PATMSSM.cpp@ 77758

Last change on this file since 77758 was 76553, checked in by vboxsync, 6 years ago
scm --update-copyright-year
Property svn:eol-style set to `native` Property svn:keywords set to `Id Revision`
File size: 71.7 KB

Line
1	/* $Id: PATMSSM.cpp 76553 2019-01-01 01:45:53Z vboxsync $ */
2	/** @file
3	* PATMSSM - Dynamic Guest OS Patching Manager; Save and load state
4	*
5	* NOTE: CSAM assumes patch memory is never reused!!
6	*/
7
8	/*
9	* Copyright (C) 2006-2019 Oracle Corporation
10	*
11	* This file is part of VirtualBox Open Source Edition (OSE), as
12	* available from http://www.virtualbox.org. This file is free software;
13	* you can redistribute it and/or modify it under the terms of the GNU
14	* General Public License (GPL) as published by the Free Software
15	* Foundation, in version 2 as it comes in the "COPYING" file of the
16	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
17	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
18	*/
19
20
21	/*********************************************************************************************************************************
22	* Header Files *
23	*********************************************************************************************************************************/
24	#define LOG_GROUP LOG_GROUP_PATM
25	#include <VBox/vmm/patm.h>
26	#include <VBox/vmm/pdmapi.h>
27	#include <VBox/vmm/cpum.h>
28	#include <VBox/vmm/cpumctx-v1_6.h>
29	#include <VBox/vmm/mm.h>
30	#include <VBox/vmm/ssm.h>
31	#include <VBox/param.h>
32	#include <iprt/avl.h>
33	#include "PATMInternal.h"
34	#include "PATMPatch.h"
35	#include "PATMA.h"
36	#include <VBox/vmm/vm.h>
37	#include <VBox/vmm/csam.h>
38	#include <VBox/dbg.h>
39	#include <VBox/err.h>
40	#include <VBox/log.h>
41	#include <iprt/assert.h>
42	#include <iprt/asm.h>
43	#include <iprt/string.h>
44	#include <VBox/dis.h>
45	#include <VBox/disopcode.h>
46	#include <VBox/version.h>
47
48	/**
49	* Patch information - SSM version.
50	*
51	* the difference is the missing pTrampolinePatchesHead member
52	* to avoid changing the saved state version for now (will come later).
53	*/
54	typedef struct PATCHINFOSSM
55	{
56	uint32_t uState;
57	uint32_t uOldState;
58	DISCPUMODE uOpMode;
59
60	/* GC pointer of privileged instruction */
61	RCPTRTYPE(uint8_t *) pPrivInstrGC;
62	R3PTRTYPE(uint8_t ) unusedHC; /* @todo Can't remove due to structure size dependencies in saved states. */
63	uint8_t aPrivInstr[MAX_INSTR_SIZE];
64	uint32_t cbPrivInstr;
65	uint32_t opcode; //opcode for priv instr (OP_*)
66	uint32_t cbPatchJump; //patch jump size
67
68	/* Only valid for PATMFL_JUMP_CONFLICT patches */
69	RTRCPTR pPatchJumpDestGC;
70
71	RTGCUINTPTR32 pPatchBlockOffset;
72	uint32_t cbPatchBlockSize;
73	uint32_t uCurPatchOffset;
74	#if HC_ARCH_BITS == 64
75	uint32_t Alignment0; /*< Align flags correctly. /
76	#endif
77
78	uint64_t flags;
79
80	/**
81	* Lowest and highest patched GC instruction address. To optimize searches.
82	*/
83	RTRCPTR pInstrGCLowest;
84	RTRCPTR pInstrGCHighest;
85
86	/* Tree of fixup records for the patch. */
87	R3PTRTYPE(PAVLPVNODECORE) FixupTree;
88	uint32_t nrFixups;
89
90	/* Tree of jumps inside the generated patch code. */
91	uint32_t nrJumpRecs;
92	R3PTRTYPE(PAVLPVNODECORE) JumpTree;
93
94	/**
95	* Lookup trees for determining the corresponding guest address of an
96	* instruction in the patch block.
97	*/
98	R3PTRTYPE(PAVLU32NODECORE) Patch2GuestAddrTree;
99	R3PTRTYPE(PAVLU32NODECORE) Guest2PatchAddrTree;
100	uint32_t nrPatch2GuestRecs;
101	#if HC_ARCH_BITS == 64
102	uint32_t Alignment1;
103	#endif
104
105	/* Unused, but can't remove due to structure size dependencies in the saved state. */
106	PATMP2GLOOKUPREC_OBSOLETE unused;
107
108	/* Temporary information during patch creation. Don't waste hypervisor memory for this. */
109	R3PTRTYPE(PPATCHINFOTEMP) pTempInfo;
110
111	/* Count the number of writes to the corresponding guest code. */
112	uint32_t cCodeWrites;
113
114	/* Count the number of invalid writes to pages monitored for the patch. */
115	//some statistics to determine if we should keep this patch activated
116	uint32_t cTraps;
117
118	uint32_t cInvalidWrites;
119
120	// Index into the uPatchRun and uPatchTrap arrays (0..MAX_PATCHES-1)
121	uint32_t uPatchIdx;
122
123	/* First opcode byte, that's overwritten when a patch is marked dirty. */
124	uint8_t bDirtyOpcode;
125	uint8_t Alignment2[7]; /*< Align the structure size on a 8-byte boundary. /
126	} PATCHINFOSSM, *PPATCHINFOSSM;
127
128	/**
129	* Lookup record for patches - SSM version.
130	*/
131	typedef struct PATMPATCHRECSSM
132	{
133	/** The key is a GC virtual address. */
134	AVLOU32NODECORE Core;
135	/** The key is a patch offset. */
136	AVLOU32NODECORE CoreOffset;
137
138	PATCHINFOSSM patch;
139	} PATMPATCHRECSSM, *PPATMPATCHRECSSM;
140
141
142	/**
143	* Callback arguments.
144	*/
145	typedef struct PATMCALLBACKARGS
146	{
147	PVM pVM;
148	PSSMHANDLE pSSM;
149	PPATMPATCHREC pPatchRec;
150	} PATMCALLBACKARGS;
151	typedef PATMCALLBACKARGS *PPATMCALLBACKARGS;
152
153
154	/*********************************************************************************************************************************
155	* Internal Functions *
156	*********************************************************************************************************************************/
157	static int patmCorrectFixup(PVM pVM, unsigned ulSSMVersion, PATM &patmInfo, PPATCHINFO pPatch, PRELOCREC pRec,
158	int32_t offset, RTRCPTR *pFixup);
159
160
161	/*********************************************************************************************************************************
162	* Global Variables *
163	*********************************************************************************************************************************/
164	/**
165	* SSM descriptor table for the PATM structure.
166	*/
167	static SSMFIELD const g_aPatmFields[] =
168	{
169	/** @todo there are a bunch more fields here which can be marked as ignored. */
170	SSMFIELD_ENTRY_IGNORE( PATM, offVM),
171	SSMFIELD_ENTRY_RCPTR( PATM, pPatchMemGC),
172	SSMFIELD_ENTRY_IGN_HCPTR( PATM, pPatchMemHC),
173	SSMFIELD_ENTRY( PATM, cbPatchMem),
174	SSMFIELD_ENTRY( PATM, offPatchMem),
175	SSMFIELD_ENTRY( PATM, fOutOfMemory),
176	SSMFIELD_ENTRY_PAD_HC_AUTO( 3, 3),
177	SSMFIELD_ENTRY( PATM, deltaReloc),
178	SSMFIELD_ENTRY_IGN_HCPTR( PATM, pGCStateHC),
179	SSMFIELD_ENTRY_RCPTR( PATM, pGCStateGC),
180	SSMFIELD_ENTRY_RCPTR( PATM, pGCStackGC),
181	SSMFIELD_ENTRY_IGN_HCPTR( PATM, pGCStackHC),
182	SSMFIELD_ENTRY_RCPTR( PATM, pCPUMCtxGC),
183	SSMFIELD_ENTRY_RCPTR( PATM, pStatsGC),
184	SSMFIELD_ENTRY_IGN_HCPTR( PATM, pStatsHC),
185	SSMFIELD_ENTRY( PATM, uCurrentPatchIdx),
186	SSMFIELD_ENTRY( PATM, ulCallDepth),
187	SSMFIELD_ENTRY( PATM, cPageRecords),
188	SSMFIELD_ENTRY_RCPTR( PATM, pPatchedInstrGCLowest),
189	SSMFIELD_ENTRY_RCPTR( PATM, pPatchedInstrGCHighest),
190	SSMFIELD_ENTRY_RCPTR( PATM, PatchLookupTreeGC),
191	SSMFIELD_ENTRY_IGN_HCPTR( PATM, PatchLookupTreeHC),
192	SSMFIELD_ENTRY_RCPTR( PATM, pfnHelperCallGC),
193	SSMFIELD_ENTRY_RCPTR( PATM, pfnHelperRetGC),
194	SSMFIELD_ENTRY_RCPTR( PATM, pfnHelperJumpGC),
195	SSMFIELD_ENTRY_RCPTR( PATM, pfnHelperIretGC),
196	SSMFIELD_ENTRY_IGN_HCPTR( PATM, pGlobalPatchRec),
197	SSMFIELD_ENTRY_RCPTR( PATM, pfnSysEnterGC),
198	SSMFIELD_ENTRY_RCPTR( PATM, pfnSysEnterPatchGC),
199	SSMFIELD_ENTRY( PATM, uSysEnterPatchIdx),
200	SSMFIELD_ENTRY_RCPTR( PATM, pvFaultMonitor),
201	SSMFIELD_ENTRY_GCPHYS( PATM, mmio.GCPhys),
202	SSMFIELD_ENTRY_RCPTR( PATM, mmio.pCachedData),
203	SSMFIELD_ENTRY_IGN_RCPTR( PATM, mmio.Alignment0),
204	SSMFIELD_ENTRY_IGN_HCPTR( PATM, savedstate.pSSM),
205	SSMFIELD_ENTRY( PATM, savedstate.cPatches),
206	SSMFIELD_ENTRY_PAD_HC64( PATM, savedstate.Alignment0, sizeof(uint32_t)),
207	SSMFIELD_ENTRY_IGNORE( PATM, StatNrOpcodeRead),
208	SSMFIELD_ENTRY_IGNORE( PATM, StatDisabled),
209	SSMFIELD_ENTRY_IGNORE( PATM, StatUnusable),
210	SSMFIELD_ENTRY_IGNORE( PATM, StatEnabled),
211	SSMFIELD_ENTRY_IGNORE( PATM, StatInstalled),
212	SSMFIELD_ENTRY_IGNORE( PATM, StatInstalledFunctionPatches),
213	SSMFIELD_ENTRY_IGNORE( PATM, StatInstalledTrampoline),
214	SSMFIELD_ENTRY_IGNORE( PATM, StatInstalledJump),
215	SSMFIELD_ENTRY_IGNORE( PATM, StatInt3Callable),
216	SSMFIELD_ENTRY_IGNORE( PATM, StatInt3BlockRun),
217	SSMFIELD_ENTRY_IGNORE( PATM, StatOverwritten),
218	SSMFIELD_ENTRY_IGNORE( PATM, StatFixedConflicts),
219	SSMFIELD_ENTRY_IGNORE( PATM, StatFlushed),
220	SSMFIELD_ENTRY_IGNORE( PATM, StatPageBoundaryCrossed),
221	SSMFIELD_ENTRY_IGNORE( PATM, StatMonitored),
222	SSMFIELD_ENTRY_IGNORE( PATM, StatHandleTrap),
223	SSMFIELD_ENTRY_IGNORE( PATM, StatSwitchBack),
224	SSMFIELD_ENTRY_IGNORE( PATM, StatSwitchBackFail),
225	SSMFIELD_ENTRY_IGNORE( PATM, StatPATMMemoryUsed),
226	SSMFIELD_ENTRY_IGNORE( PATM, StatDuplicateREQSuccess),
227	SSMFIELD_ENTRY_IGNORE( PATM, StatDuplicateREQFailed),
228	SSMFIELD_ENTRY_IGNORE( PATM, StatDuplicateUseExisting),
229	SSMFIELD_ENTRY_IGNORE( PATM, StatFunctionFound),
230	SSMFIELD_ENTRY_IGNORE( PATM, StatFunctionNotFound),
231	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchWrite),
232	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchWriteDetect),
233	SSMFIELD_ENTRY_IGNORE( PATM, StatDirty),
234	SSMFIELD_ENTRY_IGNORE( PATM, StatPushTrap),
235	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchWriteInterpreted),
236	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchWriteInterpretedFailed),
237	SSMFIELD_ENTRY_IGNORE( PATM, StatSysEnter),
238	SSMFIELD_ENTRY_IGNORE( PATM, StatSysExit),
239	SSMFIELD_ENTRY_IGNORE( PATM, StatEmulIret),
240	SSMFIELD_ENTRY_IGNORE( PATM, StatEmulIretFailed),
241	SSMFIELD_ENTRY_IGNORE( PATM, StatInstrDirty),
242	SSMFIELD_ENTRY_IGNORE( PATM, StatInstrDirtyGood),
243	SSMFIELD_ENTRY_IGNORE( PATM, StatInstrDirtyBad),
244	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchPageInserted),
245	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchPageRemoved),
246	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchRefreshSuccess),
247	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchRefreshFailed),
248	SSMFIELD_ENTRY_IGNORE( PATM, StatGenRet),
249	SSMFIELD_ENTRY_IGNORE( PATM, StatGenRetReused),
250	SSMFIELD_ENTRY_IGNORE( PATM, StatGenJump),
251	SSMFIELD_ENTRY_IGNORE( PATM, StatGenCall),
252	SSMFIELD_ENTRY_IGNORE( PATM, StatGenPopf),
253	SSMFIELD_ENTRY_IGNORE( PATM, StatCheckPendingIRQ),
254	SSMFIELD_ENTRY_IGNORE( PATM, StatFunctionLookupReplace),
255	SSMFIELD_ENTRY_IGNORE( PATM, StatFunctionLookupInsert),
256	SSMFIELD_ENTRY_IGNORE( PATM, StatU32FunctionMaxSlotsUsed),
257	SSMFIELD_ENTRY_IGNORE( PATM, Alignment0),
258	SSMFIELD_ENTRY_TERM()
259	};
260
261	/**
262	* SSM descriptor table for the PATM structure starting with r86139.
263	*/
264	static SSMFIELD const g_aPatmFields86139[] =
265	{
266	/** @todo there are a bunch more fields here which can be marked as ignored. */
267	SSMFIELD_ENTRY_IGNORE( PATM, offVM),
268	SSMFIELD_ENTRY_RCPTR( PATM, pPatchMemGC),
269	SSMFIELD_ENTRY_IGN_HCPTR( PATM, pPatchMemHC),
270	SSMFIELD_ENTRY( PATM, cbPatchMem),
271	SSMFIELD_ENTRY( PATM, offPatchMem),
272	SSMFIELD_ENTRY( PATM, fOutOfMemory),
273	SSMFIELD_ENTRY_PAD_HC_AUTO( 3, 3),
274	SSMFIELD_ENTRY( PATM, deltaReloc),
275	SSMFIELD_ENTRY_IGN_HCPTR( PATM, pGCStateHC),
276	SSMFIELD_ENTRY_RCPTR( PATM, pGCStateGC),
277	SSMFIELD_ENTRY_RCPTR( PATM, pGCStackGC),
278	SSMFIELD_ENTRY_IGN_HCPTR( PATM, pGCStackHC),
279	SSMFIELD_ENTRY_RCPTR( PATM, pCPUMCtxGC),
280	SSMFIELD_ENTRY_RCPTR( PATM, pStatsGC),
281	SSMFIELD_ENTRY_IGN_HCPTR( PATM, pStatsHC),
282	SSMFIELD_ENTRY( PATM, uCurrentPatchIdx),
283	SSMFIELD_ENTRY( PATM, ulCallDepth),
284	SSMFIELD_ENTRY( PATM, cPageRecords),
285	SSMFIELD_ENTRY_RCPTR( PATM, pPatchedInstrGCLowest),
286	SSMFIELD_ENTRY_RCPTR( PATM, pPatchedInstrGCHighest),
287	SSMFIELD_ENTRY_RCPTR( PATM, PatchLookupTreeGC),
288	SSMFIELD_ENTRY_IGN_HCPTR( PATM, PatchLookupTreeHC),
289	SSMFIELD_ENTRY_RCPTR( PATM, pfnHelperCallGC),
290	SSMFIELD_ENTRY_RCPTR( PATM, pfnHelperRetGC),
291	SSMFIELD_ENTRY_RCPTR( PATM, pfnHelperJumpGC),
292	SSMFIELD_ENTRY_RCPTR( PATM, pfnHelperIretGC),
293	SSMFIELD_ENTRY_IGN_HCPTR( PATM, pGlobalPatchRec),
294	SSMFIELD_ENTRY_RCPTR( PATM, pfnSysEnterGC),
295	SSMFIELD_ENTRY_RCPTR( PATM, pfnSysEnterPatchGC),
296	SSMFIELD_ENTRY( PATM, uSysEnterPatchIdx),
297	SSMFIELD_ENTRY_RCPTR( PATM, pvFaultMonitor),
298	SSMFIELD_ENTRY_GCPHYS( PATM, mmio.GCPhys),
299	SSMFIELD_ENTRY_RCPTR( PATM, mmio.pCachedData),
300	SSMFIELD_ENTRY_IGN_RCPTR( PATM, mmio.Alignment0),
301	SSMFIELD_ENTRY_IGN_HCPTR( PATM, savedstate.pSSM),
302	SSMFIELD_ENTRY( PATM, savedstate.cPatches),
303	SSMFIELD_ENTRY_PAD_HC64( PATM, savedstate.Alignment0, sizeof(uint32_t)),
304	SSMFIELD_ENTRY_IGN_HCPTR( PATM, hDbgModPatchMem),
305	SSMFIELD_ENTRY_PAD_HC32( PATM, Alignment0, sizeof(uint32_t)),
306	SSMFIELD_ENTRY_IGNORE( PATM, StatNrOpcodeRead),
307	SSMFIELD_ENTRY_IGNORE( PATM, StatDisabled),
308	SSMFIELD_ENTRY_IGNORE( PATM, StatUnusable),
309	SSMFIELD_ENTRY_IGNORE( PATM, StatEnabled),
310	SSMFIELD_ENTRY_IGNORE( PATM, StatInstalled),
311	SSMFIELD_ENTRY_IGNORE( PATM, StatInstalledFunctionPatches),
312	SSMFIELD_ENTRY_IGNORE( PATM, StatInstalledTrampoline),
313	SSMFIELD_ENTRY_IGNORE( PATM, StatInstalledJump),
314	SSMFIELD_ENTRY_IGNORE( PATM, StatInt3Callable),
315	SSMFIELD_ENTRY_IGNORE( PATM, StatInt3BlockRun),
316	SSMFIELD_ENTRY_IGNORE( PATM, StatOverwritten),
317	SSMFIELD_ENTRY_IGNORE( PATM, StatFixedConflicts),
318	SSMFIELD_ENTRY_IGNORE( PATM, StatFlushed),
319	SSMFIELD_ENTRY_IGNORE( PATM, StatPageBoundaryCrossed),
320	SSMFIELD_ENTRY_IGNORE( PATM, StatMonitored),
321	SSMFIELD_ENTRY_IGNORE( PATM, StatHandleTrap),
322	SSMFIELD_ENTRY_IGNORE( PATM, StatSwitchBack),
323	SSMFIELD_ENTRY_IGNORE( PATM, StatSwitchBackFail),
324	SSMFIELD_ENTRY_IGNORE( PATM, StatPATMMemoryUsed),
325	SSMFIELD_ENTRY_IGNORE( PATM, StatDuplicateREQSuccess),
326	SSMFIELD_ENTRY_IGNORE( PATM, StatDuplicateREQFailed),
327	SSMFIELD_ENTRY_IGNORE( PATM, StatDuplicateUseExisting),
328	SSMFIELD_ENTRY_IGNORE( PATM, StatFunctionFound),
329	SSMFIELD_ENTRY_IGNORE( PATM, StatFunctionNotFound),
330	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchWrite),
331	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchWriteDetect),
332	SSMFIELD_ENTRY_IGNORE( PATM, StatDirty),
333	SSMFIELD_ENTRY_IGNORE( PATM, StatPushTrap),
334	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchWriteInterpreted),
335	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchWriteInterpretedFailed),
336	SSMFIELD_ENTRY_IGNORE( PATM, StatSysEnter),
337	SSMFIELD_ENTRY_IGNORE( PATM, StatSysExit),
338	SSMFIELD_ENTRY_IGNORE( PATM, StatEmulIret),
339	SSMFIELD_ENTRY_IGNORE( PATM, StatEmulIretFailed),
340	SSMFIELD_ENTRY_IGNORE( PATM, StatInstrDirty),
341	SSMFIELD_ENTRY_IGNORE( PATM, StatInstrDirtyGood),
342	SSMFIELD_ENTRY_IGNORE( PATM, StatInstrDirtyBad),
343	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchPageInserted),
344	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchPageRemoved),
345	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchRefreshSuccess),
346	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchRefreshFailed),
347	SSMFIELD_ENTRY_IGNORE( PATM, StatGenRet),
348	SSMFIELD_ENTRY_IGNORE( PATM, StatGenRetReused),
349	SSMFIELD_ENTRY_IGNORE( PATM, StatGenJump),
350	SSMFIELD_ENTRY_IGNORE( PATM, StatGenCall),
351	SSMFIELD_ENTRY_IGNORE( PATM, StatGenPopf),
352	SSMFIELD_ENTRY_IGNORE( PATM, StatCheckPendingIRQ),
353	SSMFIELD_ENTRY_IGNORE( PATM, StatFunctionLookupReplace),
354	SSMFIELD_ENTRY_IGNORE( PATM, StatFunctionLookupInsert),
355	SSMFIELD_ENTRY_IGNORE( PATM, StatU32FunctionMaxSlotsUsed),
356	SSMFIELD_ENTRY_IGNORE( PATM, Alignment0),
357	SSMFIELD_ENTRY_TERM()
358	};
359
360	/**
361	* SSM descriptor table for the PATMGCSTATE structure.
362	*/
363	static SSMFIELD const g_aPatmGCStateFields[] =
364	{
365	SSMFIELD_ENTRY( PATMGCSTATE, uVMFlags),
366	SSMFIELD_ENTRY( PATMGCSTATE, uPendingAction),
367	SSMFIELD_ENTRY( PATMGCSTATE, uPatchCalls),
368	SSMFIELD_ENTRY( PATMGCSTATE, uScratch),
369	SSMFIELD_ENTRY( PATMGCSTATE, uIretEFlags),
370	SSMFIELD_ENTRY( PATMGCSTATE, uIretCS),
371	SSMFIELD_ENTRY( PATMGCSTATE, uIretEIP),
372	SSMFIELD_ENTRY( PATMGCSTATE, Psp),
373	SSMFIELD_ENTRY( PATMGCSTATE, fPIF),
374	SSMFIELD_ENTRY_RCPTR( PATMGCSTATE, GCPtrInhibitInterrupts),
375	SSMFIELD_ENTRY_RCPTR( PATMGCSTATE, GCCallPatchTargetAddr),
376	SSMFIELD_ENTRY_RCPTR( PATMGCSTATE, GCCallReturnAddr),
377	SSMFIELD_ENTRY( PATMGCSTATE, Restore.uEAX),
378	SSMFIELD_ENTRY( PATMGCSTATE, Restore.uECX),
379	SSMFIELD_ENTRY( PATMGCSTATE, Restore.uEDI),
380	SSMFIELD_ENTRY( PATMGCSTATE, Restore.eFlags),
381	SSMFIELD_ENTRY( PATMGCSTATE, Restore.uFlags),
382	SSMFIELD_ENTRY_TERM()
383	};
384
385	/**
386	* SSM descriptor table for the PATMPATCHREC structure.
387	*/
388	static SSMFIELD const g_aPatmPatchRecFields[] =
389	{
390	SSMFIELD_ENTRY( PATMPATCHRECSSM, Core.Key),
391	SSMFIELD_ENTRY_IGNORE( PATMPATCHRECSSM, Core.pLeft),
392	SSMFIELD_ENTRY_IGNORE( PATMPATCHRECSSM, Core.pRight),
393	SSMFIELD_ENTRY_IGNORE( PATMPATCHRECSSM, Core.uchHeight),
394	SSMFIELD_ENTRY_PAD_HC_AUTO( 3, 3),
395	SSMFIELD_ENTRY( PATMPATCHRECSSM, CoreOffset.Key),
396	SSMFIELD_ENTRY_IGNORE( PATMPATCHRECSSM, CoreOffset.pLeft),
397	SSMFIELD_ENTRY_IGNORE( PATMPATCHRECSSM, CoreOffset.pRight),
398	SSMFIELD_ENTRY_IGNORE( PATMPATCHRECSSM, CoreOffset.uchHeight),
399	SSMFIELD_ENTRY_PAD_HC_AUTO( 3, 3),
400	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.uState),
401	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.uOldState),
402	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.uOpMode),
403	SSMFIELD_ENTRY_RCPTR( PATMPATCHRECSSM, patch.pPrivInstrGC),
404	SSMFIELD_ENTRY_IGN_HCPTR( PATMPATCHRECSSM, patch.unusedHC),
405	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.aPrivInstr),
406	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.cbPrivInstr),
407	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.opcode),
408	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.cbPatchJump),
409	SSMFIELD_ENTRY_RCPTR( PATMPATCHRECSSM, patch.pPatchJumpDestGC),
410	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.pPatchBlockOffset),
411	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.cbPatchBlockSize),
412	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.uCurPatchOffset),
413	SSMFIELD_ENTRY_PAD_HC64( PATMPATCHRECSSM, patch.Alignment0, sizeof(uint32_t)),
414	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.flags),
415	SSMFIELD_ENTRY_RCPTR( PATMPATCHRECSSM, patch.pInstrGCLowest),
416	SSMFIELD_ENTRY_RCPTR( PATMPATCHRECSSM, patch.pInstrGCHighest),
417	SSMFIELD_ENTRY_IGN_HCPTR( PATMPATCHRECSSM, patch.FixupTree),
418	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.nrFixups),
419	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.nrJumpRecs), // should be zero?
420	SSMFIELD_ENTRY_IGN_HCPTR( PATMPATCHRECSSM, patch.JumpTree),
421	SSMFIELD_ENTRY_IGN_HCPTR( PATMPATCHRECSSM, patch.Patch2GuestAddrTree),
422	SSMFIELD_ENTRY_IGN_HCPTR( PATMPATCHRECSSM, patch.Guest2PatchAddrTree),
423	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.nrPatch2GuestRecs),
424	SSMFIELD_ENTRY_PAD_HC64( PATMPATCHRECSSM, patch.Alignment1, sizeof(uint32_t)),
425	SSMFIELD_ENTRY_IGN_HCPTR( PATMPATCHRECSSM, patch.unused.pPatchLocStartHC), // saved as zero
426	SSMFIELD_ENTRY_IGN_HCPTR( PATMPATCHRECSSM, patch.unused.pPatchLocEndHC), // ditto
427	SSMFIELD_ENTRY_IGN_RCPTR( PATMPATCHRECSSM, patch.unused.pGuestLoc), // ditto
428	SSMFIELD_ENTRY_IGNORE( PATMPATCHRECSSM, patch.unused.opsize), // ditto
429	SSMFIELD_ENTRY_IGN_HCPTR( PATMPATCHRECSSM, patch.pTempInfo),
430	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.cCodeWrites),
431	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.cTraps),
432	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.cInvalidWrites),
433	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.uPatchIdx),
434	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.bDirtyOpcode),
435	SSMFIELD_ENTRY_IGNORE( PATMPATCHRECSSM, patch.Alignment2),
436	SSMFIELD_ENTRY_TERM()
437	};
438
439	/**
440	* SSM descriptor table for the RELOCREC structure.
441	*/
442	static SSMFIELD const g_aPatmRelocRec[] =
443	{
444	SSMFIELD_ENTRY_HCPTR_HACK_U32( RELOCREC, Core.Key), // Used to store the relocation type
445	SSMFIELD_ENTRY_IGN_HCPTR( RELOCREC, Core.pLeft),
446	SSMFIELD_ENTRY_IGN_HCPTR( RELOCREC, Core.pRight),
447	SSMFIELD_ENTRY_IGNORE( RELOCREC, Core.uchHeight),
448	SSMFIELD_ENTRY_PAD_HC_AUTO( 3, 7),
449	SSMFIELD_ENTRY( RELOCREC, uType),
450	SSMFIELD_ENTRY_PAD_HC_AUTO( 0, 4),
451	SSMFIELD_ENTRY_HCPTR_HACK_U32( RELOCREC, pRelocPos), // converted to a patch member offset.
452	SSMFIELD_ENTRY_RCPTR( RELOCREC, pSource),
453	SSMFIELD_ENTRY_RCPTR( RELOCREC, pDest),
454	SSMFIELD_ENTRY_TERM()
455	};
456
457	/**
458	* SSM descriptor table for the RECPATCHTOGUEST structure.
459	*/
460	static SSMFIELD const g_aPatmRecPatchToGuest[] =
461	{
462	SSMFIELD_ENTRY( RECPATCHTOGUEST, Core.Key),
463	SSMFIELD_ENTRY_PAD_HC_AUTO( 0, 4),
464	SSMFIELD_ENTRY_IGN_HCPTR( RECPATCHTOGUEST, Core.pLeft),
465	SSMFIELD_ENTRY_IGN_HCPTR( RECPATCHTOGUEST, Core.pRight),
466	SSMFIELD_ENTRY_IGNORE( RECPATCHTOGUEST, Core.uchHeight),
467	SSMFIELD_ENTRY_PAD_HC_AUTO( 3, 7),
468	SSMFIELD_ENTRY_RCPTR( RECPATCHTOGUEST, pOrgInstrGC),
469	SSMFIELD_ENTRY( RECPATCHTOGUEST, enmType),
470	SSMFIELD_ENTRY( RECPATCHTOGUEST, fDirty),
471	SSMFIELD_ENTRY( RECPATCHTOGUEST, fJumpTarget),
472	SSMFIELD_ENTRY( RECPATCHTOGUEST, u8DirtyOpcode),
473	SSMFIELD_ENTRY_PAD_HC_AUTO( 1, 5),
474	SSMFIELD_ENTRY_TERM()
475	};
476
477	#ifdef VBOX_STRICT
478
479	/**
480	* Callback function for RTAvlPVDoWithAll
481	*
482	* Counts the number of patches in the tree
483	*
484	* @returns VBox status code.
485	* @param pNode Current node
486	* @param pcPatches Pointer to patch counter (uint32_t)
487	*/
488	static DECLCALLBACK(int) patmCountLeafPV(PAVLPVNODECORE pNode, void *pcPatches)
489	{
490	NOREF(pNode);
491	(uint32_t )pcPatches = (uint32_t )pcPatches + 1;
492	return VINF_SUCCESS;
493	}
494
495	/**
496	* Callback function for RTAvlU32DoWithAll
497	*
498	* Counts the number of patches in the tree
499	*
500	* @returns VBox status code.
501	* @param pNode Current node
502	* @param pcPatches Pointer to patch counter (uint32_t)
503	*/
504	static DECLCALLBACK(int) patmCountLeaf(PAVLU32NODECORE pNode, void *pcPatches)
505	{
506	NOREF(pNode);
507	(uint32_t )pcPatches = (uint32_t )pcPatches + 1;
508	return VINF_SUCCESS;
509	}
510
511	#endif /* VBOX_STRICT */
512
513	/**
514	* Callback function for RTAvloU32DoWithAll
515	*
516	* Counts the number of patches in the tree
517	*
518	* @returns VBox status code.
519	* @param pNode Current node
520	* @param pcPatches Pointer to patch counter
521	*/
522	static DECLCALLBACK(int) patmCountPatch(PAVLOU32NODECORE pNode, void *pcPatches)
523	{
524	NOREF(pNode);
525	(uint32_t )pcPatches = (uint32_t )pcPatches + 1;
526	return VINF_SUCCESS;
527	}
528
529	/**
530	* Callback function for RTAvlU32DoWithAll
531	*
532	* Saves all patch to guest lookup records.
533	*
534	* @returns VBox status code.
535	* @param pNode Current node
536	* @param pvUser Pointer to PATMCALLBACKARGS.
537	*/
538	static DECLCALLBACK(int) patmSaveP2GLookupRecords(PAVLU32NODECORE pNode, void *pvUser)
539	{
540	PPATMCALLBACKARGS pArgs = (PPATMCALLBACKARGS)pvUser;
541	PRECPATCHTOGUEST pPatchToGuestRec = (PRECPATCHTOGUEST)pNode;
542
543	/* Save the lookup record. */
544	int rc = SSMR3PutStructEx(pArgs->pSSM, pPatchToGuestRec, sizeof(RECPATCHTOGUEST), 0 /fFlags/,
545	&g_aPatmRecPatchToGuest[0], NULL);
546	AssertRCReturn(rc, rc);
547
548	return VINF_SUCCESS;
549	}
550
551	/**
552	* Callback function for RTAvlPVDoWithAll
553	*
554	* Saves all patch to guest lookup records.
555	*
556	* @returns VBox status code.
557	* @param pNode Current node
558	* @param pvUser Pointer to PATMCALLBACKARGS.
559	*/
560	static DECLCALLBACK(int) patmSaveFixupRecords(PAVLPVNODECORE pNode, void *pvUser)
561	{
562	PPATMCALLBACKARGS pArgs = (PPATMCALLBACKARGS)pvUser;
563	RELOCREC rec = *(PRELOCREC)pNode;
564
565	/* Convert pointer to an offset into patch memory. May not be applicable
566	to all fixup types, thus the UINT32_MAX. */
567	AssertMsg( rec.pRelocPos
568	\|\| ( rec.uType == FIXUP_REL_JMPTOPATCH
569	&& !(pArgs->pPatchRec->patch.flags & PATMFL_PATCHED_GUEST_CODE)),
570	("uState=%#x uType=%#x flags=%#RX64\n", pArgs->pPatchRec->patch.uState, rec.uType, pArgs->pPatchRec->patch.flags));
571	uintptr_t offRelocPos = (uintptr_t)rec.pRelocPos - (uintptr_t)pArgs->pVM->patm.s.pPatchMemHC;
572	if (offRelocPos > pArgs->pVM->patm.s.cbPatchMem)
573	offRelocPos = UINT32_MAX;
574	rec.pRelocPos = (uint8_t *)offRelocPos;
575
576	/* Zero rec.Core.Key since it's unused and may trigger SSM check due to the hack below. */
577	rec.Core.Key = 0;
578
579	/* Save the lookup record. */
580	int rc = SSMR3PutStructEx(pArgs->pSSM, &rec, sizeof(rec), 0 /fFlags/, &g_aPatmRelocRec[0], NULL);
581	AssertRCReturn(rc, rc);
582
583	return VINF_SUCCESS;
584	}
585
586	/**
587	* Converts a saved state patch record to the memory record.
588	*
589	* @returns nothing.
590	* @param pPatch The memory record.
591	* @param pPatchSSM The SSM version of the patch record.
592	*/
593	static void patmR3PatchConvertSSM2Mem(PPATMPATCHREC pPatch, PPATMPATCHRECSSM pPatchSSM)
594	{
595	/*
596	* Only restore the patch part of the tree record; not the internal data (except the key of course)
597	*/
598	pPatch->Core.Key = pPatchSSM->Core.Key;
599	pPatch->CoreOffset.Key = pPatchSSM->CoreOffset.Key;
600	pPatch->patch.uState = pPatchSSM->patch.uState;
601	pPatch->patch.uOldState = pPatchSSM->patch.uOldState;
602	pPatch->patch.uOpMode = pPatchSSM->patch.uOpMode;
603	pPatch->patch.pPrivInstrGC = pPatchSSM->patch.pPrivInstrGC;
604	pPatch->patch.unusedHC = pPatchSSM->patch.unusedHC;
605	memcpy(&pPatch->patch.aPrivInstr[0], &pPatchSSM->patch.aPrivInstr[0], MAX_INSTR_SIZE);
606	pPatch->patch.cbPrivInstr = pPatchSSM->patch.cbPrivInstr;
607	pPatch->patch.opcode = pPatchSSM->patch.opcode;
608	pPatch->patch.cbPatchJump = pPatchSSM->patch.cbPatchJump;
609	pPatch->patch.pPatchJumpDestGC = pPatchSSM->patch.pPatchJumpDestGC;
610	pPatch->patch.pPatchBlockOffset = pPatchSSM->patch.pPatchBlockOffset;
611	pPatch->patch.cbPatchBlockSize = pPatchSSM->patch.cbPatchBlockSize;
612	pPatch->patch.uCurPatchOffset = pPatchSSM->patch.uCurPatchOffset;
613	pPatch->patch.flags = pPatchSSM->patch.flags;
614	pPatch->patch.pInstrGCLowest = pPatchSSM->patch.pInstrGCLowest;
615	pPatch->patch.pInstrGCHighest = pPatchSSM->patch.pInstrGCHighest;
616	pPatch->patch.FixupTree = pPatchSSM->patch.FixupTree;
617	pPatch->patch.nrFixups = pPatchSSM->patch.nrFixups;
618	pPatch->patch.nrJumpRecs = pPatchSSM->patch.nrJumpRecs;
619	pPatch->patch.JumpTree = pPatchSSM->patch.JumpTree;
620	pPatch->patch.Patch2GuestAddrTree = pPatchSSM->patch.Patch2GuestAddrTree;
621	pPatch->patch.Guest2PatchAddrTree = pPatchSSM->patch.Guest2PatchAddrTree;
622	pPatch->patch.nrPatch2GuestRecs = pPatchSSM->patch.nrPatch2GuestRecs;
623	pPatch->patch.unused = pPatchSSM->patch.unused;
624	pPatch->patch.pTempInfo = pPatchSSM->patch.pTempInfo;
625	pPatch->patch.cCodeWrites = pPatchSSM->patch.cCodeWrites;
626	pPatch->patch.cTraps = pPatchSSM->patch.cTraps;
627	pPatch->patch.cInvalidWrites = pPatchSSM->patch.cInvalidWrites;
628	pPatch->patch.uPatchIdx = pPatchSSM->patch.uPatchIdx;
629	pPatch->patch.bDirtyOpcode = pPatchSSM->patch.bDirtyOpcode;
630	pPatch->patch.pTrampolinePatchesHead = NULL;
631	}
632
633	/**
634	* Converts a memory patch record to the saved state version.
635	*
636	* @returns nothing.
637	* @param pPatchSSM The saved state record.
638	* @param pPatch The memory version to save.
639	*/
640	static void patmR3PatchConvertMem2SSM(PPATMPATCHRECSSM pPatchSSM, PPATMPATCHREC pPatch)
641	{
642	pPatchSSM->Core = pPatch->Core;
643	pPatchSSM->CoreOffset = pPatch->CoreOffset;
644	pPatchSSM->patch.uState = pPatch->patch.uState;
645	pPatchSSM->patch.uOldState = pPatch->patch.uOldState;
646	pPatchSSM->patch.uOpMode = pPatch->patch.uOpMode;
647	pPatchSSM->patch.pPrivInstrGC = pPatch->patch.pPrivInstrGC;
648	pPatchSSM->patch.unusedHC = pPatch->patch.unusedHC;
649	memcpy(&pPatchSSM->patch.aPrivInstr[0], &pPatch->patch.aPrivInstr[0], MAX_INSTR_SIZE);
650	pPatchSSM->patch.cbPrivInstr = pPatch->patch.cbPrivInstr;
651	pPatchSSM->patch.opcode = pPatch->patch.opcode;
652	pPatchSSM->patch.cbPatchJump = pPatch->patch.cbPatchJump;
653	pPatchSSM->patch.pPatchJumpDestGC = pPatch->patch.pPatchJumpDestGC;
654	pPatchSSM->patch.pPatchBlockOffset = pPatch->patch.pPatchBlockOffset;
655	pPatchSSM->patch.cbPatchBlockSize = pPatch->patch.cbPatchBlockSize;
656	pPatchSSM->patch.uCurPatchOffset = pPatch->patch.uCurPatchOffset;
657	pPatchSSM->patch.flags = pPatch->patch.flags;
658	pPatchSSM->patch.pInstrGCLowest = pPatch->patch.pInstrGCLowest;
659	pPatchSSM->patch.pInstrGCHighest = pPatch->patch.pInstrGCHighest;
660	pPatchSSM->patch.FixupTree = pPatch->patch.FixupTree;
661	pPatchSSM->patch.nrFixups = pPatch->patch.nrFixups;
662	pPatchSSM->patch.nrJumpRecs = pPatch->patch.nrJumpRecs;
663	pPatchSSM->patch.JumpTree = pPatch->patch.JumpTree;
664	pPatchSSM->patch.Patch2GuestAddrTree = pPatch->patch.Patch2GuestAddrTree;
665	pPatchSSM->patch.Guest2PatchAddrTree = pPatch->patch.Guest2PatchAddrTree;
666	pPatchSSM->patch.nrPatch2GuestRecs = pPatch->patch.nrPatch2GuestRecs;
667	pPatchSSM->patch.unused = pPatch->patch.unused;
668	pPatchSSM->patch.pTempInfo = pPatch->patch.pTempInfo;
669	pPatchSSM->patch.cCodeWrites = pPatch->patch.cCodeWrites;
670	pPatchSSM->patch.cTraps = pPatch->patch.cTraps;
671	pPatchSSM->patch.cInvalidWrites = pPatch->patch.cInvalidWrites;
672	pPatchSSM->patch.uPatchIdx = pPatch->patch.uPatchIdx;
673	pPatchSSM->patch.bDirtyOpcode = pPatch->patch.bDirtyOpcode;
674	}
675
676	/**
677	* Callback function for RTAvloU32DoWithAll
678	*
679	* Saves the state of the patch that's being enumerated
680	*
681	* @returns VBox status code.
682	* @param pNode Current node
683	* @param pvUser Pointer to PATMCALLBACKARGS.
684	*/
685	static DECLCALLBACK(int) patmSavePatchState(PAVLOU32NODECORE pNode, void *pvUser)
686	{
687	PPATMCALLBACKARGS pArgs = (PPATMCALLBACKARGS)pvUser;
688	PPATMPATCHREC pPatch = (PPATMPATCHREC)pNode;
689	PATMPATCHRECSSM patch;
690	int rc;
691
692	pArgs->pPatchRec = pPatch;
693	Assert(!(pPatch->patch.flags & PATMFL_GLOBAL_FUNCTIONS));
694
695	patmR3PatchConvertMem2SSM(&patch, pPatch);
696	Log4(("patmSavePatchState: cbPatchJump=%u uCurPathOffset=%#x pInstrGCLowest/Higest=%#x/%#x nrFixups=%#x nrJumpRecs=%#x\n",
697	patch.patch.cbPatchJump, patch.patch.uCurPatchOffset, patch.patch.pInstrGCLowest, patch.patch.pInstrGCHighest,
698	patch.patch.nrFixups, patch.patch.nrJumpRecs));
699
700	/*
701	* Reset HC pointers that need to be recalculated when loading the state
702	*/
703	#ifdef VBOX_STRICT
704	PVM pVM = pArgs->pVM; /* For PATCHCODE_PTR_HC. */
705	AssertMsg(patch.patch.uState == PATCH_REFUSED \|\| (patch.patch.pPatchBlockOffset \|\| (patch.patch.flags & (PATMFL_SYSENTER_XP\|PATMFL_INT3_REPLACEMENT))),
706	("State = %x pPatchBlockHC=%08x flags=%x\n", patch.patch.uState, PATCHCODE_PTR_HC(&patch.patch), patch.patch.flags));
707	#endif
708	Assert(pPatch->patch.JumpTree == 0);
709	Assert(!pPatch->patch.pTempInfo \|\| pPatch->patch.pTempInfo->DisasmJumpTree == 0);
710	Assert(!pPatch->patch.pTempInfo \|\| pPatch->patch.pTempInfo->IllegalInstrTree == 0);
711
712	/* Save the patch record itself */
713	rc = SSMR3PutStructEx(pArgs->pSSM, &patch, sizeof(patch), 0 /fFlags/, &g_aPatmPatchRecFields[0], NULL);
714	AssertRCReturn(rc, rc);
715
716	/*
717	* Reset HC pointers in fixup records and save them.
718	*/
719	#ifdef VBOX_STRICT
720	uint32_t nrFixupRecs = 0;
721	RTAvlPVDoWithAll(&pPatch->patch.FixupTree, true, patmCountLeafPV, &nrFixupRecs);
722	AssertMsg(nrFixupRecs == pPatch->patch.nrFixups, ("Fixup inconsistency! counted %d vs %d\n", nrFixupRecs, pPatch->patch.nrFixups));
723	#endif
724	rc = RTAvlPVDoWithAll(&pPatch->patch.FixupTree, true, patmSaveFixupRecords, pArgs);
725	AssertRCReturn(rc, rc);
726
727	#ifdef VBOX_STRICT
728	uint32_t nrLookupRecords = 0;
729	RTAvlU32DoWithAll(&pPatch->patch.Patch2GuestAddrTree, true, patmCountLeaf, &nrLookupRecords);
730	Assert(nrLookupRecords == pPatch->patch.nrPatch2GuestRecs);
731	#endif
732
733	rc = RTAvlU32DoWithAll(&pPatch->patch.Patch2GuestAddrTree, true, patmSaveP2GLookupRecords, pArgs);
734	AssertRCReturn(rc, rc);
735
736	pArgs->pPatchRec = NULL;
737	return VINF_SUCCESS;
738	}
739
740	/**
741	* Execute state save operation.
742	*
743	* @returns VBox status code.
744	* @param pVM The cross context VM structure.
745	* @param pSSM SSM operation handle.
746	*/
747	DECLCALLBACK(int) patmR3Save(PVM pVM, PSSMHANDLE pSSM)
748	{
749	PATM patmInfo = pVM->patm.s;
750	int rc;
751
752	pVM->patm.s.savedstate.pSSM = pSSM;
753
754	/*
755	* Reset HC pointers that need to be recalculated when loading the state
756	*/
757	patmInfo.pPatchMemHC = NULL;
758	patmInfo.pGCStateHC = 0;
759	patmInfo.pvFaultMonitor = 0;
760
761	Assert(patmInfo.ulCallDepth == 0);
762
763	/*
764	* Count the number of patches in the tree (feeling lazy)
765	*/
766	patmInfo.savedstate.cPatches = 0;
767	RTAvloU32DoWithAll(&pVM->patm.s.PatchLookupTreeHC->PatchTree, true, patmCountPatch, &patmInfo.savedstate.cPatches);
768
769	/*
770	* Save PATM structure
771	*/
772	rc = SSMR3PutStructEx(pSSM, &patmInfo, sizeof(patmInfo), 0 /fFlags/, &g_aPatmFields[0], NULL);
773	AssertRCReturn(rc, rc);
774
775	/*
776	* Save patch memory contents
777	*/
778	rc = SSMR3PutMem(pSSM, pVM->patm.s.pPatchMemHC, pVM->patm.s.cbPatchMem);
779	AssertRCReturn(rc, rc);
780
781	/*
782	* Save GC state memory
783	*/
784	rc = SSMR3PutStructEx(pSSM, pVM->patm.s.pGCStateHC, sizeof(PATMGCSTATE), 0 /fFlags/, &g_aPatmGCStateFields[0], NULL);
785	AssertRCReturn(rc, rc);
786
787	/*
788	* Save PATM stack page
789	*/
790	SSMR3PutU32(pSSM, PATM_STACK_TOTAL_SIZE);
791	rc = SSMR3PutMem(pSSM, pVM->patm.s.pGCStackHC, PATM_STACK_TOTAL_SIZE);
792	AssertRCReturn(rc, rc);
793
794	/*
795	* Save all patches
796	*/
797	PATMCALLBACKARGS Args;
798	Args.pVM = pVM;
799	Args.pSSM = pSSM;
800	rc = RTAvloU32DoWithAll(&pVM->patm.s.PatchLookupTreeHC->PatchTree, true, patmSavePatchState, &Args);
801	AssertRCReturn(rc, rc);
802
803	/* Note! Patch statistics are not saved. */
804
805	return VINF_SUCCESS;
806	}
807
808
809	/**
810	* Execute state load operation.
811	*
812	* @returns VBox status code.
813	* @param pVM The cross context VM structure.
814	* @param pSSM SSM operation handle.
815	* @param uVersion Data layout version.
816	* @param uPass The data pass.
817	*/
818	DECLCALLBACK(int) patmR3Load(PVM pVM, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass)
819	{
820	PATM patmInfo;
821	int rc;
822
823	if ( uVersion != PATM_SAVED_STATE_VERSION
824	&& uVersion != PATM_SAVED_STATE_VERSION_NO_RAW_MEM
825	&& uVersion != PATM_SAVED_STATE_VERSION_MEM
826	&& uVersion != PATM_SAVED_STATE_VERSION_FIXUP_HACK
827	&& uVersion != PATM_SAVED_STATE_VERSION_VER16
828	)
829	{
830	AssertMsgFailed(("patmR3Load: Invalid version uVersion=%d!\n", uVersion));
831	return VERR_SSM_UNSUPPORTED_DATA_UNIT_VERSION;
832	}
833	uint32_t const fStructRestoreFlags = uVersion <= PATM_SAVED_STATE_VERSION_MEM ? SSMSTRUCT_FLAGS_MEM_BAND_AID_RELAXED : 0;
834	Assert(uPass == SSM_PASS_FINAL); NOREF(uPass);
835
836	pVM->patm.s.savedstate.pSSM = pSSM;
837
838	/*
839	* Restore PATM structure
840	*/
841	RT_ZERO(patmInfo);
842	if ( uVersion == PATM_SAVED_STATE_VERSION_MEM
843	&& SSMR3HandleRevision(pSSM) >= 86139
844	&& SSMR3HandleVersion(pSSM) >= VBOX_FULL_VERSION_MAKE(4, 2, 51))
845	rc = SSMR3GetStructEx(pSSM, &patmInfo, sizeof(patmInfo), SSMSTRUCT_FLAGS_MEM_BAND_AID_RELAXED,
846	&g_aPatmFields86139[0], NULL);
847	else
848	rc = SSMR3GetStructEx(pSSM, &patmInfo, sizeof(patmInfo), fStructRestoreFlags, &g_aPatmFields[0], NULL);
849	AssertRCReturn(rc, rc);
850
851	/* Relative calls are made to the helper functions. Therefor their relative location must not change! */
852	/* Note: we reuse the saved global helpers and assume they are identical, which is kind of dangerous. */
853	AssertLogRelReturn((pVM->patm.s.pfnHelperCallGC - pVM->patm.s.pPatchMemGC) == (patmInfo.pfnHelperCallGC - patmInfo.pPatchMemGC),
854	VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
855	AssertLogRelReturn((pVM->patm.s.pfnHelperRetGC - pVM->patm.s.pPatchMemGC) == (patmInfo.pfnHelperRetGC - patmInfo.pPatchMemGC),
856	VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
857	AssertLogRelReturn((pVM->patm.s.pfnHelperJumpGC - pVM->patm.s.pPatchMemGC) == (patmInfo.pfnHelperJumpGC - patmInfo.pPatchMemGC),
858	VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
859	AssertLogRelReturn((pVM->patm.s.pfnHelperIretGC - pVM->patm.s.pPatchMemGC) == (patmInfo.pfnHelperIretGC - patmInfo.pPatchMemGC),
860	VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
861	AssertLogRelReturn(pVM->patm.s.cbPatchMem == patmInfo.cbPatchMem, VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
862
863	pVM->patm.s.offPatchMem = patmInfo.offPatchMem;
864	pVM->patm.s.deltaReloc = patmInfo.deltaReloc;
865	pVM->patm.s.uCurrentPatchIdx = patmInfo.uCurrentPatchIdx;
866	pVM->patm.s.fOutOfMemory = patmInfo.fOutOfMemory;
867
868	/* Lowest and highest patched instruction */
869	pVM->patm.s.pPatchedInstrGCLowest = patmInfo.pPatchedInstrGCLowest;
870	pVM->patm.s.pPatchedInstrGCHighest = patmInfo.pPatchedInstrGCHighest;
871
872	/* Sysenter handlers */
873	pVM->patm.s.pfnSysEnterGC = patmInfo.pfnSysEnterGC;
874	pVM->patm.s.pfnSysEnterPatchGC = patmInfo.pfnSysEnterPatchGC;
875	pVM->patm.s.uSysEnterPatchIdx = patmInfo.uSysEnterPatchIdx;
876
877	Assert(patmInfo.ulCallDepth == 0 && pVM->patm.s.ulCallDepth == 0);
878
879	Log(("pPatchMemGC %RRv vs old %RRv\n", pVM->patm.s.pPatchMemGC, patmInfo.pPatchMemGC));
880	Log(("pGCStateGC %RRv vs old %RRv\n", pVM->patm.s.pGCStateGC, patmInfo.pGCStateGC));
881	Log(("pGCStackGC %RRv vs old %RRv\n", pVM->patm.s.pGCStackGC, patmInfo.pGCStackGC));
882	Log(("pCPUMCtxGC %RRv vs old %RRv\n", pVM->patm.s.pCPUMCtxGC, patmInfo.pCPUMCtxGC));
883
884
885	/** @note patch statistics are not restored. */
886
887	/*
888	* Restore patch memory contents
889	*/
890	Log(("Restore patch memory: new %RRv old %RRv\n", pVM->patm.s.pPatchMemGC, patmInfo.pPatchMemGC));
891	rc = SSMR3GetMem(pSSM, pVM->patm.s.pPatchMemHC, pVM->patm.s.cbPatchMem);
892	AssertRCReturn(rc, rc);
893
894	/*
895	* Restore GC state memory
896	*/
897	RT_BZERO(pVM->patm.s.pGCStateHC, sizeof(PATMGCSTATE));
898	rc = SSMR3GetStructEx(pSSM, pVM->patm.s.pGCStateHC, sizeof(PATMGCSTATE), fStructRestoreFlags, &g_aPatmGCStateFields[0], NULL);
899	AssertRCReturn(rc, rc);
900
901	/*
902	* Restore PATM stack page
903	*/
904	uint32_t cbStack = PATM_STACK_TOTAL_SIZE;
905	if (uVersion > PATM_SAVED_STATE_VERSION_MEM)
906	{
907	rc = SSMR3GetU32(pSSM, &cbStack);
908	AssertRCReturn(rc, rc);
909	}
910	AssertCompile(!(PATM_STACK_TOTAL_SIZE & 31));
911	AssertLogRelMsgReturn(cbStack > 0 && cbStack <= PATM_STACK_TOTAL_SIZE && !(cbStack & 31),
912	("cbStack=%#x vs %#x", cbStack, PATM_STACK_TOTAL_SIZE),
913	VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
914	rc = SSMR3GetMem(pSSM, pVM->patm.s.pGCStackHC, cbStack);
915	AssertRCReturn(rc, rc);
916	if (cbStack < PATM_STACK_TOTAL_SIZE)
917	memset((uint8_t *)pVM->patm.s.pGCStackHC + cbStack, 0, PATM_STACK_TOTAL_SIZE - cbStack);
918
919	/*
920	* Load all patches
921	*/
922	for (unsigned i = 0; i < patmInfo.savedstate.cPatches; i++)
923	{
924	PATMPATCHRECSSM patch;
925	PATMPATCHREC *pPatchRec;
926
927	RT_ZERO(patch);
928	rc = SSMR3GetStructEx(pSSM, &patch, sizeof(patch), fStructRestoreFlags, &g_aPatmPatchRecFields[0], NULL);
929	AssertRCReturn(rc, rc);
930	Log4(("patmR3Load: cbPatchJump=%u uCurPathOffset=%#x pInstrGCLowest/Higest=%#x/%#x nrFixups=%#x nrJumpRecs=%#x\n",
931	patch.patch.cbPatchJump, patch.patch.uCurPatchOffset, patch.patch.pInstrGCLowest, patch.patch.pInstrGCHighest,
932	patch.patch.nrFixups, patch.patch.nrJumpRecs));
933
934	Assert(!(patch.patch.flags & PATMFL_GLOBAL_FUNCTIONS));
935
936	rc = MMHyperAlloc(pVM, sizeof(PATMPATCHREC), 0, MM_TAG_PATM_PATCH, (void **)&pPatchRec);
937	if (RT_FAILURE(rc))
938	{
939	AssertMsgFailed(("Out of memory!!!!\n"));
940	return VERR_NO_MEMORY;
941	}
942
943	/* Convert SSM version to memory. */
944	patmR3PatchConvertSSM2Mem(pPatchRec, &patch);
945
946	Log(("Restoring patch %RRv -> %RRv state %x\n", pPatchRec->patch.pPrivInstrGC, patmInfo.pPatchMemGC + pPatchRec->patch.pPatchBlockOffset, pPatchRec->patch.uState));
947	bool ret = RTAvloU32Insert(&pVM->patm.s.PatchLookupTreeHC->PatchTree, &pPatchRec->Core);
948	Assert(ret);
949	if (pPatchRec->patch.uState != PATCH_REFUSED)
950	{
951	if (pPatchRec->patch.pPatchBlockOffset)
952	{
953	/* We actually generated code for this patch. */
954	ret = RTAvloU32Insert(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPatchAddr, &pPatchRec->CoreOffset);
955	AssertMsg(ret, ("Inserting patch %RRv offset %08RX32 failed!!\n", pPatchRec->patch.pPrivInstrGC, pPatchRec->CoreOffset.Key));
956	}
957	}
958	/* Set to zero as we don't need it anymore. */
959	pPatchRec->patch.pTempInfo = 0;
960
961	PATMP2GLOOKUPREC cacheRec;
962	RT_ZERO(cacheRec);
963	cacheRec.pPatch = &pPatchRec->patch;
964
965	uint8_t *pPrivInstrHC = patmR3GCVirtToHCVirt(pVM, &cacheRec, pPatchRec->patch.pPrivInstrGC);
966	/* Can fail due to page or page table not present. */
967
968	/*
969	* Restore fixup records and correct HC pointers in fixup records
970	*/
971	pPatchRec->patch.FixupTree = 0;
972	pPatchRec->patch.nrFixups = 0; /* increased by patmPatchAddReloc32 */
973	for (unsigned j = 0; j < patch.patch.nrFixups; j++)
974	{
975	RELOCREC rec;
976	int32_t offset;
977	RTRCPTR *pFixup;
978
979	RT_ZERO(rec);
980	rc = SSMR3GetStructEx(pSSM, &rec, sizeof(rec), fStructRestoreFlags, &g_aPatmRelocRec[0], NULL);
981	AssertRCReturn(rc, rc);
982
983	if (pPrivInstrHC)
984	{
985	/* rec.pRelocPos now contains the relative position inside the hypervisor area. */
986	offset = (int32_t)(intptr_t)rec.pRelocPos;
987	/* Convert to HC pointer again. */
988	if ((uintptr_t)rec.pRelocPos < pVM->patm.s.cbPatchMem)
989	rec.pRelocPos = pVM->patm.s.pPatchMemHC + (uintptr_t)rec.pRelocPos;
990	else
991	rec.pRelocPos = NULL;
992	pFixup = (RTRCPTR *)rec.pRelocPos;
993
994	if (pPatchRec->patch.uState != PATCH_REFUSED)
995	{
996	if ( rec.uType == FIXUP_REL_JMPTOPATCH
997	&& (pPatchRec->patch.flags & PATMFL_PATCHED_GUEST_CODE))
998	{
999	Assert(pPatchRec->patch.cbPatchJump == SIZEOF_NEARJUMP32 \|\| pPatchRec->patch.cbPatchJump == SIZEOF_NEAR_COND_JUMP32);
1000	unsigned offset2 = (pPatchRec->patch.cbPatchJump == SIZEOF_NEARJUMP32) ? 1 : 2;
1001
1002	rec.pRelocPos = pPrivInstrHC + offset2;
1003	pFixup = (RTRCPTR *)rec.pRelocPos;
1004	}
1005
1006	rc = patmCorrectFixup(pVM, uVersion, patmInfo, &pPatchRec->patch, &rec, offset, pFixup);
1007	AssertRCReturn(rc, rc);
1008	}
1009
1010	rc = patmPatchAddReloc32(pVM, &pPatchRec->patch, rec.pRelocPos, rec.uType, rec.pSource, rec.pDest);
1011	AssertRCReturn(rc, rc);
1012	}
1013	}
1014	/* Release previous lock if any. */
1015	if (cacheRec.Lock.pvMap)
1016	PGMPhysReleasePageMappingLock(pVM, &cacheRec.Lock);
1017
1018	/* And all patch to guest lookup records */
1019	Assert(pPatchRec->patch.nrPatch2GuestRecs \|\| pPatchRec->patch.uState == PATCH_REFUSED \|\| (pPatchRec->patch.flags & (PATMFL_SYSENTER_XP \| PATMFL_IDTHANDLER \| PATMFL_TRAPHANDLER \| PATMFL_INT3_REPLACEMENT)));
1020
1021	pPatchRec->patch.Patch2GuestAddrTree = 0;
1022	pPatchRec->patch.Guest2PatchAddrTree = 0;
1023	if (pPatchRec->patch.nrPatch2GuestRecs)
1024	{
1025	RECPATCHTOGUEST rec;
1026	uint32_t nrPatch2GuestRecs = pPatchRec->patch.nrPatch2GuestRecs;
1027
1028	pPatchRec->patch.nrPatch2GuestRecs = 0; /* incremented by patmr3AddP2GLookupRecord */
1029	for (uint32_t j=0;j<nrPatch2GuestRecs;j++)
1030	{
1031	RT_ZERO(rec);
1032	rc = SSMR3GetStructEx(pSSM, &rec, sizeof(rec), fStructRestoreFlags, &g_aPatmRecPatchToGuest[0], NULL);
1033	AssertRCReturn(rc, rc);
1034
1035	patmR3AddP2GLookupRecord(pVM, &pPatchRec->patch, (uintptr_t)rec.Core.Key + pVM->patm.s.pPatchMemHC, rec.pOrgInstrGC, rec.enmType, rec.fDirty);
1036	}
1037	Assert(pPatchRec->patch.Patch2GuestAddrTree);
1038	}
1039
1040	if (pPatchRec->patch.flags & PATMFL_CODE_MONITORED)
1041	{
1042	/* Insert the guest page lookup records (for detection self-modifying code) */
1043	rc = patmInsertPatchPages(pVM, &pPatchRec->patch);
1044	AssertRCReturn(rc, rc);
1045	}
1046
1047	#if 0 /* can fail def LOG_ENABLED */
1048	if ( pPatchRec->patch.uState != PATCH_REFUSED
1049	&& !(pPatchRec->patch.flags & PATMFL_INT3_REPLACEMENT))
1050	{
1051	pPatchRec->patch.pTempInfo = (PPATCHINFOTEMP)MMR3HeapAllocZ(pVM, MM_TAG_PATM_PATCH, sizeof(PATCHINFOTEMP));
1052	Log(("Patch code ----------------------------------------------------------\n"));
1053	patmr3DisasmCodeStream(pVM, PATCHCODE_PTR_GC(&pPatchRec->patch), PATCHCODE_PTR_GC(&pPatchRec->patch), patmr3DisasmCallback, &pPatchRec->patch);
1054	Log(("Patch code ends -----------------------------------------------------\n"));
1055	MMR3HeapFree(pPatchRec->patch.pTempInfo);
1056	pPatchRec->patch.pTempInfo = NULL;
1057	}
1058	#endif
1059	/* Remove the patch in case the gc mapping is not present. */
1060	if ( !pPrivInstrHC
1061	&& pPatchRec->patch.uState == PATCH_ENABLED)
1062	{
1063	Log(("Remove patch %RGv due to failed HC address translation\n", pPatchRec->patch.pPrivInstrGC));
1064	PATMR3RemovePatch(pVM, pPatchRec->patch.pPrivInstrGC);
1065	}
1066	}
1067
1068	/*
1069	* Correct absolute fixups in the global patch. (helper functions)
1070	* Bit of a mess. Uses the new patch record, but restored patch functions.
1071	*/
1072	PRELOCREC pRec = 0;
1073	AVLPVKEY key = 0;
1074
1075	Log(("Correct fixups in global helper functions\n"));
1076	while (true)
1077	{
1078	int32_t offset;
1079	RTRCPTR *pFixup;
1080
1081	/* Get the record that's closest from above */
1082	pRec = (PRELOCREC)RTAvlPVGetBestFit(&pVM->patm.s.pGlobalPatchRec->patch.FixupTree, key, true);
1083	if (pRec == 0)
1084	break;
1085
1086	key = (AVLPVKEY)(pRec->pRelocPos + 1); /* search for the next record during the next round. */
1087
1088	/* rec.pRelocPos now contains the relative position inside the hypervisor area. */
1089	offset = (int32_t)(pRec->pRelocPos - pVM->patm.s.pPatchMemHC);
1090	pFixup = (RTRCPTR *)pRec->pRelocPos;
1091
1092	/* Correct fixups that refer to PATM structures in the hypervisor region (their addresses might have changed). */
1093	rc = patmCorrectFixup(pVM, uVersion, patmInfo, &pVM->patm.s.pGlobalPatchRec->patch, pRec, offset, pFixup);
1094	AssertRCReturn(rc, rc);
1095	}
1096
1097	#ifdef VBOX_WITH_STATISTICS
1098	/*
1099	* Restore relevant old statistics
1100	*/
1101	pVM->patm.s.StatDisabled = patmInfo.StatDisabled;
1102	pVM->patm.s.StatUnusable = patmInfo.StatUnusable;
1103	pVM->patm.s.StatEnabled = patmInfo.StatEnabled;
1104	pVM->patm.s.StatInstalled = patmInfo.StatInstalled;
1105	#endif
1106
1107	return VINF_SUCCESS;
1108	}
1109
1110	/**
1111	* Correct fixups to predefined hypervisor PATM regions. (their addresses might have changed)
1112	*
1113	* @returns VBox status code.
1114	* @param pVM The cross context VM structure.
1115	* @param uVersion Saved state version.
1116	* @param patmInfo Saved PATM structure
1117	* @param pPatch Patch record
1118	* @param pRec Relocation record
1119	* @param offset Offset of referenced data/code
1120	* @param pFixup Fixup address
1121	*/
1122	static int patmCorrectFixup(PVM pVM, unsigned uVersion, PATM &patmInfo, PPATCHINFO pPatch, PRELOCREC pRec,
1123	int32_t offset, RTRCPTR *pFixup)
1124	{
1125	int32_t delta = pVM->patm.s.pPatchMemGC - patmInfo.pPatchMemGC;
1126	RT_NOREF1(offset);
1127
1128	switch (pRec->uType)
1129	{
1130	case FIXUP_ABSOLUTE:
1131	case FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL:
1132	{
1133	Assert( pRec->uType != PATM_SAVED_STATE_VERSION_NO_RAW_MEM
1134	\|\| (pRec->pSource == pRec->pDest && PATM_IS_ASMFIX(pRec->pSource)) );
1135
1136	/* bird: What is this for exactly? Only the MMIO fixups used to have pSource set. */
1137	if ( pRec->pSource
1138	&& !PATMIsPatchGCAddr(pVM, (RTRCUINTPTR)pRec->pSource)
1139	&& pRec->uType != FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL)
1140	break;
1141
1142	RTRCPTR const uFixup = *pFixup;
1143	if ( uFixup >= patmInfo.pGCStateGC
1144	&& uFixup < patmInfo.pGCStateGC + sizeof(PATMGCSTATE))
1145	{
1146	LogFlow(("Changing absolute GCState at %RRv from %RRv to %RRv\n", patmInfo.pPatchMemGC + offset, uFixup, (uFixup - patmInfo.pGCStateGC) + pVM->patm.s.pGCStateGC));
1147	*pFixup = (uFixup - patmInfo.pGCStateGC) + pVM->patm.s.pGCStateGC;
1148	}
1149	else if ( uFixup >= patmInfo.pCPUMCtxGC
1150	&& uFixup < patmInfo.pCPUMCtxGC + sizeof(CPUMCTX))
1151	{
1152	LogFlow(("Changing absolute CPUMCTX at %RRv from %RRv to %RRv\n", patmInfo.pPatchMemGC + offset, uFixup, (uFixup - patmInfo.pCPUMCtxGC) + pVM->patm.s.pCPUMCtxGC));
1153
1154	/* The CPUMCTX structure has completely changed, so correct the offsets too. */
1155	if (uVersion == PATM_SAVED_STATE_VERSION_VER16)
1156	{
1157	unsigned offCpumCtx = uFixup - patmInfo.pCPUMCtxGC;
1158
1159	/* ''case RT_OFFSETOF()'' does not work as gcc refuses to use & as a constant expression.
1160	* Defining RT_OFFSETOF as __builtin_offsetof for gcc would make this possible. But this
1161	* function is not available in older gcc versions, at least not in gcc-3.3 */
1162	if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, dr0))
1163	{
1164	LogFlow(("Changing dr[0] offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, dr[0])));
1165	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, dr[0]);
1166	}
1167	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, dr1))
1168	{
1169	LogFlow(("Changing dr[1] offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, dr[1])));
1170	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, dr[1]);
1171	}
1172	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, dr2))
1173	{
1174	LogFlow(("Changing dr[2] offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, dr[2])));
1175	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, dr[2]);
1176	}
1177	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, dr3))
1178	{
1179	LogFlow(("Changing dr[3] offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, dr[3])));
1180	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, dr[3]);
1181	}
1182	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, dr4))
1183	{
1184	LogFlow(("Changing dr[4] offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, dr[4])));
1185	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, dr[4]);
1186	}
1187	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, dr5))
1188	{
1189	LogFlow(("Changing dr[5] offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, dr[5])));
1190	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, dr[5]);
1191	}
1192	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, dr6))
1193	{
1194	LogFlow(("Changing dr[6] offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, dr[6])));
1195	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, dr[6]);
1196	}
1197	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, dr7))
1198	{
1199	LogFlow(("Changing dr[7] offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, dr[7])));
1200	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, dr[7]);
1201	}
1202	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, cr0))
1203	{
1204	LogFlow(("Changing cr0 offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, cr0)));
1205	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, cr0);
1206	}
1207	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, cr2))
1208	{
1209	LogFlow(("Changing cr2 offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, cr2)));
1210	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, cr2);
1211	}
1212	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, cr3))
1213	{
1214	LogFlow(("Changing cr3 offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, cr3)));
1215	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, cr3);
1216	}
1217	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, cr4))
1218	{
1219	LogFlow(("Changing cr4 offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, cr4)));
1220	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, cr4);
1221	}
1222	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, tr))
1223	{
1224	LogFlow(("Changing tr offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, tr)));
1225	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, tr);
1226	}
1227	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, ldtr))
1228	{
1229	LogFlow(("Changing ldtr offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, ldtr)));
1230	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, ldtr);
1231	}
1232	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, gdtr.pGdt))
1233	{
1234	LogFlow(("Changing pGdt offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, gdtr.pGdt)));
1235	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, gdtr.pGdt);
1236	}
1237	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, gdtr.cbGdt))
1238	{
1239	LogFlow(("Changing cbGdt offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, gdtr.cbGdt)));
1240	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, gdtr.cbGdt);
1241	}
1242	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, idtr.pIdt))
1243	{
1244	LogFlow(("Changing pIdt offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, idtr.pIdt)));
1245	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, idtr.pIdt);
1246	}
1247	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, idtr.cbIdt))
1248	{
1249	LogFlow(("Changing cbIdt offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, idtr.cbIdt)));
1250	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, idtr.cbIdt);
1251	}
1252	else
1253	AssertMsgFailed(("Unexpected CPUMCTX offset %x\n", offCpumCtx));
1254	}
1255	else
1256	*pFixup = (uFixup - patmInfo.pCPUMCtxGC) + pVM->patm.s.pCPUMCtxGC;
1257	}
1258	else if ( uFixup >= patmInfo.pStatsGC
1259	&& uFixup < patmInfo.pStatsGC + PATM_STAT_MEMSIZE)
1260	{
1261	LogFlow(("Changing absolute Stats at %RRv from %RRv to %RRv\n", patmInfo.pPatchMemGC + offset, uFixup, (uFixup - patmInfo.pStatsGC) + pVM->patm.s.pStatsGC));
1262	*pFixup = (uFixup - patmInfo.pStatsGC) + pVM->patm.s.pStatsGC;
1263	}
1264	else if ( uFixup >= patmInfo.pGCStackGC
1265	&& uFixup < patmInfo.pGCStackGC + PATM_STACK_TOTAL_SIZE)
1266	{
1267	LogFlow(("Changing absolute Stack at %RRv from %RRv to %RRv\n", patmInfo.pPatchMemGC + offset, uFixup, (uFixup - patmInfo.pGCStackGC) + pVM->patm.s.pGCStackGC));
1268	*pFixup = (uFixup - patmInfo.pGCStackGC) + pVM->patm.s.pGCStackGC;
1269	}
1270	else if ( uFixup >= patmInfo.pPatchMemGC
1271	&& uFixup < patmInfo.pPatchMemGC + patmInfo.cbPatchMem)
1272	{
1273	LogFlow(("Changing absolute PatchMem at %RRv from %RRv to %RRv\n", patmInfo.pPatchMemGC + offset, uFixup, (uFixup - patmInfo.pPatchMemGC) + pVM->patm.s.pPatchMemGC));
1274	*pFixup = (uFixup - patmInfo.pPatchMemGC) + pVM->patm.s.pPatchMemGC;
1275	}
1276	/*
1277	* For PATM_SAVED_STATE_VERSION_FIXUP_HACK and earlier boldly ASSUME:
1278	* 1. That pCPUMCtxGC is in the VM structure and that its location is
1279	* at the first page of the same 4 MB chunk.
1280	* 2. That the forced actions were in the first 32 bytes of the VM
1281	* structure.
1282	* 3. That the CPUM leaves are less than 8KB into the structure.
1283	*/
1284	else if ( uVersion <= PATM_SAVED_STATE_VERSION_FIXUP_HACK
1285	&& uFixup - (patmInfo.pCPUMCtxGC & UINT32_C(0xffc00000)) < UINT32_C(32))
1286	{
1287	LogFlow(("Changing fLocalForcedActions fixup from %RRv to %RRv\n", uFixup, pVM->pVMRC + RT_OFFSETOF(VM, aCpus[0].fLocalForcedActions)));
1288	*pFixup = pVM->pVMRC + RT_OFFSETOF(VM, aCpus[0].fLocalForcedActions);
1289	pRec->pSource = pRec->pDest = PATM_ASMFIX_VM_FORCEDACTIONS;
1290	pRec->uType = FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL;
1291	}
1292	else if ( uVersion <= PATM_SAVED_STATE_VERSION_FIXUP_HACK
1293	&& uFixup - (patmInfo.pCPUMCtxGC & UINT32_C(0xffc00000)) < UINT32_C(8192))
1294	{
1295	static int cCpuidFixup = 0;
1296
1297	/* Very dirty assumptions about the cpuid patch and cpuid ordering. */
1298	switch (cCpuidFixup & 3)
1299	{
1300	case 0:
1301	*pFixup = CPUMR3GetGuestCpuIdPatmDefRCPtr(pVM);
1302	pRec->pSource = pRec->pDest = PATM_ASMFIX_CPUID_DEF_PTR;
1303	pRec->uType = FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL;
1304	break;
1305	case 1:
1306	*pFixup = CPUMR3GetGuestCpuIdPatmStdRCPtr(pVM);
1307	pRec->pSource = pRec->pDest = PATM_ASMFIX_CPUID_STD_PTR;
1308	pRec->uType = FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL;
1309	break;
1310	case 2:
1311	*pFixup = CPUMR3GetGuestCpuIdPatmExtRCPtr(pVM);
1312	pRec->pSource = pRec->pDest = PATM_ASMFIX_CPUID_EXT_PTR;
1313	pRec->uType = FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL;
1314	break;
1315	case 3:
1316	*pFixup = CPUMR3GetGuestCpuIdPatmCentaurRCPtr(pVM);
1317	pRec->pSource = pRec->pDest = PATM_ASMFIX_CPUID_CENTAUR_PTR;
1318	pRec->uType = FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL;
1319	break;
1320	}
1321	LogFlow(("Changing cpuid fixup %d from %RRv to %RRv\n", cCpuidFixup, uFixup, *pFixup));
1322	cCpuidFixup++;
1323	}
1324	/*
1325	* For PATM_SAVED_STATE_VERSION_MEM thru PATM_SAVED_STATE_VERSION_NO_RAW_MEM
1326	* we abused Core.Key to store the type for fixups needing correcting on load.
1327	*/
1328	else if ( uVersion >= PATM_SAVED_STATE_VERSION_MEM
1329	&& uVersion <= PATM_SAVED_STATE_VERSION_NO_RAW_MEM)
1330	{
1331	/* Core.Key abused to store the type of fixup. */
1332	switch ((uintptr_t)pRec->Core.Key)
1333	{
1334	case PATM_FIXUP_CPU_FF_ACTION:
1335	*pFixup = pVM->pVMRC + RT_OFFSETOF(VM, aCpus[0].fLocalForcedActions);
1336	pRec->pSource = pRec->pDest = PATM_ASMFIX_VM_FORCEDACTIONS;
1337	pRec->uType = FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL;
1338	LogFlow(("Changing cpu ff action fixup from %x to %x\n", uFixup, *pFixup));
1339	break;
1340	case PATM_FIXUP_CPUID_DEFAULT:
1341	*pFixup = CPUMR3GetGuestCpuIdPatmDefRCPtr(pVM);
1342	pRec->pSource = pRec->pDest = PATM_ASMFIX_CPUID_DEF_PTR;
1343	pRec->uType = FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL;
1344	LogFlow(("Changing cpuid def fixup from %x to %x\n", uFixup, *pFixup));
1345	break;
1346	case PATM_FIXUP_CPUID_STANDARD:
1347	*pFixup = CPUMR3GetGuestCpuIdPatmStdRCPtr(pVM);
1348	pRec->pSource = pRec->pDest = PATM_ASMFIX_CPUID_STD_PTR;
1349	pRec->uType = FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL;
1350	LogFlow(("Changing cpuid std fixup from %x to %x\n", uFixup, *pFixup));
1351	break;
1352	case PATM_FIXUP_CPUID_EXTENDED:
1353	*pFixup = CPUMR3GetGuestCpuIdPatmExtRCPtr(pVM);
1354	pRec->pSource = pRec->pDest = PATM_ASMFIX_CPUID_EXT_PTR;
1355	pRec->uType = FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL;
1356	LogFlow(("Changing cpuid ext fixup from %x to %x\n", uFixup, *pFixup));
1357	break;
1358	case PATM_FIXUP_CPUID_CENTAUR:
1359	*pFixup = CPUMR3GetGuestCpuIdPatmCentaurRCPtr(pVM);
1360	pRec->pSource = pRec->pDest = PATM_ASMFIX_CPUID_CENTAUR_PTR;
1361	pRec->uType = FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL;
1362	LogFlow(("Changing cpuid centaur fixup from %x to %x\n", uFixup, *pFixup));
1363	break;
1364	default:
1365	AssertMsgFailed(("Unexpected fixup value %p\n", (uintptr_t)pRec->Core.Key));
1366	break;
1367	}
1368	}
1369	/*
1370	* After PATM_SAVED_STATE_VERSION_NO_RAW_MEM we changed the fixup type
1371	* and instead put the patch fixup code in the source and target addresses.
1372	*/
1373	else if ( uVersion > PATM_SAVED_STATE_VERSION_NO_RAW_MEM
1374	&& pRec->uType == FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL)
1375	{
1376	Assert(pRec->pSource == pRec->pDest); Assert(PATM_IS_ASMFIX(pRec->pSource));
1377	switch (pRec->pSource)
1378	{
1379	case PATM_ASMFIX_VM_FORCEDACTIONS:
1380	*pFixup = pVM->pVMRC + RT_OFFSETOF(VM, aCpus[0].fLocalForcedActions);
1381	break;
1382	case PATM_ASMFIX_CPUID_DEF_PTR:
1383	*pFixup = CPUMR3GetGuestCpuIdPatmDefRCPtr(pVM);
1384	break;
1385	case PATM_ASMFIX_CPUID_STD_PTR: /* Saved again patches only. */
1386	*pFixup = CPUMR3GetGuestCpuIdPatmStdRCPtr(pVM);
1387	break;
1388	case PATM_ASMFIX_CPUID_EXT_PTR: /* Saved again patches only. */
1389	*pFixup = CPUMR3GetGuestCpuIdPatmExtRCPtr(pVM);
1390	break;
1391	case PATM_ASMFIX_CPUID_CENTAUR_PTR: /* Saved again patches only. */
1392	*pFixup = CPUMR3GetGuestCpuIdPatmCentaurRCPtr(pVM);
1393	break;
1394	case PATM_ASMFIX_REUSE_LATER_0: /* Was only used for a few days. Don't want to keep this legacy around. */
1395	case PATM_ASMFIX_REUSE_LATER_1:
1396	AssertLogRelMsgFailedReturn(("Unsupported PATM fixup. You have to discard this saved state or snapshot."),
1397	VERR_INTERNAL_ERROR);
1398	break;
1399	}
1400	}
1401	/*
1402	* Constant that may change between VM version needs fixing up.
1403	*/
1404	else if (pRec->uType == FIXUP_CONSTANT_IN_PATCH_ASM_TMPL)
1405	{
1406	AssertLogRelReturn(uVersion > PATM_SAVED_STATE_VERSION_NO_RAW_MEM, VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
1407	Assert(pRec->pSource == pRec->pDest); Assert(PATM_IS_ASMFIX(pRec->pSource));
1408	switch (pRec->pSource)
1409	{
1410	case PATM_ASMFIX_REUSE_LATER_2: /* Was only used for a few days. Don't want to keep this legacy around. */
1411	case PATM_ASMFIX_REUSE_LATER_3:
1412	AssertLogRelMsgFailedReturn(("Unsupported PATM fixup. You have to discard this saved state or snapshot."),
1413	VERR_INTERNAL_ERROR);
1414	break;
1415	default:
1416	AssertLogRelMsgFailed(("Unknown FIXUP_CONSTANT_IN_PATCH_ASM_TMPL fixup: %#x\n", pRec->pSource));
1417	return VERR_SSM_DATA_UNIT_FORMAT_CHANGED;
1418	}
1419	}
1420	/*
1421	* Relative fixups for calling or jumping to helper functions inside VMMRC.
1422	* (The distance between the helper function and the patch is subject to
1423	* new code being added to VMMRC as well as VM configurations influencing
1424	* heap allocations and so on and so forth.)
1425	*/
1426	else if (pRec->uType == FIXUP_REL_HELPER_IN_PATCH_ASM_TMPL)
1427	{
1428	AssertLogRelReturn(uVersion > PATM_SAVED_STATE_VERSION_NO_RAW_MEM, VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
1429	Assert(pRec->pSource == pRec->pDest); Assert(PATM_IS_ASMFIX(pRec->pSource));
1430	int rc;
1431	RTRCPTR uRCPtrDest;
1432	switch (pRec->pSource)
1433	{
1434	case PATM_ASMFIX_HELPER_CPUM_CPUID:
1435	rc = PDMR3LdrGetSymbolRC(pVM, NULL, "CPUMPatchHlpCpuId", &uRCPtrDest);
1436	AssertLogRelRCReturn(rc, rc);
1437	break;
1438	default:
1439	AssertLogRelMsgFailed(("Unknown FIXUP_REL_HLP_CALL_IN_PATCH_ASM_TMPL fixup: %#x\n", pRec->pSource));
1440	return VERR_SSM_DATA_UNIT_FORMAT_CHANGED;
1441	}
1442	RTRCPTR uRCPtrAfter = pVM->patm.s.pPatchMemGC + ((uintptr_t)&pFixup[1] - (uintptr_t)pVM->patm.s.pPatchMemHC);
1443	*pFixup = uRCPtrDest - uRCPtrAfter;
1444	}
1445
1446	#ifdef RT_OS_WINDOWS
1447	AssertCompile(RT_OFFSETOF(VM, fGlobalForcedActions) < 32);
1448	#endif
1449	break;
1450	}
1451
1452	case FIXUP_REL_JMPTOPATCH:
1453	{
1454	RTRCPTR pTarget = (RTRCPTR)((RTRCINTPTR)pRec->pDest + delta);
1455
1456	if ( pPatch->uState == PATCH_ENABLED
1457	&& (pPatch->flags & PATMFL_PATCHED_GUEST_CODE))
1458	{
1459	uint8_t oldJump[SIZEOF_NEAR_COND_JUMP32];
1460	uint8_t temp[SIZEOF_NEAR_COND_JUMP32];
1461	RTRCPTR pJumpOffGC;
1462	RTRCINTPTR displ = (RTRCINTPTR)pTarget - (RTRCINTPTR)pRec->pSource;
1463	RTRCINTPTR displOld= (RTRCINTPTR)pRec->pDest - (RTRCINTPTR)pRec->pSource;
1464
1465	Log(("Relative fixup (g2p) %08X -> %08X at %08X (source=%08x, target=%08x)\n", (int32_t)pRec->pRelocPos, displ, pRec->pRelocPos, pRec->pSource, pRec->pDest));
1466
1467	Assert(pRec->pSource - pPatch->cbPatchJump == pPatch->pPrivInstrGC);
1468	#ifdef PATM_RESOLVE_CONFLICTS_WITH_JUMP_PATCHES
1469	if (pPatch->cbPatchJump == SIZEOF_NEAR_COND_JUMP32)
1470	{
1471	Assert(pPatch->flags & PATMFL_JUMP_CONFLICT);
1472
1473	pJumpOffGC = pPatch->pPrivInstrGC + 2; //two byte opcode
1474	oldJump[0] = pPatch->aPrivInstr[0];
1475	oldJump[1] = pPatch->aPrivInstr[1];
1476	(RTRCUINTPTR )&oldJump[2] = displOld;
1477	}
1478	else
1479	#endif
1480	if (pPatch->cbPatchJump == SIZEOF_NEARJUMP32)
1481	{
1482	pJumpOffGC = pPatch->pPrivInstrGC + 1; //one byte opcode
1483	oldJump[0] = 0xE9;
1484	(RTRCUINTPTR )&oldJump[1] = displOld;
1485	}
1486	else
1487	{
1488	AssertMsgFailed(("Invalid patch jump size %d\n", pPatch->cbPatchJump));
1489	break;
1490	}
1491	Assert(pPatch->cbPatchJump <= sizeof(temp));
1492
1493	/*
1494	* Read old patch jump and compare it to the one we previously installed
1495	*/
1496	int rc = PGMPhysSimpleReadGCPtr(VMMGetCpu0(pVM), temp, pPatch->pPrivInstrGC, pPatch->cbPatchJump);
1497	Assert(RT_SUCCESS(rc) \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT);
1498
1499	if (rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT)
1500	{
1501	RTRCPTR pPage = pPatch->pPrivInstrGC & PAGE_BASE_GC_MASK;
1502	rc = PGMR3HandlerVirtualRegister(pVM, VMMGetCpu(pVM), pVM->patm.s.hMonitorPageType,
1503	pPage,
1504	pPage + (PAGE_SIZE - 1) /* inclusive! */,
1505	(void )(uintptr_t)pPage, NIL_RTRCPTR /pvUserRC/, NULL /pszDesc*/);
1506	Assert(RT_SUCCESS(rc) \|\| rc == VERR_PGM_HANDLER_VIRTUAL_CONFLICT);
1507	}
1508	else
1509	if (memcmp(temp, oldJump, pPatch->cbPatchJump))
1510	{
1511	Log(("PATM: Patch jump was overwritten -> disabling patch!!\n"));
1512	/*
1513	* Disable patch; this is not a good solution
1514	*/
1515	/** @todo hopefully it was completely overwritten (if the read was successful)!!!! */
1516	pPatch->uState = PATCH_DISABLED;
1517	}
1518	else
1519	if (RT_SUCCESS(rc))
1520	{
1521	rc = PGMPhysSimpleDirtyWriteGCPtr(VMMGetCpu0(pVM), pJumpOffGC, &displ, sizeof(displ));
1522	AssertRC(rc);
1523	}
1524	else
1525	AssertMsgFailed(("Unexpected error %d from MMR3PhysReadGCVirt\n", rc));
1526	}
1527	else
1528	Log(("Skip the guest jump to patch code for this disabled patch %08X\n", pRec->pRelocPos));
1529
1530	pRec->pDest = pTarget;
1531	break;
1532	}
1533
1534	case FIXUP_REL_JMPTOGUEST:
1535	{
1536	RTRCPTR pSource = (RTRCPTR)((RTRCINTPTR)pRec->pSource + delta);
1537	RTRCINTPTR displ = (RTRCINTPTR)pRec->pDest - (RTRCINTPTR)pSource;
1538
1539	Assert(!(pPatch->flags & PATMFL_GLOBAL_FUNCTIONS));
1540	Log(("Relative fixup (p2g) %08X -> %08X at %08X (source=%08x, target=%08x)\n", (int32_t)pRec->pRelocPos, displ, pRec->pRelocPos, pRec->pSource, pRec->pDest));
1541	(RTRCUINTPTR )pRec->pRelocPos = displ;
1542	pRec->pSource = pSource;
1543	break;
1544
1545	}
1546	}
1547	return VINF_SUCCESS;
1548	}
1549

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMR3/PATMSSM.cpp@ 77758

Download in other formats: