s.StatInstalledJump, STAMTYPE_COUNTER, "/PATM/Patch/Installed/Jump", STAMUNIT_OCCURENCES, "Number of installed jump patches.");
208
209	STAM_REG(pVM, &pVM->patm.s.StatOverwritten, STAMTYPE_COUNTER, "/PATM/Patch/Overwritten", STAMUNIT_OCCURENCES, "Number of overwritten patches.");
210	STAM_REG(pVM, &pVM->patm.s.StatFixedConflicts,STAMTYPE_COUNTER, "/PATM/Patch/ConflictFixed", STAMUNIT_OCCURENCES, "Number of fixed conflicts.");
211	STAM_REG(pVM, &pVM->patm.s.StatFlushed, STAMTYPE_COUNTER, "/PATM/Patch/Flushed", STAMUNIT_OCCURENCES, "Number of flushes of pages with patch jumps.");
212	STAM_REG(pVM, &pVM->patm.s.StatMonitored, STAMTYPE_COUNTER, "/PATM/Patch/Monitored", STAMUNIT_OCCURENCES, "Number of patches in monitored patch pages.");
213	STAM_REG(pVM, &pVM->patm.s.StatPageBoundaryCrossed, STAMTYPE_COUNTER, "/PATM/Patch/BoundaryCross", STAMUNIT_OCCURENCES, "Number of refused patches due to patch jump crossing page boundary.");
214
215	STAM_REG(pVM, &pVM->patm.s.StatHandleTrap, STAMTYPE_PROFILE, "/PATM/HandleTrap", STAMUNIT_TICKS_PER_CALL, "Profiling of PATMR3HandleTrap");
216	STAM_REG(pVM, &pVM->patm.s.StatPushTrap, STAMTYPE_COUNTER, "/PATM/HandleTrap/PushWP", STAMUNIT_OCCURENCES, "Number of traps due to monitored stack pages.");
217
218	STAM_REG(pVM, &pVM->patm.s.StatSwitchBack, STAMTYPE_COUNTER, "/PATM/SwitchBack", STAMUNIT_OCCURENCES, "Switch back to original guest code when IF=1 & executing PATM instructions");
219	STAM_REG(pVM, &pVM->patm.s.StatSwitchBackFail,STAMTYPE_COUNTER, "/PATM/SwitchBackFail", STAMUNIT_OCCURENCES, "Failed switch back to original guest code when IF=1 & executing PATM instructions");
220
221	STAM_REG(pVM, &pVM->patm.s.StatDuplicateREQFailed, STAMTYPE_COUNTER, "/PATM/Function/DupREQ/Failed", STAMUNIT_OCCURENCES, "Nr of failed PATMR3DuplicateFunctionRequest calls");
222	STAM_REG(pVM, &pVM->patm.s.StatDuplicateREQSuccess, STAMTYPE_COUNTER, "/PATM/Function/DupREQ/Success", STAMUNIT_OCCURENCES, "Nr of successful PATMR3DuplicateFunctionRequest calls");
223	STAM_REG(pVM, &pVM->patm.s.StatDuplicateUseExisting,STAMTYPE_COUNTER, "/PATM/Function/DupREQ/UseExist", STAMUNIT_OCCURENCES, "Nr of successful PATMR3DuplicateFunctionRequest calls when using an existing patch");
224
225	STAM_REG(pVM, &pVM->patm.s.StatFunctionLookupInsert, STAMTYPE_COUNTER, "/PATM/Function/Lookup/Insert", STAMUNIT_OCCURENCES, "Nr of successful function address insertions");
226	STAM_REG(pVM, &pVM->patm.s.StatFunctionLookupReplace, STAMTYPE_COUNTER, "/PATM/Function/Lookup/Replace", STAMUNIT_OCCURENCES, "Nr of successful function address replacements");
227	STAM_REG(pVM, &pVM->patm.s.StatU32FunctionMaxSlotsUsed, STAMTYPE_U32_RESET,"/PATM/Function/Lookup/MaxSlots", STAMUNIT_OCCURENCES, "Maximum nr of lookup slots used in all call patches");
228
229	STAM_REG(pVM, &pVM->patm.s.StatFunctionFound, STAMTYPE_COUNTER, "/PATM/Function/Found", STAMUNIT_OCCURENCES, "Nr of successful function patch lookups in GC");
230	STAM_REG(pVM, &pVM->patm.s.StatFunctionNotFound, STAMTYPE_COUNTER, "/PATM/Function/NotFound", STAMUNIT_OCCURENCES, "Nr of failed function patch lookups in GC");
231
232	STAM_REG(pVM, &pVM->patm.s.StatPatchWrite, STAMTYPE_PROFILE, "/PATM/Write/Handle", STAMUNIT_TICKS_PER_CALL, "Profiling of PATMR3PatchWrite");
233	STAM_REG(pVM, &pVM->patm.s.StatPatchWriteDetect, STAMTYPE_PROFILE, "/PATM/Write/Detect", STAMUNIT_TICKS_PER_CALL, "Profiling of PATMIsWriteToPatchPage");
234	STAM_REG(pVM, &pVM->patm.s.StatPatchWriteInterpreted, STAMTYPE_COUNTER, "/PATM/Write/Interpreted/Success", STAMUNIT_OCCURENCES, "Nr of interpreted patch writes.");
235	STAM_REG(pVM, &pVM->patm.s.StatPatchWriteInterpretedFailed, STAMTYPE_COUNTER, "/PATM/Write/Interpreted/Failed", STAMUNIT_OCCURENCES, "Nr of failed interpreted patch writes.");
236
237	STAM_REG(pVM, &pVM->patm.s.StatPatchRefreshSuccess, STAMTYPE_COUNTER, "/PATM/Refresh/Success", STAMUNIT_OCCURENCES, "Successful patch refreshes");
238	STAM_REG(pVM, &pVM->patm.s.StatPatchRefreshFailed, STAMTYPE_COUNTER, "/PATM/Refresh/Failure", STAMUNIT_OCCURENCES, "Failed patch refreshes");
239
240	STAM_REG(pVM, &pVM->patm.s.StatPatchPageInserted, STAMTYPE_COUNTER, "/PATM/Page/Inserted", STAMUNIT_OCCURENCES, "Nr of inserted guest pages that were patched");
241	STAM_REG(pVM, &pVM->patm.s.StatPatchPageRemoved, STAMTYPE_COUNTER, "/PATM/Page/Removed", STAMUNIT_OCCURENCES, "Nr of removed guest pages that were patched");
242
243	STAM_REG(pVM, &pVM->patm.s.StatInstrDirty, STAMTYPE_COUNTER, "/PATM/Instr/Dirty/Detected", STAMUNIT_OCCURENCES, "Number of times instructions were marked dirty.");
244	STAM_REG(pVM, &pVM->patm.s.StatInstrDirtyGood, STAMTYPE_COUNTER, "/PATM/Instr/Dirty/Corrected", STAMUNIT_OCCURENCES, "Number of times instructions were marked dirty and corrected later on.");
245	STAM_REG(pVM, &pVM->patm.s.StatInstrDirtyBad, STAMTYPE_COUNTER, "/PATM/Instr/Dirty/Failed", STAMUNIT_OCCURENCES, "Number of times instructions were marked dirty and we were not able to correct them.");
246
247	STAM_REG(pVM, &pVM->patm.s.StatSysEnter, STAMTYPE_COUNTER, "/PATM/Emul/SysEnter", STAMUNIT_OCCURENCES, "Number of times sysenter was emulated.");
248	STAM_REG(pVM, &pVM->patm.s.StatSysExit, STAMTYPE_COUNTER, "/PATM/Emul/SysExit" , STAMUNIT_OCCURENCES, "Number of times sysexit was emulated.");
249	STAM_REG(pVM, &pVM->patm.s.StatEmulIret, STAMTYPE_COUNTER, "/PATM/Emul/Iret/Success", STAMUNIT_OCCURENCES, "Number of times iret was emulated.");
250	STAM_REG(pVM, &pVM->patm.s.StatEmulIretFailed, STAMTYPE_COUNTER, "/PATM/Emul/Iret/Failed", STAMUNIT_OCCURENCES, "Number of times iret was emulated.");
251
252	STAM_REG(pVM, &pVM->patm.s.StatGenRet, STAMTYPE_COUNTER, "/PATM/Gen/Ret" , STAMUNIT_OCCURENCES, "Number of generated ret instructions.");
253	STAM_REG(pVM, &pVM->patm.s.StatGenRetReused, STAMTYPE_COUNTER, "/PATM/Gen/RetReused" , STAMUNIT_OCCURENCES, "Number of reused ret instructions.");
254	STAM_REG(pVM, &pVM->patm.s.StatGenCall, STAMTYPE_COUNTER, "/PATM/Gen/Call", STAMUNIT_OCCURENCES, "Number of generated call instructions.");
255	STAM_REG(pVM, &pVM->patm.s.StatGenJump, STAMTYPE_COUNTER, "/PATM/Gen/Jmp" , STAMUNIT_OCCURENCES, "Number of generated indirect jump instructions.");
256	STAM_REG(pVM, &pVM->patm.s.StatGenPopf, STAMTYPE_COUNTER, "/PATM/Gen/Popf" , STAMUNIT_OCCURENCES, "Number of generated popf instructions.");
257
258	STAM_REG(pVM, &pVM->patm.s.StatCheckPendingIRQ, STAMTYPE_COUNTER, "/PATM/GC/CheckIRQ" , STAMUNIT_OCCURENCES, "Number of traps that ask to check for pending irqs.");
259	#endif /* VBOX_WITH_STATISTICS */
260
261	Log(("PATMCallRecord.size %d\n", PATMCallRecord.size));
262	Log(("PATMCallIndirectRecord.size %d\n", PATMCallIndirectRecord.size));
263	Log(("PATMRetRecord.size %d\n", PATMRetRecord.size));
264	Log(("PATMJumpIndirectRecord.size %d\n", PATMJumpIndirectRecord.size));
265	Log(("PATMPopf32Record.size %d\n", PATMPopf32Record.size));
266	Log(("PATMIretRecord.size %d\n", PATMIretRecord.size));
267	Log(("PATMStiRecord.size %d\n", PATMStiRecord.size));
268	Log(("PATMCheckIFRecord.size %d\n", PATMCheckIFRecord.size));
269
270	return rc;
271	}
272
273	/**
274	* Finalizes HMA page attributes.
275	*
276	* @returns VBox status code.
277	* @param pVM The VM handle.
278	*/
279	PATMR3DECL(int) PATMR3InitFinalize(PVM pVM)
280	{
281	/* The GC state, stack and statistics must be read/write for the guest (supervisor only of course). */
282	int rc = PGMMapSetPage(pVM, pVM->patm.s.pGCStateGC, PAGE_SIZE, X86_PTE_P \| X86_PTE_A \| X86_PTE_D \| X86_PTE_RW);
283	if (VBOX_FAILURE(rc))
284	Log(("PATMR3InitFinalize: PGMMapSetPage failed with %Vrc!!\n", rc));
285
286	rc = PGMMapSetPage(pVM, pVM->patm.s.pGCStackGC, PATM_STACK_TOTAL_SIZE, X86_PTE_P \| X86_PTE_A \| X86_PTE_D \| X86_PTE_RW);
287	if (VBOX_FAILURE(rc))
288	Log(("PATMR3InitFinalize: PGMMapSetPage failed with %Vrc!!\n", rc));
289
290	rc = PGMMapSetPage(pVM, pVM->patm.s.pStatsGC, PATM_STAT_MEMSIZE, X86_PTE_P \| X86_PTE_A \| X86_PTE_D \| X86_PTE_RW);
291	if (VBOX_FAILURE(rc))
292	Log(("PATMR3InitFinalize: PGMMapSetPage failed with %Vrc!!\n", rc));
293
294	return rc;
295	}
296
297	/**
298	* (Re)initializes PATM
299	*
300	* @param pVM The VM.
301	*/
302	static int patmReinit(PVM pVM)
303	{
304	int rc;
305
306	/*
307	* Assert alignment and sizes.
308	*/
309	AssertRelease(!(RT_OFFSETOF(VM, patm.s) & 31));
310	AssertRelease(sizeof(pVM->patm.s) <= sizeof(pVM->patm.padding));
311
312	/*
313	* Setup any fixed pointers and offsets.
314	*/
315	pVM->patm.s.offVM = RT_OFFSETOF(VM, patm);
316
317	#ifndef RT_ARCH_AMD64 /* would be nice if this was changed everywhere. was driving me crazy on AMD64. */
318	#ifndef PATM_DISABLE_ALL
319	pVM->fPATMEnabled = true;
320	#endif
321	#endif
322
323	Assert(pVM->patm.s.pGCStateHC);
324	memset(pVM->patm.s.pGCStateHC, 0, PAGE_SIZE);
325	AssertReleaseMsg(pVM->patm.s.pGCStateGC, ("Impossible! MMHyperHC2GC(%p) failed!\n", pVM->patm.s.pGCStateGC));
326	Log(("Patch memory allocated at %p - %VGv\n", pVM->patm.s.pPatchMemHC, pVM->patm.s.pPatchMemGC));
327	pVM->patm.s.pGCStateHC->uVMFlags = X86_EFL_IF;
328
329	Assert(pVM->patm.s.pGCStackHC);
330	memset(pVM->patm.s.pGCStackHC, 0, PAGE_SIZE);
331	AssertReleaseMsg(pVM->patm.s.pGCStackGC, ("Impossible! MMHyperHC2GC(%p) failed!\n", pVM->patm.s.pGCStackGC));
332	pVM->patm.s.pGCStateHC->Psp = PATM_STACK_SIZE;
333	pVM->patm.s.pGCStateHC->fPIF = 1; /* PATM Interrupt Flag */
334
335	Assert(pVM->patm.s.pStatsHC);
336	memset(pVM->patm.s.pStatsHC, 0, PATM_STAT_MEMSIZE);
337	AssertReleaseMsg(pVM->patm.s.pStatsGC, ("Impossible! MMHyperHC2GC(%p) failed!\n", pVM->patm.s.pStatsGC));
338
339	Assert(pVM->patm.s.pPatchMemHC);
340	Assert(pVM->patm.s.pPatchMemGC = MMHyperHC2GC(pVM, pVM->patm.s.pPatchMemHC));
341	memset(pVM->patm.s.pPatchMemHC, 0, PATCH_MEMORY_SIZE);
342	AssertReleaseMsg(pVM->patm.s.pPatchMemGC, ("Impossible! MMHyperHC2GC(%p) failed!\n", pVM->patm.s.pPatchMemHC));
343
344	/* Needed for future patching of sldt/sgdt/sidt/str etc. */
345	rc = CPUMR3QueryGuestCtxGCPtr(pVM, &pVM->patm.s.pCPUMCtxGC);
346	AssertRCReturn(rc, rc);
347
348	Assert(pVM->patm.s.PatchLookupTreeHC);
349	Assert(pVM->patm.s.PatchLookupTreeGC == MMHyperHC2GC(pVM, pVM->patm.s.PatchLookupTreeHC));
350
351	/*
352	* (Re)Initialize PATM structure
353	*/
354	Assert(!pVM->patm.s.PatchLookupTreeHC->PatchTree);
355	Assert(!pVM->patm.s.PatchLookupTreeHC->PatchTreeByPatchAddr);
356	Assert(!pVM->patm.s.PatchLookupTreeHC->PatchTreeByPage);
357	pVM->patm.s.offPatchMem = 16; /* don't start with zero here */
358	pVM->patm.s.uCurrentPatchIdx = 1; /* Index zero is a dummy */
359	pVM->patm.s.pvFaultMonitor = 0;
360	pVM->patm.s.deltaReloc = 0;
361
362	/* Lowest and highest patched instruction */
363	pVM->patm.s.pPatchedInstrGCLowest = ~0;
364	pVM->patm.s.pPatchedInstrGCHighest = 0;
365
366	pVM->patm.s.PatchLookupTreeHC->PatchTree = 0;
367	pVM->patm.s.PatchLookupTreeHC->PatchTreeByPatchAddr = 0;
368	pVM->patm.s.PatchLookupTreeHC->PatchTreeByPage = 0;
369
370	pVM->patm.s.pfnSysEnterPatchGC = 0;
371	pVM->patm.s.pfnSysEnterGC = 0;
372
373	pVM->patm.s.fOutOfMemory = false;
374
375	pVM->patm.s.pfnHelperCallGC = 0;
376
377	/* Generate all global functions to be used by future patches. */
378	/* We generate a fake patch in order to use the existing code for relocation. */
379	rc = MMHyperAlloc(pVM, sizeof(PATMPATCHREC), 0, MM_TAG_PATM_PATCH, (void **)&pVM->patm.s.pGlobalPatchRec);
380	if (VBOX_FAILURE(rc))
381	{
382	Log(("Out of memory!!!!\n"));
383	return VERR_NO_MEMORY;
384	}
385	pVM->patm.s.pGlobalPatchRec->patch.flags = PATMFL_GLOBAL_FUNCTIONS;
386	pVM->patm.s.pGlobalPatchRec->patch.uState = PATCH_ENABLED;
387	pVM->patm.s.pGlobalPatchRec->patch.pPatchBlockOffset = pVM->patm.s.offPatchMem;
388
389	rc = patmPatchGenGlobalFunctions(pVM, &pVM->patm.s.pGlobalPatchRec->patch);
390	AssertRC(rc);
391
392	/* Update free pointer in patch memory. */
393	pVM->patm.s.offPatchMem += pVM->patm.s.pGlobalPatchRec->patch.uCurPatchOffset;
394	/* Round to next 8 byte boundary. */
395	pVM->patm.s.offPatchMem = RT_ALIGN_32(pVM->patm.s.offPatchMem, 8);
396	return rc;
397	}
398
399
400	/**
401	* Applies relocations to data and code managed by this
402	* component. This function will be called at init and
403	* whenever the VMM need to relocate it self inside the GC.
404	*
405	* The PATM will update the addresses used by the switcher.
406	*
407	* @param pVM The VM.
408	*/
409	PATMR3DECL(void) PATMR3Relocate(PVM pVM)
410	{
411	RTGCPTR GCPtrNew = MMHyperHC2GC(pVM, pVM->patm.s.pGCStateHC);
412	RTGCINTPTR delta = GCPtrNew - pVM->patm.s.pGCStateGC;
413
414	Log(("PATMR3Relocate from %VGv to %VGv - delta %08X\n", pVM->patm.s.pGCStateGC, GCPtrNew, delta));
415	if (delta)
416	{
417	PCPUMCTX pCtx;
418	int rc;
419
420	/* Update CPUMCTX guest context pointer. */
421	pVM->patm.s.pCPUMCtxGC += delta;
422
423	pVM->patm.s.deltaReloc = delta;
424
425	RTAvloGCPtrDoWithAll(&pVM->patm.s.PatchLookupTreeHC->PatchTree, true, RelocatePatches, (void *)pVM);
426
427	rc = CPUMQueryGuestCtxPtr(pVM, &pCtx);
428	AssertRC(rc);
429
430	/* If we are running patch code right now, then also adjust EIP. */
431	if (PATMIsPatchGCAddr(pVM, pCtx->eip))
432	pCtx->eip += delta;
433
434	pVM->patm.s.pGCStateGC = GCPtrNew;
435	pVM->patm.s.pPatchMemGC = MMHyperHC2GC(pVM, pVM->patm.s.pPatchMemHC);
436
437	pVM->patm.s.pGCStackGC = MMHyperHC2GC(pVM, pVM->patm.s.pGCStackHC);
438
439	pVM->patm.s.pStatsGC = MMHyperHC2GC(pVM, pVM->patm.s.pStatsHC);
440
441	pVM->patm.s.PatchLookupTreeGC = MMHyperHC2GC(pVM, pVM->patm.s.PatchLookupTreeHC);
442
443	if (pVM->patm.s.pfnSysEnterPatchGC)
444	pVM->patm.s.pfnSysEnterPatchGC += delta;
445
446	/* Deal with the global patch functions. */
447	pVM->patm.s.pfnHelperCallGC += delta;
448	pVM->patm.s.pfnHelperRetGC += delta;
449	pVM->patm.s.pfnHelperIretGC += delta;
450	pVM->patm.s.pfnHelperJumpGC += delta;
451
452	RelocatePatches(&pVM->patm.s.pGlobalPatchRec->Core, (void *)pVM);
453	}
454	}
455
456
457	/**
458	* Terminates the PATM.
459	*
460	* Termination means cleaning up and freeing all resources,
461	* the VM it self is at this point powered off or suspended.
462	*
463	* @returns VBox status code.
464	* @param pVM The VM to operate on.
465	*/
466	PATMR3DECL(int) PATMR3Term(PVM pVM)
467	{
468	/* Memory was all allocated from the two MM heaps and requires no freeing. */
469	return VINF_SUCCESS;
470	}
471
472
473	/**
474	* PATM reset callback.
475	*
476	* @returns VBox status code.
477	* @param pVM The VM which is reset.
478	*/
479	PATMR3DECL(int) PATMR3Reset(PVM pVM)
480	{
481	Log(("PATMR3Reset\n"));
482
483	/* Free all patches. */
484	while (true)
485	{
486	PPATMPATCHREC pPatchRec = (PPATMPATCHREC)RTAvloGCPtrRemoveBestFit(&pVM->patm.s.PatchLookupTreeHC->PatchTree, 0, true);
487	if (pPatchRec)
488	{
489	PATMRemovePatch(pVM, pPatchRec, true);
490	}
491	else
492	break;
493	}
494	Assert(!pVM->patm.s.PatchLookupTreeHC->PatchTreeByPage);
495	Assert(!pVM->patm.s.PatchLookupTreeHC->PatchTree);
496	pVM->patm.s.PatchLookupTreeHC->PatchTreeByPatchAddr = 0;
497	pVM->patm.s.PatchLookupTreeHC->PatchTreeByPage = 0;
498
499	int rc = patmReinit(pVM);
500	if (VBOX_SUCCESS(rc))
501	rc = PATMR3InitFinalize(pVM); /* paranoia */
502
503	return rc;
504	}
505
506	/**
507	* Read callback for disassembly function; supports reading bytes that cross a page boundary
508	*
509	* @returns VBox status code.
510	* @param pSrc GC source pointer
511	* @param pDest HC destination pointer
512	* @param size Number of bytes to read
513	* @param pvUserdata Callback specific user data (pCpu)
514	*
515	*/
516	int patmReadBytes(RTHCUINTPTR pSrc, uint8_t pDest, unsigned size, void pvUserdata)
517	{
518	DISCPUSTATE pCpu = (DISCPUSTATE )pvUserdata;
519	PATMDISASM pDisInfo = (PATMDISASM )pCpu->apvUserData[0];
520	int orgsize = size;
521
522	Assert(size);
523	if (size == 0)
524	return VERR_INVALID_PARAMETER;
525
526	/*
527	* Trap/interrupt handler typically call common code on entry. Which might already have patches inserted.
528	* As we currently don't support calling patch code from patch code, we'll let it read the original opcode bytes instead.
529	*/
530	/** @todo could change in the future! */
531	if (pDisInfo->fReadFlags & PATMREAD_ORGCODE)
532	{
533	for (int i=0;i<orgsize;i++)
534	{
535	int rc = PATMR3QueryOpcode(pDisInfo->pVM, (RTGCPTR)pSrc, pDest);
536	if (VBOX_SUCCESS(rc))
537	{
538	pSrc++;
539	pDest++;
540	size--;
541	}
542	else break;
543	}
544	if (size == 0)
545	return VINF_SUCCESS;
546	#ifdef VBOX_STRICT
547	if ( !(pDisInfo->pPatchInfo->flags & (PATMFL_DUPLICATE_FUNCTION\|PATMFL_IDTHANDLER))
548	&& !(pDisInfo->fReadFlags & PATMREAD_NOCHECK))
549	{
550	Assert(PATMR3IsInsidePatchJump(pDisInfo->pVM, pSrc, NULL) == false);
551	Assert(PATMR3IsInsidePatchJump(pDisInfo->pVM, pSrc+size-1, NULL) == false);
552	}
553	#endif
554	}
555
556
557	if (PAGE_ADDRESS(pDisInfo->pInstrGC) != PAGE_ADDRESS(pSrc + size - 1) && !PATMIsPatchGCAddr(pDisInfo->pVM, pSrc))
558	{
559	return PGMPhysReadGCPtr(pDisInfo->pVM, pDest, pSrc, size);
560	}
561	else
562	{
563	uint8_t *pInstrHC = pDisInfo->pInstrHC;
564
565	Assert(pInstrHC);
566
567	/* pInstrHC is the base address; adjust according to the GC pointer. */
568	pInstrHC = pInstrHC + (pSrc - pDisInfo->pInstrGC);
569
570	memcpy(pDest, (void *)pInstrHC, size);
571	}
572
573	return VINF_SUCCESS;
574	}
575
576	/**
577	* Callback function for RTAvloGCPtrDoWithAll
578	*
579	* Updates all fixups in the patches
580	*
581	* @returns VBox status code.
582	* @param pNode Current node
583	* @param pParam The VM to operate on.
584	*/
585	static DECLCALLBACK(int) RelocatePatches(PAVLOGCPTRNODECORE pNode, void *pParam)
586	{
587	PPATMPATCHREC pPatch = (PPATMPATCHREC)pNode;
588	PVM pVM = (PVM)pParam;
589	RTGCINTPTR delta;
590	#ifdef LOG_ENABLED
591	DISCPUSTATE cpu;
592	char szOutput[256];
593	uint32_t opsize;
594	bool disret;
595	#endif
596	int rc;
597
598	/* Nothing to do if the patch is not active. */
599	if (pPatch->patch.uState == PATCH_REFUSED)
600	return 0;
601
602	#ifdef LOG_ENABLED
603	if (pPatch->patch.flags & PATMFL_PATCHED_GUEST_CODE)
604	{
605	/** @note pPrivInstrHC is probably not valid anymore */
606	rc = PGMPhysGCPtr2HCPtr(pVM, pPatch->patch.pPrivInstrGC, (PRTHCPTR)&pPatch->patch.pPrivInstrHC);
607	if (rc == VINF_SUCCESS)
608	{
609	cpu.mode = (pPatch->patch.flags & PATMFL_CODE32) ? CPUMODE_32BIT : CPUMODE_16BIT;
610	disret = PATMR3DISInstr(pVM, &pPatch->patch, &cpu, pPatch->patch.pPrivInstrGC, pPatch->patch.pPrivInstrHC, &opsize, szOutput, PATMREAD_RAWCODE);
611	Log(("Org patch jump: %s", szOutput));
612	}
613	}
614	#endif
615
616	Log(("Nr of fixups %d\n", pPatch->patch.nrFixups));
617	delta = (RTGCINTPTR)pVM->patm.s.deltaReloc;
618
619	/*
620	* Apply fixups
621	*/
622	PRELOCREC pRec = 0;
623	AVLPVKEY key = 0;
624
625	while (true)
626	{
627	/* Get the record that's closest from above */
628	pRec = (PRELOCREC)RTAvlPVGetBestFit(&pPatch->patch.FixupTree, key, true);
629	if (pRec == 0)
630	break;
631
632	key = (AVLPVKEY)(pRec->pRelocPos + 1); /* search for the next record during the next round. */
633
634	switch (pRec->uType)
635	{
636	case FIXUP_ABSOLUTE:
637	Log(("Absolute fixup at %VGv %VHv -> %VHv at %VGv\n", pRec->pSource, (RTGCUINTPTR)pRec->pRelocPos, (RTGCINTPTR)pRec->pRelocPos + delta, pRec->pRelocPos));
638	if (!pRec->pSource \|\| PATMIsPatchGCAddr(pVM, pRec->pSource))
639	{
640	(RTGCUINTPTR )pRec->pRelocPos += delta;
641	}
642	else
643	{
644	uint8_t curInstr[15];
645	uint8_t oldInstr[15];
646	Assert(pRec->pSource && pPatch->patch.cbPrivInstr <= 15);
647
648	Assert(!(pPatch->patch.flags & PATMFL_GLOBAL_FUNCTIONS));
649
650	memcpy(oldInstr, pPatch->patch.aPrivInstr, pPatch->patch.cbPrivInstr);
651	(RTGCPTR )&oldInstr[pPatch->patch.cbPrivInstr - sizeof(RTGCPTR)] = pRec->pDest;
652
653	rc = PGMPhysReadGCPtr(pVM, curInstr, pPatch->patch.pPrivInstrGC, pPatch->patch.cbPrivInstr);
654	Assert(VBOX_SUCCESS(rc) \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT);
655
656	pRec->pDest = (RTGCPTR)((RTGCUINTPTR)pRec->pDest + delta);
657
658	if (rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT)
659	{
660	RTGCPTR pPage = pPatch->patch.pPrivInstrGC & PAGE_BASE_GC_MASK;
661
662	Log(("PATM: Patch page not present -> check later!\n"));
663	rc = PGMR3HandlerVirtualRegister(pVM, PGMVIRTHANDLERTYPE_ALL, pPage, pPage + (PAGE_SIZE - 1) /* inclusive! */, 0, patmVirtPageHandler, "PATMGCMonitorPage", 0, "PATMMonitorPatchJump");
664	Assert(VBOX_SUCCESS(rc) \|\| rc == VERR_PGM_HANDLER_VIRTUAL_CONFLICT);
665	}
666	else
667	if (memcmp(curInstr, oldInstr, pPatch->patch.cbPrivInstr))
668	{
669	Log(("PATM: Patch was overwritten -> disabling patch!!\n"));
670	/*
671	* Disable patch; this is not a good solution
672	*/
673	/* @todo hopefully it was completely overwritten (if the read was successful)!!!! */
674	pPatch->patch.uState = PATCH_DISABLED;
675	}
676	else
677	if (VBOX_SUCCESS(rc))
678	{
679	(RTGCPTR )&curInstr[pPatch->patch.cbPrivInstr - sizeof(RTGCPTR)] = pRec->pDest;
680	rc = PGMPhysWriteGCPtrDirty(pVM, pRec->pSource, curInstr, pPatch->patch.cbPrivInstr);
681	AssertRC(rc);
682	}
683	}
684	break;
685
686	case FIXUP_REL_JMPTOPATCH:
687	{
688	RTGCPTR pTarget = (RTGCPTR)((RTGCINTPTR)pRec->pDest + delta);
689
690	if ( pPatch->patch.uState == PATCH_ENABLED
691	&& (pPatch->patch.flags & PATMFL_PATCHED_GUEST_CODE))
692	{
693	uint8_t oldJump[SIZEOF_NEAR_COND_JUMP32];
694	uint8_t temp[SIZEOF_NEAR_COND_JUMP32];
695	RTGCPTR pJumpOffGC;
696	RTGCINTPTR displ = (RTGCINTPTR)pTarget - (RTGCINTPTR)pRec->pSource;
697	RTGCINTPTR displOld= (RTGCINTPTR)pRec->pDest - (RTGCINTPTR)pRec->pSource;
698
699	Log(("Relative fixup (g2p) %08X -> %08X at %08X (source=%08x, target=%08x)\n", (int32_t)pRec->pRelocPos, displ, pRec->pRelocPos, pRec->pSource, pRec->pDest));
700
701	Assert(pRec->pSource - pPatch->patch.cbPatchJump == pPatch->patch.pPrivInstrGC);
702	#ifdef PATM_RESOLVE_CONFLICTS_WITH_JUMP_PATCHES
703	if (pPatch->patch.cbPatchJump == SIZEOF_NEAR_COND_JUMP32)
704	{
705	Assert(pPatch->patch.flags & PATMFL_JUMP_CONFLICT);
706
707	pJumpOffGC = pPatch->patch.pPrivInstrGC + 2; //two byte opcode
708	oldJump[0] = pPatch->patch.aPrivInstr[0];
709	oldJump[1] = pPatch->patch.aPrivInstr[1];
710	(RTGCUINTPTR )&oldJump[2] = displOld;
711	}
712	else
713	#endif
714	if (pPatch->patch.cbPatchJump == SIZEOF_NEARJUMP32)
715	{
716	pJumpOffGC = pPatch->patch.pPrivInstrGC + 1; //one byte opcode
717	oldJump[0] = 0xE9;
718	(RTGCUINTPTR )&oldJump[1] = displOld;
719	}
720	else
721	{
722	AssertMsgFailed(("Invalid patch jump size %d\n", pPatch->patch.cbPatchJump));
723	continue; //this should never happen!!
724	}
725	Assert(pPatch->patch.cbPatchJump <= sizeof(temp));
726
727	/*
728	* Read old patch jump and compare it to the one we previously installed
729	*/
730	rc = PGMPhysReadGCPtr(pVM, temp, pPatch->patch.pPrivInstrGC, pPatch->patch.cbPatchJump);
731	Assert(VBOX_SUCCESS(rc) \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT);
732
733	if (rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT)
734	{
735	RTGCPTR pPage = pPatch->patch.pPrivInstrGC & PAGE_BASE_GC_MASK;
736
737	rc = PGMR3HandlerVirtualRegister(pVM, PGMVIRTHANDLERTYPE_ALL, pPage, pPage + (PAGE_SIZE - 1) /* inclusive! */, 0, patmVirtPageHandler, "PATMGCMonitorPage", 0, "PATMMonitorPatchJump");
738	Assert(VBOX_SUCCESS(rc) \|\| rc == VERR_PGM_HANDLER_VIRTUAL_CONFLICT);
739	}
740	else
741	if (memcmp(temp, oldJump, pPatch->patch.cbPatchJump))
742	{
743	Log(("PATM: Patch jump was overwritten -> disabling patch!!\n"));
744	/*
745	* Disable patch; this is not a good solution
746	*/
747	/* @todo hopefully it was completely overwritten (if the read was successful)!!!! */
748	pPatch->patch.uState = PATCH_DISABLED;
749	}
750	else
751	if (VBOX_SUCCESS(rc))
752	{
753	rc = PGMPhysWriteGCPtrDirty(pVM, pJumpOffGC, &displ, sizeof(displ));
754	AssertRC(rc);
755	}
756	else
757	{
758	AssertMsgFailed(("Unexpected error %d from MMR3PhysReadGCVirt\n", rc));
759	}
760	}
761	else
762	{
763	Log(("Skip the guest jump to patch code for this disabled patch %08X - %08X\n", pPatch->patch.pPrivInstrHC, pRec->pRelocPos));
764	}
765
766	pRec->pDest = pTarget;
767	break;
768	}
769
770	case FIXUP_REL_JMPTOGUEST:
771	{
772	RTGCPTR pSource = (RTGCPTR)((RTGCINTPTR)pRec->pSource + delta);
773	RTGCINTPTR displ = (RTGCINTPTR)pRec->pDest - (RTGCINTPTR)pSource;
774
775	Assert(!(pPatch->patch.flags & PATMFL_GLOBAL_FUNCTIONS));
776	Log(("Relative fixup (p2g) %08X -> %08X at %08X (source=%08x, target=%08x)\n", (int32_t)pRec->pRelocPos, displ, pRec->pRelocPos, pRec->pSource, pRec->pDest));
777	(RTGCUINTPTR )pRec->pRelocPos = displ;
778	pRec->pSource = pSource;
779	break;
780	}
781
782	default:
783	AssertMsg(0, ("Invalid fixup type!!\n"));
784	return VERR_INVALID_PARAMETER;
785	}
786	}
787
788	#ifdef LOG_ENABLED
789	if (pPatch->patch.flags & PATMFL_PATCHED_GUEST_CODE)
790	{
791	/** @note pPrivInstrHC is probably not valid anymore */
792	rc = PGMPhysGCPtr2HCPtr(pVM, pPatch->patch.pPrivInstrGC, (PRTHCPTR)&pPatch->patch.pPrivInstrHC);
793	if (rc == VINF_SUCCESS)
794	{
795	cpu.mode = (pPatch->patch.flags & PATMFL_CODE32) ? CPUMODE_32BIT : CPUMODE_16BIT;
796	disret = PATMR3DISInstr(pVM, &pPatch->patch, &cpu, pPatch->patch.pPrivInstrGC, pPatch->patch.pPrivInstrHC, &opsize, szOutput, PATMREAD_RAWCODE);
797	Log(("Rel patch jump: %s", szOutput));
798	}
799	}
800	#endif
801	return 0;
802	}
803
804	/**
805	* #PF Handler callback for virtual access handler ranges.
806	*
807	* Important to realize that a physical page in a range can have aliases, and
808	* for ALL and WRITE handlers these will also trigger.
809	*
810	* @returns VINF_SUCCESS if the handler have carried out the operation.
811	* @returns VINF_PGM_HANDLER_DO_DEFAULT if the caller should carry out the access operation.
812	* @param pVM VM Handle.
813	* @param GCPtr The virtual address the guest is writing to. (not correct if it's an alias!)
814	* @param pvPtr The HC mapping of that address.
815	* @param pvBuf What the guest is reading/writing.
816	* @param cbBuf How much it's reading/writing.
817	* @param enmAccessType The access type.
818	* @param pvUser User argument.
819	*/
820	static DECLCALLBACK(int) patmVirtPageHandler(PVM pVM, RTGCPTR GCPtr, void pvPtr, void pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType, void *pvUser)
821	{
822	Assert(enmAccessType == PGMACCESSTYPE_WRITE);
823	/** @todo could be the wrong virtual address (alias) */
824	pVM->patm.s.pvFaultMonitor = GCPtr;
825	PATMR3HandleMonitoredPage(pVM);
826	return VINF_PGM_HANDLER_DO_DEFAULT;
827	}
828
829
830	#ifdef VBOX_WITH_DEBUGGER
831	/**
832	* Callback function for RTAvloGCPtrDoWithAll
833	*
834	* Enables the patch that's being enumerated
835	*
836	* @returns 0 (continue enumeration).
837	* @param pNode Current node
838	* @param pVM The VM to operate on.
839	*/
840	static DECLCALLBACK(int) EnableAllPatches(PAVLOGCPTRNODECORE pNode, void *pVM)
841	{
842	PPATMPATCHREC pPatch = (PPATMPATCHREC)pNode;
843
844	PATMR3EnablePatch((PVM)pVM, (RTGCPTR)pPatch->Core.Key);
845	return 0;
846	}
847	#endif /* VBOX_WITH_DEBUGGER */
848
849
850	#ifdef VBOX_WITH_DEBUGGER
851	/**
852	* Callback function for RTAvloGCPtrDoWithAll
853	*
854	* Disables the patch that's being enumerated
855	*
856	* @returns 0 (continue enumeration).
857	* @param pNode Current node
858	* @param pVM The VM to operate on.
859	*/
860	static DECLCALLBACK(int) DisableAllPatches(PAVLOGCPTRNODECORE pNode, void *pVM)
861	{
862	PPATMPATCHREC pPatch = (PPATMPATCHREC)pNode;
863
864	PATMR3DisablePatch((PVM)pVM, (RTGCPTR)pPatch->Core.Key);
865	return 0;
866	}
867	#endif
868
869	/**
870	* Returns the host context pointer and size of the patch memory block
871	*
872	* @returns VBox status code.
873	* @param pVM The VM to operate on.
874	* @param pcb Size of the patch memory block
875	*/
876	PATMR3DECL(void ) PATMR3QueryPatchMemHC(PVM pVM, uint32_t pcb)
877	{
878	if (pcb)
879	{
880	*pcb = pVM->patm.s.cbPatchMem;
881	}
882	return pVM->patm.s.pPatchMemHC;
883	}
884
885
886	/**
887	* Returns the guest context pointer and size of the patch memory block
888	*
889	* @returns VBox status code.
890	* @param pVM The VM to operate on.
891	* @param pcb Size of the patch memory block
892	*/
893	PATMR3DECL(RTGCPTR) PATMR3QueryPatchMemGC(PVM pVM, uint32_t *pcb)
894	{
895	if (pcb)
896	{
897	*pcb = pVM->patm.s.cbPatchMem;
898	}
899	return pVM->patm.s.pPatchMemGC;
900	}
901
902
903	/**
904	* Returns the host context pointer of the GC context structure
905	*
906	* @returns VBox status code.
907	* @param pVM The VM to operate on.
908	*/
909	PATMR3DECL(PPATMGCSTATE) PATMR3QueryGCStateHC(PVM pVM)
910	{
911	return pVM->patm.s.pGCStateHC;
912	}
913
914
915	/**
916	* Checks whether the HC address is part of our patch region
917	*
918	* @returns VBox status code.
919	* @param pVM The VM to operate on.
920	* @param pAddrGC Guest context address
921	*/
922	PATMR3DECL(bool) PATMR3IsPatchHCAddr(PVM pVM, R3PTRTYPE(uint8_t *) pAddrHC)
923	{
924	return (pAddrHC >= pVM->patm.s.pPatchMemHC && pAddrHC < pVM->patm.s.pPatchMemHC + pVM->patm.s.cbPatchMem) ? true : false;
925	}
926
927
928	/**
929	* Allows or disallow patching of privileged instructions executed by the guest OS
930	*
931	* @returns VBox status code.
932	* @param pVM The VM to operate on.
933	* @param fAllowPatching Allow/disallow patching
934	*/
935	PATMR3DECL(int) PATMR3AllowPatching(PVM pVM, uint32_t fAllowPatching)
936	{
937	pVM->fPATMEnabled = (fAllowPatching) ? true : false;
938	return VINF_SUCCESS;
939	}
940
941	/**
942	* Convert a GC patch block pointer to a HC patch pointer
943	*
944	* @returns HC pointer or NULL if it's not a GC patch pointer
945	* @param pVM The VM to operate on.
946	* @param pAddrGC GC pointer
947	*/
948	PATMR3DECL(R3PTRTYPE(void *)) PATMR3GCPtrToHCPtr(PVM pVM, RTGCPTR pAddrGC)
949	{
950	if (pVM->patm.s.pPatchMemGC <= pAddrGC && pVM->patm.s.pPatchMemGC + pVM->patm.s.cbPatchMem > pAddrGC)
951	{
952	return pVM->patm.s.pPatchMemHC + (pAddrGC - pVM->patm.s.pPatchMemGC);
953	}
954	return NULL;
955	}
956
957	/**
958	* Query PATM state (enabled/disabled)
959	*
960	* @returns 0 - disabled, 1 - enabled
961	* @param pVM The VM to operate on.
962	*/
963	PATMR3DECL(int) PATMR3IsEnabled(PVM pVM)
964	{
965	return pVM->fPATMEnabled;
966	}
967
968
969	/**
970	* Convert guest context address to host context pointer
971	*
972	* @returns VBox status code.
973	* @param pVM The VM to operate on.
974	* @param pPatch Patch block structure pointer
975	* @param pGCPtr Guest context pointer
976	*
977	* @returns Host context pointer or NULL in case of an error
978	*
979	*/
980	R3PTRTYPE(uint8_t ) PATMGCVirtToHCVirt(PVM pVM, PPATCHINFO pPatch, GCPTRTYPE(uint8_t ) pGCPtr)
981	{
982	int rc;
983	R3PTRTYPE(uint8_t *) pHCPtr;
984	uint32_t offset;
985
986	if (PATMIsPatchGCAddr(pVM, pGCPtr))
987	{
988	return PATCHCODE_PTR_HC(pPatch) + (pGCPtr - PATCHCODE_PTR_GC(pPatch));
989	}
990
991	offset = pGCPtr & PAGE_OFFSET_MASK;
992	if (pPatch->cacheRec.pGuestLoc == (pGCPtr & PAGE_BASE_GC_MASK))
993	{
994	return pPatch->cacheRec.pPatchLocStartHC + offset;
995	}
996
997	rc = PGMPhysGCPtr2HCPtr(pVM, pGCPtr, (void **)&pHCPtr);
998	if (rc != VINF_SUCCESS)
999	{
1000	AssertMsg(rc == VINF_SUCCESS \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT, ("MMR3PhysGCVirt2HCVirtEx failed for %08X\n", pGCPtr));
1001	return NULL;
1002	}
1003	////invalid? Assert(sizeof(R3PTRTYPE(uint8_t*)) == sizeof(uint32_t));
1004
1005	pPatch->cacheRec.pPatchLocStartHC = (R3PTRTYPE(uint8_t*))((RTHCUINTPTR)pHCPtr & PAGE_BASE_HC_MASK);
1006	pPatch->cacheRec.pGuestLoc = pGCPtr & PAGE_BASE_GC_MASK;
1007	return pHCPtr;
1008	}
1009
1010
1011	/* Calculates and fills in all branch targets
1012	*
1013	* @returns VBox status code.
1014	* @param pVM The VM to operate on.
1015	* @param pPatch Current patch block pointer
1016	*
1017	*/
1018	static int patmr3SetBranchTargets(PVM pVM, PPATCHINFO pPatch)
1019	{
1020	int32_t displ;
1021
1022	PJUMPREC pRec = 0;
1023	int nrJumpRecs = 0;
1024
1025	/*
1026	* Set all branch targets inside the patch block.
1027	* We remove all jump records as they are no longer needed afterwards.
1028	*/
1029	while (true)
1030	{
1031	GCPTRTYPE(uint8_t *) pInstrGC;
1032	GCPTRTYPE(uint8_t *) pBranchTargetGC = 0;
1033
1034	pRec = (PJUMPREC)RTAvlPVRemoveBestFit(&pPatch->JumpTree, 0, true);
1035	if (pRec == 0)
1036	break;
1037
1038	nrJumpRecs++;
1039
1040	/* HC in patch block to GC in patch block. */
1041	pInstrGC = patmPatchHCPtr2PatchGCPtr(pVM, pRec->pJumpHC);
1042
1043	if (pRec->opcode == OP_CALL)
1044	{
1045	/* Special case: call function replacement patch from this patch block.
1046	*/
1047	if (PATMQueryFunctionPatch(pVM, pRec->pTargetGC) == 0)
1048	{
1049	int rc;
1050
1051	if (PATMR3HasBeenPatched(pVM, pRec->pTargetGC) == false)
1052	rc = PATMR3InstallPatch(pVM, pRec->pTargetGC, PATMFL_CODE32 \| PATMFL_DUPLICATE_FUNCTION);
1053	else
1054	rc = VERR_PATCHING_REFUSED; /* exists as a normal patch; can't use it */
1055
1056	if (VBOX_FAILURE(rc))
1057	{
1058	uint8_t *pPatchHC;
1059	RTGCPTR pPatchGC;
1060	RTGCPTR pOrgInstrGC;
1061
1062	pOrgInstrGC = PATMR3PatchToGCPtr(pVM, pInstrGC, 0);
1063	Assert(pOrgInstrGC);
1064
1065	/* Failure for some reason -> mark exit point with int 3. */
1066	Log(("Failed to install function replacement patch (at %x) for reason %Vrc\n", pOrgInstrGC, rc));
1067
1068	pPatchGC = patmGuestGCPtrToPatchGCPtr(pVM, pPatch, pOrgInstrGC);
1069	Assert(pPatchGC);
1070
1071	pPatchHC = pVM->patm.s.pPatchMemHC + (pPatchGC - pVM->patm.s.pPatchMemGC);
1072
1073	/* Set a breakpoint at the very beginning of the recompiled instruction */
1074	*pPatchHC = 0xCC;
1075
1076	continue;
1077	}
1078	}
1079	pBranchTargetGC = PATMR3QueryPatchGCPtr(pVM, pRec->pTargetGC);
1080	}
1081	else
1082	{
1083	pBranchTargetGC = patmGuestGCPtrToPatchGCPtr(pVM, pPatch, pRec->pTargetGC);
1084	}
1085
1086	if (pBranchTargetGC == 0)
1087	{
1088	AssertMsgFailed(("patmr3SetBranchTargets: patmGuestGCPtrToPatchGCPtr failed for %08X\n", pRec->pTargetGC));
1089	return VERR_PATCHING_REFUSED;
1090	}
1091	/* Our jumps always have a dword displacement (to make things easier). */
1092	Assert(sizeof(uint32_t) == sizeof(RTGCPTR));
1093	displ = pBranchTargetGC - (pInstrGC + pRec->offDispl + sizeof(RTGCPTR));
1094	(RTGCPTR )(pRec->pJumpHC + pRec->offDispl) = displ;
1095	Log(("Set branch target %d to %08X : %08x - (%08x + %d + %d)\n", nrJumpRecs, displ, pBranchTargetGC, pInstrGC, pRec->offDispl, sizeof(RTGCPTR)));
1096	}
1097	Assert(nrJumpRecs == pPatch->nrJumpRecs);
1098	Assert(pPatch->JumpTree == 0);
1099	return VINF_SUCCESS;
1100	}
1101
1102	/* Add an illegal instruction record
1103	*
1104	* @param pVM The VM to operate on.
1105	* @param pPatch Patch structure ptr
1106	* @param pInstrGC Guest context pointer to privileged instruction
1107	*
1108	*/
1109	static void patmAddIllegalInstrRecord(PVM pVM, PPATCHINFO pPatch, RTGCPTR pInstrGC)
1110	{
1111	PAVLPVNODECORE pRec;
1112
1113	pRec = (PAVLPVNODECORE)MMR3HeapAllocZ(pVM, MM_TAG_PATM_PATCH, sizeof(*pRec));
1114	Assert(pRec);
1115	pRec->Key = (AVLPVKEY)pInstrGC;
1116
1117	bool ret = RTAvlPVInsert(&pPatch->pTempInfo->IllegalInstrTree, pRec);
1118	Assert(ret); NOREF(ret);
1119	pPatch->pTempInfo->nrIllegalInstr++;
1120	}
1121
1122	static bool patmIsIllegalInstr(PPATCHINFO pPatch, RTGCPTR pInstrGC)
1123	{
1124	PAVLPVNODECORE pRec;
1125
1126	pRec = RTAvlPVGet(&pPatch->pTempInfo->IllegalInstrTree, (AVLPVKEY)pInstrGC);
1127	if (pRec)
1128	return true;
1129	return false;
1130	}
1131
1132	/**
1133	* Add a patch to guest lookup record
1134	*
1135	* @param pVM The VM to operate on.
1136	* @param pPatch Patch structure ptr
1137	* @param pPatchInstrHC Guest context pointer to patch block
1138	* @param pInstrGC Guest context pointer to privileged instruction
1139	* @param enmType Lookup type
1140	* @param fDirty Dirty flag
1141	*
1142	*/
1143	/** @note Be extremely careful with this function. Make absolutely sure the guest address is correct! (to avoid executing instructions twice!) */
1144	void patmr3AddP2GLookupRecord(PVM pVM, PPATCHINFO pPatch, uint8_t *pPatchInstrHC, RTGCPTR pInstrGC, PATM_LOOKUP_TYPE enmType, bool fDirty)
1145	{
1146	bool ret;
1147	PRECPATCHTOGUEST pPatchToGuestRec;
1148	PRECGUESTTOPATCH pGuestToPatchRec;
1149	uint32_t PatchOffset = pPatchInstrHC - pVM->patm.s.pPatchMemHC; /* Offset in memory reserved for PATM. */
1150
1151	if (enmType == PATM_LOOKUP_PATCH2GUEST)
1152	{
1153	pPatchToGuestRec = (PRECPATCHTOGUEST)RTAvlU32Get(&pPatch->Patch2GuestAddrTree, PatchOffset);
1154	if (pPatchToGuestRec && pPatchToGuestRec->Core.Key == PatchOffset)
1155	return; /* already there */
1156
1157	Assert(!pPatchToGuestRec);
1158	}
1159	#ifdef VBOX_STRICT
1160	else
1161	{
1162	pPatchToGuestRec = (PRECPATCHTOGUEST)RTAvlU32Get(&pPatch->Patch2GuestAddrTree, PatchOffset);
1163	Assert(!pPatchToGuestRec);
1164	}
1165	#endif
1166
1167	pPatchToGuestRec = (PRECPATCHTOGUEST)MMR3HeapAllocZ(pVM, MM_TAG_PATM_PATCH, sizeof(RECPATCHTOGUEST) + sizeof(RECGUESTTOPATCH));
1168	Assert(pPatchToGuestRec);
1169	pPatchToGuestRec->Core.Key = PatchOffset;
1170	pPatchToGuestRec->pOrgInstrGC = pInstrGC;
1171	pPatchToGuestRec->enmType = enmType;
1172	pPatchToGuestRec->fDirty = fDirty;
1173
1174	ret = RTAvlU32Insert(&pPatch->Patch2GuestAddrTree, &pPatchToGuestRec->Core);
1175	Assert(ret);
1176
1177	/* GC to patch address */
1178	if (enmType == PATM_LOOKUP_BOTHDIR)
1179	{
1180	pGuestToPatchRec = (PRECGUESTTOPATCH)RTAvlGCPtrGet(&pPatch->Guest2PatchAddrTree, pInstrGC);
1181	if (!pGuestToPatchRec)
1182	{
1183	pGuestToPatchRec = (PRECGUESTTOPATCH)(pPatchToGuestRec+1);
1184	pGuestToPatchRec->Core.Key = pInstrGC;
1185	pGuestToPatchRec->PatchOffset = PatchOffset;
1186
1187	ret = RTAvlGCPtrInsert(&pPatch->Guest2PatchAddrTree, &pGuestToPatchRec->Core);
1188	Assert(ret);
1189	}
1190	}
1191
1192	pPatch->nrPatch2GuestRecs++;
1193	}
1194
1195
1196	/**
1197	* Removes a patch to guest lookup record
1198	*
1199	* @param pVM The VM to operate on.
1200	* @param pPatch Patch structure ptr
1201	* @param pPatchInstrGC Guest context pointer to patch block
1202	*/
1203	void patmr3RemoveP2GLookupRecord(PVM pVM, PPATCHINFO pPatch, RTGCPTR pPatchInstrGC)
1204	{
1205	PAVLU32NODECORE pNode;
1206	PAVLGCPTRNODECORE pNode2;
1207	PRECPATCHTOGUEST pPatchToGuestRec;
1208	uint32_t PatchOffset = pPatchInstrGC - pVM->patm.s.pPatchMemGC; /* Offset in memory reserved for PATM. */
1209
1210	pPatchToGuestRec = (PRECPATCHTOGUEST)RTAvlU32Get(&pPatch->Patch2GuestAddrTree, PatchOffset);
1211	Assert(pPatchToGuestRec);
1212	if (pPatchToGuestRec)
1213	{
1214	if (pPatchToGuestRec->enmType == PATM_LOOKUP_BOTHDIR)
1215	{
1216	PRECGUESTTOPATCH pGuestToPatchRec = (PRECGUESTTOPATCH)(pPatchToGuestRec+1);
1217
1218	Assert(pGuestToPatchRec->Core.Key);
1219	pNode2 = RTAvlGCPtrRemove(&pPatch->Guest2PatchAddrTree, pGuestToPatchRec->Core.Key);
1220	Assert(pNode2);
1221	}
1222	pNode = RTAvlU32Remove(&pPatch->Patch2GuestAddrTree, pPatchToGuestRec->Core.Key);
1223	Assert(pNode);
1224
1225	MMR3HeapFree(pPatchToGuestRec);
1226	pPatch->nrPatch2GuestRecs--;
1227	}
1228	}
1229
1230
1231	/**
1232	* RTAvlPVDestroy callback.
1233	*/
1234	static DECLCALLBACK(int) patmEmptyTreePVCallback(PAVLPVNODECORE pNode, void *)
1235	{
1236	MMR3HeapFree(pNode);
1237	return 0;
1238	}
1239
1240	/**
1241	* Empty the specified tree (PV tree, MMR3 heap)
1242	*
1243	* @param pVM The VM to operate on.
1244	* @param ppTree Tree to empty
1245	*/
1246	void patmEmptyTree(PVM pVM, PAVLPVNODECORE *ppTree)
1247	{
1248	RTAvlPVDestroy(ppTree, patmEmptyTreePVCallback, NULL);
1249	}
1250
1251
1252	/**
1253	* RTAvlU32Destroy callback.
1254	*/
1255	static DECLCALLBACK(int) patmEmptyTreeU32Callback(PAVLU32NODECORE pNode, void *)
1256	{
1257	MMR3HeapFree(pNode);
1258	return 0;
1259	}
1260
1261	/**
1262	* Empty the specified tree (U32 tree, MMR3 heap)
1263	*
1264	* @param pVM The VM to operate on.
1265	* @param ppTree Tree to empty
1266	*/
1267	void patmEmptyTreeU32(PVM pVM, PPAVLU32NODECORE ppTree)
1268	{
1269	RTAvlU32Destroy(ppTree, patmEmptyTreeU32Callback, NULL);
1270	}
1271
1272
1273	/**
1274	* Analyses the instructions following the cli for compliance with our heuristics for cli & pushf
1275	*
1276	* @returns VBox status code.
1277	* @param pVM The VM to operate on.
1278	* @param pCpu CPU disassembly state
1279	* @param pInstrGC Guest context pointer to privileged instruction
1280	* @param pCurInstrGC Guest context pointer to the current instruction
1281	* @param pUserData User pointer (callback specific)
1282	*
1283	*/
1284	static int patmAnalyseBlockCallback(PVM pVM, DISCPUSTATE pCpu, GCPTRTYPE(uint8_t ) pInstrGC, GCPTRTYPE(uint8_t ) pCurInstrGC, void pUserData)
1285	{
1286	PPATCHINFO pPatch = (PPATCHINFO)pUserData;
1287	bool fIllegalInstr = false;
1288
1289	//Preliminary heuristics:
1290	//- no call instructions without a fixed displacement between cli and sti/popf
1291	//- no jumps in the instructions following cli (4+ bytes; enough for the replacement jump (5 bytes))
1292	//- no nested pushf/cli
1293	//- sti/popf should be the (eventual) target of all branches
1294	//- no near or far returns; no int xx, no into
1295	//
1296	// Note: Later on we can impose less stricter guidelines if the need arises
1297
1298	/* Bail out if the patch gets too big. */
1299	if (pPatch->cbPatchBlockSize >= MAX_PATCH_SIZE)
1300	{
1301	Log(("Code block too big (%x) for patch at %VGv!!\n", pPatch->cbPatchBlockSize, pCurInstrGC));
1302	fIllegalInstr = true;
1303	patmAddIllegalInstrRecord(pVM, pPatch, pCurInstrGC);
1304	}
1305	else
1306	{
1307	/* No unconditinal jumps or calls without fixed displacements. */
1308	if ( (pCpu->pCurInstr->optype & OPTYPE_CONTROLFLOW)
1309	&& (pCpu->pCurInstr->opcode == OP_JMP \|\| pCpu->pCurInstr->opcode == OP_CALL)
1310	)
1311	{
1312	Assert(pCpu->param1.size <= 4 \|\| pCpu->param1.size == 6);
1313	if ( pCpu->param1.size == 6 /* far call/jmp */
1314	\|\| (pCpu->pCurInstr->opcode == OP_CALL && !(pPatch->flags & PATMFL_SUPPORT_CALLS))
1315	\|\| (OP_PARM_VTYPE(pCpu->pCurInstr->param1) != OP_PARM_J && !(pPatch->flags & PATMFL_SUPPORT_INDIRECT_CALLS))
1316	)
1317	{
1318	fIllegalInstr = true;
1319	patmAddIllegalInstrRecord(pVM, pPatch, pCurInstrGC);
1320	}
1321	}
1322
1323	/* An unconditional (short) jump right after a cli is a potential problem; we will overwrite whichever function comes afterwards */
1324	if (pPatch->opcode == OP_CLI && pCpu->pCurInstr->opcode == OP_JMP)
1325	{
1326	if (pCurInstrGC > pPatch->pPrivInstrGC && pCurInstrGC + pCpu->opsize < pPatch->pPrivInstrGC + SIZEOF_NEARJUMP32) /* hardcoded patch jump size; cbPatchJump is still zero */
1327	{
1328	Log(("Dangerous unconditional jump ends in our generated patch jump!! (%x vs %x)\n", pCurInstrGC, pPatch->pPrivInstrGC));
1329	/* We turn this one into a int 3 callable patch. */
1330	pPatch->flags \|= PATMFL_INT3_REPLACEMENT_BLOCK;
1331	}
1332	}
1333	else
1334	/* no nested pushfs just yet; nested cli is allowed for cli patches though. */
1335	if (pPatch->opcode == OP_PUSHF)
1336	{
1337	if (pCurInstrGC != pInstrGC && pCpu->pCurInstr->opcode == OP_PUSHF)
1338	{
1339	fIllegalInstr = true;
1340	patmAddIllegalInstrRecord(pVM, pPatch, pCurInstrGC);
1341	}
1342	}
1343
1344	// no far returns
1345	if (pCpu->pCurInstr->opcode == OP_RETF)
1346	{
1347	pPatch->pTempInfo->nrRetInstr++;
1348	fIllegalInstr = true;
1349	patmAddIllegalInstrRecord(pVM, pPatch, pCurInstrGC);
1350	}
1351	else
1352	// no int xx or into either
1353	if (pCpu->pCurInstr->opcode == OP_INT3 \|\| pCpu->pCurInstr->opcode == OP_INT \|\| pCpu->pCurInstr->opcode == OP_INTO)
1354	{
1355	fIllegalInstr = true;
1356	patmAddIllegalInstrRecord(pVM, pPatch, pCurInstrGC);
1357	}
1358	}
1359
1360	pPatch->cbPatchBlockSize += pCpu->opsize;
1361
1362	/* Illegal instruction -> end of analysis phase for this code block */
1363	if (fIllegalInstr \|\| patmIsIllegalInstr(pPatch, pCurInstrGC))
1364	return VINF_SUCCESS;
1365
1366	/* Check for exit points. */
1367	switch (pCpu->pCurInstr->opcode)
1368	{
1369	case OP_SYSEXIT:
1370	return VINF_SUCCESS; /* duplicate it; will fault or emulated in GC. */
1371
1372	case OP_SYSENTER:
1373	case OP_ILLUD2:
1374	//This appears to be some kind of kernel panic in Linux 2.4; no point to analyse more
1375	Log(("Illegal opcode (0xf 0xb) -> return here\n"));
1376	return VINF_SUCCESS;
1377
1378	case OP_STI:
1379	case OP_POPF:
1380	Assert(!(pPatch->flags & (PATMFL_DUPLICATE_FUNCTION)));
1381	/* If out exit point lies within the generated patch jump, then we have to refuse!! */
1382	if (pCurInstrGC > pPatch->pPrivInstrGC && pCurInstrGC < pPatch->pPrivInstrGC + SIZEOF_NEARJUMP32) /* hardcoded patch jump size; cbPatchJump is still zero */
1383	{
1384	Log(("Exit point within patch jump itself!! (%x vs %x)\n", pCurInstrGC, pPatch->pPrivInstrGC));
1385	return VERR_PATCHING_REFUSED;
1386	}
1387	if (pPatch->opcode == OP_PUSHF)
1388	{
1389	if (pCpu->pCurInstr->opcode == OP_POPF)
1390	{
1391	if (pPatch->cbPatchBlockSize >= SIZEOF_NEARJUMP32)
1392	return VINF_SUCCESS;
1393
1394	/* Or else we need to duplicate more instructions, because we can't jump back yet! */
1395	Log(("WARNING: End of block reached, but we need to duplicate some extra instruction to avoid a conflict with the patch jump\n"));
1396	pPatch->flags \|= PATMFL_CHECK_SIZE;
1397	}
1398	break; //sti doesn't mark the end of a pushf block; only popf does
1399	}
1400	//else no break
1401	case OP_RETN: /* exit point for function replacement */
1402	return VINF_SUCCESS;
1403
1404	case OP_IRET:
1405	return VINF_SUCCESS; /* exitpoint */
1406
1407	case OP_CPUID:
1408	case OP_CALL:
1409	case OP_JMP:
1410	break;
1411
1412	default:
1413	if (pCpu->pCurInstr->optype & (OPTYPE_PRIVILEGED_NOTRAP))
1414	{
1415	patmAddIllegalInstrRecord(pVM, pPatch, pCurInstrGC);
1416	return VINF_SUCCESS; /* exit point */
1417	}
1418	break;
1419	}
1420
1421	// If single instruction patch, we've copied enough instructions and the current instruction is not a relative jump
1422	if ((pPatch->flags & PATMFL_CHECK_SIZE) && pPatch->cbPatchBlockSize > SIZEOF_NEARJUMP32 && !(pCpu->pCurInstr->optype & OPTYPE_RELATIVE_CONTROLFLOW))
1423	{
1424	// The end marker for this kind of patch is any instruction at a location outside our patch jump
1425	Log(("End of block at %VGv size %d\n", pCurInstrGC, pCpu->opsize));
1426	return VINF_SUCCESS;
1427	}
1428
1429	return VWRN_CONTINUE_ANALYSIS;
1430	}
1431
1432	/**
1433	* Analyses the instructions inside a function for compliance
1434	*
1435	* @returns VBox status code.
1436	* @param pVM The VM to operate on.
1437	* @param pCpu CPU disassembly state
1438	* @param pInstrGC Guest context pointer to privileged instruction
1439	* @param pCurInstrGC Guest context pointer to the current instruction
1440	* @param pUserData User pointer (callback specific)
1441	*
1442	*/
1443	static int patmAnalyseFunctionCallback(PVM pVM, DISCPUSTATE pCpu, GCPTRTYPE(uint8_t ) pInstrGC, GCPTRTYPE(uint8_t ) pCurInstrGC, void pUserData)
1444	{
1445	PPATCHINFO pPatch = (PPATCHINFO)pUserData;
1446	bool fIllegalInstr = false;
1447
1448	//Preliminary heuristics:
1449	//- no call instructions
1450	//- ret ends a block
1451
1452	Assert(pPatch->flags & (PATMFL_DUPLICATE_FUNCTION));
1453
1454	// bail out if the patch gets too big
1455	if (pPatch->cbPatchBlockSize >= MAX_PATCH_SIZE)
1456	{
1457	Log(("Code block too big (%x) for function patch at %VGv!!\n", pPatch->cbPatchBlockSize, pCurInstrGC));
1458	fIllegalInstr = true;
1459	patmAddIllegalInstrRecord(pVM, pPatch, pCurInstrGC);
1460	}
1461	else
1462	{
1463	// no unconditinal jumps or calls without fixed displacements
1464	if ( (pCpu->pCurInstr->optype & OPTYPE_CONTROLFLOW)
1465	&& (pCpu->pCurInstr->opcode == OP_JMP \|\| pCpu->pCurInstr->opcode == OP_CALL)
1466	)
1467	{
1468	Assert(pCpu->param1.size <= 4 \|\| pCpu->param1.size == 6);
1469	if ( pCpu->param1.size == 6 /* far call/jmp */
1470	\|\| (pCpu->pCurInstr->opcode == OP_CALL && !(pPatch->flags & PATMFL_SUPPORT_CALLS))
1471	\|\| (OP_PARM_VTYPE(pCpu->pCurInstr->param1) != OP_PARM_J && !(pPatch->flags & PATMFL_SUPPORT_INDIRECT_CALLS))
1472	)
1473	{
1474	fIllegalInstr = true;
1475	patmAddIllegalInstrRecord(pVM, pPatch, pCurInstrGC);
1476	}
1477	}
1478	else /* no far returns */
1479	if (pCpu->pCurInstr->opcode == OP_RETF)
1480	{
1481	patmAddIllegalInstrRecord(pVM, pPatch, pCurInstrGC);
1482	fIllegalInstr = true;
1483	}
1484	else /* no int xx or into either */
1485	if (pCpu->pCurInstr->opcode == OP_INT3 \|\| pCpu->pCurInstr->opcode == OP_INT \|\| pCpu->pCurInstr->opcode == OP_INTO)
1486	{
1487	patmAddIllegalInstrRecord(pVM, pPatch, pCurInstrGC);
1488	fIllegalInstr = true;
1489	}
1490
1491	#if 0
1492	///@todo we can handle certain in/out and privileged instructions in the guest context
1493	if (pCpu->pCurInstr->optype & OPTYPE_PRIVILEGED && pCpu->pCurInstr->opcode != OP_STI)
1494	{
1495	Log(("Illegal instructions for function patch!!\n"));
1496	return VERR_PATCHING_REFUSED;
1497	}
1498	#endif
1499	}
1500
1501	pPatch->cbPatchBlockSize += pCpu->opsize;
1502
1503	/* Illegal instruction -> end of analysis phase for this code block */
1504	if (fIllegalInstr \|\| patmIsIllegalInstr(pPatch, pCurInstrGC))
1505	{
1506	return VINF_SUCCESS;
1507	}
1508
1509	// Check for exit points
1510	switch (pCpu->pCurInstr->opcode)
1511	{
1512	case OP_ILLUD2:
1513	//This appears to be some kind of kernel panic in Linux 2.4; no point to analyse more
1514	Log(("Illegal opcode (0xf 0xb) -> return here\n"));
1515	return VINF_SUCCESS;
1516
1517	case OP_IRET:
1518	case OP_SYSEXIT: /* will fault or emulated in GC */
1519	case OP_RETN:
1520	return VINF_SUCCESS;
1521
1522	case OP_POPF:
1523	case OP_STI:
1524	return VWRN_CONTINUE_ANALYSIS;
1525	default:
1526	if (pCpu->pCurInstr->optype & (OPTYPE_PRIVILEGED_NOTRAP))
1527	{
1528	patmAddIllegalInstrRecord(pVM, pPatch, pCurInstrGC);
1529	return VINF_SUCCESS; /* exit point */
1530	}
1531	return VWRN_CONTINUE_ANALYSIS;
1532	}
1533
1534	return VWRN_CONTINUE_ANALYSIS;
1535	}
1536
1537	/**
1538	* Recompiles the instructions in a code block
1539	*
1540	* @returns VBox status code.
1541	* @param pVM The VM to operate on.
1542	* @param pCpu CPU disassembly state
1543	* @param pInstrGC Guest context pointer to privileged instruction
1544	* @param pCurInstrGC Guest context pointer to the current instruction
1545	* @param pUserData User pointer (callback specific)
1546	*
1547	*/
1548	static int patmRecompileCallback(PVM pVM, DISCPUSTATE pCpu, GCPTRTYPE(uint8_t ) pInstrGC, GCPTRTYPE(uint8_t ) pCurInstrGC, void pUserData)
1549	{
1550	PPATCHINFO pPatch = (PPATCHINFO)pUserData;
1551	int rc = VINF_SUCCESS;
1552	bool fInhibitIRQInstr = false; /* did the instruction cause PATMFL_INHIBITIRQS to be set? */
1553
1554	LogFlow(("patmRecompileCallback %VGv %VGv\n", pInstrGC, pCurInstrGC));
1555
1556	if ( patmGuestGCPtrToPatchGCPtr(pVM, pPatch, pCurInstrGC) != 0
1557	&& !(pPatch->flags & PATMFL_RECOMPILE_NEXT)) /* do not do this when the next instruction must be executed! */
1558	{
1559	/*
1560	* Been there, done that; so insert a jump (we don't want to duplicate code)
1561	* no need to record this instruction as it's glue code that never crashes (it had better not!)
1562	*/
1563	Log(("patmRecompileCallback: jump to code we've recompiled before %VGv!\n", pCurInstrGC));
1564	return patmPatchGenRelJump(pVM, pPatch, pCurInstrGC, OP_JMP, !!(pCpu->prefix & PREFIX_OPSIZE));
1565	}
1566
1567	if (pPatch->flags & (PATMFL_DUPLICATE_FUNCTION))
1568	{
1569	rc = patmAnalyseFunctionCallback(pVM, pCpu, pInstrGC, pCurInstrGC, pUserData);
1570	}
1571	else
1572	rc = patmAnalyseBlockCallback(pVM, pCpu, pInstrGC, pCurInstrGC, pUserData);
1573
1574	if (VBOX_FAILURE(rc))
1575	return rc;
1576
1577	/** @note Never do a direct return unless a failure is encountered! */
1578
1579	/* Clear recompilation of next instruction flag; we are doing that right here. */
1580	if (pPatch->flags & PATMFL_RECOMPILE_NEXT)
1581	pPatch->flags &= ~PATMFL_RECOMPILE_NEXT;
1582
1583	/* Add lookup record for patch to guest address translation */
1584	patmr3AddP2GLookupRecord(pVM, pPatch, PATCHCODE_PTR_HC(pPatch) + pPatch->uCurPatchOffset, pCurInstrGC, PATM_LOOKUP_BOTHDIR);
1585
1586	/* Update lowest and highest instruction address for this patch */
1587	if (pCurInstrGC < pPatch->pInstrGCLowest)
1588	pPatch->pInstrGCLowest = pCurInstrGC;
1589	else
1590	if (pCurInstrGC > pPatch->pInstrGCHighest)
1591	pPatch->pInstrGCHighest = pCurInstrGC + pCpu->opsize;
1592
1593	/* Illegal instruction -> end of recompile phase for this code block. */
1594	if (patmIsIllegalInstr(pPatch, pCurInstrGC))
1595	{
1596	Log(("Illegal instruction at %VGv -> mark with int 3\n", pCurInstrGC));
1597	rc = patmPatchGenIllegalInstr(pVM, pPatch);
1598	goto end;
1599	}
1600
1601	/* For our first attempt, we'll handle only simple relative jumps (immediate offset coded in instruction).
1602	* Indirect calls are handled below.
1603	*/
1604	if ( (pCpu->pCurInstr->optype & OPTYPE_CONTROLFLOW)
1605	&& (pCpu->pCurInstr->opcode != OP_CALL \|\| (pPatch->flags & PATMFL_SUPPORT_CALLS))
1606	&& (OP_PARM_VTYPE(pCpu->pCurInstr->param1) == OP_PARM_J))
1607	{
1608	GCPTRTYPE(uint8_t *) pTargetGC = PATMResolveBranch(pCpu, pCurInstrGC);
1609	if (pTargetGC == 0)
1610	{
1611	Log(("We don't support far jumps here!! (%08X)\n", pCpu->param1.flags));
1612	return VERR_PATCHING_REFUSED;
1613	}
1614
1615	if (pCpu->pCurInstr->opcode == OP_CALL)
1616	{
1617	Assert(!PATMIsPatchGCAddr(pVM, pTargetGC));
1618	rc = patmPatchGenCall(pVM, pPatch, pCpu, pCurInstrGC, pTargetGC, false);
1619	if (VBOX_FAILURE(rc))
1620	goto end;
1621	}
1622	else
1623	rc = patmPatchGenRelJump(pVM, pPatch, pTargetGC, pCpu->pCurInstr->opcode, !!(pCpu->prefix & PREFIX_OPSIZE));
1624
1625	if (VBOX_SUCCESS(rc))
1626	rc = VWRN_CONTINUE_RECOMPILE;
1627
1628	goto end;
1629	}
1630
1631	switch (pCpu->pCurInstr->opcode)
1632	{
1633	case OP_CLI:
1634	{
1635	/* If a cli is found while duplicating instructions for another patch, then it's of vital importance to continue
1636	* until we've found the proper exit point(s).
1637	*/
1638	if ( pCurInstrGC != pInstrGC
1639	&& !(pPatch->flags & (PATMFL_DUPLICATE_FUNCTION))
1640	)
1641	{
1642	Log(("cli instruction found in other instruction patch block; force it to continue & find an exit point\n"));
1643	pPatch->flags &= ~(PATMFL_CHECK_SIZE \| PATMFL_SINGLE_INSTRUCTION);
1644	}
1645	/* Set by irq inhibition; no longer valid now. */
1646	pPatch->flags &= ~PATMFL_GENERATE_JUMPTOGUEST;
1647
1648	rc = patmPatchGenCli(pVM, pPatch);
1649	if (VBOX_SUCCESS(rc))
1650	rc = VWRN_CONTINUE_RECOMPILE;
1651	break;
1652	}
1653
1654	case OP_MOV:
1655	if (pCpu->pCurInstr->optype & OPTYPE_POTENTIALLY_DANGEROUS)
1656	{
1657	/* mov ss, src? */
1658	if ( (pCpu->param1.flags & USE_REG_SEG)
1659	&& (pCpu->param1.base.reg_seg == USE_REG_SS))
1660	{
1661	Log(("Force recompilation of next instruction for OP_MOV at %VGv\n", pCurInstrGC));
1662	pPatch->flags \|= PATMFL_RECOMPILE_NEXT;
1663	/** @todo this could cause a fault (ring 0 selector being loaded in ring 1) */
1664	}
1665	#if 0 /* necessary for Haiku */
1666	else
1667	if ( (pCpu->param2.flags & USE_REG_SEG)
1668	&& (pCpu->param2.base.reg_seg == USE_REG_SS)
1669	&& (pCpu->param1.flags & (USE_REG_GEN32\|USE_REG_GEN16))) /** @todo memory operand must in theory be handled too */
1670	{
1671	/* mov GPR, ss */
1672	rc = patmPatchGenMovFromSS(pVM, pPatch, pCpu, pCurInstrGC);
1673	if (VBOX_SUCCESS(rc))
1674	rc = VWRN_CONTINUE_RECOMPILE;
1675	break;
1676	}
1677	#endif
1678	}
1679	goto duplicate_instr;
1680
1681	case OP_POP:
1682	if (pCpu->pCurInstr->param1 == OP_PARM_REG_SS)
1683	{
1684	Assert(pCpu->pCurInstr->optype & OPTYPE_INHIBIT_IRQS);
1685
1686	Log(("Force recompilation of next instruction for OP_MOV at %VGv\n", pCurInstrGC));
1687	pPatch->flags \|= PATMFL_RECOMPILE_NEXT;
1688	}
1689	goto duplicate_instr;
1690
1691	case OP_STI:
1692	{
1693	RTGCPTR pNextInstrGC = 0; /* by default no inhibit irq */
1694
1695	/** In a sequence of instructions that inhibit irqs, only the first one actually inhibits irqs. */
1696	if (!(pPatch->flags & PATMFL_INHIBIT_IRQS))
1697	{
1698	pPatch->flags \|= PATMFL_INHIBIT_IRQS \| PATMFL_GENERATE_JUMPTOGUEST;
1699	fInhibitIRQInstr = true;
1700	pNextInstrGC = pCurInstrGC + pCpu->opsize;
1701	Log(("Inhibit irqs for instruction OP_STI at %VGv\n", pCurInstrGC));
1702	}
1703	rc = patmPatchGenSti(pVM, pPatch, pCurInstrGC, pNextInstrGC);
1704
1705	if (VBOX_SUCCESS(rc))
1706	{
1707	DISCPUSTATE cpu = *pCpu;
1708	unsigned opsize;
1709	int disret;
1710	GCPTRTYPE(uint8_t *) pNextInstrGC, pReturnInstrGC;
1711	R3PTRTYPE(uint8_t *) pNextInstrHC;
1712
1713	pPatch->flags \|= PATMFL_FOUND_PATCHEND;
1714
1715	pNextInstrGC = pCurInstrGC + pCpu->opsize;
1716	pNextInstrHC = PATMGCVirtToHCVirt(pVM, pPatch, pNextInstrGC);
1717	if (pNextInstrHC == NULL)
1718	{
1719	AssertFailed();
1720	return VERR_PATCHING_REFUSED;
1721	}
1722
1723	// Disassemble the next instruction
1724	disret = PATMR3DISInstr(pVM, pPatch, &cpu, pNextInstrGC, pNextInstrHC, &opsize, NULL);
1725	if (disret == false)
1726	{
1727	AssertMsgFailed(("STI: Disassembly failed (probably page not present) -> return to caller\n"));
1728	return VERR_PATCHING_REFUSED;
1729	}
1730	pReturnInstrGC = pNextInstrGC + opsize;
1731
1732	if ( (pPatch->flags & (PATMFL_DUPLICATE_FUNCTION))
1733	\|\| pReturnInstrGC <= pInstrGC
1734	\|\| pReturnInstrGC - pInstrGC >= SIZEOF_NEARJUMP32
1735	)
1736	{
1737	/* Not an exit point for function duplication patches */
1738	if ( (pPatch->flags & PATMFL_DUPLICATE_FUNCTION)
1739	&& VBOX_SUCCESS(rc))
1740	{
1741	pPatch->flags &= ~PATMFL_GENERATE_JUMPTOGUEST; /* Don't generate a jump back */
1742	rc = VWRN_CONTINUE_RECOMPILE;
1743	}
1744	else
1745	rc = VINF_SUCCESS; //exit point
1746	}
1747	else {
1748	Log(("PATM: sti occurred too soon; refusing patch!\n"));
1749	rc = VERR_PATCHING_REFUSED; //not allowed!!
1750	}
1751	}
1752	break;
1753	}
1754
1755	case OP_POPF:
1756	{
1757	bool fGenerateJmpBack = (pCurInstrGC + pCpu->opsize - pInstrGC >= SIZEOF_NEARJUMP32);
1758
1759	/* Not an exit point for IDT handler or function replacement patches */
1760	/* Note: keep IOPL in mind when changing any of this!! (see comments in PATMA.asm, PATMPopf32Replacement) */
1761	if (pPatch->flags & (PATMFL_IDTHANDLER\|PATMFL_DUPLICATE_FUNCTION))
1762	fGenerateJmpBack = false;
1763
1764	rc = patmPatchGenPopf(pVM, pPatch, pCurInstrGC + pCpu->opsize, !!(pCpu->prefix & PREFIX_OPSIZE), fGenerateJmpBack);
1765	if (VBOX_SUCCESS(rc))
1766	{
1767	if (fGenerateJmpBack == false)
1768	{
1769	/* Not an exit point for IDT handler or function replacement patches */
1770	rc = VWRN_CONTINUE_RECOMPILE;
1771	}
1772	else
1773	{
1774	pPatch->flags \|= PATMFL_FOUND_PATCHEND;
1775	rc = VINF_SUCCESS; /* exit point! */
1776	}
1777	}
1778	break;
1779	}
1780
1781	case OP_PUSHF:
1782	rc = patmPatchGenPushf(pVM, pPatch, !!(pCpu->prefix & PREFIX_OPSIZE));
1783	if (VBOX_SUCCESS(rc))
1784	rc = VWRN_CONTINUE_RECOMPILE;
1785	break;
1786
1787	case OP_PUSH:
1788	if (pCpu->pCurInstr->param1 == OP_PARM_REG_CS)
1789	{
1790	rc = patmPatchGenPushCS(pVM, pPatch);
1791	if (VBOX_SUCCESS(rc))
1792	rc = VWRN_CONTINUE_RECOMPILE;
1793	break;
1794	}
1795	goto duplicate_instr;
1796
1797	case OP_IRET:
1798	Log(("IRET at %VGv\n", pCurInstrGC));
1799	rc = patmPatchGenIret(pVM, pPatch, pCurInstrGC, !!(pCpu->prefix & PREFIX_OPSIZE));
1800	if (VBOX_SUCCESS(rc))
1801	{
1802	pPatch->flags \|= PATMFL_FOUND_PATCHEND;
1803	rc = VINF_SUCCESS; /* exit point by definition */
1804	}
1805	break;
1806
1807	case OP_ILLUD2:
1808	/* This appears to be some kind of kernel panic in Linux 2.4; no point to continue */
1809	rc = patmPatchGenIllegalInstr(pVM, pPatch);
1810	if (VBOX_SUCCESS(rc))
1811	rc = VINF_SUCCESS; /* exit point by definition */
1812	Log(("Illegal opcode (0xf 0xb)\n"));
1813	break;
1814
1815	case OP_CPUID:
1816	rc = patmPatchGenCpuid(pVM, pPatch, pCurInstrGC);
1817	if (VBOX_SUCCESS(rc))
1818	rc = VWRN_CONTINUE_RECOMPILE;
1819	break;
1820
1821	case OP_STR:
1822	case OP_SLDT:
1823	rc = patmPatchGenSldtStr(pVM, pPatch, pCpu, pCurInstrGC);
1824	if (VBOX_SUCCESS(rc))
1825	rc = VWRN_CONTINUE_RECOMPILE;
1826	break;
1827
1828	case OP_SGDT:
1829	case OP_SIDT:
1830	rc = patmPatchGenSxDT(pVM, pPatch, pCpu, pCurInstrGC);
1831	if (VBOX_SUCCESS(rc))
1832	rc = VWRN_CONTINUE_RECOMPILE;
1833	break;
1834
1835	case OP_RETN:
1836	/* retn is an exit point for function patches */
1837	rc = patmPatchGenRet(pVM, pPatch, pCpu, pCurInstrGC);
1838	if (VBOX_SUCCESS(rc))
1839	rc = VINF_SUCCESS; /* exit point by definition */
1840	break;
1841
1842	case OP_SYSEXIT:
1843	/* Duplicate it, so it can be emulated in GC (or fault). */
1844	rc = patmPatchGenDuplicate(pVM, pPatch, pCpu, pCurInstrGC);
1845	if (VBOX_SUCCESS(rc))
1846	rc = VINF_SUCCESS; /* exit point by definition */
1847	break;
1848
1849	case OP_CALL:
1850	Assert(pPatch->flags & PATMFL_SUPPORT_INDIRECT_CALLS);
1851	/* In interrupt gate handlers it's possible to encounter jumps or calls when IF has been enabled again.
1852	* In that case we'll jump to the original instruction and continue from there. Otherwise an int 3 is executed.
1853	*/
1854	Assert(pCpu->param1.size == 4 \|\| pCpu->param1.size == 6);
1855	if (pPatch->flags & PATMFL_SUPPORT_INDIRECT_CALLS && pCpu->param1.size == 4 /* no far calls! */)
1856	{
1857	rc = patmPatchGenCall(pVM, pPatch, pCpu, pCurInstrGC, (RTGCPTR)0xDEADBEEF, true);
1858	if (VBOX_SUCCESS(rc))
1859	{
1860	rc = VWRN_CONTINUE_RECOMPILE;
1861	}
1862	break;
1863	}
1864	goto gen_illegal_instr;
1865
1866	case OP_JMP:
1867	Assert(pPatch->flags & PATMFL_SUPPORT_INDIRECT_CALLS);
1868	/* In interrupt gate handlers it's possible to encounter jumps or calls when IF has been enabled again.
1869	* In that case we'll jump to the original instruction and continue from there. Otherwise an int 3 is executed.
1870	*/
1871	Assert(pCpu->param1.size == 4 \|\| pCpu->param1.size == 6);
1872	if (pPatch->flags & PATMFL_SUPPORT_INDIRECT_CALLS && pCpu->param1.size == 4 /* no far jumps! */)
1873	{
1874	rc = patmPatchGenJump(pVM, pPatch, pCpu, pCurInstrGC);
1875	if (VBOX_SUCCESS(rc))
1876	rc = VINF_SUCCESS; /* end of branch */
1877	break;
1878	}
1879	goto gen_illegal_instr;
1880
1881	case OP_INT3:
1882	case OP_INT:
1883	case OP_INTO:
1884	goto gen_illegal_instr;
1885
1886	case OP_MOV_DR:
1887	/** @note: currently we let DRx writes cause a trap d; our trap handler will decide to interpret it or not. */
1888	if (pCpu->pCurInstr->param2 == OP_PARM_Dd)
1889	{
1890	rc = patmPatchGenMovDebug(pVM, pPatch, pCpu);
1891	if (VBOX_SUCCESS(rc))
1892	rc = VWRN_CONTINUE_RECOMPILE;
1893	break;
1894	}
1895	goto duplicate_instr;
1896
1897	case OP_MOV_CR:
1898	/** @note: currently we let CRx writes cause a trap d; our trap handler will decide to interpret it or not. */
1899	if (pCpu->pCurInstr->param2 == OP_PARM_Cd)
1900	{
1901	rc = patmPatchGenMovControl(pVM, pPatch, pCpu);
1902	if (VBOX_SUCCESS(rc))
1903	rc = VWRN_CONTINUE_RECOMPILE;
1904	break;
1905	}
1906	goto duplicate_instr;
1907
1908	default:
1909	if (pCpu->pCurInstr->optype & (OPTYPE_CONTROLFLOW \| OPTYPE_PRIVILEGED_NOTRAP))
1910	{
1911	gen_illegal_instr:
1912	rc = patmPatchGenIllegalInstr(pVM, pPatch);
1913	if (VBOX_SUCCESS(rc))
1914	rc = VINF_SUCCESS; /* exit point by definition */
1915	}
1916	else
1917	{
1918	duplicate_instr:
1919	Log(("patmPatchGenDuplicate\n"));
1920	rc = patmPatchGenDuplicate(pVM, pPatch, pCpu, pCurInstrGC);
1921	if (VBOX_SUCCESS(rc))
1922	rc = VWRN_CONTINUE_RECOMPILE;
1923	}
1924	break;
1925	}
1926
1927	end:
1928
1929	if ( !fInhibitIRQInstr
1930	&& (pPatch->flags & PATMFL_INHIBIT_IRQS))
1931	{
1932	int rc2;
1933	RTGCPTR pNextInstrGC = pCurInstrGC + pCpu->opsize;
1934
1935	pPatch->flags &= ~PATMFL_INHIBIT_IRQS;
1936	Log(("Clear inhibit IRQ flag at %VGv\n", pCurInstrGC));
1937	if (pPatch->flags & PATMFL_GENERATE_JUMPTOGUEST)
1938	{
1939	Log(("patmRecompileCallback: generate jump back to guest (%VGv) after fused instruction\n", pNextInstrGC));
1940
1941	rc2 = patmPatchGenJumpToGuest(pVM, pPatch, pNextInstrGC, true /* clear inhibit irq flag */);
1942	pPatch->flags &= ~PATMFL_GENERATE_JUMPTOGUEST;
1943	rc = VINF_SUCCESS; /* end of the line */
1944	}
1945	else
1946	{
1947	rc2 = patmPatchGenClearInhibitIRQ(pVM, pPatch, pNextInstrGC);
1948	}
1949	if (VBOX_FAILURE(rc2))
1950	rc = rc2;
1951	}
1952
1953	if (VBOX_SUCCESS(rc))
1954	{
1955	// If single instruction patch, we've copied enough instructions and the current instruction is not a relative jump
1956	if ( (pPatch->flags & PATMFL_CHECK_SIZE)
1957	&& pCurInstrGC + pCpu->opsize - pInstrGC >= SIZEOF_NEARJUMP32
1958	&& !(pCpu->pCurInstr->optype & OPTYPE_RELATIVE_CONTROLFLOW)
1959	&& !(pPatch->flags & PATMFL_RECOMPILE_NEXT) /* do not do this when the next instruction must be executed! */
1960	)
1961	{
1962	RTGCPTR pNextInstrGC = pCurInstrGC + pCpu->opsize;
1963
1964	// The end marker for this kind of patch is any instruction at a location outside our patch jump
1965	Log(("patmRecompileCallback: end found for single instruction patch at %VGv opsize %d\n", pNextInstrGC, pCpu->opsize));
1966
1967	rc = patmPatchGenJumpToGuest(pVM, pPatch, pNextInstrGC);
1968	AssertRC(rc);
1969	}
1970	}
1971	return rc;
1972	}
1973
1974
1975	#ifdef LOG_ENABLED
1976
1977	/* Add a disasm jump record (temporary for prevent duplicate analysis)
1978	*
1979	* @param pVM The VM to operate on.
1980	* @param pPatch Patch structure ptr
1981	* @param pInstrGC Guest context pointer to privileged instruction
1982	*
1983	*/
1984	static void patmPatchAddDisasmJump(PVM pVM, PPATCHINFO pPatch, RTGCPTR pInstrGC)
1985	{
1986	PAVLPVNODECORE pRec;
1987
1988	pRec = (PAVLPVNODECORE)MMR3HeapAllocZ(pVM, MM_TAG_PATM_PATCH, sizeof(*pRec));
1989	Assert(pRec);
1990	pRec->Key = (AVLPVKEY)pInstrGC;
1991
1992	int ret = RTAvlPVInsert(&pPatch->pTempInfo->DisasmJumpTree, pRec);
1993	Assert(ret);
1994	}
1995
1996	/**
1997	* Checks if jump target has been analysed before.
1998	*
1999	* @returns VBox status code.
2000	* @param pPatch Patch struct
2001	* @param pInstrGC Jump target
2002	*
2003	*/
2004	static bool patmIsKnownDisasmJump(PPATCHINFO pPatch, RTGCPTR pInstrGC)
2005	{
2006	PAVLPVNODECORE pRec;
2007
2008	pRec = RTAvlPVGet(&pPatch->pTempInfo->DisasmJumpTree, (AVLPVKEY)pInstrGC);
2009	if (pRec)
2010	return true;
2011	return false;
2012	}
2013
2014	/**
2015	* For proper disassembly of the final patch block
2016	*
2017	* @returns VBox status code.
2018	* @param pVM The VM to operate on.
2019	* @param pCpu CPU disassembly state
2020	* @param pInstrGC Guest context pointer to privileged instruction
2021	* @param pCurInstrGC Guest context pointer to the current instruction
2022	* @param pUserData User pointer (callback specific)
2023	*
2024	*/
2025	int patmr3DisasmCallback(PVM pVM, DISCPUSTATE pCpu, GCPTRTYPE(uint8_t ) pInstrGC, GCPTRTYPE(uint8_t ) pCurInstrGC, void pUserData)
2026	{
2027	PPATCHINFO pPatch = (PPATCHINFO)pUserData;
2028
2029	if (pCpu->pCurInstr->opcode == OP_INT3)
2030	{
2031	/* Could be an int3 inserted in a call patch. Check to be sure */
2032	DISCPUSTATE cpu;
2033	uint8_t *pOrgJumpHC;
2034	RTGCPTR pOrgJumpGC;
2035	uint32_t dummy;
2036
2037	cpu.mode = (pPatch->flags & PATMFL_CODE32) ? CPUMODE_32BIT : CPUMODE_16BIT;
2038	pOrgJumpGC = patmPatchGCPtr2GuestGCPtr(pVM, pPatch, pCurInstrGC);
2039	pOrgJumpHC = PATMGCVirtToHCVirt(pVM, pPatch, pOrgJumpGC);
2040
2041	bool disret = PATMR3DISInstr(pVM, pPatch, &cpu, pOrgJumpGC, pOrgJumpHC, &dummy, NULL);
2042	if (!disret \|\| cpu.pCurInstr->opcode != OP_CALL \|\| cpu.param1.size != 4 /* only near calls */)
2043	return VINF_SUCCESS;
2044
2045	return VWRN_CONTINUE_ANALYSIS;
2046	}
2047
2048	if ( pCpu->pCurInstr->opcode == OP_ILLUD2
2049	&& PATMIsPatchGCAddr(pVM, pCurInstrGC))
2050	{
2051	/* the indirect call patch contains an 0xF/0xB illegal instr to call for assistance; check for this and continue */
2052	return VWRN_CONTINUE_ANALYSIS;
2053	}
2054
2055	if ( (pCpu->pCurInstr->opcode == OP_CALL && !(pPatch->flags & PATMFL_SUPPORT_CALLS))
2056	\|\| pCpu->pCurInstr->opcode == OP_INT
2057	\|\| pCpu->pCurInstr->opcode == OP_IRET
2058	\|\| pCpu->pCurInstr->opcode == OP_RETN
2059	\|\| pCpu->pCurInstr->opcode == OP_RETF
2060	)
2061	{
2062	return VINF_SUCCESS;
2063	}
2064
2065	if (pCpu->pCurInstr->opcode == OP_ILLUD2)
2066	return VINF_SUCCESS;
2067
2068	return VWRN_CONTINUE_ANALYSIS;
2069	}
2070
2071
2072	/**
2073	* Disassembles the code stream until the callback function detects a failure or decides everything is acceptable
2074	*
2075	* @returns VBox status code.
2076	* @param pVM The VM to operate on.
2077	* @param pInstrGC Guest context pointer to the initial privileged instruction
2078	* @param pCurInstrGC Guest context pointer to the current instruction
2079	* @param pfnPATMR3Disasm Callback for testing the disassembled instruction
2080	* @param pUserData User pointer (callback specific)
2081	*
2082	*/
2083	int patmr3DisasmCode(PVM pVM, GCPTRTYPE(uint8_t ) pInstrGC, GCPTRTYPE(uint8_t ) pCurInstrGC, PFN_PATMR3ANALYSE pfnPATMR3Disasm, void *pUserData)
2084	{
2085	DISCPUSTATE cpu;
2086	PPATCHINFO pPatch = (PPATCHINFO)pUserData;
2087	int rc = VWRN_CONTINUE_ANALYSIS;
2088	uint32_t opsize, delta;
2089	R3PTRTYPE(uint8_t *) pCurInstrHC = 0;
2090	bool disret;
2091	char szOutput[256];
2092
2093	Assert(pCurInstrHC != PATCHCODE_PTR_HC(pPatch) \|\| pPatch->pTempInfo->DisasmJumpTree == 0);
2094
2095	/* We need this to determine branch targets (and for disassembling). */
2096	delta = pVM->patm.s.pPatchMemGC - (uintptr_t)pVM->patm.s.pPatchMemHC;
2097
2098	while(rc == VWRN_CONTINUE_ANALYSIS)
2099	{
2100	cpu.mode = (pPatch->flags & PATMFL_CODE32) ? CPUMODE_32BIT : CPUMODE_16BIT;
2101
2102	pCurInstrHC = PATMGCVirtToHCVirt(pVM, pPatch, pCurInstrGC);
2103	if (pCurInstrHC == NULL)
2104	{
2105	rc = VERR_PATCHING_REFUSED;
2106	goto end;
2107	}
2108
2109	disret = PATMR3DISInstr(pVM, pPatch, &cpu, pCurInstrGC, pCurInstrHC, &opsize, szOutput, PATMREAD_RAWCODE);
2110	if (PATMIsPatchGCAddr(pVM, pCurInstrGC))
2111	{
2112	RTGCPTR pOrgInstrGC = patmPatchGCPtr2GuestGCPtr(pVM, pPatch, pCurInstrGC);
2113
2114	if (pOrgInstrGC != pPatch->pTempInfo->pLastDisasmInstrGC)
2115	Log(("DIS %VGv<-%s", pOrgInstrGC, szOutput));
2116	else
2117	Log(("DIS %s", szOutput));
2118
2119	pPatch->pTempInfo->pLastDisasmInstrGC = pOrgInstrGC;
2120	if (patmIsIllegalInstr(pPatch, pOrgInstrGC))
2121	{
2122	rc = VINF_SUCCESS;
2123	goto end;
2124	}
2125	}
2126	else
2127	Log(("DIS: %s", szOutput));
2128
2129	if (disret == false)
2130	{
2131	Log(("Disassembly failed (probably page not present) -> return to caller\n"));
2132	rc = VINF_SUCCESS;
2133	goto end;
2134	}
2135
2136	rc = pfnPATMR3Disasm(pVM, &cpu, pInstrGC, pCurInstrGC, pUserData);
2137	if (rc != VWRN_CONTINUE_ANALYSIS) {
2138	break; //done!
2139	}
2140
2141	/* For our first attempt, we'll handle only simple relative jumps and calls (immediate offset coded in instruction) */
2142	if ( (cpu.pCurInstr->optype & OPTYPE_CONTROLFLOW)
2143	&& (OP_PARM_VTYPE(cpu.pCurInstr->param1) == OP_PARM_J)
2144	&& cpu.pCurInstr->opcode != OP_CALL /* complete functions are replaced; don't bother here. */
2145	)
2146	{
2147	RTGCPTR pTargetGC = PATMResolveBranch(&cpu, pCurInstrGC);
2148	RTGCPTR pOrgTargetGC;
2149
2150	if (pTargetGC == 0)
2151	{
2152	Log(("We don't support far jumps here!! (%08X)\n", cpu.param1.flags));
2153	rc = VERR_PATCHING_REFUSED;
2154	break;
2155	}
2156
2157	if (!PATMIsPatchGCAddr(pVM, pTargetGC))
2158	{
2159	//jump back to guest code
2160	rc = VINF_SUCCESS;
2161	goto end;
2162	}
2163	pOrgTargetGC = PATMR3PatchToGCPtr(pVM, pTargetGC, 0);
2164
2165	if (patmIsCommonIDTHandlerPatch(pVM, pOrgTargetGC))
2166	{
2167	rc = VINF_SUCCESS;
2168	goto end;
2169	}
2170
2171	if (patmIsKnownDisasmJump(pPatch, pTargetGC) == false)
2172	{
2173	/* New jump, let's check it. */
2174	patmPatchAddDisasmJump(pVM, pPatch, pTargetGC);
2175
2176	if (cpu.pCurInstr->opcode == OP_CALL) pPatch->pTempInfo->nrCalls++;
2177	rc = patmr3DisasmCode(pVM, pInstrGC, pTargetGC, pfnPATMR3Disasm, pUserData);
2178	if (cpu.pCurInstr->opcode == OP_CALL) pPatch->pTempInfo->nrCalls--;
2179
2180	if (rc != VINF_SUCCESS) {
2181	break; //done!
2182	}
2183	}
2184	if (cpu.pCurInstr->opcode == OP_JMP)
2185	{
2186	/* Unconditional jump; return to caller. */
2187	rc = VINF_SUCCESS;
2188	goto end;
2189	}
2190
2191	rc = VWRN_CONTINUE_ANALYSIS;
2192	}
2193	pCurInstrGC += opsize;
2194	}
2195	end:
2196	return rc;
2197	}
2198
2199	/**
2200	* Disassembles the code stream until the callback function detects a failure or decides everything is acceptable
2201	*
2202	* @returns VBox status code.
2203	* @param pVM The VM to operate on.
2204	* @param pInstrGC Guest context pointer to the initial privileged instruction
2205	* @param pCurInstrGC Guest context pointer to the current instruction
2206	* @param pfnPATMR3Disasm Callback for testing the disassembled instruction
2207	* @param pUserData User pointer (callback specific)
2208	*
2209	*/
2210	int patmr3DisasmCodeStream(PVM pVM, GCPTRTYPE(uint8_t ) pInstrGC, GCPTRTYPE(uint8_t ) pCurInstrGC, PFN_PATMR3ANALYSE pfnPATMR3Disasm, void *pUserData)
2211	{
2212	PPATCHINFO pPatch = (PPATCHINFO)pUserData;
2213
2214	int rc = patmr3DisasmCode(pVM, pInstrGC, pCurInstrGC, pfnPATMR3Disasm, pUserData);
2215	/* Free all disasm jump records. */
2216	patmEmptyTree(pVM, &pPatch->pTempInfo->DisasmJumpTree);
2217	return rc;
2218	}
2219
2220	#endif /* LOG_ENABLED */
2221
2222	/**
2223	* Detects it the specified address falls within a 5 byte jump generated for an active patch.
2224	* If so, this patch is permanently disabled.
2225	*
2226	* @param pVM The VM to operate on.
2227	* @param pInstrGC Guest context pointer to instruction
2228	* @param pConflictGC Guest context pointer to check
2229	*
2230	* @note also checks for patch hints to make sure they can never be enabled if a conflict is present.
2231	*
2232	*/
2233	PATMR3DECL(int) PATMR3DetectConflict(PVM pVM, RTGCPTR pInstrGC, RTGCPTR pConflictGC)
2234	{
2235	PPATCHINFO pTargetPatch = PATMFindActivePatchByEntrypoint(pVM, pConflictGC, true /* include patch hints */);
2236	if (pTargetPatch)
2237	{
2238	return patmDisableUnusablePatch(pVM, pInstrGC, pConflictGC, pTargetPatch);
2239	}
2240	return VERR_PATCH_NO_CONFLICT;
2241	}
2242
2243	/**
2244	* Recompile the code stream until the callback function detects a failure or decides everything is acceptable
2245	*
2246	* @returns VBox status code.
2247	* @param pVM The VM to operate on.
2248	* @param pInstrGC Guest context pointer to privileged instruction
2249	* @param pCurInstrGC Guest context pointer to the current instruction
2250	* @param pfnPATMR3Recompile Callback for testing the disassembled instruction
2251	* @param pUserData User pointer (callback specific)
2252	*
2253	*/
2254	static int patmRecompileCodeStream(PVM pVM, GCPTRTYPE(uint8_t ) pInstrGC, GCPTRTYPE(uint8_t ) pCurInstrGC, PFN_PATMR3ANALYSE pfnPATMR3Recompile, void *pUserData)
2255	{
2256	DISCPUSTATE cpu;
2257	PPATCHINFO pPatch = (PPATCHINFO)pUserData;
2258	int rc = VWRN_CONTINUE_ANALYSIS;
2259	uint32_t opsize;
2260	R3PTRTYPE(uint8_t *) pCurInstrHC = 0;
2261	bool disret;
2262	#ifdef LOG_ENABLED
2263	char szOutput[256];
2264	#endif
2265
2266	while (rc == VWRN_CONTINUE_RECOMPILE)
2267	{
2268	cpu.mode = (pPatch->flags & PATMFL_CODE32) ? CPUMODE_32BIT : CPUMODE_16BIT;
2269
2270	////Log(("patmRecompileCodeStream %VGv %VGv\n", pInstrGC, pCurInstrGC));
2271
2272	pCurInstrHC = PATMGCVirtToHCVirt(pVM, pPatch, pCurInstrGC);
2273	if (pCurInstrHC == NULL)
2274	{
2275	rc = VERR_PATCHING_REFUSED; /* fatal in this case */
2276	goto end;
2277	}
2278	#ifdef LOG_ENABLED
2279	disret = PATMR3DISInstr(pVM, pPatch, &cpu, pCurInstrGC, pCurInstrHC, &opsize, szOutput);
2280	Log(("Recompile: %s", szOutput));
2281	#else
2282	disret = PATMR3DISInstr(pVM, pPatch, &cpu, pCurInstrGC, pCurInstrHC, &opsize, NULL);
2283	#endif
2284	if (disret == false)
2285	{
2286	Log(("Disassembly failed (probably page not present) -> return to caller\n"));
2287
2288	/* Add lookup record for patch to guest address translation */
2289	patmr3AddP2GLookupRecord(pVM, pPatch, PATCHCODE_PTR_HC(pPatch) + pPatch->uCurPatchOffset, pCurInstrGC, PATM_LOOKUP_BOTHDIR);
2290	patmPatchGenIllegalInstr(pVM, pPatch);
2291	rc = VINF_SUCCESS; /* Note: don't fail here; we might refuse an important patch!! */
2292	goto end;
2293	}
2294
2295	rc = pfnPATMR3Recompile(pVM, &cpu, pInstrGC, pCurInstrGC, pUserData);
2296	if (rc != VWRN_CONTINUE_RECOMPILE)
2297	{
2298	/* If irqs are inhibited because of the current instruction, then we must make sure the next one is executed! */
2299	if ( rc == VINF_SUCCESS
2300	&& (pPatch->flags & PATMFL_INHIBIT_IRQS))
2301	{
2302	DISCPUSTATE cpunext;
2303	uint32_t opsizenext;
2304	uint8_t *pNextInstrHC;
2305	RTGCPTR pNextInstrGC = pCurInstrGC + opsize;
2306
2307	Log(("patmRecompileCodeStream: irqs inhibited by instruction %VGv\n", pNextInstrGC));
2308
2309	/* Certain instructions (e.g. sti) force the next instruction to be executed before any interrupts can occur.
2310	* Recompile the next instruction as well
2311	*/
2312	pNextInstrHC = PATMGCVirtToHCVirt(pVM, pPatch, pNextInstrGC);
2313	if (pNextInstrHC == NULL)
2314	{
2315	rc = VERR_PATCHING_REFUSED; /* fatal in this case */
2316	goto end;
2317	}
2318	cpunext.mode = (pPatch->flags & PATMFL_CODE32) ? CPUMODE_32BIT : CPUMODE_16BIT;
2319	disret = PATMR3DISInstr(pVM, pPatch, &cpunext, pNextInstrGC, pNextInstrHC, &opsizenext, NULL);
2320	if (disret == false)
2321	{
2322	rc = VERR_PATCHING_REFUSED; /* fatal in this case */
2323	goto end;
2324	}
2325	switch(cpunext.pCurInstr->opcode)
2326	{
2327	case OP_IRET: /* inhibit cleared in generated code */
2328	case OP_SYSEXIT: /* faults; inhibit should be cleared in HC handling */
2329	case OP_HLT:
2330	break; /* recompile these */
2331
2332	default:
2333	if (cpunext.pCurInstr->optype & OPTYPE_CONTROLFLOW)
2334	{
2335	Log(("Unexpected control flow instruction after inhibit irq instruction\n"));
2336
2337	rc = patmPatchGenJumpToGuest(pVM, pPatch, pNextInstrGC, true /* clear inhibit irq flag */);
2338	AssertRC(rc);
2339	pPatch->flags &= ~PATMFL_INHIBIT_IRQS;
2340	goto end; /** @todo should be ok to ignore instruction fusing in this case */
2341	}
2342	break;
2343	}
2344
2345	/** @note after a cli we must continue to a proper exit point */
2346	if (cpunext.pCurInstr->opcode != OP_CLI)
2347	{
2348	rc = pfnPATMR3Recompile(pVM, &cpunext, pInstrGC, pNextInstrGC, pUserData);
2349	if (VBOX_SUCCESS(rc))
2350	{
2351	rc = VINF_SUCCESS;
2352	goto end;
2353	}
2354	break;
2355	}
2356	else
2357	rc = VWRN_CONTINUE_RECOMPILE;
2358	}
2359	else
2360	break; /* done! */
2361	}
2362
2363	/** @todo continue with the instructions following the jump and then recompile the jump target code */
2364
2365
2366	/* For our first attempt, we'll handle only simple relative jumps and calls (immediate offset coded in instruction). */
2367	if ( (cpu.pCurInstr->optype & OPTYPE_CONTROLFLOW)
2368	&& (OP_PARM_VTYPE(cpu.pCurInstr->param1) == OP_PARM_J)
2369	&& cpu.pCurInstr->opcode != OP_CALL /* complete functions are replaced; don't bother here. */
2370	)
2371	{
2372	GCPTRTYPE(uint8_t *) addr = PATMResolveBranch(&cpu, pCurInstrGC);
2373	if (addr == 0)
2374	{
2375	Log(("We don't support far jumps here!! (%08X)\n", cpu.param1.flags));
2376	rc = VERR_PATCHING_REFUSED;
2377	break;
2378	}
2379
2380	Log(("Jump encountered target %VGv\n", addr));
2381
2382	/* We don't check if the branch target lies in a valid page as we've already done that in the analysis phase. */
2383	if (!(cpu.pCurInstr->optype & OPTYPE_UNCOND_CONTROLFLOW))
2384	{
2385	Log(("patmRecompileCodeStream continue passed conditional jump\n"));
2386	/* First we need to finish this linear code stream until the next exit point. */
2387	rc = patmRecompileCodeStream(pVM, pInstrGC, pCurInstrGC+opsize, pfnPATMR3Recompile, pUserData);
2388	if (VBOX_FAILURE(rc))
2389	{
2390	Log(("patmRecompileCodeStream fatal error %d\n", rc));
2391	break; //fatal error
2392	}
2393	}
2394
2395	if (patmGuestGCPtrToPatchGCPtr(pVM, pPatch, addr) == 0)
2396	{
2397	/* New code; let's recompile it. */
2398	Log(("patmRecompileCodeStream continue with jump\n"));
2399
2400	/*
2401	* If we are jumping to an existing patch (or within 5 bytes of the entrypoint), then we must temporarily disable
2402	* this patch so we can continue our analysis
2403	*
2404	* We rely on CSAM to detect and resolve conflicts
2405	*/
2406	PPATCHINFO pTargetPatch = PATMFindActivePatchByEntrypoint(pVM, addr);
2407	if(pTargetPatch)
2408	{
2409	Log(("Found active patch at target %VGv (%VGv) -> temporarily disabling it!!\n", addr, pTargetPatch->pPrivInstrGC));
2410	PATMR3DisablePatch(pVM, pTargetPatch->pPrivInstrGC);
2411	}
2412
2413	if (cpu.pCurInstr->opcode == OP_CALL) pPatch->pTempInfo->nrCalls++;
2414	rc = patmRecompileCodeStream(pVM, pInstrGC, addr, pfnPATMR3Recompile, pUserData);
2415	if (cpu.pCurInstr->opcode == OP_CALL) pPatch->pTempInfo->nrCalls--;
2416
2417	if(pTargetPatch)
2418	{
2419	PATMR3EnablePatch(pVM, pTargetPatch->pPrivInstrGC);
2420	}
2421
2422	if (VBOX_FAILURE(rc))
2423	{
2424	Log(("patmRecompileCodeStream fatal error %d\n", rc));
2425	break; //done!
2426	}
2427	}
2428	/* Always return to caller here; we're done! */
2429	rc = VINF_SUCCESS;
2430	goto end;
2431	}
2432	else
2433	if (cpu.pCurInstr->optype & OPTYPE_UNCOND_CONTROLFLOW)
2434	{
2435	rc = VINF_SUCCESS;
2436	goto end;
2437	}
2438	pCurInstrGC += opsize;
2439	}
2440	end:
2441	Assert(!(pPatch->flags & PATMFL_RECOMPILE_NEXT));
2442	return rc;
2443	}
2444
2445
2446	/**
2447	* Generate the jump from guest to patch code
2448	*
2449	* @returns VBox status code.
2450	* @param pVM The VM to operate on.
2451	* @param pPatch Patch record
2452	*/
2453	static int patmGenJumpToPatch(PVM pVM, PPATCHINFO pPatch, bool fAddFixup = true)
2454	{
2455	uint8_t temp[8];
2456	uint8_t *pPB;
2457	int rc;
2458
2459	Assert(pPatch->cbPatchJump <= sizeof(temp));
2460	Assert(!(pPatch->flags & PATMFL_PATCHED_GUEST_CODE));
2461
2462	pPB = pPatch->pPrivInstrHC;
2463
2464	#ifdef PATM_RESOLVE_CONFLICTS_WITH_JUMP_PATCHES
2465	if (pPatch->flags & PATMFL_JUMP_CONFLICT)
2466	{
2467	Assert(pPatch->pPatchJumpDestGC);
2468
2469	if (pPatch->cbPatchJump == SIZEOF_NEARJUMP32)
2470	{
2471	// jmp [PatchCode]
2472	if (fAddFixup)
2473	{
2474	if (patmPatchAddReloc32(pVM, pPatch, &pPB[1], FIXUP_REL_JMPTOPATCH, pPatch->pPrivInstrGC + pPatch->cbPatchJump, pPatch->pPatchJumpDestGC) != VINF_SUCCESS)
2475	{
2476	Log(("Relocation failed for the jump in the guest code!!\n"));
2477	return VERR_PATCHING_REFUSED;
2478	}
2479	}
2480
2481	temp[0] = pPatch->aPrivInstr[0]; //jump opcode copied from original instruction
2482	(uint32_t )&temp[1] = (uint32_t)pPatch->pPatchJumpDestGC - ((uint32_t)pPatch->pPrivInstrGC + pPatch->cbPatchJump); //return address
2483	}
2484	else
2485	if (pPatch->cbPatchJump == SIZEOF_NEAR_COND_JUMP32)
2486	{
2487	// jmp [PatchCode]
2488	if (fAddFixup)
2489	{
2490	if (patmPatchAddReloc32(pVM, pPatch, &pPB[2], FIXUP_REL_JMPTOPATCH, pPatch->pPrivInstrGC + pPatch->cbPatchJump, pPatch->pPatchJumpDestGC) != VINF_SUCCESS)
2491	{
2492	Log(("Relocation failed for the jump in the guest code!!\n"));
2493	return VERR_PATCHING_REFUSED;
2494	}
2495	}
2496
2497	temp[0] = pPatch->aPrivInstr[0]; //jump opcode copied from original instruction
2498	temp[1] = pPatch->aPrivInstr[1]; //jump opcode copied from original instruction
2499	(uint32_t )&temp[2] = (uint32_t)pPatch->pPatchJumpDestGC - ((uint32_t)pPatch->pPrivInstrGC + pPatch->cbPatchJump); //return address
2500	}
2501	else
2502	{
2503	Assert(0);
2504	return VERR_PATCHING_REFUSED;
2505	}
2506	}
2507	else
2508	#endif
2509	{
2510	Assert(pPatch->cbPatchJump == SIZEOF_NEARJUMP32);
2511
2512	// jmp [PatchCode]
2513	if (fAddFixup)
2514	{
2515	if (patmPatchAddReloc32(pVM, pPatch, &pPB[1], FIXUP_REL_JMPTOPATCH, pPatch->pPrivInstrGC + SIZEOF_NEARJUMP32, PATCHCODE_PTR_GC(pPatch)) != VINF_SUCCESS)
2516	{
2517	Log(("Relocation failed for the jump in the guest code!!\n"));
2518	return VERR_PATCHING_REFUSED;
2519	}
2520	}
2521	temp[0] = 0xE9; //jmp
2522	(uint32_t )&temp[1] = (RTGCUINTPTR)PATCHCODE_PTR_GC(pPatch) - ((RTGCUINTPTR)pPatch->pPrivInstrGC + SIZEOF_NEARJUMP32); //return address
2523	}
2524	rc = PGMPhysWriteGCPtrDirty(pVM, pPatch->pPrivInstrGC, temp, pPatch->cbPatchJump);
2525	AssertRC(rc);
2526
2527	if (rc == VINF_SUCCESS)
2528	pPatch->flags \|= PATMFL_PATCHED_GUEST_CODE;
2529
2530	return rc;
2531	}
2532
2533	/**
2534	* Remove the jump from guest to patch code
2535	*
2536	* @returns VBox status code.
2537	* @param pVM The VM to operate on.
2538	* @param pPatch Patch record
2539	*/
2540	static int patmRemoveJumpToPatch(PVM pVM, PPATCHINFO pPatch)
2541	{
2542	#ifdef DEBUG
2543	DISCPUSTATE cpu;
2544	char szOutput[256];
2545	uint32_t opsize, i = 0;
2546	bool disret;
2547
2548	while(i < pPatch->cbPrivInstr)
2549	{
2550	cpu.mode = (pPatch->flags & PATMFL_CODE32) ? CPUMODE_32BIT : CPUMODE_16BIT;
2551	disret = PATMR3DISInstr(pVM, pPatch, &cpu, pPatch->pPrivInstrGC + i, &pPatch->pPrivInstrHC[i], &opsize, szOutput);
2552	if (disret == false)
2553	break;
2554
2555	Log(("Org patch jump: %s", szOutput));
2556	Assert(opsize);
2557	i += opsize;
2558	}
2559	#endif
2560
2561	/* Restore original code (privileged instruction + following instructions that were overwritten because of the 5/6 byte jmp). */
2562	int rc = PGMPhysWriteGCPtrDirty(pVM, pPatch->pPrivInstrGC, pPatch->aPrivInstr, pPatch->cbPatchJump);
2563	#ifdef DEBUG
2564	if (rc == VINF_SUCCESS)
2565	{
2566	DISCPUSTATE cpu;
2567	char szOutput[256];
2568	uint32_t opsize, i = 0;
2569	bool disret;
2570
2571	while(i < pPatch->cbPrivInstr)
2572	{
2573	cpu.mode = (pPatch->flags & PATMFL_CODE32) ? CPUMODE_32BIT : CPUMODE_16BIT;
2574	disret = PATMR3DISInstr(pVM, pPatch, &cpu, pPatch->pPrivInstrGC + i, &pPatch->pPrivInstrHC[i], &opsize, szOutput);
2575	if (disret == false)
2576	break;
2577
2578	Log(("Org instr: %s", szOutput));
2579	Assert(opsize);
2580	i += opsize;
2581	}
2582	}
2583	#endif
2584	pPatch->flags &= ~PATMFL_PATCHED_GUEST_CODE;
2585	return rc;
2586	}
2587
2588	/**
2589	* Generate the call from guest to patch code
2590	*
2591	* @returns VBox status code.
2592	* @param pVM The VM to operate on.
2593	* @param pPatch Patch record
2594	*/
2595	static int patmGenCallToPatch(PVM pVM, PPATCHINFO pPatch, RTGCPTR pTargetGC, bool fAddFixup = true)
2596	{
2597	uint8_t temp[8];
2598	uint8_t *pPB;
2599	int rc;
2600
2601	Assert(pPatch->cbPatchJump <= sizeof(temp));
2602
2603	pPB = pPatch->pPrivInstrHC;
2604
2605	Assert(pPatch->cbPatchJump == SIZEOF_NEARJUMP32);
2606
2607	// jmp [PatchCode]
2608	if (fAddFixup)
2609	{
2610	if (patmPatchAddReloc32(pVM, pPatch, &pPB[1], FIXUP_REL_JMPTOPATCH, pPatch->pPrivInstrGC + SIZEOF_NEARJUMP32, pTargetGC) != VINF_SUCCESS)
2611	{
2612	Log(("Relocation failed for the jump in the guest code!!\n"));
2613	return VERR_PATCHING_REFUSED;
2614	}
2615	}
2616
2617	Assert(pPatch->aPrivInstr[0] == 0xE8 \|\| pPatch->aPrivInstr[0] == 0xE9); /* call or jmp */
2618	temp[0] = pPatch->aPrivInstr[0];
2619	(uint32_t )&temp[1] = (uint32_t)pTargetGC - ((uint32_t)pPatch->pPrivInstrGC + SIZEOF_NEARJUMP32); //return address
2620
2621	rc = PGMPhysWriteGCPtrDirty(pVM, pPatch->pPrivInstrGC, temp, pPatch->cbPatchJump);
2622	AssertRC(rc);
2623
2624	return rc;
2625	}
2626
2627
2628	/**
2629	* Patch cli/sti pushf/popf instruction block at specified location
2630	*
2631	* @returns VBox status code.
2632	* @param pVM The VM to operate on.
2633	* @param pInstrGC Guest context point to privileged instruction
2634	* @param pInstrHC Host context point to privileged instruction
2635	* @param uOpcode Instruction opcode
2636	* @param uOpSize Size of starting instruction
2637	* @param pPatchRec Patch record
2638	*
2639	* @note returns failure if patching is not allowed or possible
2640	*
2641	*/
2642	PATMR3DECL(int) PATMR3PatchBlock(PVM pVM, RTGCPTR pInstrGC, R3PTRTYPE(uint8_t *) pInstrHC,
2643	uint32_t uOpcode, uint32_t uOpSize, PPATMPATCHREC pPatchRec)
2644	{
2645	PPATCHINFO pPatch = &pPatchRec->patch;
2646	int rc = VERR_PATCHING_REFUSED;
2647	DISCPUSTATE cpu;
2648	uint32_t orgOffsetPatchMem = ~0;
2649	RTGCPTR pInstrStart;
2650	#ifdef LOG_ENABLED
2651	uint32_t opsize;
2652	char szOutput[256];
2653	bool disret;
2654	#endif
2655
2656	/* Save original offset (in case of failures later on) */
2657	/** @todo use the hypervisor heap (that has quite a few consequences for save/restore though) */
2658	orgOffsetPatchMem = pVM->patm.s.offPatchMem;
2659
2660	Assert(!(pPatch->flags & (PATMFL_GUEST_SPECIFIC\|PATMFL_USER_MODE\|PATMFL_TRAPHANDLER)));
2661	switch (uOpcode)
2662	{
2663	case OP_MOV:
2664	break;
2665
2666	case OP_CLI:
2667	case OP_PUSHF:
2668	/* We can 'call' a cli or pushf patch. It will either return to the original guest code when IF is set again, or fault. */
2669	/** @note special precautions are taken when disabling and enabling such patches. */
2670	pPatch->flags \|= PATMFL_CALLABLE_AS_FUNCTION;
2671	break;
2672
2673	default:
2674	if (!(pPatch->flags & PATMFL_IDTHANDLER))
2675	{
2676	AssertMsg(0, ("PATMR3PatchBlock: Invalid opcode %x\n", uOpcode));
2677	return VERR_INVALID_PARAMETER;
2678	}
2679	}
2680
2681	if (!(pPatch->flags & (PATMFL_IDTHANDLER\|PATMFL_IDTHANDLER_WITHOUT_ENTRYPOINT\|PATMFL_SYSENTER\|PATMFL_INT3_REPLACEMENT_BLOCK)))
2682	pPatch->flags \|= PATMFL_MUST_INSTALL_PATCHJMP;
2683
2684	/* If we're going to insert a patch jump, then the jump itself is not allowed to cross a page boundary. */
2685	if ( (pPatch->flags & PATMFL_MUST_INSTALL_PATCHJMP)
2686	&& PAGE_ADDRESS(pInstrGC) != PAGE_ADDRESS(pInstrGC + SIZEOF_NEARJUMP32)
2687	)
2688	{
2689	STAM_COUNTER_INC(&pVM->patm.s.StatPageBoundaryCrossed);
2690	#ifdef DEBUG_sandervl
2691	//// AssertMsgFailed(("Patch jump would cross page boundary -> refuse!!\n"));
2692	#endif
2693	rc = VERR_PATCHING_REFUSED;
2694	goto failure;
2695	}
2696
2697	pPatch->nrPatch2GuestRecs = 0;
2698	pInstrStart = pInstrGC;
2699
2700	#ifdef PATM_ENABLE_CALL
2701	pPatch->flags \|= PATMFL_SUPPORT_CALLS \| PATMFL_SUPPORT_INDIRECT_CALLS;
2702	#endif
2703
2704	pPatch->pPatchBlockOffset = pVM->patm.s.offPatchMem;
2705	pPatch->uCurPatchOffset = 0;
2706
2707	cpu.mode = (pPatch->flags & PATMFL_CODE32) ? CPUMODE_32BIT : CPUMODE_16BIT;
2708
2709	if ((pPatch->flags & (PATMFL_IDTHANDLER\|PATMFL_IDTHANDLER_WITHOUT_ENTRYPOINT\|PATMFL_SYSENTER)) == PATMFL_IDTHANDLER)
2710	{
2711	Assert(pPatch->flags & PATMFL_INTHANDLER);
2712
2713	/* Install fake cli patch (to clear the virtual IF and check int xx parameters) */
2714	rc = patmPatchGenIntEntry(pVM, pPatch, pInstrGC);
2715	if (VBOX_FAILURE(rc))
2716	goto failure;
2717	}
2718
2719	/***************************************************************************************************************************/
2720	/** @note We can't insert any code before a sysenter handler; some linux guests have an invalid stack at this point!!!!! */
2721	/***************************************************************************************************************************/
2722	#ifdef VBOX_WITH_STATISTICS
2723	if (!(pPatch->flags & PATMFL_SYSENTER))
2724	{
2725	rc = patmPatchGenStats(pVM, pPatch, pInstrGC);
2726	if (VBOX_FAILURE(rc))
2727	goto failure;
2728	}
2729	#endif
2730
2731	rc = patmRecompileCodeStream(pVM, pInstrGC, pInstrGC, patmRecompileCallback, pPatch);
2732	if (rc != VINF_SUCCESS)
2733	{
2734	Log(("PATMR3PatchCli: patmRecompileCodeStream failed with %d\n", rc));
2735	goto failure;
2736	}
2737
2738	/* Calculated during analysis. */
2739	if (pPatch->cbPatchBlockSize < SIZEOF_NEARJUMP32)
2740	{
2741	/* Most likely cause: we encountered an illegal instruction very early on. */
2742	/** @todo could turn it into an int3 callable patch. */
2743	Log(("PATMR3PatchBlock: patch block too small -> refuse\n"));
2744	rc = VERR_PATCHING_REFUSED;
2745	goto failure;
2746	}
2747
2748	/* size of patch block */
2749	pPatch->cbPatchBlockSize = pPatch->uCurPatchOffset;
2750
2751
2752	/* Update free pointer in patch memory. */
2753	pVM->patm.s.offPatchMem += pPatch->cbPatchBlockSize;
2754	/* Round to next 8 byte boundary. */
2755	pVM->patm.s.offPatchMem = RT_ALIGN_32(pVM->patm.s.offPatchMem, 8);
2756
2757	/*
2758	* Insert into patch to guest lookup tree
2759	*/
2760	LogFlow(("Insert %VGv patch offset %VGv\n", pPatchRec->patch.pPrivInstrGC, pPatch->pPatchBlockOffset));
2761	pPatchRec->CoreOffset.Key = pPatch->pPatchBlockOffset;
2762	rc = RTAvloGCPtrInsert(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPatchAddr, &pPatchRec->CoreOffset);
2763	AssertMsg(rc, ("RTAvlULInsert failed for %x\n", pPatchRec->CoreOffset.Key));
2764	if (!rc)
2765	{
2766	rc = VERR_PATCHING_REFUSED;
2767	goto failure;
2768	}
2769
2770	/* Note that patmr3SetBranchTargets can install additional patches!! */
2771	rc = patmr3SetBranchTargets(pVM, pPatch);
2772	if (rc != VINF_SUCCESS)
2773	{
2774	Log(("PATMR3PatchCli: patmr3SetBranchTargets failed with %d\n", rc));
2775	goto failure;
2776	}
2777
2778	#ifdef LOG_ENABLED
2779	Log(("Patch code ----------------------------------------------------------\n"));
2780	patmr3DisasmCodeStream(pVM, PATCHCODE_PTR_GC(pPatch), PATCHCODE_PTR_GC(pPatch), patmr3DisasmCallback, pPatch);
2781	Log(("Patch code ends -----------------------------------------------------\n"));
2782	#endif
2783
2784	/* make a copy of the guest code bytes that will be overwritten */
2785	pPatch->cbPatchJump = SIZEOF_NEARJUMP32;
2786
2787	rc = PGMPhysReadGCPtr(pVM, pPatch->aPrivInstr, pPatch->pPrivInstrGC, pPatch->cbPatchJump);
2788	AssertRC(rc);
2789
2790	if (pPatch->flags & PATMFL_INT3_REPLACEMENT_BLOCK)
2791	{
2792	/uint8_t ASMInt3 = 0xCC; - unused /
2793
2794	Log(("PATMR3PatchBlock %VGv -> int 3 callable patch.\n", pPatch->pPrivInstrGC));
2795	/* Replace first opcode byte with 'int 3'. */
2796	rc = patmActivateInt3Patch(pVM, pPatch);
2797	if (VBOX_FAILURE(rc))
2798	goto failure;
2799
2800	/* normal patch can be turned into an int3 patch -> clear patch jump installation flag. */
2801	pPatch->flags &= ~PATMFL_MUST_INSTALL_PATCHJMP;
2802
2803	pPatch->flags &= ~PATMFL_INSTR_HINT;
2804	STAM_COUNTER_INC(&pVM->patm.s.StatInt3Callable);
2805	}
2806	else
2807	if (pPatch->flags & PATMFL_MUST_INSTALL_PATCHJMP)
2808	{
2809	Assert(!(pPatch->flags & (PATMFL_IDTHANDLER\|PATMFL_IDTHANDLER_WITHOUT_ENTRYPOINT\|PATMFL_SYSENTER\|PATMFL_INT3_REPLACEMENT_BLOCK)));
2810	/* now insert a jump in the guest code */
2811	rc = patmGenJumpToPatch(pVM, pPatch, true);
2812	AssertRC(rc);
2813	if (VBOX_FAILURE(rc))
2814	goto failure;
2815
2816	}
2817
2818	#ifdef LOG_ENABLED
2819	cpu.mode = (pPatch->flags & PATMFL_CODE32) ? CPUMODE_32BIT : CPUMODE_16BIT;
2820	disret = PATMR3DISInstr(pVM, pPatch, &cpu, pPatch->pPrivInstrGC, pPatch->pPrivInstrHC, &opsize, szOutput, PATMREAD_RAWCODE);
2821	Log(("%s patch: %s", patmGetInstructionString(pPatch->opcode, pPatch->flags), szOutput));
2822	#endif
2823
2824	patmEmptyTree(pVM, &pPatch->pTempInfo->IllegalInstrTree);
2825	pPatch->pTempInfo->nrIllegalInstr = 0;
2826
2827	Log(("Successfully installed %s patch at %VGv\n", patmGetInstructionString(pPatch->opcode, pPatch->flags), pInstrGC));
2828
2829	pPatch->uState = PATCH_ENABLED;
2830	return VINF_SUCCESS;
2831
2832	failure:
2833	if (pPatchRec->CoreOffset.Key)
2834	RTAvloGCPtrRemove(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPatchAddr, pPatchRec->CoreOffset.Key);
2835
2836	patmEmptyTree(pVM, &pPatch->FixupTree);
2837	pPatch->nrFixups = 0;
2838
2839	patmEmptyTree(pVM, &pPatch->JumpTree);
2840	pPatch->nrJumpRecs = 0;
2841
2842	patmEmptyTree(pVM, &pPatch->pTempInfo->IllegalInstrTree);
2843	pPatch->pTempInfo->nrIllegalInstr = 0;
2844
2845	/* Turn this cli patch into a dummy. */
2846	pPatch->uState = PATCH_REFUSED;
2847	pPatch->pPatchBlockOffset = 0;
2848
2849	// Give back the patch memory we no longer need
2850	Assert(orgOffsetPatchMem != (uint32_t)~0);
2851	pVM->patm.s.offPatchMem = orgOffsetPatchMem;
2852
2853	return rc;
2854	}
2855
2856	/**
2857	* Patch IDT handler
2858	*
2859	* @returns VBox status code.
2860	* @param pVM The VM to operate on.
2861	* @param pInstrGC Guest context point to privileged instruction
2862	* @param pInstrHC Host context point to privileged instruction
2863	* @param uOpSize Size of starting instruction
2864	* @param pPatchRec Patch record
2865	*
2866	* @note returns failure if patching is not allowed or possible
2867	*
2868	*/
2869	static int patmIdtHandler(PVM pVM, RTGCPTR pInstrGC, R3PTRTYPE(uint8_t *) pInstrHC,
2870	uint32_t uOpSize, PPATMPATCHREC pPatchRec)
2871	{
2872	PPATCHINFO pPatch = &pPatchRec->patch;
2873	bool disret;
2874	DISCPUSTATE cpuPush, cpuJmp;
2875	uint32_t opsize;
2876	RTGCPTR pCurInstrGC = pInstrGC;
2877	uint8_t *pCurInstrHC = pInstrHC;
2878	uint32_t orgOffsetPatchMem = ~0;
2879
2880	/*
2881	* In Linux it's often the case that many interrupt handlers push a predefined value onto the stack
2882	* and then jump to a common entrypoint. In order not to waste a lot of memory, we will check for this
2883	* condition here and only patch the common entypoint once.
2884	*/
2885	cpuPush.mode = (pPatch->flags & PATMFL_CODE32) ? CPUMODE_32BIT : CPUMODE_16BIT;
2886	disret = PATMR3DISInstr(pVM, pPatch, &cpuPush, pCurInstrGC, pCurInstrHC, &opsize, NULL);
2887	Assert(disret);
2888	if (disret && cpuPush.pCurInstr->opcode == OP_PUSH)
2889	{
2890	RTGCPTR pJmpInstrGC;
2891	int rc;
2892
2893	pCurInstrGC += opsize;
2894	pCurInstrHC = PATMGCVirtToHCVirt(pVM, pPatch, pCurInstrGC);
2895
2896	cpuJmp.mode = (pPatch->flags & PATMFL_CODE32) ? CPUMODE_32BIT : CPUMODE_16BIT;
2897	disret = PATMR3DISInstr(pVM, pPatch, &cpuJmp, pCurInstrGC, pCurInstrHC, &opsize, NULL);
2898	if ( disret
2899	&& cpuJmp.pCurInstr->opcode == OP_JMP
2900	&& (pJmpInstrGC = PATMResolveBranch(&cpuJmp, pCurInstrGC))
2901	)
2902	{
2903	PPATMPATCHREC pJmpPatch = (PPATMPATCHREC)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTree, pJmpInstrGC);
2904	if (pJmpPatch == 0)
2905	{
2906	/* Patch it first! */
2907	rc = PATMR3InstallPatch(pVM, pJmpInstrGC, pPatch->flags \| PATMFL_IDTHANDLER_WITHOUT_ENTRYPOINT);
2908	if (rc != VINF_SUCCESS)
2909	goto failure;
2910	pJmpPatch = (PPATMPATCHREC)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTree, pJmpInstrGC);
2911	Assert(pJmpPatch);
2912	}
2913	if (pJmpPatch->patch.uState != PATCH_ENABLED)
2914	goto failure;
2915
2916	/* save original offset (in case of failures later on) */
2917	orgOffsetPatchMem = pVM->patm.s.offPatchMem;
2918
2919	pPatch->pPatchBlockOffset = pVM->patm.s.offPatchMem;
2920	pPatch->uCurPatchOffset = 0;
2921	pPatch->nrPatch2GuestRecs = 0;
2922
2923	#ifdef VBOX_WITH_STATISTICS
2924	rc = patmPatchGenStats(pVM, pPatch, pInstrGC);
2925	if (VBOX_FAILURE(rc))
2926	goto failure;
2927	#endif
2928
2929	/* Install fake cli patch (to clear the virtual IF) */
2930	rc = patmPatchGenIntEntry(pVM, pPatch, pInstrGC);
2931	if (VBOX_FAILURE(rc))
2932	goto failure;
2933
2934	/* Add lookup record for patch to guest address translation (for the push) */
2935	patmr3AddP2GLookupRecord(pVM, pPatch, PATCHCODE_PTR_HC(pPatch) + pPatch->uCurPatchOffset, pInstrGC, PATM_LOOKUP_BOTHDIR);
2936
2937	/* Duplicate push. */
2938	rc = patmPatchGenDuplicate(pVM, pPatch, &cpuPush, pInstrGC);
2939	if (VBOX_FAILURE(rc))
2940	goto failure;
2941
2942	/* Generate jump to common entrypoint. */
2943	rc = patmPatchGenPatchJump(pVM, pPatch, pCurInstrGC, PATCHCODE_PTR_GC(&pJmpPatch->patch));
2944	if (VBOX_FAILURE(rc))
2945	goto failure;
2946
2947	/* size of patch block */
2948	pPatch->cbPatchBlockSize = pPatch->uCurPatchOffset;
2949
2950	/* Update free pointer in patch memory. */
2951	pVM->patm.s.offPatchMem += pPatch->cbPatchBlockSize;
2952	/* Round to next 8 byte boundary */
2953	pVM->patm.s.offPatchMem = RT_ALIGN_32(pVM->patm.s.offPatchMem, 8);
2954
2955	/* There's no jump from guest to patch code. */
2956	pPatch->cbPatchJump = 0;
2957
2958
2959	#ifdef LOG_ENABLED
2960	Log(("Patch code ----------------------------------------------------------\n"));
2961	patmr3DisasmCodeStream(pVM, PATCHCODE_PTR_GC(pPatch), PATCHCODE_PTR_GC(pPatch), patmr3DisasmCallback, pPatch);
2962	Log(("Patch code ends -----------------------------------------------------\n"));
2963	#endif
2964	Log(("Successfully installed IDT handler patch at %VGv\n", pInstrGC));
2965
2966	/*
2967	* Insert into patch to guest lookup tree
2968	*/
2969	LogFlow(("Insert %VGv patch offset %VGv\n", pPatchRec->patch.pPrivInstrGC, pPatch->pPatchBlockOffset));
2970	pPatchRec->CoreOffset.Key = pPatch->pPatchBlockOffset;
2971	rc = RTAvloGCPtrInsert(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPatchAddr, &pPatchRec->CoreOffset);
2972	AssertMsg(rc, ("RTAvlULInsert failed for %x\n", pPatchRec->CoreOffset.Key));
2973
2974	pPatch->uState = PATCH_ENABLED;
2975
2976	return VINF_SUCCESS;
2977	}
2978	}
2979	failure:
2980	/* Give back the patch memory we no longer need */
2981	if (orgOffsetPatchMem != (uint32_t)~0)
2982	pVM->patm.s.offPatchMem = orgOffsetPatchMem;
2983
2984	return PATMR3PatchBlock(pVM, pInstrGC, pInstrHC, OP_CLI, uOpSize, pPatchRec);
2985	}
2986
2987	/**
2988	* Install a trampoline to call a guest trap handler directly
2989	*
2990	* @returns VBox status code.
2991	* @param pVM The VM to operate on.
2992	* @param pInstrGC Guest context point to privileged instruction
2993	* @param pPatchRec Patch record
2994	*
2995	*/
2996	static int patmInstallTrapTrampoline(PVM pVM, RTGCPTR pInstrGC, PPATMPATCHREC pPatchRec)
2997	{
2998	PPATCHINFO pPatch = &pPatchRec->patch;
2999	int rc = VERR_PATCHING_REFUSED;
3000	uint32_t orgOffsetPatchMem = ~0;
3001	#ifdef LOG_ENABLED
3002	bool disret;
3003	DISCPUSTATE cpu;
3004	uint32_t opsize;
3005	char szOutput[256];
3006	#endif
3007
3008	// save original offset (in case of failures later on)
3009	orgOffsetPatchMem = pVM->patm.s.offPatchMem;
3010
3011	pPatch->pPatchBlockOffset = pVM->patm.s.offPatchMem;
3012	pPatch->uCurPatchOffset = 0;
3013	pPatch->nrPatch2GuestRecs = 0;
3014
3015	#ifdef VBOX_WITH_STATISTICS
3016	rc = patmPatchGenStats(pVM, pPatch, pInstrGC);
3017	if (VBOX_FAILURE(rc))
3018	goto failure;
3019	#endif
3020
3021	rc = patmPatchGenTrapEntry(pVM, pPatch, pInstrGC);
3022	if (VBOX_FAILURE(rc))
3023	goto failure;
3024
3025	/* size of patch block */
3026	pPatch->cbPatchBlockSize = pPatch->uCurPatchOffset;
3027
3028	/* Update free pointer in patch memory. */
3029	pVM->patm.s.offPatchMem += pPatch->cbPatchBlockSize;
3030	/* Round to next 8 byte boundary */
3031	pVM->patm.s.offPatchMem = RT_ALIGN_32(pVM->patm.s.offPatchMem, 8);
3032
3033	/* There's no jump from guest to patch code. */
3034	pPatch->cbPatchJump = 0;
3035
3036	#ifdef LOG_ENABLED
3037	Log(("Patch code ----------------------------------------------------------\n"));
3038	patmr3DisasmCodeStream(pVM, PATCHCODE_PTR_GC(pPatch), PATCHCODE_PTR_GC(pPatch), patmr3DisasmCallback, pPatch);
3039	Log(("Patch code ends -----------------------------------------------------\n"));
3040	#endif
3041
3042	#ifdef LOG_ENABLED
3043	cpu.mode = (pPatch->flags & PATMFL_CODE32) ? CPUMODE_32BIT : CPUMODE_16BIT;
3044	disret = PATMR3DISInstr(pVM, pPatch, &cpu, pPatch->pPrivInstrGC, pPatch->pPrivInstrHC, &opsize, szOutput);
3045	Log(("TRAP handler patch: %s", szOutput));
3046	#endif
3047	Log(("Successfully installed Trap Trampoline patch at %VGv\n", pInstrGC));
3048
3049	/*
3050	* Insert into patch to guest lookup tree
3051	*/
3052	LogFlow(("Insert %VGv patch offset %VGv\n", pPatchRec->patch.pPrivInstrGC, pPatch->pPatchBlockOffset));
3053	pPatchRec->CoreOffset.Key = pPatch->pPatchBlockOffset;
3054	rc = RTAvloGCPtrInsert(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPatchAddr, &pPatchRec->CoreOffset);
3055	AssertMsg(rc, ("RTAvlULInsert failed for %x\n", pPatchRec->CoreOffset.Key));
3056
3057	pPatch->uState = PATCH_ENABLED;
3058	return VINF_SUCCESS;
3059
3060	failure:
3061	AssertMsgFailed(("Failed to install trap handler trampoline!!\n"));
3062
3063	/* Turn this cli patch into a dummy. */
3064	pPatch->uState = PATCH_REFUSED;
3065	pPatch->pPatchBlockOffset = 0;
3066
3067	/* Give back the patch memory we no longer need */
3068	Assert(orgOffsetPatchMem != (uint32_t)~0);
3069	pVM->patm.s.offPatchMem = orgOffsetPatchMem;
3070
3071	return rc;
3072	}
3073
3074
3075	#ifdef LOG_ENABLED
3076	/**
3077	* Check if the instruction is patched as a common idt handler
3078	*
3079	* @returns true or false
3080	* @param pVM The VM to operate on.
3081	* @param pInstrGC Guest context point to the instruction
3082	*
3083	*/
3084	static bool patmIsCommonIDTHandlerPatch(PVM pVM, RTGCPTR pInstrGC)
3085	{
3086	PPATMPATCHREC pRec;
3087
3088	pRec = (PPATMPATCHREC)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTree, pInstrGC);
3089	if (pRec && pRec->patch.flags & PATMFL_IDTHANDLER_WITHOUT_ENTRYPOINT)
3090	return true;
3091	return false;
3092	}
3093	#endif //DEBUG
3094
3095
3096	/**
3097	* Duplicates a complete function
3098	*
3099	* @returns VBox status code.
3100	* @param pVM The VM to operate on.
3101	* @param pInstrGC Guest context point to privileged instruction
3102	* @param pPatchRec Patch record
3103	*
3104	*/
3105	static int patmDuplicateFunction(PVM pVM, RTGCPTR pInstrGC, PPATMPATCHREC pPatchRec)
3106	{
3107	PPATCHINFO pPatch = &pPatchRec->patch;
3108	int rc = VERR_PATCHING_REFUSED;
3109	DISCPUSTATE cpu;
3110	uint32_t orgOffsetPatchMem = ~0;
3111
3112	Log(("patmDuplicateFunction %VGv\n", pInstrGC));
3113	/* Save original offset (in case of failures later on). */
3114	orgOffsetPatchMem = pVM->patm.s.offPatchMem;
3115
3116	/* We will not go on indefinitely with call instruction handling. */
3117	if (pVM->patm.s.ulCallDepth > PATM_MAX_CALL_DEPTH)
3118	{
3119	Log(("patmDuplicateFunction: maximum callback depth reached!!\n"));
3120	return VERR_PATCHING_REFUSED;
3121	}
3122
3123	pVM->patm.s.ulCallDepth++;
3124
3125	#ifdef PATM_ENABLE_CALL
3126	pPatch->flags \|= PATMFL_SUPPORT_CALLS \| PATMFL_SUPPORT_INDIRECT_CALLS;
3127	#endif
3128
3129	Assert(pPatch->flags & (PATMFL_DUPLICATE_FUNCTION));
3130
3131	pPatch->nrPatch2GuestRecs = 0;
3132	pPatch->pPatchBlockOffset = pVM->patm.s.offPatchMem;
3133	pPatch->uCurPatchOffset = 0;
3134
3135	cpu.mode = (pPatch->flags & PATMFL_CODE32) ? CPUMODE_32BIT : CPUMODE_16BIT;
3136
3137	/** @note Set the PATM interrupt flag here; it was cleared before the patched call. (!!!) */
3138	rc = patmPatchGenSetPIF(pVM, pPatch, pInstrGC);
3139	if (VBOX_FAILURE(rc))
3140	goto failure;
3141
3142	#ifdef VBOX_WITH_STATISTICS
3143	rc = patmPatchGenStats(pVM, pPatch, pInstrGC);
3144	if (VBOX_FAILURE(rc))
3145	goto failure;
3146	#endif
3147	rc = patmRecompileCodeStream(pVM, pInstrGC, pInstrGC, patmRecompileCallback, pPatch);
3148	if (rc != VINF_SUCCESS)
3149	{
3150	Log(("PATMR3PatchCli: patmRecompileCodeStream failed with %d\n", rc));
3151	goto failure;
3152	}
3153
3154	//size of patch block
3155	pPatch->cbPatchBlockSize = pPatch->uCurPatchOffset;
3156
3157	//update free pointer in patch memory
3158	pVM->patm.s.offPatchMem += pPatch->cbPatchBlockSize;
3159	/* Round to next 8 byte boundary. */
3160	pVM->patm.s.offPatchMem = RT_ALIGN_32(pVM->patm.s.offPatchMem, 8);
3161
3162	pPatch->uState = PATCH_ENABLED;
3163
3164	/*
3165	* Insert into patch to guest lookup tree
3166	*/
3167	LogFlow(("Insert %VGv patch offset %VGv\n", pPatchRec->patch.pPrivInstrGC, pPatch->pPatchBlockOffset));
3168	pPatchRec->CoreOffset.Key = pPatch->pPatchBlockOffset;
3169	rc = RTAvloGCPtrInsert(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPatchAddr, &pPatchRec->CoreOffset);
3170	AssertMsg(rc, ("RTAvloGCPtrInsert failed for %x\n", pPatchRec->CoreOffset.Key));
3171	if (!rc)
3172	{
3173	rc = VERR_PATCHING_REFUSED;
3174	goto failure;
3175	}
3176
3177	/* Note that patmr3SetBranchTargets can install additional patches!! */
3178	rc = patmr3SetBranchTargets(pVM, pPatch);
3179	if (rc != VINF_SUCCESS)
3180	{
3181	Log(("PATMR3PatchCli: patmr3SetBranchTargets failed with %d\n", rc));
3182	goto failure;
3183	}
3184
3185	#ifdef LOG_ENABLED
3186	Log(("Patch code ----------------------------------------------------------\n"));
3187	patmr3DisasmCodeStream(pVM, PATCHCODE_PTR_GC(pPatch), PATCHCODE_PTR_GC(pPatch), patmr3DisasmCallback, pPatch);
3188	Log(("Patch code ends -----------------------------------------------------\n"));
3189	#endif
3190
3191	Log(("Successfully installed function duplication patch at %VGv\n", pInstrGC));
3192
3193	patmEmptyTree(pVM, &pPatch->pTempInfo->IllegalInstrTree);
3194	pPatch->pTempInfo->nrIllegalInstr = 0;
3195
3196	pVM->patm.s.ulCallDepth--;
3197	STAM_COUNTER_INC(&pVM->patm.s.StatInstalledFunctionPatches);
3198	return VINF_SUCCESS;
3199
3200	failure:
3201	if (pPatchRec->CoreOffset.Key)
3202	RTAvloGCPtrRemove(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPatchAddr, pPatchRec->CoreOffset.Key);
3203
3204	patmEmptyTree(pVM, &pPatch->FixupTree);
3205	pPatch->nrFixups = 0;
3206
3207	patmEmptyTree(pVM, &pPatch->JumpTree);
3208	pPatch->nrJumpRecs = 0;
3209
3210	patmEmptyTree(pVM, &pPatch->pTempInfo->IllegalInstrTree);
3211	pPatch->pTempInfo->nrIllegalInstr = 0;
3212
3213	/* Turn this cli patch into a dummy. */
3214	pPatch->uState = PATCH_REFUSED;
3215	pPatch->pPatchBlockOffset = 0;
3216
3217	// Give back the patch memory we no longer need
3218	Assert(orgOffsetPatchMem != (uint32_t)~0);
3219	pVM->patm.s.offPatchMem = orgOffsetPatchMem;
3220
3221	pVM->patm.s.ulCallDepth--;
3222	Log(("patmDupicateFunction %VGv failed!!\n", pInstrGC));
3223	return rc;
3224	}
3225
3226	/**
3227	* Creates trampoline code to jump inside an existing patch
3228	*
3229	* @returns VBox status code.
3230	* @param pVM The VM to operate on.
3231	* @param pInstrGC Guest context point to privileged instruction
3232	* @param pPatchRec Patch record
3233	*
3234	*/
3235	static int patmCreateTrampoline(PVM pVM, RTGCPTR pInstrGC, PPATMPATCHREC pPatchRec)
3236	{
3237	PPATCHINFO pPatch = &pPatchRec->patch;
3238	RTGCPTR pPage, pPatchTargetGC = 0;
3239	uint32_t orgOffsetPatchMem = ~0;
3240	int rc = VERR_PATCHING_REFUSED;
3241
3242	Log(("patmCreateTrampoline %VGv\n", pInstrGC));
3243	/* Save original offset (in case of failures later on). */
3244	orgOffsetPatchMem = pVM->patm.s.offPatchMem;
3245
3246	/* First we check if the duplicate function target lies in some existing function patch already. Will save some space. */
3247	/** @todo we already checked this before */
3248	pPage = pInstrGC & PAGE_BASE_GC_MASK;
3249
3250	PPATMPATCHPAGE pPatchPage = (PPATMPATCHPAGE)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPage, (RTGCPTR)pPage);
3251	if (pPatchPage)
3252	{
3253	uint32_t i;
3254
3255	for (i=0;i<pPatchPage->cCount;i++)
3256	{
3257	if (pPatchPage->aPatch[i])
3258	{
3259	PPATCHINFO pPatch = pPatchPage->aPatch[i];
3260
3261	if ( (pPatch->flags & PATMFL_DUPLICATE_FUNCTION)
3262	&& pPatch->uState == PATCH_ENABLED)
3263	{
3264	pPatchTargetGC = patmGuestGCPtrToPatchGCPtr(pVM, pPatch, pInstrGC);
3265	if (pPatchTargetGC)
3266	{
3267	uint32_t offsetPatch = pPatchTargetGC - pVM->patm.s.pPatchMemGC;
3268	PRECPATCHTOGUEST pPatchToGuestRec = (PRECPATCHTOGUEST)RTAvlU32GetBestFit(&pPatch->Patch2GuestAddrTree, offsetPatch, false);
3269	Assert(pPatchToGuestRec);
3270
3271	pPatchToGuestRec->fJumpTarget = true;
3272	Assert(pPatchTargetGC != pPatch->pPrivInstrGC);
3273	Log(("patmCreateTrampoline: generating jump to code inside patch at %VGv\n", pPatch->pPrivInstrGC));
3274	pPatch->flags \|= PATMFL_EXTERNAL_JUMP_INSIDE;
3275	break;
3276	}
3277	}
3278	}
3279	}
3280	}
3281	AssertReturn(pPatchPage && pPatchTargetGC, VERR_PATCHING_REFUSED);
3282
3283	pPatch->nrPatch2GuestRecs = 0;
3284	pPatch->pPatchBlockOffset = pVM->patm.s.offPatchMem;
3285	pPatch->uCurPatchOffset = 0;
3286
3287	/** @note Set the PATM interrupt flag here; it was cleared before the patched call. (!!!) */
3288	rc = patmPatchGenSetPIF(pVM, pPatch, pInstrGC);
3289	if (VBOX_FAILURE(rc))
3290	goto failure;
3291
3292	#ifdef VBOX_WITH_STATISTICS
3293	rc = patmPatchGenStats(pVM, pPatch, pInstrGC);
3294	if (VBOX_FAILURE(rc))
3295	goto failure;
3296	#endif
3297
3298	rc = patmPatchGenPatchJump(pVM, pPatch, pInstrGC, pPatchTargetGC);
3299	if (VBOX_FAILURE(rc))
3300	goto failure;
3301
3302	/*
3303	* Insert into patch to guest lookup tree
3304	*/
3305	LogFlow(("Insert %VGv patch offset %VGv\n", pPatchRec->patch.pPrivInstrGC, pPatch->pPatchBlockOffset));
3306	pPatchRec->CoreOffset.Key = pPatch->pPatchBlockOffset;
3307	rc = RTAvloGCPtrInsert(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPatchAddr, &pPatchRec->CoreOffset);
3308	AssertMsg(rc, ("RTAvloGCPtrInsert failed for %x\n", pPatchRec->CoreOffset.Key));
3309	if (!rc)
3310	{
3311	rc = VERR_PATCHING_REFUSED;
3312	goto failure;
3313	}
3314
3315	/* size of patch block */
3316	pPatch->cbPatchBlockSize = pPatch->uCurPatchOffset;
3317
3318	/* Update free pointer in patch memory. */
3319	pVM->patm.s.offPatchMem += pPatch->cbPatchBlockSize;
3320	/* Round to next 8 byte boundary */
3321	pVM->patm.s.offPatchMem = RT_ALIGN_32(pVM->patm.s.offPatchMem, 8);
3322
3323	/* There's no jump from guest to patch code. */
3324	pPatch->cbPatchJump = 0;
3325
3326	/* Enable the patch. */
3327	pPatch->uState = PATCH_ENABLED;
3328	/* We allow this patch to be called as a function. */
3329	pPatch->flags \|= PATMFL_CALLABLE_AS_FUNCTION;
3330	STAM_COUNTER_INC(&pVM->patm.s.StatInstalledTrampoline);
3331	return VINF_SUCCESS;
3332
3333	failure:
3334	if (pPatchRec->CoreOffset.Key)
3335	RTAvloGCPtrRemove(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPatchAddr, pPatchRec->CoreOffset.Key);
3336
3337	patmEmptyTree(pVM, &pPatch->FixupTree);
3338	pPatch->nrFixups = 0;
3339
3340	patmEmptyTree(pVM, &pPatch->JumpTree);
3341	pPatch->nrJumpRecs = 0;
3342
3343	patmEmptyTree(pVM, &pPatch->pTempInfo->IllegalInstrTree);
3344	pPatch->pTempInfo->nrIllegalInstr = 0;
3345
3346	/* Turn this cli patch into a dummy. */
3347	pPatch->uState = PATCH_REFUSED;
3348	pPatch->pPatchBlockOffset = 0;
3349
3350	// Give back the patch memory we no longer need
3351	Assert(orgOffsetPatchMem != (uint32_t)~0);
3352	pVM->patm.s.offPatchMem = orgOffsetPatchMem;
3353
3354	return rc;
3355	}
3356
3357
3358	/**
3359	* Patch branch target function for call/jump at specified location.
3360	* (in responds to a VINF_PATM_DUPLICATE_FUNCTION GC exit reason)
3361	*
3362	* @returns VBox status code.
3363	* @param pVM The VM to operate on.
3364	* @param pCtx Guest context
3365	*
3366	*/
3367	PATMR3DECL(int) PATMR3DuplicateFunctionRequest(PVM pVM, PCPUMCTX pCtx)
3368	{
3369	RTGCPTR pBranchTarget, pPage;
3370	int rc;
3371	RTGCPTR pPatchTargetGC = 0;
3372
3373	pBranchTarget = pCtx->edx;
3374	pBranchTarget = SELMToFlat(pVM, pCtx->eflags, pCtx->cs, &pCtx->csHid, pBranchTarget);
3375
3376	/* First we check if the duplicate function target lies in some existing function patch already. Will save some space. */
3377	pPage = pBranchTarget & PAGE_BASE_GC_MASK;
3378
3379	PPATMPATCHPAGE pPatchPage = (PPATMPATCHPAGE)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPage, (RTGCPTR)pPage);
3380	if (pPatchPage)
3381	{
3382	uint32_t i;
3383
3384	for (i=0;i<pPatchPage->cCount;i++)
3385	{
3386	if (pPatchPage->aPatch[i])
3387	{
3388	PPATCHINFO pPatch = pPatchPage->aPatch[i];
3389
3390	if ( (pPatch->flags & PATMFL_DUPLICATE_FUNCTION)
3391	&& pPatch->uState == PATCH_ENABLED)
3392	{
3393	pPatchTargetGC = patmGuestGCPtrToPatchGCPtr(pVM, pPatch, pBranchTarget);
3394	if (pPatchTargetGC)
3395	{
3396	STAM_COUNTER_INC(&pVM->patm.s.StatDuplicateUseExisting);
3397	break;
3398	}
3399	}
3400	}
3401	}
3402	}
3403
3404	if (pPatchTargetGC)
3405	{
3406	/* Create a trampoline that also sets PATM_INTERRUPTFLAG. */
3407	rc = PATMR3InstallPatch(pVM, pBranchTarget, PATMFL_CODE32 \| PATMFL_TRAMPOLINE);
3408	}
3409	else
3410	{
3411	rc = PATMR3InstallPatch(pVM, pBranchTarget, PATMFL_CODE32 \| PATMFL_DUPLICATE_FUNCTION);
3412	}
3413
3414	if (rc == VINF_SUCCESS)
3415	{
3416	pPatchTargetGC = PATMR3QueryPatchGCPtr(pVM, pBranchTarget);
3417	Assert(pPatchTargetGC);
3418	}
3419
3420	if (pPatchTargetGC)
3421	{
3422	pCtx->eax = pPatchTargetGC;
3423	pCtx->eax = pCtx->eax - (RTGCUINTPTR)pVM->patm.s.pPatchMemGC; /* make it relative */
3424	}
3425	else
3426	{
3427	/* We add a dummy entry into the lookup cache so we won't get bombarded with the same requests over and over again. */
3428	pCtx->eax = 0;
3429	STAM_COUNTER_INC(&pVM->patm.s.StatDuplicateREQFailed);
3430	}
3431	Assert(PATMIsPatchGCAddr(pVM, pCtx->edi));
3432	rc = PATMAddBranchToLookupCache(pVM, pCtx->edi, pBranchTarget, pCtx->eax);
3433	AssertRC(rc);
3434
3435	pCtx->eip += PATM_ILLEGAL_INSTR_SIZE;
3436	STAM_COUNTER_INC(&pVM->patm.s.StatDuplicateREQSuccess);
3437	return VINF_SUCCESS;
3438	}
3439
3440	/**
3441	* Replaces a function call by a call to an existing function duplicate (or jmp -> jmp)
3442	*
3443	* @returns VBox status code.
3444	* @param pVM The VM to operate on.
3445	* @param pCpu Disassembly CPU structure ptr
3446	* @param pInstrGC Guest context point to privileged instruction
3447	* @param pPatch Patch record
3448	*
3449	*/
3450	static int patmReplaceFunctionCall(PVM pVM, DISCPUSTATE *pCpu, RTGCPTR pInstrGC, PPATCHINFO pPatch)
3451	{
3452	int rc = VERR_PATCHING_REFUSED;
3453	DISCPUSTATE cpu;
3454	RTGCPTR pTargetGC;
3455	PPATMPATCHREC pPatchFunction;
3456	uint32_t opsize;
3457	bool disret;
3458	#ifdef LOG_ENABLED
3459	char szOutput[256];
3460	#endif
3461
3462	Assert(pPatch->flags & PATMFL_REPLACE_FUNCTION_CALL);
3463	Assert((pCpu->pCurInstr->opcode == OP_CALL \|\| pCpu->pCurInstr->opcode == OP_JMP) && pCpu->opsize == SIZEOF_NEARJUMP32);
3464
3465	if ((pCpu->pCurInstr->opcode != OP_CALL && pCpu->pCurInstr->opcode != OP_JMP) \|\| pCpu->opsize != SIZEOF_NEARJUMP32)
3466	{
3467	rc = VERR_PATCHING_REFUSED;
3468	goto failure;
3469	}
3470
3471	pTargetGC = PATMResolveBranch(pCpu, pInstrGC);
3472	if (pTargetGC == 0)
3473	{
3474	Log(("We don't support far jumps here!! (%08X)\n", pCpu->param1.flags));
3475	rc = VERR_PATCHING_REFUSED;
3476	goto failure;
3477	}
3478
3479	pPatchFunction = (PPATMPATCHREC)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTree, pTargetGC);
3480	if (pPatchFunction == NULL)
3481	{
3482	for(;;)
3483	{
3484	/* It could be an indirect call (call -> jmp dest).
3485	* Note that it's dangerous to assume the jump will never change...
3486	*/
3487	uint8_t *pTmpInstrHC;
3488
3489	pTmpInstrHC = PATMGCVirtToHCVirt(pVM, pPatch, pTargetGC);
3490	Assert(pTmpInstrHC);
3491	if (pTmpInstrHC == 0)
3492	break;
3493
3494	cpu.mode = (pPatch->flags & PATMFL_CODE32) ? CPUMODE_32BIT : CPUMODE_16BIT;
3495	disret = PATMR3DISInstr(pVM, pPatch, &cpu, pTargetGC, pTmpInstrHC, &opsize, NULL);
3496	if (disret == false \|\| cpu.pCurInstr->opcode != OP_JMP)
3497	break;
3498
3499	pTargetGC = PATMResolveBranch(&cpu, pTargetGC);
3500	if (pTargetGC == 0)
3501	{
3502	break;
3503	}
3504
3505	pPatchFunction = (PPATMPATCHREC)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTree, pTargetGC);
3506	break;
3507	}
3508	if (pPatchFunction == 0)
3509	{
3510	AssertMsgFailed(("Unable to find duplicate function %VGv\n", pTargetGC));
3511	rc = VERR_PATCHING_REFUSED;
3512	goto failure;
3513	}
3514	}
3515
3516	// make a copy of the guest code bytes that will be overwritten
3517	pPatch->cbPatchJump = SIZEOF_NEARJUMP32;
3518
3519	rc = PGMPhysReadGCPtr(pVM, pPatch->aPrivInstr, pPatch->pPrivInstrGC, pPatch->cbPatchJump);
3520	AssertRC(rc);
3521
3522	/* Now replace the original call in the guest code */
3523	rc = patmGenCallToPatch(pVM, pPatch, PATCHCODE_PTR_GC(&pPatchFunction->patch), true);
3524	AssertRC(rc);
3525	if (VBOX_FAILURE(rc))
3526	goto failure;
3527
3528	/* Lowest and highest address for write monitoring. */
3529	pPatch->pInstrGCLowest = pInstrGC;
3530	pPatch->pInstrGCHighest = pInstrGC + pCpu->opsize;
3531
3532	#ifdef LOG_ENABLED
3533	cpu.mode = (pPatch->flags & PATMFL_CODE32) ? CPUMODE_32BIT : CPUMODE_16BIT;
3534	disret = PATMR3DISInstr(pVM, pPatch, &cpu, pPatch->pPrivInstrGC, pPatch->pPrivInstrHC, &opsize, szOutput);
3535	Log(("Call patch: %s", szOutput));
3536	#endif
3537
3538	Log(("Successfully installed function replacement patch at %VGv\n", pInstrGC));
3539
3540	pPatch->uState = PATCH_ENABLED;
3541	return VINF_SUCCESS;
3542
3543	failure:
3544	/* Turn this patch into a dummy. */
3545	pPatch->uState = PATCH_REFUSED;
3546
3547	return rc;
3548	}
3549
3550	/**
3551	* Replace the address in an MMIO instruction with the cached version.
3552	*
3553	* @returns VBox status code.
3554	* @param pVM The VM to operate on.
3555	* @param pInstrGC Guest context point to privileged instruction
3556	* @param pCpu Disassembly CPU structure ptr
3557	* @param pPatch Patch record
3558	*
3559	* @note returns failure if patching is not allowed or possible
3560	*
3561	*/
3562	static int patmPatchMMIOInstr(PVM pVM, RTGCPTR pInstrGC, DISCPUSTATE *pCpu, PPATCHINFO pPatch)
3563	{
3564	uint8_t *pPB;
3565	int rc = VERR_PATCHING_REFUSED;
3566	#ifdef LOG_ENABLED
3567	DISCPUSTATE cpu;
3568	uint32_t opsize;
3569	bool disret;
3570	char szOutput[256];
3571	#endif
3572
3573	Assert(pVM->patm.s.mmio.pCachedData);
3574	if (!pVM->patm.s.mmio.pCachedData)
3575	goto failure;
3576
3577	if (pCpu->param2.flags != USE_DISPLACEMENT32)
3578	goto failure;
3579
3580	pPB = pPatch->pPrivInstrHC;
3581
3582	/* Add relocation record for cached data access. */
3583	if (patmPatchAddReloc32(pVM, pPatch, &pPB[pCpu->opsize - sizeof(RTGCPTR)], FIXUP_ABSOLUTE, pPatch->pPrivInstrGC, pVM->patm.s.mmio.pCachedData) != VINF_SUCCESS)
3584	{
3585	Log(("Relocation failed for cached mmio address!!\n"));
3586	return VERR_PATCHING_REFUSED;
3587	}
3588	#ifdef LOG_ENABLED
3589	cpu.mode = (pPatch->flags & PATMFL_CODE32) ? CPUMODE_32BIT : CPUMODE_16BIT;
3590	disret = PATMR3DISInstr(pVM, pPatch, &cpu, pPatch->pPrivInstrGC, pPatch->pPrivInstrHC, &opsize, szOutput);
3591	Log(("MMIO patch old instruction: %s", szOutput));
3592	#endif
3593
3594	/* Save original instruction. */
3595	rc = PGMPhysReadGCPtr(pVM, pPatch->aPrivInstr, pPatch->pPrivInstrGC, pPatch->cbPrivInstr);
3596	AssertRC(rc);
3597
3598	pPatch->cbPatchJump = pPatch->cbPrivInstr; /* bit of a misnomer in this case; size of replacement instruction. */
3599
3600	/* Replace address with that of the cached item. */
3601	rc = PGMPhysWriteGCPtrDirty(pVM, pInstrGC + pCpu->opsize - sizeof(RTGCPTR), &pVM->patm.s.mmio.pCachedData, sizeof(RTGCPTR));
3602	AssertRC(rc);
3603	if (VBOX_FAILURE(rc))
3604	{
3605	goto failure;
3606	}
3607
3608	#ifdef LOG_ENABLED
3609	cpu.mode = (pPatch->flags & PATMFL_CODE32) ? CPUMODE_32BIT : CPUMODE_16BIT;
3610	disret = PATMR3DISInstr(pVM, pPatch, &cpu, pPatch->pPrivInstrGC, pPatch->pPrivInstrHC, &opsize, szOutput);
3611	Log(("MMIO patch: %s", szOutput));
3612	#endif
3613	pVM->patm.s.mmio.pCachedData = 0;
3614	pVM->patm.s.mmio.GCPhys = 0;
3615	pPatch->uState = PATCH_ENABLED;
3616	return VINF_SUCCESS;
3617
3618	failure:
3619	/* Turn this patch into a dummy. */
3620	pPatch->uState = PATCH_REFUSED;
3621
3622	return rc;
3623	}
3624
3625
3626	/**
3627	* Replace the address in an MMIO instruction with the cached version. (instruction is part of an existing patch)
3628	*
3629	* @returns VBox status code.
3630	* @param pVM The VM to operate on.
3631	* @param pInstrGC Guest context point to privileged instruction
3632	* @param pPatch Patch record
3633	*
3634	* @note returns failure if patching is not allowed or possible
3635	*
3636	*/
3637	static int patmPatchPATMMMIOInstr(PVM pVM, RTGCPTR pInstrGC, PPATCHINFO pPatch)
3638	{
3639	DISCPUSTATE cpu;
3640	uint32_t opsize;
3641	bool disret;
3642	uint8_t *pInstrHC;
3643	#ifdef LOG_ENABLED
3644	char szOutput[256];
3645	#endif
3646
3647	AssertReturn(pVM->patm.s.mmio.pCachedData, VERR_INVALID_PARAMETER);
3648
3649	/* Convert GC to HC address. */
3650	pInstrHC = patmPatchGCPtr2PatchHCPtr(pVM, pInstrGC);
3651	AssertReturn(pInstrHC, VERR_PATCHING_REFUSED);
3652
3653	/* Disassemble mmio instruction. */
3654	cpu.mode = pPatch->uOpMode;
3655	disret = PATMR3DISInstr(pVM, pPatch, &cpu, pInstrGC, pInstrHC, &opsize, NULL);
3656	if (disret == false)
3657	{
3658	Log(("Disassembly failed (probably page not present) -> return to caller\n"));
3659	return VERR_PATCHING_REFUSED;
3660	}
3661
3662	AssertMsg(opsize <= MAX_INSTR_SIZE, ("privileged instruction too big %d!!\n", opsize));
3663	if (opsize > MAX_INSTR_SIZE)
3664	return VERR_PATCHING_REFUSED;
3665	if (cpu.param2.flags != USE_DISPLACEMENT32)
3666	return VERR_PATCHING_REFUSED;
3667
3668	/* Add relocation record for cached data access. */
3669	if (patmPatchAddReloc32(pVM, pPatch, &pInstrHC[cpu.opsize - sizeof(RTGCPTR)], FIXUP_ABSOLUTE) != VINF_SUCCESS)
3670	{
3671	Log(("Relocation failed for cached mmio address!!\n"));
3672	return VERR_PATCHING_REFUSED;
3673	}
3674	/* Replace address with that of the cached item. */
3675	(RTGCPTR )&pInstrHC[cpu.opsize - sizeof(RTGCPTR)] = pVM->patm.s.mmio.pCachedData;
3676
3677	/* Lowest and highest address for write monitoring. */
3678	pPatch->pInstrGCLowest = pInstrGC;
3679	pPatch->pInstrGCHighest = pInstrGC + cpu.opsize;
3680
3681	#ifdef LOG_ENABLED
3682	cpu.mode = (pPatch->flags & PATMFL_CODE32) ? CPUMODE_32BIT : CPUMODE_16BIT;
3683	disret = PATMR3DISInstr(pVM, pPatch, &cpu, pInstrGC, pInstrHC, &opsize, szOutput);
3684	Log(("MMIO patch: %s", szOutput));
3685	#endif
3686
3687	pVM->patm.s.mmio.pCachedData = 0;
3688	pVM->patm.s.mmio.GCPhys = 0;
3689	return VINF_SUCCESS;
3690	}
3691
3692	/**
3693	* Activates an int3 patch
3694	*
3695	* @returns VBox status code.
3696	* @param pVM The VM to operate on.
3697	* @param pPatch Patch record
3698	*/
3699	static int patmActivateInt3Patch(PVM pVM, PPATCHINFO pPatch)
3700	{
3701	uint8_t ASMInt3 = 0xCC;
3702	int rc;
3703
3704	Assert(pPatch->flags & (PATMFL_INT3_REPLACEMENT\|PATMFL_INT3_REPLACEMENT_BLOCK));
3705	Assert(pPatch->uState != PATCH_ENABLED);
3706
3707	/* Replace first opcode byte with 'int 3'. */
3708	rc = PGMPhysWriteGCPtrDirty(pVM, pPatch->pPrivInstrGC, &ASMInt3, sizeof(ASMInt3));
3709	AssertRC(rc);
3710
3711	pPatch->cbPatchJump = sizeof(ASMInt3);
3712
3713	return rc;
3714	}
3715
3716	/**
3717	* Deactivates an int3 patch
3718	*
3719	* @returns VBox status code.
3720	* @param pVM The VM to operate on.
3721	* @param pPatch Patch record
3722	*/
3723	static int patmDeactivateInt3Patch(PVM pVM, PPATCHINFO pPatch)
3724	{
3725	uint8_t ASMInt3 = 0xCC;
3726	int rc;
3727
3728	Assert(pPatch->flags & (PATMFL_INT3_REPLACEMENT\|PATMFL_INT3_REPLACEMENT_BLOCK));
3729	Assert(pPatch->uState == PATCH_ENABLED \|\| pPatch->uState == PATCH_DIRTY);
3730
3731	/* Restore first opcode byte. */
3732	rc = PGMPhysWriteGCPtrDirty(pVM, pPatch->pPrivInstrGC, pPatch->aPrivInstr, sizeof(ASMInt3));
3733	AssertRC(rc);
3734	return rc;
3735	}
3736
3737	/**
3738	* Replace an instruction with a breakpoint (0xCC), that is handled dynamically in the guest context.
3739	*
3740	* @returns VBox status code.
3741	* @param pVM The VM to operate on.
3742	* @param pInstrGC Guest context point to privileged instruction
3743	* @param pInstrHC Host context point to privileged instruction
3744	* @param pCpu Disassembly CPU structure ptr
3745	* @param pPatch Patch record
3746	*
3747	* @note returns failure if patching is not allowed or possible
3748	*
3749	*/
3750	PATMR3DECL(int) PATMR3PatchInstrInt3(PVM pVM, RTGCPTR pInstrGC, R3PTRTYPE(uint8_t ) pInstrHC, DISCPUSTATE pCpu, PPATCHINFO pPatch)
3751	{
3752	uint8_t ASMInt3 = 0xCC;
3753	int rc;
3754
3755	/** @note Do not use patch memory here! It might called during patch installation too. */
3756
3757	#ifdef LOG_ENABLED
3758	DISCPUSTATE cpu;
3759	char szOutput[256];
3760	uint32_t opsize;
3761
3762	cpu.mode = (pPatch->flags & PATMFL_CODE32) ? CPUMODE_32BIT : CPUMODE_16BIT;
3763	PATMR3DISInstr(pVM, pPatch, &cpu, pInstrGC, pInstrHC, &opsize, szOutput);
3764	Log(("PATMR3PatchInstrInt3: %s", szOutput));
3765	#endif
3766
3767	/* Save the original instruction. */
3768	rc = PGMPhysReadGCPtr(pVM, pPatch->aPrivInstr, pPatch->pPrivInstrGC, pPatch->cbPrivInstr);
3769	AssertRC(rc);
3770	pPatch->cbPatchJump = sizeof(ASMInt3); /* bit of a misnomer in this case; size of replacement instruction. */
3771
3772	pPatch->flags \|= PATMFL_INT3_REPLACEMENT;
3773
3774	/* Replace first opcode byte with 'int 3'. */
3775	rc = patmActivateInt3Patch(pVM, pPatch);
3776	if (VBOX_FAILURE(rc))
3777	goto failure;
3778
3779	/* Lowest and highest address for write monitoring. */
3780	pPatch->pInstrGCLowest = pInstrGC;
3781	pPatch->pInstrGCHighest = pInstrGC + pCpu->opsize;
3782
3783	pPatch->uState = PATCH_ENABLED;
3784	return VINF_SUCCESS;
3785
3786	failure:
3787	/* Turn this patch into a dummy. */
3788	return VERR_PATCHING_REFUSED;
3789	}
3790
3791	#ifdef PATM_RESOLVE_CONFLICTS_WITH_JUMP_PATCHES
3792	/**
3793	* Patch a jump instruction at specified location
3794	*
3795	* @returns VBox status code.
3796	* @param pVM The VM to operate on.
3797	* @param pInstrGC Guest context point to privileged instruction
3798	* @param pInstrHC Host context point to privileged instruction
3799	* @param pCpu Disassembly CPU structure ptr
3800	* @param pPatchRec Patch record
3801	*
3802	* @note returns failure if patching is not allowed or possible
3803	*
3804	*/
3805	int patmPatchJump(PVM pVM, RTGCPTR pInstrGC, R3PTRTYPE(uint8_t ) pInstrHC, DISCPUSTATE pCpu, PPATMPATCHREC pPatchRec)
3806	{
3807	PPATCHINFO pPatch = &pPatchRec->patch;
3808	int rc = VERR_PATCHING_REFUSED;
3809	#ifdef LOG_ENABLED
3810	bool disret;
3811	DISCPUSTATE cpu;
3812	uint32_t opsize;
3813	char szOutput[256];
3814	#endif
3815
3816	pPatch->pPatchBlockOffset = 0; /* doesn't use patch memory */
3817	pPatch->uCurPatchOffset = 0;
3818	pPatch->cbPatchBlockSize = 0;
3819	pPatch->flags \|= PATMFL_SINGLE_INSTRUCTION;
3820
3821	/*
3822	* Instruction replacements such as these should never be interrupted. I've added code to EM.cpp to
3823	* make sure this never happens. (unless a trap is triggered (intentionally or not))
3824	*/
3825	switch (pCpu->pCurInstr->opcode)
3826	{
3827	case OP_JO:
3828	case OP_JNO:
3829	case OP_JC:
3830	case OP_JNC:
3831	case OP_JE:
3832	case OP_JNE:
3833	case OP_JBE:
3834	case OP_JNBE:
3835	case OP_JS:
3836	case OP_JNS:
3837	case OP_JP:
3838	case OP_JNP:
3839	case OP_JL:
3840	case OP_JNL:
3841	case OP_JLE:
3842	case OP_JNLE:
3843	case OP_JMP:
3844	Assert(pPatch->flags & PATMFL_JUMP_CONFLICT);
3845	Assert(pCpu->param1.flags & USE_IMMEDIATE32_REL);
3846	if (!(pCpu->param1.flags & USE_IMMEDIATE32_REL))
3847	goto failure;
3848
3849	Assert(pCpu->opsize == SIZEOF_NEARJUMP32 \|\| pCpu->opsize == SIZEOF_NEAR_COND_JUMP32);
3850	if (pCpu->opsize != SIZEOF_NEARJUMP32 && pCpu->opsize != SIZEOF_NEAR_COND_JUMP32)
3851	goto failure;
3852
3853	if (PAGE_ADDRESS(pInstrGC) != PAGE_ADDRESS(pInstrGC + pCpu->opsize))
3854	{
3855	STAM_COUNTER_INC(&pVM->patm.s.StatPageBoundaryCrossed);
3856	AssertMsgFailed(("Patch jump would cross page boundary -> refuse!!\n"));
3857	rc = VERR_PATCHING_REFUSED;
3858	goto failure;
3859	}
3860
3861	break;
3862
3863	default:
3864	goto failure;
3865	}
3866
3867	// make a copy of the guest code bytes that will be overwritten
3868	Assert(pCpu->opsize <= sizeof(pPatch->aPrivInstr));
3869	Assert(pCpu->opsize >= SIZEOF_NEARJUMP32);
3870	pPatch->cbPatchJump = pCpu->opsize;
3871
3872	rc = PGMPhysReadGCPtr(pVM, pPatch->aPrivInstr, pPatch->pPrivInstrGC, pPatch->cbPatchJump);
3873	AssertRC(rc);
3874
3875	/* Now insert a jump in the guest code. */
3876	/*
3877	* A conflict jump patch needs to be treated differently; we'll just replace the relative jump address with one that
3878	* references the target instruction in the conflict patch.
3879	*/
3880	RTGCPTR pJmpDest = PATMR3GuestGCPtrToPatchGCPtr(pVM, pInstrGC + pCpu->opsize + (int32_t)pCpu->param1.parval);
3881
3882	AssertMsg(pJmpDest, ("PATMR3GuestGCPtrToPatchGCPtr failed for %VGv\n", pInstrGC + pCpu->opsize + (int32_t)pCpu->param1.parval));
3883	pPatch->pPatchJumpDestGC = pJmpDest;
3884
3885	rc = patmGenJumpToPatch(pVM, pPatch, true);
3886	AssertRC(rc);
3887	if (VBOX_FAILURE(rc))
3888	goto failure;
3889
3890	pPatch->flags \|= PATMFL_MUST_INSTALL_PATCHJMP;
3891
3892	#ifdef LOG_ENABLED
3893	cpu.mode = (pPatch->flags & PATMFL_CODE32) ? CPUMODE_32BIT : CPUMODE_16BIT;
3894	disret = PATMR3DISInstr(pVM, pPatch, &cpu, pPatch->pPrivInstrGC, pPatch->pPrivInstrHC, &opsize, szOutput);
3895	Log(("%s patch: %s", patmGetInstructionString(pPatch->opcode, pPatch->flags), szOutput));
3896	#endif
3897
3898	Log(("Successfully installed %s patch at %VGv\n", patmGetInstructionString(pPatch->opcode, pPatch->flags), pInstrGC));
3899
3900	STAM_COUNTER_INC(&pVM->patm.s.StatInstalledJump);
3901
3902	/* Lowest and highest address for write monitoring. */
3903	pPatch->pInstrGCLowest = pInstrGC;
3904	pPatch->pInstrGCHighest = pInstrGC + pPatch->cbPatchJump;
3905
3906	pPatch->uState = PATCH_ENABLED;
3907	return VINF_SUCCESS;
3908
3909	failure:
3910	/* Turn this cli patch into a dummy. */
3911	pPatch->uState = PATCH_REFUSED;
3912
3913	return rc;
3914	}
3915	#endif /* PATM_RESOLVE_CONFLICTS_WITH_JUMP_PATCHES */
3916
3917
3918	/**
3919	* Gives hint to PATM about supervisor guest instructions
3920	*
3921	* @returns VBox status code.
3922	* @param pVM The VM to operate on.
3923	* @param pInstr Guest context point to privileged instruction
3924	* @param flags Patch flags
3925	*/
3926	PATMR3DECL(int) PATMR3AddHint(PVM pVM, RTGCPTR pInstrGC, uint32_t flags)
3927	{
3928	Assert(pInstrGC);
3929	Assert(flags == PATMFL_CODE32);
3930
3931	Log(("PATMR3AddHint %VGv\n", pInstrGC));
3932	return PATMR3InstallPatch(pVM, pInstrGC, PATMFL_CODE32 \| PATMFL_INSTR_HINT);
3933	}
3934
3935	/**
3936	* Patch privileged instruction at specified location
3937	*
3938	* @returns VBox status code.
3939	* @param pVM The VM to operate on.
3940	* @param pInstr Guest context point to privileged instruction (0:32 flat address)
3941	* @param flags Patch flags
3942	*
3943	* @note returns failure if patching is not allowed or possible
3944	*/
3945	PATMR3DECL(int) PATMR3InstallPatch(PVM pVM, RTGCPTR pInstrGC, uint64_t flags)
3946	{
3947	DISCPUSTATE cpu;
3948	R3PTRTYPE(uint8_t *) pInstrHC;
3949	uint32_t opsize;
3950	PPATMPATCHREC pPatchRec;
3951	PCPUMCTX pCtx = 0;
3952	bool disret;
3953	int rc;
3954
3955	if (!pVM \|\| pInstrGC == 0 \|\| (flags & ~(PATMFL_CODE32\|PATMFL_IDTHANDLER\|PATMFL_INTHANDLER\|PATMFL_SYSENTER\|PATMFL_TRAPHANDLER\|PATMFL_DUPLICATE_FUNCTION\|PATMFL_REPLACE_FUNCTION_CALL\|PATMFL_GUEST_SPECIFIC\|PATMFL_INT3_REPLACEMENT\|PATMFL_TRAPHANDLER_WITH_ERRORCODE\|PATMFL_IDTHANDLER_WITHOUT_ENTRYPOINT\|PATMFL_MMIO_ACCESS\|PATMFL_TRAMPOLINE\|PATMFL_INSTR_HINT\|PATMFL_JUMP_CONFLICT)))
3956	{
3957	AssertFailed();
3958	return VERR_INVALID_PARAMETER;
3959	}
3960
3961	if (PATMIsEnabled(pVM) == false)
3962	return VERR_PATCHING_REFUSED;
3963
3964	/* Test for patch conflict only with patches that actually change guest code. */
3965	if (!(flags & (PATMFL_GUEST_SPECIFIC\|PATMFL_IDTHANDLER\|PATMFL_INTHANDLER\|PATMFL_TRAMPOLINE)))
3966	{
3967	PPATCHINFO pConflictPatch = PATMFindActivePatchByEntrypoint(pVM, pInstrGC);
3968	AssertReleaseMsg(pConflictPatch == 0, ("Unable to patch overwritten instruction at %VGv (%VGv)\n", pInstrGC, pConflictPatch->pPrivInstrGC));
3969	if (pConflictPatch != 0)
3970	return VERR_PATCHING_REFUSED;
3971	}
3972
3973	if (!(flags & PATMFL_CODE32))
3974	{
3975	/** @todo Only 32 bits code right now */
3976	AssertMsgFailed(("PATMR3InstallPatch: We don't support 16 bits code at this moment!!\n"));
3977	return VERR_NOT_IMPLEMENTED;
3978	}
3979
3980	/* We ran out of patch memory; don't bother anymore. */
3981	if (pVM->patm.s.fOutOfMemory == true)
3982	return VERR_PATCHING_REFUSED;
3983
3984	/* Make sure the code selector is wide open; otherwise refuse. */
3985	CPUMQueryGuestCtxPtr(pVM, &pCtx);
3986	if (CPUMGetGuestCPL(pVM, CPUMCTX2CORE(pCtx)) == 0)
3987	{
3988	RTGCPTR pInstrGCFlat = SELMToFlat(pVM, pCtx->eflags, pCtx->cs, &pCtx->csHid, pInstrGC);
3989	if (pInstrGCFlat != pInstrGC)
3990	{
3991	Log(("PATMR3InstallPatch: code selector not wide open: %04x:%VGv != %VGv eflags=%08x\n", pCtx->cs, pInstrGCFlat, pInstrGC, pCtx->eflags.u32));
3992	return VERR_PATCHING_REFUSED;
3993	}
3994	}
3995
3996	/** @note the OpenBSD specific check will break if we allow additional patches to be installed (int 3)) */
3997	if (!(flags & PATMFL_GUEST_SPECIFIC))
3998	{
3999	/* New code. Make sure CSAM has a go at it first. */
4000	CSAMR3CheckCode(pVM, pInstrGC);
4001	}
4002
4003	/** @note obsolete */
4004	if ( PATMIsPatchGCAddr(pVM, pInstrGC)
4005	&& (flags & PATMFL_MMIO_ACCESS))
4006	{
4007	RTGCUINTPTR offset;
4008	void *pvPatchCoreOffset;
4009
4010	/* Find the patch record. */
4011	offset = pInstrGC - pVM->patm.s.pPatchMemGC;
4012	pvPatchCoreOffset = RTAvloGCPtrGetBestFit(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPatchAddr, offset, false);
4013	if (pvPatchCoreOffset == NULL)
4014	{
4015	AssertMsgFailed(("PATMR3InstallPatch: patch not found at address %VGv!!\n", pInstrGC));
4016	return VERR_PATCH_NOT_FOUND; //fatal error
4017	}
4018	pPatchRec = PATM_PATCHREC_FROM_COREOFFSET(pvPatchCoreOffset);
4019
4020	return patmPatchPATMMMIOInstr(pVM, pInstrGC, &pPatchRec->patch);
4021	}
4022
4023	AssertReturn(!PATMIsPatchGCAddr(pVM, pInstrGC), VERR_PATCHING_REFUSED);
4024
4025	pPatchRec = (PPATMPATCHREC)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTree, pInstrGC);
4026	if (pPatchRec)
4027	{
4028	Assert(!(flags & PATMFL_TRAMPOLINE));
4029
4030	/* Hints about existing patches are ignored. */
4031	if (flags & PATMFL_INSTR_HINT)
4032	return VERR_PATCHING_REFUSED;
4033
4034	if (pPatchRec->patch.uState == PATCH_DISABLE_PENDING)
4035	{
4036	Log(("PATMR3InstallPatch: disable operation is pending for patch at %VGv\n", pPatchRec->patch.pPrivInstrGC));
4037	PATMR3DisablePatch(pVM, pPatchRec->patch.pPrivInstrGC);
4038	Assert(pPatchRec->patch.uState == PATCH_DISABLED);
4039	}
4040
4041	if (pPatchRec->patch.uState == PATCH_DISABLED)
4042	{
4043	/* A patch, for which we previously received a hint, will be enabled and turned into a normal patch. */
4044	if (pPatchRec->patch.flags & PATMFL_INSTR_HINT)
4045	{
4046	Log(("Enabling HINTED patch %VGv\n", pInstrGC));
4047	pPatchRec->patch.flags &= ~PATMFL_INSTR_HINT;
4048	}
4049	else
4050	Log(("Enabling patch %VGv again\n", pInstrGC));
4051
4052	/** @todo we shouldn't disable and enable patches too often (it's relatively cheap, but pointless if it always happens) */
4053	rc = PATMR3EnablePatch(pVM, pInstrGC);
4054	if (VBOX_SUCCESS(rc))
4055	return VWRN_PATCH_ENABLED;
4056
4057	return rc;
4058	}
4059	if ( pPatchRec->patch.uState == PATCH_ENABLED
4060	\|\| pPatchRec->patch.uState == PATCH_DIRTY)
4061	{
4062	/*
4063	* The patch might have been overwritten.
4064	*/
4065	STAM_COUNTER_INC(&pVM->patm.s.StatOverwritten);
4066	if (pPatchRec->patch.uState != PATCH_REFUSED && pPatchRec->patch.uState != PATCH_UNUSABLE)
4067	{
4068	/* Patch must have been overwritten; remove it and pretend nothing happened. */
4069	Log(("Patch an existing patched instruction?!? (%VGv)\n", pInstrGC));
4070	if (pPatchRec->patch.flags & (PATMFL_DUPLICATE_FUNCTION\|PATMFL_IDTHANDLER\|PATMFL_MMIO_ACCESS\|PATMFL_INT3_REPLACEMENT\|PATMFL_INT3_REPLACEMENT_BLOCK))
4071	{
4072	if (flags & PATMFL_IDTHANDLER)
4073	pPatchRec->patch.flags \|= (flags & (PATMFL_IDTHANDLER\|PATMFL_TRAPHANDLER\|PATMFL_INTHANDLER)); /* update the type */
4074
4075	return VERR_PATM_ALREADY_PATCHED; /* already done once */
4076	}
4077	}
4078	PATMR3RemovePatch(pVM, pInstrGC);
4079	}
4080	else
4081	{
4082	AssertMsg(pPatchRec->patch.uState == PATCH_REFUSED \|\| pPatchRec->patch.uState == PATCH_UNUSABLE, ("Patch an existing patched instruction?!? (%VGv, state=%d)\n", pInstrGC, pPatchRec->patch.uState));
4083	/* already tried it once! */
4084	return VERR_PATCHING_REFUSED;
4085	}
4086	}
4087
4088	rc = MMHyperAlloc(pVM, sizeof(PATMPATCHREC), 0, MM_TAG_PATM_PATCH, (void **)&pPatchRec);
4089	if (VBOX_FAILURE(rc))
4090	{
4091	Log(("Out of memory!!!!\n"));
4092	return VERR_NO_MEMORY;
4093	}
4094	pPatchRec->Core.Key = pInstrGC;
4095	pPatchRec->patch.uState = PATCH_REFUSED; //default
4096	rc = RTAvloGCPtrInsert(&pVM->patm.s.PatchLookupTreeHC->PatchTree, &pPatchRec->Core);
4097	Assert(rc);
4098
4099	RTGCPHYS GCPhys;
4100	rc = PGMGstGetPage(pVM, pInstrGC, NULL, &GCPhys);
4101	if (rc != VINF_SUCCESS)
4102	{
4103	Log(("PGMGstGetPage failed with %Vrc\n", rc));
4104	return rc;
4105	}
4106	/* Disallow patching instructions inside ROM code; complete function duplication is allowed though. */
4107	if ( !(flags & (PATMFL_DUPLICATE_FUNCTION\|PATMFL_TRAMPOLINE))
4108	&& !PGMPhysIsGCPhysNormal(pVM, GCPhys))
4109	{
4110	Log(("Code at %RGv (phys %RGp) is in a ROM, MMIO or invalid page - refused\n", pInstrGC, GCPhys));
4111	return VERR_PATCHING_REFUSED;
4112	}
4113	GCPhys = GCPhys + (pInstrGC & PAGE_OFFSET_MASK);
4114	rc = PGMPhysGCPhys2HCPtr(pVM, GCPhys, MAX_INSTR_SIZE, (void **)&pInstrHC);
4115	AssertRCReturn(rc, rc);
4116
4117	pPatchRec->patch.pPrivInstrHC = pInstrHC;
4118	pPatchRec->patch.pPrivInstrGC = pInstrGC;
4119	pPatchRec->patch.flags = flags;
4120	pPatchRec->patch.uOpMode = (flags & PATMFL_CODE32) ? CPUMODE_32BIT : CPUMODE_16BIT;
4121
4122	pPatchRec->patch.pInstrGCLowest = pInstrGC;
4123	pPatchRec->patch.pInstrGCHighest = pInstrGC;
4124
4125	if (!(pPatchRec->patch.flags & (PATMFL_DUPLICATE_FUNCTION \| PATMFL_IDTHANDLER \| PATMFL_SYSENTER \| PATMFL_TRAMPOLINE)))
4126	{
4127	/*
4128	* Close proximity to an unusable patch is a possible hint that this patch would turn out to be dangerous too!
4129	*/
4130	PPATMPATCHREC pPatchNear = (PPATMPATCHREC)RTAvloGCPtrGetBestFit(&pVM->patm.s.PatchLookupTreeHC->PatchTree, (pInstrGC + SIZEOF_NEARJUMP32 - 1), false);
4131	if (pPatchNear)
4132	{
4133	if (pPatchNear->patch.uState == PATCH_UNUSABLE && pInstrGC < pPatchNear->patch.pPrivInstrGC && pInstrGC + SIZEOF_NEARJUMP32 > pPatchNear->patch.pPrivInstrGC)
4134	{
4135	Log(("Dangerous patch; would overwrite the ususable patch at %VGv\n", pPatchNear->patch.pPrivInstrGC));
4136
4137	pPatchRec->patch.uState = PATCH_UNUSABLE;
4138	/*
4139	* Leave the new patch active as it's marked unusable; to prevent us from checking it over and over again
4140	*/
4141	return VERR_PATCHING_REFUSED;
4142	}
4143	}
4144	}
4145
4146	pPatchRec->patch.pTempInfo = (PPATCHINFOTEMP)MMR3HeapAllocZ(pVM, MM_TAG_PATM_PATCH, sizeof(PATCHINFOTEMP));
4147	if (pPatchRec->patch.pTempInfo == 0)
4148	{
4149	Log(("Out of memory!!!!\n"));
4150	return VERR_NO_MEMORY;
4151	}
4152
4153	cpu.mode = pPatchRec->patch.uOpMode;
4154	disret = PATMR3DISInstr(pVM, &pPatchRec->patch, &cpu, pInstrGC, pInstrHC, &opsize, NULL);
4155	if (disret == false)
4156	{
4157	Log(("Disassembly failed (probably page not present) -> return to caller\n"));
4158	return VERR_PATCHING_REFUSED;
4159	}
4160
4161	AssertMsg(opsize <= MAX_INSTR_SIZE, ("privileged instruction too big %d!!\n", opsize));
4162	if (opsize > MAX_INSTR_SIZE)
4163	{
4164	return VERR_PATCHING_REFUSED;
4165	}
4166
4167	pPatchRec->patch.cbPrivInstr = opsize;
4168	pPatchRec->patch.opcode = cpu.pCurInstr->opcode;
4169
4170	/* Restricted hinting for now. */
4171	Assert(!(flags & PATMFL_INSTR_HINT) \|\| cpu.pCurInstr->opcode == OP_CLI);
4172
4173	/* Allocate statistics slot */
4174	if (pVM->patm.s.uCurrentPatchIdx < PATM_STAT_MAX_COUNTERS)
4175	{
4176	pPatchRec->patch.uPatchIdx = pVM->patm.s.uCurrentPatchIdx++;
4177	}
4178	else
4179	{
4180	Log(("WARNING: Patch index wrap around!!\n"));
4181	pPatchRec->patch.uPatchIdx = PATM_STAT_INDEX_DUMMY;
4182	}
4183
4184	if (pPatchRec->patch.flags & PATMFL_TRAPHANDLER)
4185	{
4186	rc = patmInstallTrapTrampoline(pVM, pInstrGC, pPatchRec);
4187	}
4188	else
4189	if (pPatchRec->patch.flags & (PATMFL_DUPLICATE_FUNCTION ))
4190	{
4191	rc = patmDuplicateFunction(pVM, pInstrGC, pPatchRec);
4192	}
4193	else
4194	if (pPatchRec->patch.flags & PATMFL_TRAMPOLINE)
4195	{
4196	rc = patmCreateTrampoline(pVM, pInstrGC, pPatchRec);
4197	}
4198	else
4199	if (pPatchRec->patch.flags & PATMFL_REPLACE_FUNCTION_CALL)
4200	{
4201	rc = patmReplaceFunctionCall(pVM, &cpu, pInstrGC, &pPatchRec->patch);
4202	}
4203	else
4204	if (pPatchRec->patch.flags & PATMFL_INT3_REPLACEMENT)
4205	{
4206	rc = PATMR3PatchInstrInt3(pVM, pInstrGC, pInstrHC, &cpu, &pPatchRec->patch);
4207	}
4208	else
4209	if (pPatchRec->patch.flags & PATMFL_MMIO_ACCESS)
4210	{
4211	rc = patmPatchMMIOInstr(pVM, pInstrGC, &cpu, &pPatchRec->patch);
4212	}
4213	else
4214	if (pPatchRec->patch.flags & (PATMFL_IDTHANDLER\|PATMFL_SYSENTER))
4215	{
4216	if (pPatchRec->patch.flags & PATMFL_SYSENTER)
4217	pPatchRec->patch.flags \|= PATMFL_IDTHANDLER; /* we treat a sysenter handler as an IDT handler */
4218
4219	rc = patmIdtHandler(pVM, pInstrGC, pInstrHC, opsize, pPatchRec);
4220	#ifdef VBOX_WITH_STATISTICS
4221	if ( rc == VINF_SUCCESS
4222	&& (pPatchRec->patch.flags & PATMFL_SYSENTER))
4223	{
4224	pVM->patm.s.uSysEnterPatchIdx = pPatchRec->patch.uPatchIdx;
4225	}
4226	#endif
4227	}
4228	else
4229	if (pPatchRec->patch.flags & PATMFL_GUEST_SPECIFIC)
4230	{
4231	switch (cpu.pCurInstr->opcode)
4232	{
4233	case OP_SYSENTER:
4234	case OP_PUSH:
4235	rc = PATMInstallGuestSpecificPatch(pVM, &cpu, pInstrGC, pInstrHC, pPatchRec);
4236	if (rc == VINF_SUCCESS)
4237	{
4238	if (rc == VINF_SUCCESS)
4239	Log(("PATMR3InstallPatch GUEST: %s %VGv code32=%d\n", patmGetInstructionString(pPatchRec->patch.opcode, pPatchRec->patch.flags), pInstrGC, (flags & PATMFL_CODE32) ? 1 : 0));
4240	return rc;
4241	}
4242	break;
4243
4244	default:
4245	rc = VERR_NOT_IMPLEMENTED;
4246	break;
4247	}
4248	}
4249	else
4250	{
4251	switch (cpu.pCurInstr->opcode)
4252	{
4253	case OP_SYSENTER:
4254	rc = PATMInstallGuestSpecificPatch(pVM, &cpu, pInstrGC, pInstrHC, pPatchRec);
4255	if (rc == VINF_SUCCESS)
4256	{
4257	Log(("PATMR3InstallPatch GUEST: %s %VGv code32=%d\n", patmGetInstructionString(pPatchRec->patch.opcode, pPatchRec->patch.flags), pInstrGC, (flags & PATMFL_CODE32) ? 1 : 0));
4258	return VINF_SUCCESS;
4259	}
4260	break;
4261
4262	#ifdef PATM_RESOLVE_CONFLICTS_WITH_JUMP_PATCHES
4263	case OP_JO:
4264	case OP_JNO:
4265	case OP_JC:
4266	case OP_JNC:
4267	case OP_JE:
4268	case OP_JNE:
4269	case OP_JBE:
4270	case OP_JNBE:
4271	case OP_JS:
4272	case OP_JNS:
4273	case OP_JP:
4274	case OP_JNP:
4275	case OP_JL:
4276	case OP_JNL:
4277	case OP_JLE:
4278	case OP_JNLE:
4279	case OP_JECXZ:
4280	case OP_LOOP:
4281	case OP_LOOPNE:
4282	case OP_LOOPE:
4283	case OP_JMP:
4284	if (pPatchRec->patch.flags & PATMFL_JUMP_CONFLICT)
4285	{
4286	rc = patmPatchJump(pVM, pInstrGC, pInstrHC, &cpu, pPatchRec);
4287	break;
4288	}
4289	return VERR_NOT_IMPLEMENTED;
4290	#endif
4291
4292	case OP_PUSHF:
4293	case OP_CLI:
4294	Log(("PATMR3InstallPatch %s %VGv code32=%d\n", patmGetInstructionString(pPatchRec->patch.opcode, pPatchRec->patch.flags), pInstrGC, (flags & PATMFL_CODE32) ? 1 : 0));
4295	rc = PATMR3PatchBlock(pVM, pInstrGC, pInstrHC, cpu.pCurInstr->opcode, opsize, pPatchRec);
4296	break;
4297
4298	case OP_STR:
4299	case OP_SGDT:
4300	case OP_SLDT:
4301	case OP_SIDT:
4302	case OP_CPUID:
4303	case OP_LSL:
4304	case OP_LAR:
4305	case OP_SMSW:
4306	case OP_VERW:
4307	case OP_VERR:
4308	case OP_IRET:
4309	rc = PATMR3PatchInstrInt3(pVM, pInstrGC, pInstrHC, &cpu, &pPatchRec->patch);
4310	break;
4311
4312	default:
4313	return VERR_NOT_IMPLEMENTED;
4314	}
4315	}
4316
4317	if (rc != VINF_SUCCESS)
4318	{
4319	if (pPatchRec && pPatchRec->patch.nrPatch2GuestRecs)
4320	{
4321	patmEmptyTreeU32(pVM, &pPatchRec->patch.Patch2GuestAddrTree);
4322	pPatchRec->patch.nrPatch2GuestRecs = 0;
4323	}
4324	pVM->patm.s.uCurrentPatchIdx--;
4325	}
4326	else
4327	{
4328	rc = patmInsertPatchPages(pVM, &pPatchRec->patch);
4329	AssertRCReturn(rc, rc);
4330
4331	/* Keep track upper and lower boundaries of patched instructions */
4332	if (pPatchRec->patch.pInstrGCLowest < pVM->patm.s.pPatchedInstrGCLowest)
4333	pVM->patm.s.pPatchedInstrGCLowest = pPatchRec->patch.pInstrGCLowest;
4334	if (pPatchRec->patch.pInstrGCHighest > pVM->patm.s.pPatchedInstrGCHighest)
4335	pVM->patm.s.pPatchedInstrGCHighest = pPatchRec->patch.pInstrGCHighest;
4336
4337	Log(("Patch lowest %VGv highest %VGv\n", pPatchRec->patch.pInstrGCLowest, pPatchRec->patch.pInstrGCHighest));
4338	Log(("Global lowest %VGv highest %VGv\n", pVM->patm.s.pPatchedInstrGCLowest, pVM->patm.s.pPatchedInstrGCHighest));
4339
4340	STAM_COUNTER_ADD(&pVM->patm.s.StatInstalled, 1);
4341	STAM_COUNTER_ADD(&pVM->patm.s.StatPATMMemoryUsed, pPatchRec->patch.cbPatchBlockSize);
4342
4343	rc = VINF_SUCCESS;
4344
4345	/* Patch hints are not enabled by default. Only when the are actually encountered. */
4346	if (pPatchRec->patch.flags & PATMFL_INSTR_HINT)
4347	{
4348	rc = PATMR3DisablePatch(pVM, pInstrGC);
4349	AssertRCReturn(rc, rc);
4350	}
4351
4352	#ifdef VBOX_WITH_STATISTICS
4353	/* Register statistics counter */
4354	if (PATM_STAT_INDEX_IS_VALID(pPatchRec->patch.uPatchIdx))
4355	{
4356	STAMR3RegisterCallback(pVM, &pPatchRec->patch, STAMVISIBILITY_NOT_GUI, STAMUNIT_GOOD_BAD, patmResetStat, patmPrintStat, "Patch statistics",
4357	"/PATM/Stats/Patch/0x%VGv", pPatchRec->patch.pPrivInstrGC);
4358	#ifndef DEBUG_sandervl
4359	/* Full breakdown for the GUI. */
4360	STAMR3RegisterF(pVM, &pVM->patm.s.pStatsHC[pPatchRec->patch.uPatchIdx], STAMTYPE_RATIO_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_GOOD_BAD, PATMPatchType(pVM, &pPatchRec->patch),
4361	"/PATM/Stats/PatchBD/0x%VGv", pPatchRec->patch.pPrivInstrGC);
4362	STAMR3RegisterF(pVM, &pPatchRec->patch.cbPatchBlockSize,STAMTYPE_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_BYTES, NULL, "/PATM/Stats/PatchBD/0x%VGv/cbPatchBlockSize", pPatchRec->patch.pPrivInstrGC);
4363	STAMR3RegisterF(pVM, &pPatchRec->patch.cbPatchJump, STAMTYPE_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_BYTES, NULL, "/PATM/Stats/PatchBD/0x%VGv/cbPatchJump", pPatchRec->patch.pPrivInstrGC);
4364	STAMR3RegisterF(pVM, &pPatchRec->patch.cbPrivInstr, STAMTYPE_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_BYTES, NULL, "/PATM/Stats/PatchBD/0x%VGv/cbPrivInstr", pPatchRec->patch.pPrivInstrGC);
4365	STAMR3RegisterF(pVM, &pPatchRec->patch.cCodeWrites, STAMTYPE_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, NULL, "/PATM/Stats/PatchBD/0x%VGv/cCodeWrites", pPatchRec->patch.pPrivInstrGC);
4366	STAMR3RegisterF(pVM, &pPatchRec->patch.cInvalidWrites, STAMTYPE_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, NULL, "/PATM/Stats/PatchBD/0x%VGv/cInvalidWrites", pPatchRec->patch.pPrivInstrGC);
4367	STAMR3RegisterF(pVM, &pPatchRec->patch.cTraps, STAMTYPE_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, NULL, "/PATM/Stats/PatchBD/0x%VGv/cTraps", pPatchRec->patch.pPrivInstrGC);
4368	STAMR3RegisterF(pVM, &pPatchRec->patch.flags, STAMTYPE_X32, STAMVISIBILITY_ALWAYS, STAMUNIT_NONE, NULL, "/PATM/Stats/PatchBD/0x%VGv/flags", pPatchRec->patch.pPrivInstrGC);
4369	STAMR3RegisterF(pVM, &pPatchRec->patch.nrJumpRecs, STAMTYPE_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, NULL, "/PATM/Stats/PatchBD/0x%VGv/nrJumpRecs", pPatchRec->patch.pPrivInstrGC);
4370	STAMR3RegisterF(pVM, &pPatchRec->patch.nrFixups, STAMTYPE_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, NULL, "/PATM/Stats/PatchBD/0x%VGv/nrFixups", pPatchRec->patch.pPrivInstrGC);
4371	STAMR3RegisterF(pVM, &pPatchRec->patch.opcode, STAMTYPE_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, NULL, "/PATM/Stats/PatchBD/0x%VGv/opcode", pPatchRec->patch.pPrivInstrGC);
4372	STAMR3RegisterF(pVM, &pPatchRec->patch.uOldState, STAMTYPE_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_NONE, NULL, "/PATM/Stats/PatchBD/0x%VGv/uOldState", pPatchRec->patch.pPrivInstrGC);
4373	STAMR3RegisterF(pVM, &pPatchRec->patch.uOpMode, STAMTYPE_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_NONE, NULL, "/PATM/Stats/PatchBD/0x%VGv/uOpMode", pPatchRec->patch.pPrivInstrGC);
4374	/// @todo change the state to be a callback so we can get a state mnemonic instead.
4375	STAMR3RegisterF(pVM, &pPatchRec->patch.uState, STAMTYPE_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_NONE, NULL, "/PATM/Stats/PatchBD/0x%VGv/uState", pPatchRec->patch.pPrivInstrGC);
4376	#endif
4377	}
4378	#endif
4379	}
4380	return rc;
4381	}
4382
4383	/**
4384	* Query instruction size
4385	*
4386	* @returns VBox status code.
4387	* @param pVM The VM to operate on.
4388	* @param pPatch Patch record
4389	* @param pInstrGC Instruction address
4390	*/
4391	static uint32_t patmGetInstrSize(PVM pVM, PPATCHINFO pPatch, RTGCPTR pInstrGC)
4392	{
4393	uint8_t *pInstrHC;
4394
4395	int rc = PGMPhysGCPtr2HCPtr(pVM, pInstrGC, (RTHCPTR *)&pInstrHC);
4396	if (rc == VINF_SUCCESS)
4397	{
4398	DISCPUSTATE cpu;
4399	bool disret;
4400	uint32_t opsize;
4401
4402	cpu.mode = (pPatch->flags & PATMFL_CODE32) ? CPUMODE_32BIT : CPUMODE_16BIT;
4403	disret = PATMR3DISInstr(pVM, pPatch, &cpu, pInstrGC, pInstrHC, &opsize, NULL, PATMREAD_ORGCODE \| PATMREAD_NOCHECK);
4404	if (disret)
4405	return opsize;
4406	}
4407	return 0;
4408	}
4409
4410	/**
4411	* Add patch to page record
4412	*
4413	* @returns VBox status code.
4414	* @param pVM The VM to operate on.
4415	* @param pPage Page address
4416	* @param pPatch Patch record
4417	*/
4418	int patmAddPatchToPage(PVM pVM, RTGCUINTPTR pPage, PPATCHINFO pPatch)
4419	{
4420	PPATMPATCHPAGE pPatchPage;
4421	int rc;
4422
4423	Log(("patmAddPatchToPage: insert patch %VHv to page %VGv\n", pPatch, pPage));
4424
4425	pPatchPage = (PPATMPATCHPAGE)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPage, pPage);
4426	if (pPatchPage)
4427	{
4428	Assert(pPatchPage->cCount <= pPatchPage->cMaxPatches);
4429	if (pPatchPage->cCount == pPatchPage->cMaxPatches)
4430	{
4431	uint32_t cMaxPatchesOld = pPatchPage->cMaxPatches;
4432	PPATCHINFO *paPatchOld = pPatchPage->aPatch;
4433
4434	pPatchPage->cMaxPatches += PATMPATCHPAGE_PREALLOC_INCREMENT;
4435	rc = MMHyperAlloc(pVM, sizeof(PPATCHINFO)pPatchPage->cMaxPatches, 0, MM_TAG_PATM_PATCH, (void *)&pPatchPage->aPatch);
4436	if (VBOX_FAILURE(rc))
4437	{
4438	Log(("Out of memory!!!!\n"));
4439	return VERR_NO_MEMORY;
4440	}
4441	memcpy(pPatchPage->aPatch, paPatchOld, cMaxPatchesOld*sizeof(PPATCHINFO));
4442	MMHyperFree(pVM, paPatchOld);
4443	}
4444	pPatchPage->aPatch[pPatchPage->cCount] = pPatch;
4445	pPatchPage->cCount++;
4446	}
4447	else
4448	{
4449	rc = MMHyperAlloc(pVM, sizeof(PATMPATCHPAGE), 0, MM_TAG_PATM_PATCH, (void **)&pPatchPage);
4450	if (VBOX_FAILURE(rc))
4451	{
4452	Log(("Out of memory!!!!\n"));
4453	return VERR_NO_MEMORY;
4454	}
4455	pPatchPage->Core.Key = pPage;
4456	pPatchPage->cCount = 1;
4457	pPatchPage->cMaxPatches = PATMPATCHPAGE_PREALLOC_INCREMENT;
4458
4459	rc = MMHyperAlloc(pVM, sizeof(PPATCHINFO)PATMPATCHPAGE_PREALLOC_INCREMENT, 0, MM_TAG_PATM_PATCH, (void *)&pPatchPage->aPatch);
4460	if (VBOX_FAILURE(rc))
4461	{
4462	Log(("Out of memory!!!!\n"));
4463	MMHyperFree(pVM, pPatchPage);
4464	return VERR_NO_MEMORY;
4465	}
4466	pPatchPage->aPatch[0] = pPatch;
4467
4468	rc = RTAvloGCPtrInsert(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPage, &pPatchPage->Core);
4469	Assert(rc);
4470	pVM->patm.s.cPageRecords++;
4471
4472	STAM_COUNTER_INC(&pVM->patm.s.StatPatchPageInserted);
4473	}
4474	CSAMR3MonitorPage(pVM, pPage, CSAM_TAG_PATM);
4475
4476	/* Get the closest guest instruction (from below) */
4477	PRECGUESTTOPATCH pGuestToPatchRec = (PRECGUESTTOPATCH)RTAvlGCPtrGetBestFit(&pPatch->Guest2PatchAddrTree, pPage, true);
4478	Assert(pGuestToPatchRec);
4479	if (pGuestToPatchRec)
4480	{
4481	LogFlow(("patmAddPatchToPage: lowest patch page address %VGv current lowest %VGv\n", pGuestToPatchRec->Core.Key, pPatchPage->pLowestAddrGC));
4482	if ( pPatchPage->pLowestAddrGC == 0
4483	\|\| pPatchPage->pLowestAddrGC > (RTGCPTR)pGuestToPatchRec->Core.Key)
4484	{
4485	RTGCUINTPTR offset;
4486
4487	pPatchPage->pLowestAddrGC = (RTGCPTR)pGuestToPatchRec->Core.Key;
4488
4489	offset = pPatchPage->pLowestAddrGC & PAGE_OFFSET_MASK;
4490	/* If we're too close to the page boundary, then make sure an instruction from the previous page doesn't cross the boundary itself. */
4491	if (offset && offset < MAX_INSTR_SIZE)
4492	{
4493	/* Get the closest guest instruction (from above) */
4494	pGuestToPatchRec = (PRECGUESTTOPATCH)RTAvlGCPtrGetBestFit(&pPatch->Guest2PatchAddrTree, pPage-1, false);
4495
4496	if (pGuestToPatchRec)
4497	{
4498	uint32_t size = patmGetInstrSize(pVM, pPatch, (RTGCPTR)pGuestToPatchRec->Core.Key);
4499	if ((RTGCUINTPTR)pGuestToPatchRec->Core.Key + size > pPage)
4500	{
4501	pPatchPage->pLowestAddrGC = pPage;
4502	LogFlow(("patmAddPatchToPage: new lowest %VGv\n", pPatchPage->pLowestAddrGC));
4503	}
4504	}
4505	}
4506	}
4507	}
4508
4509	/* Get the closest guest instruction (from above) */
4510	pGuestToPatchRec = (PRECGUESTTOPATCH)RTAvlGCPtrGetBestFit(&pPatch->Guest2PatchAddrTree, pPage+PAGE_SIZE-1, false);
4511	Assert(pGuestToPatchRec);
4512	if (pGuestToPatchRec)
4513	{
4514	LogFlow(("patmAddPatchToPage: highest patch page address %VGv current lowest %VGv\n", pGuestToPatchRec->Core.Key, pPatchPage->pHighestAddrGC));
4515	if ( pPatchPage->pHighestAddrGC == 0
4516	\|\| pPatchPage->pHighestAddrGC <= (RTGCPTR)pGuestToPatchRec->Core.Key)
4517	{
4518	pPatchPage->pHighestAddrGC = (RTGCPTR)pGuestToPatchRec->Core.Key;
4519	/* Increase by instruction size. */
4520	uint32_t size = patmGetInstrSize(pVM, pPatch, pPatchPage->pHighestAddrGC);
4521	//// Assert(size);
4522	pPatchPage->pHighestAddrGC += size;
4523	LogFlow(("patmAddPatchToPage: new highest %VGv\n", pPatchPage->pHighestAddrGC));
4524	}
4525	}
4526
4527	return VINF_SUCCESS;
4528	}
4529
4530	/**
4531	* Remove patch from page record
4532	*
4533	* @returns VBox status code.
4534	* @param pVM The VM to operate on.
4535	* @param pPage Page address
4536	* @param pPatch Patch record
4537	*/
4538	int patmRemovePatchFromPage(PVM pVM, RTGCUINTPTR pPage, PPATCHINFO pPatch)
4539	{
4540	PPATMPATCHPAGE pPatchPage;
4541	int rc;
4542
4543	pPatchPage = (PPATMPATCHPAGE)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPage, pPage);
4544	Assert(pPatchPage);
4545
4546	if (!pPatchPage)
4547	return VERR_INVALID_PARAMETER;
4548
4549	Assert(pPatchPage->cCount <= pPatchPage->cMaxPatches);
4550
4551	Log(("patmRemovePatchPage: remove patch %VHv from page %VGv\n", pPatch, pPage));
4552	if (pPatchPage->cCount > 1)
4553	{
4554	uint32_t i;
4555
4556	/* Used by multiple patches */
4557	for (i=0;i<pPatchPage->cCount;i++)
4558	{
4559	if (pPatchPage->aPatch[i] == pPatch)
4560	{
4561	pPatchPage->aPatch[i] = 0;
4562	break;
4563	}
4564	}
4565	/* close the gap between the remaining pointers. */
4566	if (i < pPatchPage->cCount - 1)
4567	{
4568	memcpy(&pPatchPage->aPatch[i], &pPatchPage->aPatch[i+1], sizeof(PPATCHINFO)*(pPatchPage->cCount - (i+1)));
4569	}
4570	AssertMsg(i < pPatchPage->cCount, ("Unable to find patch %VHv in page %VGv\n", pPatch, pPage));
4571
4572	pPatchPage->cCount--;
4573	}
4574	else
4575	{
4576	PPATMPATCHPAGE pPatchNode;
4577
4578	Log(("patmRemovePatchFromPage %VGv\n", pPage));
4579
4580	STAM_COUNTER_INC(&pVM->patm.s.StatPatchPageRemoved);
4581	pPatchNode = (PPATMPATCHPAGE)RTAvloGCPtrRemove(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPage, pPage);
4582	Assert(pPatchNode && pPatchNode == pPatchPage);
4583
4584	Assert(pPatchPage->aPatch);
4585	rc = MMHyperFree(pVM, pPatchPage->aPatch);
4586	AssertRC(rc);
4587	rc = MMHyperFree(pVM, pPatchPage);
4588	AssertRC(rc);
4589	pVM->patm.s.cPageRecords--;
4590	}
4591	return VINF_SUCCESS;
4592	}
4593
4594	/**
4595	* Insert page records for all guest pages that contain instructions that were recompiled for this patch
4596	*
4597	* @returns VBox status code.
4598	* @param pVM The VM to operate on.
4599	* @param pPatch Patch record
4600	*/
4601	int patmInsertPatchPages(PVM pVM, PPATCHINFO pPatch)
4602	{
4603	int rc;
4604	RTGCUINTPTR pPatchPageStart, pPatchPageEnd, pPage;
4605
4606	/* Insert the pages that contain patched instructions into a lookup tree for detecting self-modifying code. */
4607	pPatchPageStart = (RTGCUINTPTR)pPatch->pInstrGCLowest & PAGE_BASE_GC_MASK;
4608	pPatchPageEnd = (RTGCUINTPTR)pPatch->pInstrGCHighest & PAGE_BASE_GC_MASK;
4609
4610	/** @todo optimize better (large gaps between current and next used page) */
4611	for(pPage = pPatchPageStart; pPage <= pPatchPageEnd; pPage += PAGE_SIZE)
4612	{
4613	/* Get the closest guest instruction (from above) */
4614	PRECGUESTTOPATCH pGuestToPatchRec = (PRECGUESTTOPATCH)RTAvlGCPtrGetBestFit(&pPatch->Guest2PatchAddrTree, pPage, true);
4615	if ( pGuestToPatchRec
4616	&& PAGE_ADDRESS(pGuestToPatchRec->Core.Key) == PAGE_ADDRESS(pPage)
4617	)
4618	{
4619	/* Code in page really patched -> add record */
4620	rc = patmAddPatchToPage(pVM, pPage, pPatch);
4621	AssertRC(rc);
4622	}
4623	}
4624	pPatch->flags \|= PATMFL_CODE_MONITORED;
4625	return VINF_SUCCESS;
4626	}
4627
4628	/**
4629	* Remove page records for all guest pages that contain instructions that were recompiled for this patch
4630	*
4631	* @returns VBox status code.
4632	* @param pVM The VM to operate on.
4633	* @param pPatch Patch record
4634	*/
4635	int patmRemovePatchPages(PVM pVM, PPATCHINFO pPatch)
4636	{
4637	int rc;
4638	RTGCUINTPTR pPatchPageStart, pPatchPageEnd, pPage;
4639
4640	/* Insert the pages that contain patched instructions into a lookup tree for detecting self-modifying code. */
4641	pPatchPageStart = (RTGCUINTPTR)pPatch->pInstrGCLowest & PAGE_BASE_GC_MASK;
4642	pPatchPageEnd = (RTGCUINTPTR)pPatch->pInstrGCHighest & PAGE_BASE_GC_MASK;
4643
4644	for(pPage = pPatchPageStart; pPage <= pPatchPageEnd; pPage += PAGE_SIZE)
4645	{
4646	/* Get the closest guest instruction (from above) */
4647	PRECGUESTTOPATCH pGuestToPatchRec = (PRECGUESTTOPATCH)RTAvlGCPtrGetBestFit(&pPatch->Guest2PatchAddrTree, pPage, true);
4648	if ( pGuestToPatchRec
4649	&& PAGE_ADDRESS(pGuestToPatchRec->Core.Key) == PAGE_ADDRESS(pPage) /** @todo bird: PAGE_ADDRESS is for the current context really. check out these. */
4650	)
4651	{
4652	/* Code in page really patched -> remove record */
4653	rc = patmRemovePatchFromPage(pVM, pPage, pPatch);
4654	AssertRC(rc);
4655	}
4656	}
4657	pPatch->flags &= ~PATMFL_CODE_MONITORED;
4658	return VINF_SUCCESS;
4659	}
4660
4661	/**
4662	* Notifies PATM about a (potential) write to code that has been patched.
4663	*
4664	* @returns VBox status code.
4665	* @param pVM The VM to operate on.
4666	* @param GCPtr GC pointer to write address
4667	* @param cbWrite Nr of bytes to write
4668	*
4669	*/
4670	PATMR3DECL(int) PATMR3PatchWrite(PVM pVM, RTGCPTR GCPtr, uint32_t cbWrite)
4671	{
4672	RTGCUINTPTR pWritePageStart, pWritePageEnd, pPage;
4673
4674	Log(("PATMR3PatchWrite %VGv %x\n", GCPtr, cbWrite));
4675
4676	Assert(VM_IS_EMT(pVM));
4677
4678	/* Quick boundary check */
4679	if ( GCPtr < pVM->patm.s.pPatchedInstrGCLowest
4680	\|\| GCPtr > pVM->patm.s.pPatchedInstrGCHighest
4681	)
4682	return VINF_SUCCESS;
4683
4684	STAM_PROFILE_ADV_START(&pVM->patm.s.StatPatchWrite, a);
4685
4686	pWritePageStart = (RTGCUINTPTR)GCPtr & PAGE_BASE_GC_MASK;
4687	pWritePageEnd = ((RTGCUINTPTR)GCPtr + cbWrite - 1) & PAGE_BASE_GC_MASK;
4688
4689	for (pPage = pWritePageStart; pPage <= pWritePageEnd; pPage += PAGE_SIZE)
4690	{
4691	loop_start:
4692	PPATMPATCHPAGE pPatchPage = (PPATMPATCHPAGE)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPage, (RTGCPTR)pPage);
4693	if (pPatchPage)
4694	{
4695	uint32_t i;
4696	bool fValidPatchWrite = false;
4697
4698	/* Quick check to see if the write is in the patched part of the page */
4699	if ( pPatchPage->pLowestAddrGC > (RTGCPTR)((RTGCUINTPTR)GCPtr + cbWrite - 1)
4700	\|\| pPatchPage->pHighestAddrGC < GCPtr)
4701	{
4702	break;
4703	}
4704
4705	for (i=0;i<pPatchPage->cCount;i++)
4706	{
4707	if (pPatchPage->aPatch[i])
4708	{
4709	PPATCHINFO pPatch = pPatchPage->aPatch[i];
4710	RTGCPTR pPatchInstrGC;
4711	//unused: bool fForceBreak = false;
4712
4713	Assert(pPatchPage->aPatch[i]->flags & PATMFL_CODE_MONITORED);
4714	/** @todo inefficient and includes redundant checks for multiple pages. */
4715	for (uint32_t j=0; j<cbWrite; j++)
4716	{
4717	RTGCPTR pGuestPtrGC = (RTGCPTR)((RTGCUINTPTR)GCPtr + j);
4718
4719	if ( pPatch->cbPatchJump
4720	&& pGuestPtrGC >= pPatch->pPrivInstrGC
4721	&& pGuestPtrGC < pPatch->pPrivInstrGC + pPatch->cbPatchJump)
4722	{
4723	/* The guest is about to overwrite the 5 byte jump to patch code. Remove the patch. */
4724	Log(("PATMR3PatchWrite: overwriting jump to patch code -> remove patch.\n"));
4725	int rc = PATMR3RemovePatch(pVM, pPatch->pPrivInstrGC);
4726	AssertRC(rc);
4727
4728	/** @note jump back to the start as the pPatchPage has been deleted or changed */
4729	goto loop_start;
4730	}
4731
4732	/* Find the closest instruction from below; the above quick check ensured that we are indeed in patched code */
4733	pPatchInstrGC = patmGuestGCPtrToPatchGCPtr(pVM, pPatch, pGuestPtrGC);
4734	if (!pPatchInstrGC)
4735	{
4736	RTGCPTR pClosestInstrGC;
4737	uint32_t size;
4738
4739	pPatchInstrGC = patmGuestGCPtrToClosestPatchGCPtr(pVM, pPatch, pGuestPtrGC);
4740	if (pPatchInstrGC)
4741	{
4742	pClosestInstrGC = patmPatchGCPtr2GuestGCPtr(pVM, pPatch, pPatchInstrGC);
4743	Assert(pClosestInstrGC <= pGuestPtrGC);
4744	size = patmGetInstrSize(pVM, pPatch, pClosestInstrGC);
4745	/* Check if this is not a write into a gap between two patches */
4746	if (pClosestInstrGC + size - 1 < pGuestPtrGC)
4747	pPatchInstrGC = 0;
4748	}
4749	}
4750	if (pPatchInstrGC)
4751	{
4752	uint32_t PatchOffset = pPatchInstrGC - pVM->patm.s.pPatchMemGC; /* Offset in memory reserved for PATM. */
4753
4754	fValidPatchWrite = true;
4755
4756	PRECPATCHTOGUEST pPatchToGuestRec = (PRECPATCHTOGUEST)RTAvlU32Get(&pPatch->Patch2GuestAddrTree, PatchOffset);
4757	Assert(pPatchToGuestRec);
4758	if (pPatchToGuestRec && !pPatchToGuestRec->fDirty)
4759	{
4760	Log(("PATMR3PatchWrite: Found patched instruction %VGv -> %VGv\n", pGuestPtrGC, pPatchInstrGC));
4761
4762	if (++pPatch->cCodeWrites > PATM_MAX_CODE_WRITES)
4763	{
4764	LogRel(("PATM: Disable block at %VGv - write %VGv-%VGv\n", pPatch->pPrivInstrGC, pGuestPtrGC, pGuestPtrGC+cbWrite));
4765
4766	PATMR3MarkDirtyPatch(pVM, pPatch);
4767
4768	/** @note jump back to the start as the pPatchPage has been deleted or changed */
4769	goto loop_start;
4770	}
4771	else
4772	{
4773	/* Replace the patch instruction with a breakpoint; when it's hit, then we'll attempt to recompile the instruction again. */
4774	uint8_t *pInstrHC = patmPatchGCPtr2PatchHCPtr(pVM, pPatchInstrGC);
4775
4776	pPatchToGuestRec->u8DirtyOpcode = *pInstrHC;
4777	pPatchToGuestRec->fDirty = true;
4778
4779	*pInstrHC = 0xCC;
4780
4781	STAM_COUNTER_INC(&pVM->patm.s.StatInstrDirty);
4782	}
4783	}
4784	/* else already marked dirty */
4785	}
4786	}
4787	}
4788	} /* for each patch */
4789
4790	if (fValidPatchWrite == false)
4791	{
4792	/* Write to a part of the page that either:
4793	* - doesn't contain any code (shared code/data); rather unlikely
4794	* - old code page that's no longer in active use.
4795	*/
4796	invalid_write_loop_start:
4797	pPatchPage = (PPATMPATCHPAGE)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPage, (RTGCPTR)pPage);
4798
4799	if (pPatchPage)
4800	{
4801	for (i=0;i<pPatchPage->cCount;i++)
4802	{
4803	PPATCHINFO pPatch = pPatchPage->aPatch[i];
4804
4805	if (pPatch->cInvalidWrites > PATM_MAX_INVALID_WRITES)
4806	{
4807	/** @note possibly dangerous assumption that all future writes will be harmless. */
4808	if (pPatch->flags & PATMFL_IDTHANDLER)
4809	{
4810	LogRel(("PATM: Stop monitoring IDT handler pages at %VGv - invalid write %VGv-%VGv (this is not a fatal error)\n", pPatch->pPrivInstrGC, GCPtr, GCPtr+cbWrite));
4811
4812	Assert(pPatch->flags & PATMFL_CODE_MONITORED);
4813	int rc = patmRemovePatchPages(pVM, pPatch);
4814	AssertRC(rc);
4815	}
4816	else
4817	{
4818	LogRel(("PATM: Disable block at %VGv - invalid write %VGv-%VGv \n", pPatch->pPrivInstrGC, GCPtr, GCPtr+cbWrite));
4819	PATMR3MarkDirtyPatch(pVM, pPatch);
4820	}
4821	/** @note jump back to the start as the pPatchPage has been deleted or changed */
4822	goto invalid_write_loop_start;
4823	}
4824	} /* for */
4825	}
4826	}
4827	}
4828	}
4829	STAM_PROFILE_ADV_STOP(&pVM->patm.s.StatPatchWrite, a);
4830	return VINF_SUCCESS;
4831
4832	}
4833
4834	/**
4835	* Disable all patches in a flushed page
4836	*
4837	* @returns VBox status code
4838	* @param pVM The VM to operate on.
4839	* @param addr GC address of the page to flush
4840	*/
4841	/** @note Currently only called by CSAMR3FlushPage; optimization to avoid having to double check if the physical address has changed
4842	*/
4843	PATMR3DECL(int) PATMR3FlushPage(PVM pVM, RTGCPTR addr)
4844	{
4845	addr &= PAGE_BASE_GC_MASK;
4846
4847	PPATMPATCHPAGE pPatchPage = (PPATMPATCHPAGE)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPage, addr);
4848	if (pPatchPage)
4849	{
4850	int i;
4851
4852	/* From top to bottom as the array is modified by PATMR3MarkDirtyPatch. */
4853	for (i=(int)pPatchPage->cCount-1;i>=0;i--)
4854	{
4855	if (pPatchPage->aPatch[i])
4856	{
4857	PPATCHINFO pPatch = pPatchPage->aPatch[i];
4858
4859	Log(("PATMR3FlushPage %VGv remove patch at %VGv\n", addr, pPatch->pPrivInstrGC));
4860	PATMR3MarkDirtyPatch(pVM, pPatch);
4861	}
4862	}
4863	STAM_COUNTER_INC(&pVM->patm.s.StatFlushed);
4864	}
4865	return VINF_SUCCESS;
4866	}
4867
4868	/**
4869	* Checks if the instructions at the specified address has been patched already.
4870	*
4871	* @returns boolean, patched or not
4872	* @param pVM The VM to operate on.
4873	* @param pInstrGC Guest context pointer to instruction
4874	*/
4875	PATMR3DECL(bool) PATMR3HasBeenPatched(PVM pVM, RTGCPTR pInstrGC)
4876	{
4877	PPATMPATCHREC pPatchRec;
4878	pPatchRec = (PPATMPATCHREC)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTree, pInstrGC);
4879	if (pPatchRec && pPatchRec->patch.uState == PATCH_ENABLED)
4880	return true;
4881	return false;
4882	}
4883
4884	/**
4885	* Query the opcode of the original code that was overwritten by the 5 bytes patch jump
4886	*
4887	* @returns VBox status code.
4888	* @param pVM The VM to operate on.
4889	* @param pInstrGC GC address of instr
4890	* @param pByte opcode byte pointer (OUT)
4891	*
4892	*/
4893	PATMR3DECL(int) PATMR3QueryOpcode(PVM pVM, RTGCPTR pInstrGC, uint8_t *pByte)
4894	{
4895	PPATMPATCHREC pPatchRec;
4896
4897	/** @todo this will not work for aliased pages! (never has, but so far not a problem for us) */
4898
4899	/* Shortcut. */
4900	if ( !PATMIsEnabled(pVM)
4901	\|\| pInstrGC < pVM->patm.s.pPatchedInstrGCLowest
4902	\|\| pInstrGC > pVM->patm.s.pPatchedInstrGCHighest)
4903	{
4904	return VERR_PATCH_NOT_FOUND;
4905	}
4906
4907	pPatchRec = (PPATMPATCHREC)RTAvloGCPtrGetBestFit(&pVM->patm.s.PatchLookupTreeHC->PatchTree, pInstrGC, false);
4908	// if the patch is enabled and the pointer lies within 5 bytes of this priv instr ptr, then we've got a hit!
4909	if ( pPatchRec
4910	&& pPatchRec->patch.uState == PATCH_ENABLED
4911	&& pInstrGC >= pPatchRec->patch.pPrivInstrGC
4912	&& pInstrGC < pPatchRec->patch.pPrivInstrGC + pPatchRec->patch.cbPatchJump)
4913	{
4914	RTGCPTR offset = pInstrGC - pPatchRec->patch.pPrivInstrGC;
4915	*pByte = pPatchRec->patch.aPrivInstr[offset];
4916
4917	if (pPatchRec->patch.cbPatchJump == 1)
4918	{
4919	Log(("PATMR3QueryOpcode: returning opcode %2X for instruction at %VGv\n", *pByte, pInstrGC));
4920	}
4921	STAM_COUNTER_ADD(&pVM->patm.s.StatNrOpcodeRead, 1);
4922	return VINF_SUCCESS;
4923	}
4924	return VERR_PATCH_NOT_FOUND;
4925	}
4926
4927	/**
4928	* Disable patch for privileged instruction at specified location
4929	*
4930	* @returns VBox status code.
4931	* @param pVM The VM to operate on.
4932	* @param pInstr Guest context point to privileged instruction
4933	*
4934	* @note returns failure if patching is not allowed or possible
4935	*
4936	*/
4937	PATMR3DECL(int) PATMR3DisablePatch(PVM pVM, RTGCPTR pInstrGC)
4938	{
4939	PPATMPATCHREC pPatchRec;
4940	PPATCHINFO pPatch;
4941
4942	Log(("PATMR3DisablePatch: %VGv\n", pInstrGC));
4943	pPatchRec = (PPATMPATCHREC)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTree, pInstrGC);
4944	if (pPatchRec)
4945	{
4946	int rc = VINF_SUCCESS;
4947
4948	pPatch = &pPatchRec->patch;
4949
4950	/* Already disabled? */
4951	if (pPatch->uState == PATCH_DISABLED)
4952	return VINF_SUCCESS;
4953
4954	/* Clear the IDT entries for the patch we're disabling. */
4955	/** @note very important as we clear IF in the patch itself */
4956	/** @todo this needs to be changed */
4957	if (pPatch->flags & PATMFL_IDTHANDLER)
4958	{
4959	uint32_t iGate;
4960
4961	iGate = TRPMR3QueryGateByHandler(pVM, PATCHCODE_PTR_GC(pPatch));
4962	if (iGate != (uint32_t)~0)
4963	{
4964	TRPMR3SetGuestTrapHandler(pVM, iGate, TRPM_INVALID_HANDLER);
4965	LogRel(("PATM: Disabling IDT %x patch handler %VGv\n", iGate, pInstrGC));
4966	}
4967	}
4968
4969	/* Mark the entry with a breakpoint in case somebody else calls it later on (cli patch used as a function, function, trampoline or idt patches) */
4970	if ( pPatch->pPatchBlockOffset
4971	&& pPatch->uState == PATCH_ENABLED)
4972	{
4973	Log(("Invalidate patch at %VGv (HC=%VGv)\n", PATCHCODE_PTR_GC(pPatch), PATCHCODE_PTR_HC(pPatch)));
4974	pPatch->bDirtyOpcode = *PATCHCODE_PTR_HC(pPatch);
4975	*PATCHCODE_PTR_HC(pPatch) = 0xCC;
4976	}
4977
4978	/* IDT or function patches haven't changed any guest code. */
4979	if (pPatch->flags & PATMFL_PATCHED_GUEST_CODE)
4980	{
4981	Assert(pPatch->flags & PATMFL_MUST_INSTALL_PATCHJMP);
4982	Assert(!(pPatch->flags & (PATMFL_DUPLICATE_FUNCTION\|PATMFL_IDTHANDLER\|PATMFL_TRAMPOLINE\|PATMFL_INT3_REPLACEMENT\|PATMFL_INT3_REPLACEMENT_BLOCK)));
4983
4984	if (pPatch->uState != PATCH_REFUSED)
4985	{
4986	AssertMsg(pPatch->pPrivInstrHC, ("Invalid HC pointer?!? (%VGv)\n", pInstrGC));
4987	Assert(pPatch->cbPatchJump);
4988
4989	/** pPrivInstrHC is probably not valid anymore */
4990	rc = PGMPhysGCPtr2HCPtr(pVM, pPatchRec->patch.pPrivInstrGC, (PRTHCPTR)&pPatchRec->patch.pPrivInstrHC);
4991	if (rc == VINF_SUCCESS)
4992	{
4993	uint8_t temp[16];
4994
4995	Assert(pPatch->cbPatchJump < sizeof(temp));
4996
4997	/* Let's first check if the guest code is still the same. */
4998	rc = PGMPhysReadGCPtr(pVM, temp, pPatch->pPrivInstrGC, pPatch->cbPatchJump);
4999	Assert(rc == VINF_SUCCESS \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT \|\| rc == VERR_PAGE_NOT_PRESENT);
5000	if (rc == VINF_SUCCESS)
5001	{
5002	RTGCINTPTR displ = (RTGCUINTPTR)PATCHCODE_PTR_GC(pPatch) - ((RTGCUINTPTR)pPatch->pPrivInstrGC + SIZEOF_NEARJUMP32);
5003
5004	if ( temp[0] != 0xE9 /* jmp opcode */
5005	\|\| (RTGCINTPTR )(&temp[1]) != displ
5006	)
5007	{
5008	Log(("PATMR3DisablePatch: Can't disable a patch who's guest code has changed!!\n"));
5009	STAM_COUNTER_INC(&pVM->patm.s.StatOverwritten);
5010	/* Remove it completely */
5011	pPatch->uState = PATCH_DISABLED; /* don't call PATMR3DisablePatch again */
5012	rc = PATMR3RemovePatch(pVM, pInstrGC);
5013	AssertRC(rc);
5014	return VWRN_PATCH_REMOVED;
5015	}
5016	}
5017	patmRemoveJumpToPatch(pVM, pPatch);
5018
5019	}
5020	else
5021	{
5022	Log(("PATMR3DisablePatch: unable to disable patch -> mark PATCH_DISABLE_PENDING\n"));
5023	pPatch->uState = PATCH_DISABLE_PENDING;
5024	}
5025	}
5026	else
5027	{
5028	AssertMsgFailed(("Patch was refused!\n"));
5029	return VERR_PATCH_ALREADY_DISABLED;
5030	}
5031	}
5032	else
5033	if (pPatch->flags & (PATMFL_INT3_REPLACEMENT\|PATMFL_INT3_REPLACEMENT_BLOCK))
5034	{
5035	uint8_t temp[16];
5036
5037	Assert(pPatch->cbPatchJump < sizeof(temp));
5038
5039	/* Let's first check if the guest code is still the same. */
5040	rc = PGMPhysReadGCPtr(pVM, temp, pPatch->pPrivInstrGC, pPatch->cbPatchJump);
5041	Assert(rc == VINF_SUCCESS \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT \|\| rc == VERR_PAGE_NOT_PRESENT);
5042	if (rc == VINF_SUCCESS)
5043	{
5044	if (temp[0] != 0xCC)
5045	{
5046	Log(("PATMR3DisablePatch: Can't disable a patch who's guest code has changed!!\n"));
5047	STAM_COUNTER_INC(&pVM->patm.s.StatOverwritten);
5048	/* Remove it completely */
5049	pPatch->uState = PATCH_DISABLED; /* don't call PATMR3DisablePatch again */
5050	rc = PATMR3RemovePatch(pVM, pInstrGC);
5051	AssertRC(rc);
5052	return VWRN_PATCH_REMOVED;
5053	}
5054	patmDeactivateInt3Patch(pVM, pPatch);
5055	}
5056	}
5057
5058	if (rc == VINF_SUCCESS)
5059	{
5060	/* Save old state and mark this one as disabled (so it can be enabled later on). */
5061	if (pPatch->uState == PATCH_DISABLE_PENDING)
5062	{
5063	/* Just to be safe, let's make sure this one can never be reused; the patch might be marked dirty already (int3 at start) */
5064	pPatch->uState = PATCH_UNUSABLE;
5065	}
5066	else
5067	if (pPatch->uState != PATCH_DIRTY)
5068	{
5069	pPatch->uOldState = pPatch->uState;
5070	pPatch->uState = PATCH_DISABLED;
5071	}
5072	STAM_COUNTER_ADD(&pVM->patm.s.StatDisabled, 1);
5073	}
5074
5075	Log(("PATMR3DisablePatch: disabled patch at %VGv\n", pInstrGC));
5076	return VINF_SUCCESS;
5077	}
5078	Log(("Patch not found!\n"));
5079	return VERR_PATCH_NOT_FOUND;
5080	}
5081
5082	/**
5083	* Permanently disable patch for privileged instruction at specified location
5084	*
5085	* @returns VBox status code.
5086	* @param pVM The VM to operate on.
5087	* @param pInstr Guest context instruction pointer
5088	* @param pConflictAddr Guest context pointer which conflicts with specified patch
5089	* @param pConflictPatch Conflicting patch
5090	*
5091	*/
5092	static int patmDisableUnusablePatch(PVM pVM, RTGCPTR pInstrGC, RTGCPTR pConflictAddr, PPATCHINFO pConflictPatch)
5093	{
5094	#ifdef PATM_RESOLVE_CONFLICTS_WITH_JUMP_PATCHES
5095	PATCHINFO patch = {0};
5096	DISCPUSTATE cpu;
5097	R3PTRTYPE(uint8_t *) pInstrHC;
5098	uint32_t opsize;
5099	bool disret;
5100	int rc;
5101
5102	pInstrHC = PATMGCVirtToHCVirt(pVM, &patch, pInstrGC);
5103	cpu.mode = (pConflictPatch->flags & PATMFL_CODE32) ? CPUMODE_32BIT : CPUMODE_16BIT;
5104	disret = PATMR3DISInstr(pVM, &patch, &cpu, pInstrGC, pInstrHC, &opsize, NULL);
5105	/*
5106	* If it's a 5 byte relative jump, then we can work around the problem by replacing the 32 bits relative offset
5107	* with one that jumps right into the conflict patch.
5108	* Otherwise we must disable the conflicting patch to avoid serious problems.
5109	*/
5110	if ( disret == true
5111	&& (pConflictPatch->flags & PATMFL_CODE32)
5112	&& (cpu.pCurInstr->opcode == OP_JMP \|\| (cpu.pCurInstr->optype & OPTYPE_COND_CONTROLFLOW))
5113	&& (cpu.param1.flags & USE_IMMEDIATE32_REL))
5114	{
5115	/* Hint patches must be enabled first. */
5116	if (pConflictPatch->flags & PATMFL_INSTR_HINT)
5117	{
5118	Log(("Enabling HINTED patch %VGv\n", pConflictPatch->pPrivInstrGC));
5119	pConflictPatch->flags &= ~PATMFL_INSTR_HINT;
5120	rc = PATMR3EnablePatch(pVM, pConflictPatch->pPrivInstrGC);
5121	Assert(rc == VINF_SUCCESS \|\| rc == VERR_PATCH_NOT_FOUND);
5122	/* Enabling might fail if the patched code has changed in the meantime. */
5123	if (rc != VINF_SUCCESS)
5124	return rc;
5125	}
5126
5127	rc = PATMR3InstallPatch(pVM, pInstrGC, PATMFL_CODE32 \| PATMFL_JUMP_CONFLICT);
5128	if (VBOX_SUCCESS(rc))
5129	{
5130	Log(("PATM -> CONFLICT: Installed JMP patch for patch conflict at %VGv\n", pInstrGC));
5131	STAM_COUNTER_INC(&pVM->patm.s.StatFixedConflicts);
5132	return VINF_SUCCESS;
5133	}
5134	}
5135	#endif
5136
5137	if (pConflictPatch->opcode == OP_CLI)
5138	{
5139	/* Turn it into an int3 patch; our GC trap handler will call the generated code manually. */
5140	Log(("PATM -> CONFLICT: Found active patch at instruction %VGv with target %VGv -> turn into int 3 patch!!\n", pInstrGC, pConflictPatch->pPrivInstrGC));
5141	int rc = PATMR3DisablePatch(pVM, pConflictPatch->pPrivInstrGC);
5142	if (rc == VWRN_PATCH_REMOVED)
5143	return VINF_SUCCESS;
5144	if (VBOX_SUCCESS(rc))
5145	{
5146	pConflictPatch->flags &= ~(PATMFL_MUST_INSTALL_PATCHJMP\|PATMFL_INSTR_HINT);
5147	pConflictPatch->flags \|= PATMFL_INT3_REPLACEMENT_BLOCK;
5148	rc = PATMR3EnablePatch(pVM, pConflictPatch->pPrivInstrGC);
5149	if (rc == VERR_PATCH_NOT_FOUND)
5150	return VINF_SUCCESS; /* removed already */
5151
5152	AssertRC(rc);
5153	if (VBOX_SUCCESS(rc))
5154	{
5155	STAM_COUNTER_INC(&pVM->patm.s.StatInt3Callable);
5156	return VINF_SUCCESS;
5157	}
5158	}
5159	/* else turned into unusable patch (see below) */
5160	}
5161	else
5162	{
5163	Log(("PATM -> CONFLICT: Found active patch at instruction %VGv with target %VGv -> DISABLING it!!\n", pInstrGC, pConflictPatch->pPrivInstrGC));
5164	int rc = PATMR3DisablePatch(pVM, pConflictPatch->pPrivInstrGC);
5165	if (rc == VWRN_PATCH_REMOVED)
5166	return VINF_SUCCESS;
5167	}
5168
5169	/* No need to monitor the code anymore. */
5170	if (pConflictPatch->flags & PATMFL_CODE_MONITORED)
5171	{
5172	int rc = patmRemovePatchPages(pVM, pConflictPatch);
5173	AssertRC(rc);
5174	}
5175	pConflictPatch->uState = PATCH_UNUSABLE;
5176	STAM_COUNTER_INC(&pVM->patm.s.StatUnusable);
5177	return VERR_PATCH_DISABLED;
5178	}
5179
5180	/**
5181	* Enable patch for privileged instruction at specified location
5182	*
5183	* @returns VBox status code.
5184	* @param pVM The VM to operate on.
5185	* @param pInstr Guest context point to privileged instruction
5186	*
5187	* @note returns failure if patching is not allowed or possible
5188	*
5189	*/
5190	PATMR3DECL(int) PATMR3EnablePatch(PVM pVM, RTGCPTR pInstrGC)
5191	{
5192	PPATMPATCHREC pPatchRec;
5193	PPATCHINFO pPatch;
5194
5195	Log(("PATMR3EnablePatch %VGv\n", pInstrGC));
5196	pPatchRec = (PPATMPATCHREC)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTree, pInstrGC);
5197	if (pPatchRec)
5198	{
5199	int rc = VINF_SUCCESS;
5200
5201	pPatch = &pPatchRec->patch;
5202
5203	if (pPatch->uState == PATCH_DISABLED)
5204	{
5205	if (pPatch->flags & PATMFL_MUST_INSTALL_PATCHJMP)
5206	{
5207	Assert(!(pPatch->flags & PATMFL_PATCHED_GUEST_CODE));
5208	/** @todo -> pPrivInstrHC is probably not valid anymore */
5209	rc = PGMPhysGCPtr2HCPtr(pVM, pPatchRec->patch.pPrivInstrGC, (PRTHCPTR)&pPatchRec->patch.pPrivInstrHC);
5210	if (rc == VINF_SUCCESS)
5211	{
5212	#ifdef DEBUG
5213	DISCPUSTATE cpu;
5214	char szOutput[256];
5215	uint32_t opsize, i = 0;
5216	#endif
5217	uint8_t temp[16];
5218
5219	Assert(pPatch->cbPatchJump < sizeof(temp));
5220
5221	// let's first check if the guest code is still the same
5222	int rc = PGMPhysReadGCPtr(pVM, temp, pPatch->pPrivInstrGC, pPatch->cbPatchJump);
5223	AssertRC(rc);
5224
5225	if (memcmp(temp, pPatch->aPrivInstr, pPatch->cbPatchJump))
5226	{
5227	Log(("PATMR3EnablePatch: Can't enable a patch who's guest code has changed!!\n"));
5228	STAM_COUNTER_INC(&pVM->patm.s.StatOverwritten);
5229	/* Remove it completely */
5230	PATMR3RemovePatch(pVM, pInstrGC);
5231	return VERR_PATCH_NOT_FOUND;
5232	}
5233
5234	rc = patmGenJumpToPatch(pVM, pPatch, false);
5235	AssertRC(rc);
5236	if (VBOX_FAILURE(rc))
5237	return rc;
5238
5239	#ifdef DEBUG
5240	bool disret;
5241	i = 0;
5242	while(i < pPatch->cbPatchJump)
5243	{
5244	cpu.mode = (pPatch->flags & PATMFL_CODE32) ? CPUMODE_32BIT : CPUMODE_16BIT;
5245	disret = PATMR3DISInstr(pVM, pPatch, &cpu, pPatch->pPrivInstrGC + i, &pPatch->pPrivInstrHC[i], &opsize, szOutput);
5246	Log(("Renewed patch instr: %s", szOutput));
5247	i += opsize;
5248	}
5249	#endif
5250	}
5251	}
5252	else
5253	if (pPatch->flags & (PATMFL_INT3_REPLACEMENT\|PATMFL_INT3_REPLACEMENT_BLOCK))
5254	{
5255	uint8_t temp[16];
5256
5257	Assert(pPatch->cbPatchJump < sizeof(temp));
5258
5259	/* Let's first check if the guest code is still the same. */
5260	int rc = PGMPhysReadGCPtr(pVM, temp, pPatch->pPrivInstrGC, pPatch->cbPatchJump);
5261	AssertRC(rc);
5262
5263	if (memcmp(temp, pPatch->aPrivInstr, pPatch->cbPatchJump))
5264	{
5265	Log(("PATMR3EnablePatch: Can't enable a patch who's guest code has changed!!\n"));
5266	STAM_COUNTER_INC(&pVM->patm.s.StatOverwritten);
5267	PATMR3RemovePatch(pVM, pInstrGC);
5268	return VERR_PATCH_NOT_FOUND;
5269	}
5270
5271	rc = patmActivateInt3Patch(pVM, pPatch);
5272	if (VBOX_FAILURE(rc))
5273	return rc;
5274	}
5275
5276	pPatch->uState = pPatch->uOldState; //restore state
5277
5278	/* Restore the entry breakpoint with the original opcode (see PATMR3DisablePatch). */
5279	if (pPatch->pPatchBlockOffset)
5280	{
5281	*PATCHCODE_PTR_HC(pPatch) = pPatch->bDirtyOpcode;
5282	}
5283
5284	STAM_COUNTER_ADD(&pVM->patm.s.StatEnabled, 1);
5285	}
5286	else
5287	Log(("PATMR3EnablePatch: Unable to enable patch %VGv with state %d\n", pInstrGC, pPatch->uState));
5288
5289	return rc;
5290	}
5291	return VERR_PATCH_NOT_FOUND;
5292	}
5293
5294	/**
5295	* Remove patch for privileged instruction at specified location
5296	*
5297	* @returns VBox status code.
5298	* @param pVM The VM to operate on.
5299	* @param pPatchRec Patch record
5300	* @param fForceRemove Remove all patches
5301	*/
5302	int PATMRemovePatch(PVM pVM, PPATMPATCHREC pPatchRec, bool fForceRemove)
5303	{
5304	PPATCHINFO pPatch;
5305
5306	pPatch = &pPatchRec->patch;
5307
5308	/* Strictly forbidden to remove such patches. There can be dependencies!! */
5309	AssertReturn(fForceRemove \|\| !(pPatch->flags & (PATMFL_DUPLICATE_FUNCTION)), VERR_ACCESS_DENIED);
5310
5311	/** @note NEVER EVER REUSE PATCH MEMORY */
5312	/** @note PATMR3DisablePatch put a breakpoint (0xCC) at the entry of this patch */
5313
5314	if (pPatchRec->patch.pPatchBlockOffset)
5315	{
5316	PAVLOGCPTRNODECORE pNode;
5317
5318	pNode = RTAvloGCPtrRemove(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPatchAddr, pPatchRec->patch.pPatchBlockOffset);
5319	Assert(pNode);
5320	}
5321
5322	if (pPatchRec->patch.flags & PATMFL_CODE_MONITORED)
5323	{
5324	int rc = patmRemovePatchPages(pVM, &pPatchRec->patch);
5325	AssertRC(rc);
5326	}
5327
5328	#ifdef VBOX_WITH_STATISTICS
5329	if (PATM_STAT_INDEX_IS_VALID(pPatchRec->patch.uPatchIdx))
5330	{
5331	STAMR3Deregister(pVM, &pPatchRec->patch);
5332	#ifndef DEBUG_sandervl
5333	STAMR3Deregister(pVM, &pVM->patm.s.pStatsHC[pPatchRec->patch.uPatchIdx]);
5334	STAMR3Deregister(pVM, &pPatchRec->patch.cbPatchBlockSize);
5335	STAMR3Deregister(pVM, &pPatchRec->patch.cbPatchJump);
5336	STAMR3Deregister(pVM, &pPatchRec->patch.cbPrivInstr);
5337	STAMR3Deregister(pVM, &pPatchRec->patch.cCodeWrites);
5338	STAMR3Deregister(pVM, &pPatchRec->patch.cInvalidWrites);
5339	STAMR3Deregister(pVM, &pPatchRec->patch.cTraps);
5340	STAMR3Deregister(pVM, &pPatchRec->patch.flags);
5341	STAMR3Deregister(pVM, &pPatchRec->patch.nrJumpRecs);
5342	STAMR3Deregister(pVM, &pPatchRec->patch.nrFixups);
5343	STAMR3Deregister(pVM, &pPatchRec->patch.opcode);
5344	STAMR3Deregister(pVM, &pPatchRec->patch.uState);
5345	STAMR3Deregister(pVM, &pPatchRec->patch.uOldState);
5346	STAMR3Deregister(pVM, &pPatchRec->patch.uOpMode);
5347	#endif
5348	}
5349	#endif
5350
5351	/** @note no need to free Guest2PatchAddrTree as those records share memory with Patch2GuestAddrTree records. */
5352	patmEmptyTreeU32(pVM, &pPatch->Patch2GuestAddrTree);
5353	pPatch->nrPatch2GuestRecs = 0;
5354	Assert(pPatch->Patch2GuestAddrTree == 0);
5355
5356	patmEmptyTree(pVM, &pPatch->FixupTree);
5357	pPatch->nrFixups = 0;
5358	Assert(pPatch->FixupTree == 0);
5359
5360	if (pPatchRec->patch.pTempInfo)
5361	MMR3HeapFree(pPatchRec->patch.pTempInfo);
5362
5363	/** @note might fail, because it has already been removed (e.g. during reset). */
5364	RTAvloGCPtrRemove(&pVM->patm.s.PatchLookupTreeHC->PatchTree, pPatchRec->Core.Key);
5365
5366	/* Free the patch record */
5367	MMHyperFree(pVM, pPatchRec);
5368	return VINF_SUCCESS;
5369	}
5370
5371	/**
5372	* Attempt to refresh the patch by recompiling its entire code block
5373	*
5374	* @returns VBox status code.
5375	* @param pVM The VM to operate on.
5376	* @param pPatchRec Patch record
5377	*/
5378	int patmR3RefreshPatch(PVM pVM, PPATMPATCHREC pPatchRec)
5379	{
5380	PPATCHINFO pPatch;
5381	int rc;
5382	RTGCPTR pInstrGC = pPatchRec->patch.pPrivInstrGC;
5383
5384	Log(("patmR3RefreshPatch: attempt to refresh patch at %VGv\n", pInstrGC));
5385
5386	pPatch = &pPatchRec->patch;
5387	AssertReturn(pPatch->flags & (PATMFL_DUPLICATE_FUNCTION\|PATMFL_IDTHANDLER\|PATMFL_TRAPHANDLER), VERR_PATCHING_REFUSED);
5388	if (pPatch->flags & PATMFL_EXTERNAL_JUMP_INSIDE)
5389	{
5390	Log(("patmR3RefreshPatch: refused because external jumps to this patch exist\n"));
5391	return VERR_PATCHING_REFUSED;
5392	}
5393
5394	/** Note: quite ugly to enable/disable/remove/insert old and new patches, but there's no easy way around it. */
5395
5396	rc = PATMR3DisablePatch(pVM, pInstrGC);
5397	AssertRC(rc);
5398
5399	/** Kick it out of the lookup tree to make sure PATMR3InstallPatch doesn't fail (hack alert) */
5400	RTAvloGCPtrRemove(&pVM->patm.s.PatchLookupTreeHC->PatchTree, pPatchRec->Core.Key);
5401	#ifdef VBOX_WITH_STATISTICS
5402	if (PATM_STAT_INDEX_IS_VALID(pPatchRec->patch.uPatchIdx))
5403	{
5404	STAMR3Deregister(pVM, &pPatchRec->patch);
5405	#ifndef DEBUG_sandervl
5406	STAMR3Deregister(pVM, &pVM->patm.s.pStatsHC[pPatchRec->patch.uPatchIdx]);
5407	STAMR3Deregister(pVM, &pPatchRec->patch.cbPatchBlockSize);
5408	STAMR3Deregister(pVM, &pPatchRec->patch.cbPatchJump);
5409	STAMR3Deregister(pVM, &pPatchRec->patch.cbPrivInstr);
5410	STAMR3Deregister(pVM, &pPatchRec->patch.cCodeWrites);
5411	STAMR3Deregister(pVM, &pPatchRec->patch.cInvalidWrites);
5412	STAMR3Deregister(pVM, &pPatchRec->patch.cTraps);
5413	STAMR3Deregister(pVM, &pPatchRec->patch.flags);
5414	STAMR3Deregister(pVM, &pPatchRec->patch.nrJumpRecs);
5415	STAMR3Deregister(pVM, &pPatchRec->patch.nrFixups);
5416	STAMR3Deregister(pVM, &pPatchRec->patch.opcode);
5417	STAMR3Deregister(pVM, &pPatchRec->patch.uState);
5418	STAMR3Deregister(pVM, &pPatchRec->patch.uOldState);
5419	STAMR3Deregister(pVM, &pPatchRec->patch.uOpMode);
5420	#endif
5421	}
5422	#endif
5423
5424	/** Note: We don't attempt to reuse patch memory here as it's quite common that the new code block requires more memory. */
5425
5426	/* Attempt to install a new patch. */
5427	rc = PATMR3InstallPatch(pVM, pInstrGC, pPatch->flags & (PATMFL_CODE32\|PATMFL_IDTHANDLER\|PATMFL_INTHANDLER\|PATMFL_TRAPHANDLER\|PATMFL_DUPLICATE_FUNCTION\|PATMFL_TRAPHANDLER_WITH_ERRORCODE\|PATMFL_IDTHANDLER_WITHOUT_ENTRYPOINT));
5428	if (VBOX_SUCCESS(rc))
5429	{
5430	RTGCPTR pPatchTargetGC;
5431	PPATMPATCHREC pNewPatchRec;
5432
5433	/* Determine target address in new patch */
5434	pPatchTargetGC = PATMR3QueryPatchGCPtr(pVM, pInstrGC);
5435	Assert(pPatchTargetGC);
5436	if (!pPatchTargetGC)
5437	{
5438	rc = VERR_PATCHING_REFUSED;
5439	goto failure;
5440	}
5441
5442	/* Reset offset into patch memory to put the next code blocks right at the beginning. */
5443	pPatch->uCurPatchOffset = 0;
5444
5445	/* insert jump to new patch in old patch block */
5446	rc = patmPatchGenPatchJump(pVM, pPatch, pInstrGC, pPatchTargetGC, false /* no lookup record */);
5447	if (VBOX_FAILURE(rc))
5448	goto failure;
5449
5450	pNewPatchRec = (PPATMPATCHREC)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTree, pInstrGC);
5451	Assert(pNewPatchRec); /* can't fail */
5452
5453	/* Remove old patch (only do that when everything is finished) */
5454	int rc2 = PATMRemovePatch(pVM, pPatchRec, true /* force removal */);
5455	AssertRC(rc2);
5456
5457	/* Put the new patch back into the tree, because removing the old one kicked this one out. (hack alert) */
5458	RTAvloGCPtrInsert(&pVM->patm.s.PatchLookupTreeHC->PatchTree, &pNewPatchRec->Core);
5459
5460	LogRel(("PATM: patmR3RefreshPatch: succeeded to refresh patch at %VGv \n", pInstrGC));
5461	STAM_COUNTER_INC(&pVM->patm.s.StatPatchRefreshSuccess);
5462	}
5463
5464	failure:
5465	if (VBOX_FAILURE(rc))
5466	{
5467	LogRel(("PATM: patmR3RefreshPatch: failed to refresh patch at %VGv. Reactiving old one. \n", pInstrGC));
5468
5469	/* Remove the new inactive patch */
5470	rc = PATMR3RemovePatch(pVM, pInstrGC);
5471	AssertRC(rc);
5472
5473	/* Put the old patch back into the tree (or else it won't be saved) (hack alert) */
5474	RTAvloGCPtrInsert(&pVM->patm.s.PatchLookupTreeHC->PatchTree, &pPatchRec->Core);
5475
5476	/* Enable again in case the dirty instruction is near the end and there are safe code paths. */
5477	int rc2 = PATMR3EnablePatch(pVM, pInstrGC);
5478	AssertRC(rc2);
5479
5480	STAM_COUNTER_INC(&pVM->patm.s.StatPatchRefreshFailed);
5481	}
5482	return rc;
5483	}
5484
5485	/**
5486	* Find patch for privileged instruction at specified location
5487	*
5488	* @returns Patch structure pointer if found; else NULL
5489	* @param pVM The VM to operate on.
5490	* @param pInstr Guest context point to instruction that might lie within 5 bytes of an existing patch jump
5491	* @param fIncludeHints Include hinted patches or not
5492	*
5493	*/
5494	PPATCHINFO PATMFindActivePatchByEntrypoint(PVM pVM, RTGCPTR pInstrGC, bool fIncludeHints)
5495	{
5496	PPATMPATCHREC pPatchRec = (PPATMPATCHREC)RTAvloGCPtrGetBestFit(&pVM->patm.s.PatchLookupTreeHC->PatchTree, pInstrGC, false);
5497	/* if the patch is enabled, the pointer is not indentical to the privileged patch ptr and it lies within 5 bytes of this priv instr ptr, then we've got a hit! */
5498	if (pPatchRec)
5499	{
5500	if ( pPatchRec->patch.uState == PATCH_ENABLED
5501	&& (pPatchRec->patch.flags & PATMFL_PATCHED_GUEST_CODE)
5502	&& pInstrGC > pPatchRec->patch.pPrivInstrGC
5503	&& pInstrGC < pPatchRec->patch.pPrivInstrGC + pPatchRec->patch.cbPatchJump)
5504	{
5505	Log(("Found active patch at %VGv (org %VGv)\n", pInstrGC, pPatchRec->patch.pPrivInstrGC));
5506	return &pPatchRec->patch;
5507	}
5508	else
5509	if ( fIncludeHints
5510	&& pPatchRec->patch.uState == PATCH_DISABLED
5511	&& (pPatchRec->patch.flags & PATMFL_INSTR_HINT)
5512	&& pInstrGC > pPatchRec->patch.pPrivInstrGC
5513	&& pInstrGC < pPatchRec->patch.pPrivInstrGC + pPatchRec->patch.cbPatchJump)
5514	{
5515	Log(("Found HINT patch at %VGv (org %VGv)\n", pInstrGC, pPatchRec->patch.pPrivInstrGC));
5516	return &pPatchRec->patch;
5517	}
5518	}
5519	return NULL;
5520	}
5521
5522	/**
5523	* Checks whether the GC address is inside a generated patch jump
5524	*
5525	* @returns true -> yes, false -> no
5526	* @param pVM The VM to operate on.
5527	* @param pAddr Guest context address
5528	* @param pPatchAddr Guest context patch address (if true)
5529	*/
5530	PATMR3DECL(bool) PATMR3IsInsidePatchJump(PVM pVM, RTGCPTR pAddr, PRTGCPTR pPatchAddr)
5531	{
5532	RTGCPTR addr;
5533	PPATCHINFO pPatch;
5534
5535	if (PATMIsEnabled(pVM) == false)
5536	return false;
5537
5538	if (pPatchAddr == NULL)
5539	pPatchAddr = &addr;
5540
5541	*pPatchAddr = 0;
5542
5543	pPatch = PATMFindActivePatchByEntrypoint(pVM, pAddr);
5544	if (pPatch)
5545	{
5546	*pPatchAddr = pPatch->pPrivInstrGC;
5547	}
5548	return *pPatchAddr == 0 ? false : true;
5549	}
5550
5551	/**
5552	* Remove patch for privileged instruction at specified location
5553	*
5554	* @returns VBox status code.
5555	* @param pVM The VM to operate on.
5556	* @param pInstr Guest context point to privileged instruction
5557	*
5558	* @note returns failure if patching is not allowed or possible
5559	*
5560	*/
5561	PATMR3DECL(int) PATMR3RemovePatch(PVM pVM, RTGCPTR pInstrGC)
5562	{
5563	PPATMPATCHREC pPatchRec;
5564
5565	pPatchRec = (PPATMPATCHREC)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTree, pInstrGC);
5566	if (pPatchRec)
5567	{
5568	int rc = PATMR3DisablePatch(pVM, pInstrGC);
5569	if (rc == VWRN_PATCH_REMOVED)
5570	return VINF_SUCCESS;
5571	return PATMRemovePatch(pVM, pPatchRec, false);
5572	}
5573	AssertFailed();
5574	return VERR_PATCH_NOT_FOUND;
5575	}
5576
5577	/**
5578	* Mark patch as dirty
5579	*
5580	* @returns VBox status code.
5581	* @param pVM The VM to operate on.
5582	* @param pPatch Patch record
5583	*
5584	* @note returns failure if patching is not allowed or possible
5585	*
5586	*/
5587	PATMR3DECL(int) PATMR3MarkDirtyPatch(PVM pVM, PPATCHINFO pPatch)
5588	{
5589	if (pPatch->pPatchBlockOffset)
5590	{
5591	Log(("Invalidate patch at %VGv (HC=%VGv)\n", PATCHCODE_PTR_GC(pPatch), PATCHCODE_PTR_HC(pPatch)));
5592	pPatch->bDirtyOpcode = *PATCHCODE_PTR_HC(pPatch);
5593	*PATCHCODE_PTR_HC(pPatch) = 0xCC;
5594	}
5595
5596	STAM_COUNTER_INC(&pVM->patm.s.StatDirty);
5597	/* Put back the replaced instruction. */
5598	int rc = PATMR3DisablePatch(pVM, pPatch->pPrivInstrGC);
5599	if (rc == VWRN_PATCH_REMOVED)
5600	return VINF_SUCCESS;
5601
5602	/** @note we don't restore patch pages for patches that are not enabled! */
5603	/** @note be careful when changing this behaviour!! */
5604
5605	/* The patch pages are no longer marked for self-modifying code detection */
5606	if (pPatch->flags & PATMFL_CODE_MONITORED)
5607	{
5608	int rc = patmRemovePatchPages(pVM, pPatch);
5609	AssertRCReturn(rc, rc);
5610	}
5611	pPatch->uState = PATCH_DIRTY;
5612
5613	/* Paranoia; make sure this patch is not somewhere in the callchain, so prevent ret instructions from succeeding. */
5614	CTXSUFF(pVM->patm.s.pGCState)->Psp = PATM_STACK_SIZE;
5615
5616	return VINF_SUCCESS;
5617	}
5618
5619	/**
5620	* Query the corresponding GC instruction pointer from a pointer inside the patch block itself
5621	*
5622	* @returns VBox status code.
5623	* @param pVM The VM to operate on.
5624	* @param pPatch Patch block structure pointer
5625	* @param pPatchGC GC address in patch block
5626	*/
5627	RTGCPTR patmPatchGCPtr2GuestGCPtr(PVM pVM, PPATCHINFO pPatch, GCPTRTYPE(uint8_t *) pPatchGC)
5628	{
5629	Assert(pPatch->Patch2GuestAddrTree);
5630	/* Get the closest record from below. */
5631	PRECPATCHTOGUEST pPatchToGuestRec = (PRECPATCHTOGUEST)RTAvlU32GetBestFit(&pPatch->Patch2GuestAddrTree, pPatchGC - pVM->patm.s.pPatchMemGC, false);
5632	if (pPatchToGuestRec)
5633	return pPatchToGuestRec->pOrgInstrGC;
5634
5635	return 0;
5636	}
5637
5638	/* Converts Guest code GC ptr to Patch code GC ptr (if found)
5639	*
5640	* @returns corresponding GC pointer in patch block
5641	* @param pVM The VM to operate on.
5642	* @param pPatch Current patch block pointer
5643	* @param pInstrGC Guest context pointer to privileged instruction
5644	*
5645	*/
5646	RTGCPTR patmGuestGCPtrToPatchGCPtr(PVM pVM, PPATCHINFO pPatch, GCPTRTYPE(uint8_t*) pInstrGC)
5647	{
5648	if (pPatch->Guest2PatchAddrTree)
5649	{
5650	PRECGUESTTOPATCH pGuestToPatchRec = (PRECGUESTTOPATCH)RTAvlGCPtrGet(&pPatch->Guest2PatchAddrTree, pInstrGC);
5651	if (pGuestToPatchRec)
5652	return pVM->patm.s.pPatchMemGC + pGuestToPatchRec->PatchOffset;
5653	}
5654
5655	return 0;
5656	}
5657
5658	/* Converts Guest code GC ptr to Patch code GC ptr (or nearest from below if no identical match)
5659	*
5660	* @returns corresponding GC pointer in patch block
5661	* @param pVM The VM to operate on.
5662	* @param pPatch Current patch block pointer
5663	* @param pInstrGC Guest context pointer to privileged instruction
5664	*
5665	*/
5666	RTGCPTR patmGuestGCPtrToClosestPatchGCPtr(PVM pVM, PPATCHINFO pPatch, GCPTRTYPE(uint8_t*) pInstrGC)
5667	{
5668	PRECGUESTTOPATCH pGuestToPatchRec = (PRECGUESTTOPATCH)RTAvlGCPtrGetBestFit(&pPatch->Guest2PatchAddrTree, pInstrGC, false);
5669	if (pGuestToPatchRec)
5670	return pVM->patm.s.pPatchMemGC + pGuestToPatchRec->PatchOffset;
5671
5672	return 0;
5673	}
5674
5675	/* Converts Guest code GC ptr to Patch code GC ptr (if found)
5676	*
5677	* @returns corresponding GC pointer in patch block
5678	* @param pVM The VM to operate on.
5679	* @param pInstrGC Guest context pointer to privileged instruction
5680	*
5681	*/
5682	PATMR3DECL(RTGCPTR) PATMR3GuestGCPtrToPatchGCPtr(PVM pVM, GCPTRTYPE(uint8_t*) pInstrGC)
5683	{
5684	PPATMPATCHREC pPatchRec = (PPATMPATCHREC)RTAvloGCPtrGetBestFit(&pVM->patm.s.PatchLookupTreeHC->PatchTree, pInstrGC, false);
5685	if (pPatchRec && pPatchRec->patch.uState == PATCH_ENABLED && pInstrGC >= pPatchRec->patch.pPrivInstrGC)
5686	{
5687	return patmGuestGCPtrToPatchGCPtr(pVM, &pPatchRec->patch, pInstrGC);
5688	}
5689	return 0;
5690	}
5691
5692	/**
5693	* Query the corresponding GC instruction pointer from a pointer inside the patch block itself
5694	*
5695	* @returns original GC instruction pointer or 0 if not found
5696	* @param pVM The VM to operate on.
5697	* @param pPatchGC GC address in patch block
5698	* @param pEnmState State of the translated address (out)
5699	*
5700	*/
5701	PATMR3DECL(RTGCPTR) PATMR3PatchToGCPtr(PVM pVM, RTGCPTR pPatchGC, PATMTRANSSTATE *pEnmState)
5702	{
5703	PPATMPATCHREC pPatchRec;
5704	void *pvPatchCoreOffset;
5705	RTGCPTR pPrivInstrGC;
5706
5707	Assert(PATMIsPatchGCAddr(pVM, pPatchGC));
5708	pvPatchCoreOffset = RTAvloGCPtrGetBestFit(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPatchAddr, pPatchGC - pVM->patm.s.pPatchMemGC, false);
5709	if (pvPatchCoreOffset == 0)
5710	{
5711	Log(("PATMR3PatchToGCPtr failed for %VGv offset %x\n", pPatchGC, pPatchGC - pVM->patm.s.pPatchMemGC));
5712	return 0;
5713	}
5714	pPatchRec = PATM_PATCHREC_FROM_COREOFFSET(pvPatchCoreOffset);
5715	pPrivInstrGC = patmPatchGCPtr2GuestGCPtr(pVM, &pPatchRec->patch, pPatchGC);
5716	if (pEnmState)
5717	{
5718	AssertMsg(pPrivInstrGC && ( pPatchRec->patch.uState == PATCH_ENABLED
5719	\|\| pPatchRec->patch.uState == PATCH_DIRTY
5720	\|\| pPatchRec->patch.uState == PATCH_DISABLE_PENDING
5721	\|\| pPatchRec->patch.uState == PATCH_UNUSABLE),
5722	("pPrivInstrGC=%VGv uState=%d\n", pPrivInstrGC, pPatchRec->patch.uState));
5723
5724	if ( !pPrivInstrGC
5725	\|\| pPatchRec->patch.uState == PATCH_UNUSABLE
5726	\|\| pPatchRec->patch.uState == PATCH_REFUSED)
5727	{
5728	pPrivInstrGC = 0;
5729	*pEnmState = PATMTRANS_FAILED;
5730	}
5731	else
5732	if (pVM->patm.s.pGCStateHC->GCPtrInhibitInterrupts == pPrivInstrGC)
5733	{
5734	*pEnmState = PATMTRANS_INHIBITIRQ;
5735	}
5736	else
5737	if ( pPatchRec->patch.uState == PATCH_ENABLED
5738	&& !(pPatchRec->patch.flags & (PATMFL_DUPLICATE_FUNCTION\|PATMFL_IDTHANDLER\|PATMFL_TRAMPOLINE))
5739	&& pPrivInstrGC > pPatchRec->patch.pPrivInstrGC
5740	&& pPrivInstrGC < pPatchRec->patch.pPrivInstrGC + pPatchRec->patch.cbPatchJump)
5741	{
5742	*pEnmState = PATMTRANS_OVERWRITTEN;
5743	}
5744	else
5745	if (PATMFindActivePatchByEntrypoint(pVM, pPrivInstrGC))
5746	{
5747	*pEnmState = PATMTRANS_OVERWRITTEN;
5748	}
5749	else
5750	if (pPrivInstrGC == pPatchRec->patch.pPrivInstrGC)
5751	{
5752	*pEnmState = PATMTRANS_PATCHSTART;
5753	}
5754	else
5755	*pEnmState = PATMTRANS_SAFE;
5756	}
5757	return pPrivInstrGC;
5758	}
5759
5760	/**
5761	* Returns the GC pointer of the patch for the specified GC address
5762	*
5763	* @returns VBox status code.
5764	* @param pVM The VM to operate on.
5765	* @param pAddrGC Guest context address
5766	*/
5767	PATMR3DECL(RTGCPTR) PATMR3QueryPatchGCPtr(PVM pVM, RTGCPTR pAddrGC)
5768	{
5769	PPATMPATCHREC pPatchRec;
5770
5771	// Find the patch record
5772	pPatchRec = (PPATMPATCHREC)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTree, pAddrGC);
5773	/** @todo we should only use patches that are enabled! always did this, but it's incorrect! */
5774	if (pPatchRec && (pPatchRec->patch.uState == PATCH_ENABLED \|\| pPatchRec->patch.uState == PATCH_DIRTY))
5775	return PATCHCODE_PTR_GC(&pPatchRec->patch);
5776
5777	return 0;
5778	}
5779
5780	/**
5781	* Attempt to recover dirty instructions
5782	*
5783	* @returns VBox status code.
5784	* @param pVM The VM to operate on.
5785	* @param pCtx CPU context
5786	* @param pPatch Patch record
5787	* @param pPatchToGuestRec Patch to guest address record
5788	* @param pEip GC pointer of trapping instruction
5789	*/
5790	static int patmR3HandleDirtyInstr(PVM pVM, PCPUMCTX pCtx, PPATMPATCHREC pPatch, PRECPATCHTOGUEST pPatchToGuestRec, RTGCPTR pEip)
5791	{
5792	DISCPUSTATE CpuOld, CpuNew;
5793	uint8_t pPatchInstrHC, pCurPatchInstrHC;
5794	int rc;
5795	RTGCPTR pCurInstrGC, pCurPatchInstrGC;
5796	uint32_t cbDirty;
5797	PRECPATCHTOGUEST pRec;
5798
5799	Log(("patmR3HandleDirtyInstr: dirty instruction at %VGv (%VGv)\n", pEip, pPatchToGuestRec->pOrgInstrGC));
5800
5801	pRec = pPatchToGuestRec;
5802	pCurInstrGC = pPatchToGuestRec->pOrgInstrGC;
5803	pCurPatchInstrGC = pEip;
5804	cbDirty = 0;
5805	pPatchInstrHC = patmPatchGCPtr2PatchHCPtr(pVM, pCurPatchInstrGC);
5806
5807	/* Find all adjacent dirty instructions */
5808	while (true)
5809	{
5810	if (pRec->fJumpTarget)
5811	{
5812	LogRel(("PATM: patmR3HandleDirtyInstr: dirty instruction at %VGv (%VGv) ignored, because instruction in function was reused as target of jump\n", pEip, pPatchToGuestRec->pOrgInstrGC));
5813	pRec->fDirty = false;
5814	return VERR_PATCHING_REFUSED;
5815	}
5816
5817	/* Restore original instruction opcode byte so we can check if the write was indeed safe. */
5818	pCurPatchInstrHC = patmPatchGCPtr2PatchHCPtr(pVM, pCurPatchInstrGC);
5819	*pCurPatchInstrHC = pRec->u8DirtyOpcode;
5820
5821	/* Only harmless instructions are acceptable. */
5822	rc = CPUMR3DisasmInstrCPU(pVM, pCtx, pCurPatchInstrGC, &CpuOld, 0);
5823	if ( VBOX_FAILURE(rc)
5824	\|\| !(CpuOld.pCurInstr->optype & OPTYPE_HARMLESS))
5825	break;
5826
5827	#ifdef DEBUG
5828	char szBuf[256];
5829	szBuf[0] = '\0';
5830	DBGFR3DisasInstr(pVM, pCtx->cs, pCurPatchInstrGC, szBuf, sizeof(szBuf));
5831	Log(("DIRTY: %s\n", szBuf));
5832	#endif
5833	/** Remove old lookup record. */
5834	patmr3RemoveP2GLookupRecord(pVM, &pPatch->patch, pCurPatchInstrGC);
5835
5836	pCurPatchInstrGC += CpuOld.opsize;
5837	cbDirty += CpuOld.opsize;
5838
5839	/* Mark as clean; if we fail we'll let it always fault. */
5840	pRec->fDirty = false;
5841
5842	/* Let's see if there's another dirty instruction right after. */
5843	pRec = (PRECPATCHTOGUEST)RTAvlU32GetBestFit(&pPatch->patch.Patch2GuestAddrTree, pCurPatchInstrGC - pVM->patm.s.pPatchMemGC, true);
5844	if (!pRec \|\| !pRec->fDirty)
5845	break; /* no more dirty instructions */
5846	}
5847
5848	if ( VBOX_SUCCESS(rc)
5849	&& (CpuOld.pCurInstr->optype & OPTYPE_HARMLESS)
5850	)
5851	{
5852	uint32_t cbLeft;
5853
5854	pCurPatchInstrHC = pPatchInstrHC;
5855	pCurPatchInstrGC = pEip;
5856	cbLeft = cbDirty;
5857
5858	while (cbLeft && VBOX_SUCCESS(rc))
5859	{
5860	bool fValidInstr;
5861
5862	rc = CPUMR3DisasmInstrCPU(pVM, pCtx, pCurInstrGC, &CpuNew, 0);
5863
5864	fValidInstr = !!(CpuNew.pCurInstr->optype & OPTYPE_HARMLESS);
5865	if ( !fValidInstr
5866	&& (CpuNew.pCurInstr->optype & OPTYPE_RELATIVE_CONTROLFLOW)
5867	)
5868	{
5869	RTGCPTR pTargetGC = PATMResolveBranch(&CpuNew, pCurInstrGC);
5870
5871	if ( pTargetGC >= pPatchToGuestRec->pOrgInstrGC
5872	&& pTargetGC <= pPatchToGuestRec->pOrgInstrGC + cbDirty
5873	)
5874	{
5875	/* A relative jump to an instruction inside or to the end of the dirty block is acceptable. */
5876	fValidInstr = true;
5877	}
5878	}
5879
5880	/* If the instruction is completely harmless (which implies a 1:1 patch copy). */
5881	if ( rc == VINF_SUCCESS
5882	&& CpuNew.opsize <= cbLeft /* must still fit */
5883	&& fValidInstr
5884	)
5885	{
5886	#ifdef DEBUG
5887	char szBuf[256];
5888	szBuf[0] = '\0';
5889	DBGFR3DisasInstr(pVM, pCtx->cs, pCurInstrGC, szBuf, sizeof(szBuf));
5890	Log(("NEW: %s\n", szBuf));
5891	#endif
5892
5893	/* Copy the new instruction. */
5894	rc = PGMPhysReadGCPtr(pVM, pCurPatchInstrHC, pCurInstrGC, CpuNew.opsize);
5895	AssertRC(rc);
5896
5897	/* Add a new lookup record for the duplicated instruction. */
5898	patmr3AddP2GLookupRecord(pVM, &pPatch->patch, pCurPatchInstrHC, pCurInstrGC, PATM_LOOKUP_BOTHDIR);
5899	}
5900	else
5901	{
5902	#ifdef DEBUG
5903	char szBuf[256];
5904	szBuf[0] = '\0';
5905	DBGFR3DisasInstr(pVM, pCtx->cs, pCurInstrGC, szBuf, sizeof(szBuf));
5906	Log(("NEW: %s (FAILED)\n", szBuf));
5907	#endif
5908	/* Restore the old lookup record for the duplicated instruction. */
5909	patmr3AddP2GLookupRecord(pVM, &pPatch->patch, pCurPatchInstrHC, pCurInstrGC, PATM_LOOKUP_BOTHDIR);
5910
5911	/** @todo in theory we need to restore the lookup records for the remaining dirty instructions too! */
5912	rc = VERR_PATCHING_REFUSED;
5913	break;
5914	}
5915	pCurInstrGC += CpuNew.opsize;
5916	pCurPatchInstrHC += CpuNew.opsize;
5917	pCurPatchInstrGC += CpuNew.opsize;
5918	cbLeft -= CpuNew.opsize;
5919	}
5920	}
5921	else
5922	rc = VERR_PATCHING_REFUSED;
5923
5924	if (VBOX_SUCCESS(rc))
5925	{
5926	STAM_COUNTER_INC(&pVM->patm.s.StatInstrDirtyGood);
5927	}
5928	else
5929	{
5930	STAM_COUNTER_INC(&pVM->patm.s.StatInstrDirtyBad);
5931	/* Mark the whole instruction stream with breakpoints. */
5932	memset(pPatchInstrHC, 0xCC, cbDirty);
5933
5934	if ( pVM->patm.s.fOutOfMemory == false
5935	&& (pPatch->patch.flags & (PATMFL_DUPLICATE_FUNCTION\|PATMFL_IDTHANDLER\|PATMFL_TRAPHANDLER)))
5936	{
5937	rc = patmR3RefreshPatch(pVM, pPatch);
5938	if (VBOX_FAILURE(rc))
5939	{
5940	LogRel(("PATM: Failed to refresh dirty patch at %VGv. Disabling it.\n", pPatch->patch.pPrivInstrGC));
5941	}
5942	/* Even if we succeed, we must go back to the original instruction as the patched one could be invalid. */
5943	rc = VERR_PATCHING_REFUSED;
5944	}
5945	}
5946	return rc;
5947	}
5948
5949	/**
5950	* Handle trap inside patch code
5951	*
5952	* @returns VBox status code.
5953	* @param pVM The VM to operate on.
5954	* @param pCtx CPU context
5955	* @param pEip GC pointer of trapping instruction
5956	* @param ppNewEip GC pointer to new instruction
5957	*/
5958	PATMR3DECL(int) PATMR3HandleTrap(PVM pVM, PCPUMCTX pCtx, RTGCPTR pEip, RTGCPTR *ppNewEip)
5959	{
5960	PPATMPATCHREC pPatch = 0;
5961	void *pvPatchCoreOffset;
5962	RTGCUINTPTR offset;
5963	RTGCPTR pNewEip;
5964	int rc ;
5965	PRECPATCHTOGUEST pPatchToGuestRec = 0;
5966
5967	pNewEip = 0;
5968	*ppNewEip = 0;
5969
5970	STAM_PROFILE_ADV_START(&pVM->patm.s.StatHandleTrap, a);
5971
5972	/* Find the patch record. */
5973	/** @note there might not be a patch to guest translation record (global function) */
5974	offset = pEip - pVM->patm.s.pPatchMemGC;
5975	pvPatchCoreOffset = RTAvloGCPtrGetBestFit(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPatchAddr, offset, false);
5976	if (pvPatchCoreOffset)
5977	{
5978	pPatch = PATM_PATCHREC_FROM_COREOFFSET(pvPatchCoreOffset);
5979
5980	if (pPatch->patch.uState == PATCH_DIRTY)
5981	{
5982	Log(("PATMR3HandleTrap: trap in dirty patch at %VGv\n", pEip));
5983	if (pPatch->patch.flags & (PATMFL_DUPLICATE_FUNCTION\|PATMFL_CALLABLE_AS_FUNCTION))
5984	{
5985	/* Function duplication patches set fPIF to 1 on entry */
5986	pVM->patm.s.pGCStateHC->fPIF = 1;
5987	}
5988	}
5989	else
5990	if (pPatch->patch.uState == PATCH_DISABLED)
5991	{
5992	Log(("PATMR3HandleTrap: trap in disabled patch at %VGv\n", pEip));
5993	if (pPatch->patch.flags & (PATMFL_DUPLICATE_FUNCTION\|PATMFL_CALLABLE_AS_FUNCTION))
5994	{
5995	/* Function duplication patches set fPIF to 1 on entry */
5996	pVM->patm.s.pGCStateHC->fPIF = 1;
5997	}
5998	}
5999	else
6000	if (pPatch->patch.uState == PATCH_DISABLE_PENDING)
6001	{
6002	RTGCPTR pPrivInstrGC = pPatch->patch.pPrivInstrGC;
6003
6004	Log(("PATMR3HandleTrap: disable operation is pending for patch at %VGv\n", pPatch->patch.pPrivInstrGC));
6005	rc = PATMR3DisablePatch(pVM, pPatch->patch.pPrivInstrGC);
6006	AssertReleaseMsg(rc != VWRN_PATCH_REMOVED, ("PATMR3DisablePatch removed patch at %VGv\n", pPrivInstrGC));
6007	AssertMsg(pPatch->patch.uState == PATCH_DISABLED \|\| pPatch->patch.uState == PATCH_UNUSABLE, ("Unexpected failure to disable patch state=%d rc=%Vrc\n", pPatch->patch.uState, rc));
6008	}
6009
6010	pPatchToGuestRec = (PRECPATCHTOGUEST)RTAvlU32GetBestFit(&pPatch->patch.Patch2GuestAddrTree, offset, false);
6011	AssertReleaseMsg(pPatchToGuestRec, ("PATMR3HandleTrap: Unable to find corresponding guest address for %VGv (offset %x)\n", pEip, offset));
6012
6013	pNewEip = pPatchToGuestRec->pOrgInstrGC;
6014	pPatch->patch.cTraps++;
6015	PATM_STAT_FAULT_INC(&pPatch->patch);
6016	}
6017	else
6018	AssertReleaseMsg(pVM->patm.s.pGCStateHC->fPIF == 0, ("PATMR3HandleTrap: Unable to find translation record for %VGv (PIF=0)\n", pEip));
6019
6020	/* Check if we were interrupted in PATM generated instruction code. */
6021	if (pVM->patm.s.pGCStateHC->fPIF == 0)
6022	{
6023	DISCPUSTATE Cpu;
6024	rc = CPUMR3DisasmInstrCPU(pVM, pCtx, pEip, &Cpu, "PIF Trap: ");
6025	AssertRC(rc);
6026
6027	if ( rc == VINF_SUCCESS
6028	&& ( Cpu.pCurInstr->opcode == OP_PUSHF
6029	\|\| Cpu.pCurInstr->opcode == OP_PUSH
6030	\|\| Cpu.pCurInstr->opcode == OP_CALL)
6031	)
6032	{
6033	uint64_t fFlags;
6034
6035	STAM_COUNTER_INC(&pVM->patm.s.StatPushTrap);
6036
6037	if (Cpu.pCurInstr->opcode == OP_PUSH)
6038	{
6039	rc = PGMShwGetPage(pVM, pCtx->esp, &fFlags, NULL);
6040	if ( rc == VINF_SUCCESS
6041	&& ((fFlags & (X86_PTE_P\|X86_PTE_RW)) == (X86_PTE_P\|X86_PTE_RW)) )
6042	{
6043	/* The stack address is fine, so the push argument is a pointer -> emulate this instruction */
6044
6045	/* Reset the PATM stack. */
6046	CTXSUFF(pVM->patm.s.pGCState)->Psp = PATM_STACK_SIZE;
6047
6048	pVM->patm.s.pGCStateHC->fPIF = 1;
6049
6050	Log(("Faulting push -> go back to the original instruction\n"));
6051
6052	/* continue at the original instruction */
6053	*ppNewEip = pNewEip - SELMToFlat(pVM, pCtx->eflags, pCtx->cs, &pCtx->csHid, 0);
6054	STAM_PROFILE_ADV_STOP(&pVM->patm.s.StatHandleTrap, a);
6055	return VINF_SUCCESS;
6056	}
6057	}
6058
6059	/* Typical pushf (most patches)/push (call patch) trap because of a monitored page. */
6060	rc = PGMShwModifyPage(pVM, pCtx->esp, 1, X86_PTE_RW, ~(uint64_t)X86_PTE_RW);
6061	AssertMsgRC(rc, ("PGMShwModifyPage -> rc=%Vrc\n", rc));
6062	if (rc == VINF_SUCCESS)
6063	{
6064
6065	/* The guest page must be present. */
6066	rc = PGMGstGetPage(pVM, pCtx->esp, &fFlags, NULL);
6067	if (rc == VINF_SUCCESS && (fFlags & X86_PTE_P))
6068	{
6069	STAM_PROFILE_ADV_STOP(&pVM->patm.s.StatHandleTrap, a);
6070	return VINF_PATCH_CONTINUE;
6071	}
6072	}
6073	}
6074
6075	char szBuf[256];
6076	szBuf[0] = '\0';
6077	DBGFR3DisasInstr(pVM, pCtx->cs, pEip, szBuf, sizeof(szBuf));
6078
6079	/* Very bad. We crashed in emitted code. Probably stack? */
6080	if (pPatch)
6081	{
6082	AssertReleaseMsg(pVM->patm.s.pGCStateHC->fPIF == 1,
6083	("Crash in patch code %VGv (%VGv) esp=%RX32\nPatch state=%x flags=%x fDirty=%d\n%s\n", pEip, pNewEip, CPUMGetGuestESP(pVM), pPatch->patch.uState, pPatch->patch.flags, pPatchToGuestRec->fDirty, szBuf));
6084	}
6085	else
6086	AssertReleaseMsg(pVM->patm.s.pGCStateHC->fPIF == 1,
6087	("Crash in patch code %VGv (%VGv) esp=%RX32\n%s\n", pEip, pNewEip, CPUMGetGuestESP(pVM), szBuf));
6088	EMR3FatalError(pVM, VERR_INTERNAL_ERROR);
6089	}
6090
6091	/* From here on, we must have a valid patch to guest translation. */
6092	if (pvPatchCoreOffset == 0)
6093	{
6094	STAM_PROFILE_ADV_STOP(&pVM->patm.s.StatHandleTrap, a);
6095	AssertMsgFailed(("PATMR3HandleTrap: patch not found at address %VGv!!\n", pEip));
6096	return VERR_PATCH_NOT_FOUND; //fatal error
6097	}
6098
6099	/* Take care of dirty/changed instructions. */
6100	if (pPatchToGuestRec->fDirty)
6101	{
6102	Assert(pPatchToGuestRec->Core.Key == offset);
6103	Assert(pVM->patm.s.pGCStateHC->fPIF == 1);
6104
6105	rc = patmR3HandleDirtyInstr(pVM, pCtx, pPatch, pPatchToGuestRec, pEip);
6106	if (VBOX_SUCCESS(rc))
6107	{
6108	/* Retry the current instruction. */
6109	pNewEip = pEip;
6110	rc = VINF_PATCH_CONTINUE; /* Continue at current patch instruction. */
6111	}
6112	else
6113	{
6114	/* Reset the PATM stack. */
6115	CTXSUFF(pVM->patm.s.pGCState)->Psp = PATM_STACK_SIZE;
6116
6117	rc = VINF_SUCCESS; /* Continue at original instruction. */
6118	}
6119
6120	*ppNewEip = pNewEip - SELMToFlat(pVM, pCtx->eflags, pCtx->cs, &pCtx->csHid, 0);
6121	STAM_PROFILE_ADV_STOP(&pVM->patm.s.StatHandleTrap, a);
6122	return rc;
6123	}
6124
6125	#ifdef VBOX_STRICT
6126	if (pPatch->patch.flags & PATMFL_DUPLICATE_FUNCTION)
6127	{
6128	DISCPUSTATE cpu;
6129	bool disret;
6130	uint32_t opsize;
6131
6132	cpu.mode = (pPatch->patch.flags & PATMFL_CODE32) ? CPUMODE_32BIT : CPUMODE_16BIT;
6133	disret = PATMR3DISInstr(pVM, &pPatch->patch, &cpu, pNewEip, PATMGCVirtToHCVirt(pVM, &pPatch->patch, pNewEip), &opsize, NULL, PATMREAD_RAWCODE);
6134	if (disret && cpu.pCurInstr->opcode == OP_RETN)
6135	{
6136	RTGCPTR retaddr;
6137	PCPUMCTX pCtx;
6138	int rc;
6139
6140	rc = CPUMQueryGuestCtxPtr(pVM, &pCtx);
6141	AssertRC(rc);
6142
6143	rc = PGMPhysReadGCPtr(pVM, &retaddr, pCtx->esp, sizeof(retaddr));
6144	AssertRC(rc);
6145
6146	Log(("Return failed at %VGv (%VGv)\n", pEip, pNewEip));
6147	Log(("Expected return address %VGv found address %VGv Psp=%x\n", pVM->patm.s.pGCStackHC[(pVM->patm.s.pGCStateHC->Psp+PATM_STACK_SIZE)/sizeof(RTGCPTR)], retaddr, pVM->patm.s.pGCStateHC->Psp));
6148	}
6149	}
6150	#endif
6151
6152	/* Return original address, correct by subtracting the CS base address. */
6153	*ppNewEip = pNewEip - SELMToFlat(pVM, pCtx->eflags, pCtx->cs, &pCtx->csHid, 0);
6154
6155	/* Reset the PATM stack. */
6156	CTXSUFF(pVM->patm.s.pGCState)->Psp = PATM_STACK_SIZE;
6157
6158	if (pVM->patm.s.pGCStateHC->GCPtrInhibitInterrupts == pNewEip)
6159	{
6160	/* Must be a faulting instruction after sti; currently only sysexit, hlt or iret */
6161	Log(("PATMR3HandleTrap %VGv -> inhibit irqs set!\n", pEip));
6162	#ifdef VBOX_STRICT
6163	DISCPUSTATE cpu;
6164	bool disret;
6165	uint32_t opsize;
6166
6167	cpu.mode = (pPatch->patch.flags & PATMFL_CODE32) ? CPUMODE_32BIT : CPUMODE_16BIT;
6168	disret = PATMR3DISInstr(pVM, &pPatch->patch, &cpu, pNewEip, PATMGCVirtToHCVirt(pVM, &pPatch->patch, pNewEip), &opsize, NULL, PATMREAD_ORGCODE);
6169
6170	if (disret && (cpu.pCurInstr->opcode == OP_SYSEXIT \|\| cpu.pCurInstr->opcode == OP_HLT \|\| cpu.pCurInstr->opcode == OP_INT3))
6171	{
6172	cpu.mode = (pPatch->patch.flags & PATMFL_CODE32) ? CPUMODE_32BIT : CPUMODE_16BIT;
6173	disret = PATMR3DISInstr(pVM, &pPatch->patch, &cpu, pNewEip, PATMGCVirtToHCVirt(pVM, &pPatch->patch, pNewEip), &opsize, NULL, PATMREAD_RAWCODE);
6174
6175	Assert(cpu.pCurInstr->opcode == OP_SYSEXIT \|\| cpu.pCurInstr->opcode == OP_HLT \|\| cpu.pCurInstr->opcode == OP_IRET);
6176	}
6177	#endif
6178	EMSetInhibitInterruptsPC(pVM, pNewEip);
6179	pVM->patm.s.pGCStateHC->GCPtrInhibitInterrupts = 0;
6180	}
6181
6182	Log2(("pPatchBlockGC %VGv - pEip %VGv corresponding GC address %VGv\n", PATCHCODE_PTR_GC(&pPatch->patch), pEip, pNewEip));
6183
6184	if (pNewEip >= pPatch->patch.pPrivInstrGC && pNewEip < pPatch->patch.pPrivInstrGC + pPatch->patch.cbPatchJump)
6185	{
6186	/* We can't jump back to code that we've overwritten with a 5 byte jump! */
6187	Log(("Disabling patch at location %VGv due to trap too close to the privileged instruction \n", pPatch->patch.pPrivInstrGC));
6188	PATMR3DisablePatch(pVM, pPatch->patch.pPrivInstrGC);
6189	STAM_PROFILE_ADV_STOP(&pVM->patm.s.StatHandleTrap, a);
6190	return VERR_PATCH_DISABLED;
6191	}
6192
6193	#ifdef PATM_REMOVE_PATCH_ON_TOO_MANY_TRAPS
6194	/** @todo compare to nr of successful runs. add some aging algorithm and determine the best time to disable the patch */
6195	if (pPatch->patch.cTraps > MAX_PATCH_TRAPS)
6196	{
6197	Log(("Disabling patch at location %VGv due to too many traps inside patch code\n", pPatch->patch.pPrivInstrGC));
6198	//we are only wasting time, back out the patch
6199	PATMR3DisablePatch(pVM, pPatch->patch.pPrivInstrGC);
6200	pTrapRec->pNextPatchInstr = 0;
6201	STAM_PROFILE_ADV_STOP(&pVM->patm.s.StatHandleTrap, a);
6202	return VERR_PATCH_DISABLED;
6203	}
6204	#endif
6205
6206	STAM_PROFILE_ADV_STOP(&pVM->patm.s.StatHandleTrap, a);
6207	return VINF_SUCCESS;
6208	}
6209
6210
6211	/**
6212	* Handle page-fault in monitored page
6213	*
6214	* @returns VBox status code.
6215	* @param pVM The VM to operate on.
6216	*/
6217	PATMR3DECL(int) PATMR3HandleMonitoredPage(PVM pVM)
6218	{
6219	RTGCPTR addr = pVM->patm.s.pvFaultMonitor;
6220
6221	addr &= PAGE_BASE_GC_MASK;
6222
6223	int rc = PGMHandlerVirtualDeregister(pVM, addr);
6224	AssertRC(rc); NOREF(rc);
6225
6226	PPATMPATCHREC pPatchRec = (PPATMPATCHREC)RTAvloGCPtrGetBestFit(&pVM->patm.s.PatchLookupTreeHC->PatchTree, addr, false);
6227	if (pPatchRec && pPatchRec->patch.uState == PATCH_ENABLED && PAGE_ADDRESS(pPatchRec->patch.pPrivInstrGC) == PAGE_ADDRESS(addr))
6228	{
6229	STAM_COUNTER_INC(&pVM->patm.s.StatMonitored);
6230	Log(("Renewing patch at %VGv\n", pPatchRec->patch.pPrivInstrGC));
6231	rc = PATMR3DisablePatch(pVM, pPatchRec->patch.pPrivInstrGC);
6232	if (rc == VWRN_PATCH_REMOVED)
6233	return VINF_SUCCESS;
6234
6235	PATMR3EnablePatch(pVM, pPatchRec->patch.pPrivInstrGC);
6236
6237	if (addr == pPatchRec->patch.pPrivInstrGC)
6238	addr++;
6239	}
6240
6241	for(;;)
6242	{
6243	pPatchRec = (PPATMPATCHREC)RTAvloGCPtrGetBestFit(&pVM->patm.s.PatchLookupTreeHC->PatchTree, addr, true);
6244
6245	if (!pPatchRec \|\| PAGE_ADDRESS(pPatchRec->patch.pPrivInstrGC) != PAGE_ADDRESS(addr))
6246	break;
6247
6248	if (pPatchRec && pPatchRec->patch.uState == PATCH_ENABLED)
6249	{
6250	STAM_COUNTER_INC(&pVM->patm.s.StatMonitored);
6251	Log(("Renewing patch at %VGv\n", pPatchRec->patch.pPrivInstrGC));
6252	PATMR3DisablePatch(pVM, pPatchRec->patch.pPrivInstrGC);
6253	PATMR3EnablePatch(pVM, pPatchRec->patch.pPrivInstrGC);
6254	}
6255	addr = pPatchRec->patch.pPrivInstrGC + 1;
6256	}
6257
6258	pVM->patm.s.pvFaultMonitor = 0;
6259	return VINF_SUCCESS;
6260	}
6261
6262
6263	#ifdef VBOX_WITH_STATISTICS
6264
6265	static const char *PATMPatchType(PVM pVM, PPATCHINFO pPatch)
6266	{
6267	if (pPatch->flags & PATMFL_SYSENTER)
6268	{
6269	return "SYSENT";
6270	}
6271	else
6272	if (pPatch->flags & (PATMFL_TRAPHANDLER\|PATMFL_INTHANDLER))
6273	{
6274	static char szTrap[16];
6275	uint32_t iGate;
6276
6277	iGate = TRPMR3QueryGateByHandler(pVM, PATCHCODE_PTR_GC(pPatch));
6278	if (iGate < 256)
6279	RTStrPrintf(szTrap, sizeof(szTrap), (pPatch->flags & PATMFL_INTHANDLER) ? "INT-%2X" : "TRAP-%2X", iGate);
6280	else
6281	RTStrPrintf(szTrap, sizeof(szTrap), (pPatch->flags & PATMFL_INTHANDLER) ? "INT-??" : "TRAP-??");
6282	return szTrap;
6283	}
6284	else
6285	if (pPatch->flags & (PATMFL_DUPLICATE_FUNCTION))
6286	return "DUPFUNC";
6287	else
6288	if (pPatch->flags & PATMFL_REPLACE_FUNCTION_CALL)
6289	return "FUNCCALL";
6290	else
6291	if (pPatch->flags & PATMFL_TRAMPOLINE)
6292	return "TRAMP";
6293	else
6294	return patmGetInstructionString(pPatch->opcode, pPatch->flags);
6295	}
6296
6297	static const char *PATMPatchState(PVM pVM, PPATCHINFO pPatch)
6298	{
6299	switch(pPatch->uState)
6300	{
6301	case PATCH_ENABLED:
6302	return "ENA";
6303	case PATCH_DISABLED:
6304	return "DIS";
6305	case PATCH_DIRTY:
6306	return "DIR";
6307	case PATCH_UNUSABLE:
6308	return "UNU";
6309	case PATCH_REFUSED:
6310	return "REF";
6311	case PATCH_DISABLE_PENDING:
6312	return "DIP";
6313	default:
6314	AssertFailed();
6315	return " ";
6316	}
6317	}
6318
6319	/**
6320	* Resets the sample.
6321	* @param pVM The VM handle.
6322	* @param pvSample The sample registered using STAMR3RegisterCallback.
6323	*/
6324	static void patmResetStat(PVM pVM, void *pvSample)
6325	{
6326	PPATCHINFO pPatch = (PPATCHINFO)pvSample;
6327	Assert(pPatch);
6328
6329	pVM->patm.s.pStatsHC[pPatch->uPatchIdx].u32A = 0;
6330	pVM->patm.s.pStatsHC[pPatch->uPatchIdx].u32B = 0;
6331	}
6332
6333	/**
6334	* Prints the sample into the buffer.
6335	*
6336	* @param pVM The VM handle.
6337	* @param pvSample The sample registered using STAMR3RegisterCallback.
6338	* @param pszBuf The buffer to print into.
6339	* @param cchBuf The size of the buffer.
6340	*/
6341	static void patmPrintStat(PVM pVM, void pvSample, char pszBuf, size_t cchBuf)
6342	{
6343	PPATCHINFO pPatch = (PPATCHINFO)pvSample;
6344	Assert(pPatch);
6345
6346	Assert(pPatch->uState != PATCH_REFUSED);
6347	Assert(!(pPatch->flags & (PATMFL_REPLACE_FUNCTION_CALL\|PATMFL_MMIO_ACCESS)));
6348
6349	RTStrPrintf(pszBuf, cchBuf, "size %04x ->%3s %8s - %08d - %08d",
6350	pPatch->cbPatchBlockSize, PATMPatchState(pVM, pPatch), PATMPatchType(pVM, pPatch),
6351	pVM->patm.s.pStatsHC[pPatch->uPatchIdx].u32A, pVM->patm.s.pStatsHC[pPatch->uPatchIdx].u32B);
6352	}
6353
6354	/**
6355	* Returns the GC address of the corresponding patch statistics counter
6356	*
6357	* @returns Stat address
6358	* @param pVM The VM to operate on.
6359	* @param pPatch Patch structure
6360	*/
6361	RTGCPTR patmPatchQueryStatAddress(PVM pVM, PPATCHINFO pPatch)
6362	{
6363	Assert(pPatch->uPatchIdx != PATM_STAT_INDEX_NONE);
6364	return pVM->patm.s.pStatsGC + sizeof(STAMRATIOU32) * pPatch->uPatchIdx + RT_OFFSETOF(STAMRATIOU32, u32A);
6365	}
6366
6367	#endif /* VBOX_WITH_STATISTICS */
6368
6369	#ifdef VBOX_WITH_DEBUGGER
6370	/**
6371	* The '.patmoff' command.
6372	*
6373	* @returns VBox status.
6374	* @param pCmd Pointer to the command descriptor (as registered).
6375	* @param pCmdHlp Pointer to command helper functions.
6376	* @param pVM Pointer to the current VM (if any).
6377	* @param paArgs Pointer to (readonly) array of arguments.
6378	* @param cArgs Number of arguments in the array.
6379	*/
6380	static DECLCALLBACK(int) patmr3CmdOff(PCDBGCCMD pCmd, PDBGCCMDHLP pCmdHlp, PVM pVM, PCDBGCVAR paArgs, unsigned cArgs, PDBGCVAR pResult)
6381	{
6382	/*
6383	* Validate input.
6384	*/
6385	if (!pVM)
6386	return pCmdHlp->pfnPrintf(pCmdHlp, NULL, "error: The command requires VM to be selected.\n");
6387
6388	RTAvloGCPtrDoWithAll(&pVM->patm.s.PatchLookupTreeHC->PatchTree, true, DisableAllPatches, pVM);
6389	PATMR3AllowPatching(pVM, false);
6390	return pCmdHlp->pfnPrintf(pCmdHlp, NULL, "Patching disabled\n");
6391	}
6392
6393	/**
6394	* The '.patmon' command.
6395	*
6396	* @returns VBox status.
6397	* @param pCmd Pointer to the command descriptor (as registered).
6398	* @param pCmdHlp Pointer to command helper functions.
6399	* @param pVM Pointer to the current VM (if any).
6400	* @param paArgs Pointer to (readonly) array of arguments.
6401	* @param cArgs Number of arguments in the array.
6402	*/
6403	static DECLCALLBACK(int) patmr3CmdOn(PCDBGCCMD pCmd, PDBGCCMDHLP pCmdHlp, PVM pVM, PCDBGCVAR paArgs, unsigned cArgs, PDBGCVAR pResult)
6404	{
6405	/*
6406	* Validate input.
6407	*/
6408	if (!pVM)
6409	return pCmdHlp->pfnPrintf(pCmdHlp, NULL, "error: The command requires VM to be selected.\n");
6410
6411	PATMR3AllowPatching(pVM, true);
6412	RTAvloGCPtrDoWithAll(&pVM->patm.s.PatchLookupTreeHC->PatchTree, true, EnableAllPatches, pVM);
6413	return pCmdHlp->pfnPrintf(pCmdHlp, NULL, "Patching enabled\n");
6414	}
6415	#endif

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/PATM/PATM.cpp@ 9026

Download in other formats: