PATMSSM.cpp@ 55889

Last change on this file since 55889 was 55889, checked in by vboxsync, 10 years ago
VMM: Split up virtual handlers just like the physical ones, such that the kind+callbacks are stored seprately from the actual handler registration. This should hopefully save a byte or two when adding more callbacks. Implemented the pvUser for ring-3 callbacks.
Property svn:eol-style set to `native` Property svn:keywords set to `Id Revision`
File size: 70.5 KB

Line
1	/* $Id: PATMSSM.cpp 55889 2015-05-17 18:01:37Z vboxsync $ */
2	/** @file
3	* PATMSSM - Dynamic Guest OS Patching Manager; Save and load state
4	*
5	* NOTE: CSAM assumes patch memory is never reused!!
6	*/
7
8	/*
9	* Copyright (C) 2006-2015 Oracle Corporation
10	*
11	* This file is part of VirtualBox Open Source Edition (OSE), as
12	* available from http://www.virtualbox.org. This file is free software;
13	* you can redistribute it and/or modify it under the terms of the GNU
14	* General Public License (GPL) as published by the Free Software
15	* Foundation, in version 2 as it comes in the "COPYING" file of the
16	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
17	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
18	*/
19
20	/*******************************************************************************
21	* Header Files *
22	*******************************************************************************/
23	#define LOG_GROUP LOG_GROUP_PATM
24	#include <VBox/vmm/patm.h>
25	#include <VBox/vmm/pdmapi.h>
26	#include <VBox/vmm/cpum.h>
27	#include <VBox/vmm/cpumctx-v1_6.h>
28	#include <VBox/vmm/mm.h>
29	#include <VBox/vmm/ssm.h>
30	#include <VBox/param.h>
31	#include <iprt/avl.h>
32	#include "PATMInternal.h"
33	#include "PATMPatch.h"
34	#include "PATMA.h"
35	#include <VBox/vmm/vm.h>
36	#include <VBox/vmm/csam.h>
37	#include "internal/pgm.h"
38	#include <VBox/dbg.h>
39	#include <VBox/err.h>
40	#include <VBox/log.h>
41	#include <iprt/assert.h>
42	#include <iprt/asm.h>
43	#include <iprt/string.h>
44	#include <VBox/dis.h>
45	#include <VBox/disopcode.h>
46	#include <VBox/version.h>
47
48	/**
49	* Patch information - SSM version.
50	*
51	* the difference is the missing pTrampolinePatchesHead member
52	* to avoid changing the saved state version for now (will come later).
53	*/
54	typedef struct PATCHINFOSSM
55	{
56	uint32_t uState;
57	uint32_t uOldState;
58	DISCPUMODE uOpMode;
59
60	/* GC pointer of privileged instruction */
61	RCPTRTYPE(uint8_t *) pPrivInstrGC;
62	R3PTRTYPE(uint8_t ) unusedHC; / todo Can't remove due to structure size dependencies in saved states. */
63	uint8_t aPrivInstr[MAX_INSTR_SIZE];
64	uint32_t cbPrivInstr;
65	uint32_t opcode; //opcode for priv instr (OP_*)
66	uint32_t cbPatchJump; //patch jump size
67
68	/* Only valid for PATMFL_JUMP_CONFLICT patches */
69	RTRCPTR pPatchJumpDestGC;
70
71	RTGCUINTPTR32 pPatchBlockOffset;
72	uint32_t cbPatchBlockSize;
73	uint32_t uCurPatchOffset;
74	#if HC_ARCH_BITS == 64
75	uint32_t Alignment0; /*< Align flags correctly. /
76	#endif
77
78	uint64_t flags;
79
80	/**
81	* Lowest and highest patched GC instruction address. To optimize searches.
82	*/
83	RTRCPTR pInstrGCLowest;
84	RTRCPTR pInstrGCHighest;
85
86	/* Tree of fixup records for the patch. */
87	R3PTRTYPE(PAVLPVNODECORE) FixupTree;
88	uint32_t nrFixups;
89
90	/* Tree of jumps inside the generated patch code. */
91	uint32_t nrJumpRecs;
92	R3PTRTYPE(PAVLPVNODECORE) JumpTree;
93
94	/**
95	* Lookup trees for determining the corresponding guest address of an
96	* instruction in the patch block.
97	*/
98	R3PTRTYPE(PAVLU32NODECORE) Patch2GuestAddrTree;
99	R3PTRTYPE(PAVLU32NODECORE) Guest2PatchAddrTree;
100	uint32_t nrPatch2GuestRecs;
101	#if HC_ARCH_BITS == 64
102	uint32_t Alignment1;
103	#endif
104
105	/* Unused, but can't remove due to structure size dependencies in the saved state. */
106	PATMP2GLOOKUPREC_OBSOLETE unused;
107
108	/* Temporary information during patch creation. Don't waste hypervisor memory for this. */
109	R3PTRTYPE(PPATCHINFOTEMP) pTempInfo;
110
111	/* Count the number of writes to the corresponding guest code. */
112	uint32_t cCodeWrites;
113
114	/* Count the number of invalid writes to pages monitored for the patch. */
115	//some statistics to determine if we should keep this patch activated
116	uint32_t cTraps;
117
118	uint32_t cInvalidWrites;
119
120	// Index into the uPatchRun and uPatchTrap arrays (0..MAX_PATCHES-1)
121	uint32_t uPatchIdx;
122
123	/* First opcode byte, that's overwritten when a patch is marked dirty. */
124	uint8_t bDirtyOpcode;
125	uint8_t Alignment2[7]; /*< Align the structure size on a 8-byte boundary. /
126	} PATCHINFOSSM, *PPATCHINFOSSM;
127
128	/**
129	* Lookup record for patches - SSM version.
130	*/
131	typedef struct PATMPATCHRECSSM
132	{
133	/** The key is a GC virtual address. */
134	AVLOU32NODECORE Core;
135	/** The key is a patch offset. */
136	AVLOU32NODECORE CoreOffset;
137
138	PATCHINFOSSM patch;
139	} PATMPATCHRECSSM, *PPATMPATCHRECSSM;
140
141
142	/*******************************************************************************
143	* Internal Functions *
144	*******************************************************************************/
145	static int patmCorrectFixup(PVM pVM, unsigned ulSSMVersion, PATM &patmInfo, PPATCHINFO pPatch, PRELOCREC pRec,
146	int32_t offset, RTRCPTR *pFixup);
147
148
149	/*******************************************************************************
150	* Global Variables *
151	*******************************************************************************/
152	/**
153	* SSM descriptor table for the PATM structure.
154	*/
155	static SSMFIELD const g_aPatmFields[] =
156	{
157	/** @todo there are a bunch more fields here which can be marked as ignored. */
158	SSMFIELD_ENTRY_IGNORE( PATM, offVM),
159	SSMFIELD_ENTRY_RCPTR( PATM, pPatchMemGC),
160	SSMFIELD_ENTRY_IGN_HCPTR( PATM, pPatchMemHC),
161	SSMFIELD_ENTRY( PATM, cbPatchMem),
162	SSMFIELD_ENTRY( PATM, offPatchMem),
163	SSMFIELD_ENTRY( PATM, fOutOfMemory),
164	SSMFIELD_ENTRY_PAD_HC_AUTO( 3, 3),
165	SSMFIELD_ENTRY( PATM, deltaReloc),
166	SSMFIELD_ENTRY_IGN_HCPTR( PATM, pGCStateHC),
167	SSMFIELD_ENTRY_RCPTR( PATM, pGCStateGC),
168	SSMFIELD_ENTRY_RCPTR( PATM, pGCStackGC),
169	SSMFIELD_ENTRY_IGN_HCPTR( PATM, pGCStackHC),
170	SSMFIELD_ENTRY_RCPTR( PATM, pCPUMCtxGC),
171	SSMFIELD_ENTRY_RCPTR( PATM, pStatsGC),
172	SSMFIELD_ENTRY_IGN_HCPTR( PATM, pStatsHC),
173	SSMFIELD_ENTRY( PATM, uCurrentPatchIdx),
174	SSMFIELD_ENTRY( PATM, ulCallDepth),
175	SSMFIELD_ENTRY( PATM, cPageRecords),
176	SSMFIELD_ENTRY_RCPTR( PATM, pPatchedInstrGCLowest),
177	SSMFIELD_ENTRY_RCPTR( PATM, pPatchedInstrGCHighest),
178	SSMFIELD_ENTRY_RCPTR( PATM, PatchLookupTreeGC),
179	SSMFIELD_ENTRY_IGN_HCPTR( PATM, PatchLookupTreeHC),
180	SSMFIELD_ENTRY_RCPTR( PATM, pfnHelperCallGC),
181	SSMFIELD_ENTRY_RCPTR( PATM, pfnHelperRetGC),
182	SSMFIELD_ENTRY_RCPTR( PATM, pfnHelperJumpGC),
183	SSMFIELD_ENTRY_RCPTR( PATM, pfnHelperIretGC),
184	SSMFIELD_ENTRY_IGN_HCPTR( PATM, pGlobalPatchRec),
185	SSMFIELD_ENTRY_RCPTR( PATM, pfnSysEnterGC),
186	SSMFIELD_ENTRY_RCPTR( PATM, pfnSysEnterPatchGC),
187	SSMFIELD_ENTRY( PATM, uSysEnterPatchIdx),
188	SSMFIELD_ENTRY_RCPTR( PATM, pvFaultMonitor),
189	SSMFIELD_ENTRY_GCPHYS( PATM, mmio.GCPhys),
190	SSMFIELD_ENTRY_RCPTR( PATM, mmio.pCachedData),
191	SSMFIELD_ENTRY_IGN_RCPTR( PATM, mmio.Alignment0),
192	SSMFIELD_ENTRY_IGN_HCPTR( PATM, savedstate.pSSM),
193	SSMFIELD_ENTRY( PATM, savedstate.cPatches),
194	SSMFIELD_ENTRY_PAD_HC64( PATM, savedstate.Alignment0, sizeof(uint32_t)),
195	SSMFIELD_ENTRY_IGNORE( PATM, StatNrOpcodeRead),
196	SSMFIELD_ENTRY_IGNORE( PATM, StatDisabled),
197	SSMFIELD_ENTRY_IGNORE( PATM, StatUnusable),
198	SSMFIELD_ENTRY_IGNORE( PATM, StatEnabled),
199	SSMFIELD_ENTRY_IGNORE( PATM, StatInstalled),
200	SSMFIELD_ENTRY_IGNORE( PATM, StatInstalledFunctionPatches),
201	SSMFIELD_ENTRY_IGNORE( PATM, StatInstalledTrampoline),
202	SSMFIELD_ENTRY_IGNORE( PATM, StatInstalledJump),
203	SSMFIELD_ENTRY_IGNORE( PATM, StatInt3Callable),
204	SSMFIELD_ENTRY_IGNORE( PATM, StatInt3BlockRun),
205	SSMFIELD_ENTRY_IGNORE( PATM, StatOverwritten),
206	SSMFIELD_ENTRY_IGNORE( PATM, StatFixedConflicts),
207	SSMFIELD_ENTRY_IGNORE( PATM, StatFlushed),
208	SSMFIELD_ENTRY_IGNORE( PATM, StatPageBoundaryCrossed),
209	SSMFIELD_ENTRY_IGNORE( PATM, StatMonitored),
210	SSMFIELD_ENTRY_IGNORE( PATM, StatHandleTrap),
211	SSMFIELD_ENTRY_IGNORE( PATM, StatSwitchBack),
212	SSMFIELD_ENTRY_IGNORE( PATM, StatSwitchBackFail),
213	SSMFIELD_ENTRY_IGNORE( PATM, StatPATMMemoryUsed),
214	SSMFIELD_ENTRY_IGNORE( PATM, StatDuplicateREQSuccess),
215	SSMFIELD_ENTRY_IGNORE( PATM, StatDuplicateREQFailed),
216	SSMFIELD_ENTRY_IGNORE( PATM, StatDuplicateUseExisting),
217	SSMFIELD_ENTRY_IGNORE( PATM, StatFunctionFound),
218	SSMFIELD_ENTRY_IGNORE( PATM, StatFunctionNotFound),
219	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchWrite),
220	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchWriteDetect),
221	SSMFIELD_ENTRY_IGNORE( PATM, StatDirty),
222	SSMFIELD_ENTRY_IGNORE( PATM, StatPushTrap),
223	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchWriteInterpreted),
224	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchWriteInterpretedFailed),
225	SSMFIELD_ENTRY_IGNORE( PATM, StatSysEnter),
226	SSMFIELD_ENTRY_IGNORE( PATM, StatSysExit),
227	SSMFIELD_ENTRY_IGNORE( PATM, StatEmulIret),
228	SSMFIELD_ENTRY_IGNORE( PATM, StatEmulIretFailed),
229	SSMFIELD_ENTRY_IGNORE( PATM, StatInstrDirty),
230	SSMFIELD_ENTRY_IGNORE( PATM, StatInstrDirtyGood),
231	SSMFIELD_ENTRY_IGNORE( PATM, StatInstrDirtyBad),
232	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchPageInserted),
233	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchPageRemoved),
234	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchRefreshSuccess),
235	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchRefreshFailed),
236	SSMFIELD_ENTRY_IGNORE( PATM, StatGenRet),
237	SSMFIELD_ENTRY_IGNORE( PATM, StatGenRetReused),
238	SSMFIELD_ENTRY_IGNORE( PATM, StatGenJump),
239	SSMFIELD_ENTRY_IGNORE( PATM, StatGenCall),
240	SSMFIELD_ENTRY_IGNORE( PATM, StatGenPopf),
241	SSMFIELD_ENTRY_IGNORE( PATM, StatCheckPendingIRQ),
242	SSMFIELD_ENTRY_IGNORE( PATM, StatFunctionLookupReplace),
243	SSMFIELD_ENTRY_IGNORE( PATM, StatFunctionLookupInsert),
244	SSMFIELD_ENTRY_IGNORE( PATM, StatU32FunctionMaxSlotsUsed),
245	SSMFIELD_ENTRY_IGNORE( PATM, Alignment0),
246	SSMFIELD_ENTRY_TERM()
247	};
248
249	/**
250	* SSM descriptor table for the PATM structure starting with r86139.
251	*/
252	static SSMFIELD const g_aPatmFields86139[] =
253	{
254	/** @todo there are a bunch more fields here which can be marked as ignored. */
255	SSMFIELD_ENTRY_IGNORE( PATM, offVM),
256	SSMFIELD_ENTRY_RCPTR( PATM, pPatchMemGC),
257	SSMFIELD_ENTRY_IGN_HCPTR( PATM, pPatchMemHC),
258	SSMFIELD_ENTRY( PATM, cbPatchMem),
259	SSMFIELD_ENTRY( PATM, offPatchMem),
260	SSMFIELD_ENTRY( PATM, fOutOfMemory),
261	SSMFIELD_ENTRY_PAD_HC_AUTO( 3, 3),
262	SSMFIELD_ENTRY( PATM, deltaReloc),
263	SSMFIELD_ENTRY_IGN_HCPTR( PATM, pGCStateHC),
264	SSMFIELD_ENTRY_RCPTR( PATM, pGCStateGC),
265	SSMFIELD_ENTRY_RCPTR( PATM, pGCStackGC),
266	SSMFIELD_ENTRY_IGN_HCPTR( PATM, pGCStackHC),
267	SSMFIELD_ENTRY_RCPTR( PATM, pCPUMCtxGC),
268	SSMFIELD_ENTRY_RCPTR( PATM, pStatsGC),
269	SSMFIELD_ENTRY_IGN_HCPTR( PATM, pStatsHC),
270	SSMFIELD_ENTRY( PATM, uCurrentPatchIdx),
271	SSMFIELD_ENTRY( PATM, ulCallDepth),
272	SSMFIELD_ENTRY( PATM, cPageRecords),
273	SSMFIELD_ENTRY_RCPTR( PATM, pPatchedInstrGCLowest),
274	SSMFIELD_ENTRY_RCPTR( PATM, pPatchedInstrGCHighest),
275	SSMFIELD_ENTRY_RCPTR( PATM, PatchLookupTreeGC),
276	SSMFIELD_ENTRY_IGN_HCPTR( PATM, PatchLookupTreeHC),
277	SSMFIELD_ENTRY_RCPTR( PATM, pfnHelperCallGC),
278	SSMFIELD_ENTRY_RCPTR( PATM, pfnHelperRetGC),
279	SSMFIELD_ENTRY_RCPTR( PATM, pfnHelperJumpGC),
280	SSMFIELD_ENTRY_RCPTR( PATM, pfnHelperIretGC),
281	SSMFIELD_ENTRY_IGN_HCPTR( PATM, pGlobalPatchRec),
282	SSMFIELD_ENTRY_RCPTR( PATM, pfnSysEnterGC),
283	SSMFIELD_ENTRY_RCPTR( PATM, pfnSysEnterPatchGC),
284	SSMFIELD_ENTRY( PATM, uSysEnterPatchIdx),
285	SSMFIELD_ENTRY_RCPTR( PATM, pvFaultMonitor),
286	SSMFIELD_ENTRY_GCPHYS( PATM, mmio.GCPhys),
287	SSMFIELD_ENTRY_RCPTR( PATM, mmio.pCachedData),
288	SSMFIELD_ENTRY_IGN_RCPTR( PATM, mmio.Alignment0),
289	SSMFIELD_ENTRY_IGN_HCPTR( PATM, savedstate.pSSM),
290	SSMFIELD_ENTRY( PATM, savedstate.cPatches),
291	SSMFIELD_ENTRY_PAD_HC64( PATM, savedstate.Alignment0, sizeof(uint32_t)),
292	SSMFIELD_ENTRY_IGN_HCPTR( PATM, hDbgModPatchMem),
293	SSMFIELD_ENTRY_PAD_HC32( PATM, Alignment0, sizeof(uint32_t)),
294	SSMFIELD_ENTRY_IGNORE( PATM, StatNrOpcodeRead),
295	SSMFIELD_ENTRY_IGNORE( PATM, StatDisabled),
296	SSMFIELD_ENTRY_IGNORE( PATM, StatUnusable),
297	SSMFIELD_ENTRY_IGNORE( PATM, StatEnabled),
298	SSMFIELD_ENTRY_IGNORE( PATM, StatInstalled),
299	SSMFIELD_ENTRY_IGNORE( PATM, StatInstalledFunctionPatches),
300	SSMFIELD_ENTRY_IGNORE( PATM, StatInstalledTrampoline),
301	SSMFIELD_ENTRY_IGNORE( PATM, StatInstalledJump),
302	SSMFIELD_ENTRY_IGNORE( PATM, StatInt3Callable),
303	SSMFIELD_ENTRY_IGNORE( PATM, StatInt3BlockRun),
304	SSMFIELD_ENTRY_IGNORE( PATM, StatOverwritten),
305	SSMFIELD_ENTRY_IGNORE( PATM, StatFixedConflicts),
306	SSMFIELD_ENTRY_IGNORE( PATM, StatFlushed),
307	SSMFIELD_ENTRY_IGNORE( PATM, StatPageBoundaryCrossed),
308	SSMFIELD_ENTRY_IGNORE( PATM, StatMonitored),
309	SSMFIELD_ENTRY_IGNORE( PATM, StatHandleTrap),
310	SSMFIELD_ENTRY_IGNORE( PATM, StatSwitchBack),
311	SSMFIELD_ENTRY_IGNORE( PATM, StatSwitchBackFail),
312	SSMFIELD_ENTRY_IGNORE( PATM, StatPATMMemoryUsed),
313	SSMFIELD_ENTRY_IGNORE( PATM, StatDuplicateREQSuccess),
314	SSMFIELD_ENTRY_IGNORE( PATM, StatDuplicateREQFailed),
315	SSMFIELD_ENTRY_IGNORE( PATM, StatDuplicateUseExisting),
316	SSMFIELD_ENTRY_IGNORE( PATM, StatFunctionFound),
317	SSMFIELD_ENTRY_IGNORE( PATM, StatFunctionNotFound),
318	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchWrite),
319	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchWriteDetect),
320	SSMFIELD_ENTRY_IGNORE( PATM, StatDirty),
321	SSMFIELD_ENTRY_IGNORE( PATM, StatPushTrap),
322	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchWriteInterpreted),
323	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchWriteInterpretedFailed),
324	SSMFIELD_ENTRY_IGNORE( PATM, StatSysEnter),
325	SSMFIELD_ENTRY_IGNORE( PATM, StatSysExit),
326	SSMFIELD_ENTRY_IGNORE( PATM, StatEmulIret),
327	SSMFIELD_ENTRY_IGNORE( PATM, StatEmulIretFailed),
328	SSMFIELD_ENTRY_IGNORE( PATM, StatInstrDirty),
329	SSMFIELD_ENTRY_IGNORE( PATM, StatInstrDirtyGood),
330	SSMFIELD_ENTRY_IGNORE( PATM, StatInstrDirtyBad),
331	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchPageInserted),
332	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchPageRemoved),
333	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchRefreshSuccess),
334	SSMFIELD_ENTRY_IGNORE( PATM, StatPatchRefreshFailed),
335	SSMFIELD_ENTRY_IGNORE( PATM, StatGenRet),
336	SSMFIELD_ENTRY_IGNORE( PATM, StatGenRetReused),
337	SSMFIELD_ENTRY_IGNORE( PATM, StatGenJump),
338	SSMFIELD_ENTRY_IGNORE( PATM, StatGenCall),
339	SSMFIELD_ENTRY_IGNORE( PATM, StatGenPopf),
340	SSMFIELD_ENTRY_IGNORE( PATM, StatCheckPendingIRQ),
341	SSMFIELD_ENTRY_IGNORE( PATM, StatFunctionLookupReplace),
342	SSMFIELD_ENTRY_IGNORE( PATM, StatFunctionLookupInsert),
343	SSMFIELD_ENTRY_IGNORE( PATM, StatU32FunctionMaxSlotsUsed),
344	SSMFIELD_ENTRY_IGNORE( PATM, Alignment0),
345	SSMFIELD_ENTRY_TERM()
346	};
347
348	/**
349	* SSM descriptor table for the PATMGCSTATE structure.
350	*/
351	static SSMFIELD const g_aPatmGCStateFields[] =
352	{
353	SSMFIELD_ENTRY( PATMGCSTATE, uVMFlags),
354	SSMFIELD_ENTRY( PATMGCSTATE, uPendingAction),
355	SSMFIELD_ENTRY( PATMGCSTATE, uPatchCalls),
356	SSMFIELD_ENTRY( PATMGCSTATE, uScratch),
357	SSMFIELD_ENTRY( PATMGCSTATE, uIretEFlags),
358	SSMFIELD_ENTRY( PATMGCSTATE, uIretCS),
359	SSMFIELD_ENTRY( PATMGCSTATE, uIretEIP),
360	SSMFIELD_ENTRY( PATMGCSTATE, Psp),
361	SSMFIELD_ENTRY( PATMGCSTATE, fPIF),
362	SSMFIELD_ENTRY_RCPTR( PATMGCSTATE, GCPtrInhibitInterrupts),
363	SSMFIELD_ENTRY_RCPTR( PATMGCSTATE, GCCallPatchTargetAddr),
364	SSMFIELD_ENTRY_RCPTR( PATMGCSTATE, GCCallReturnAddr),
365	SSMFIELD_ENTRY( PATMGCSTATE, Restore.uEAX),
366	SSMFIELD_ENTRY( PATMGCSTATE, Restore.uECX),
367	SSMFIELD_ENTRY( PATMGCSTATE, Restore.uEDI),
368	SSMFIELD_ENTRY( PATMGCSTATE, Restore.eFlags),
369	SSMFIELD_ENTRY( PATMGCSTATE, Restore.uFlags),
370	SSMFIELD_ENTRY_TERM()
371	};
372
373	/**
374	* SSM descriptor table for the PATMPATCHREC structure.
375	*/
376	static SSMFIELD const g_aPatmPatchRecFields[] =
377	{
378	SSMFIELD_ENTRY( PATMPATCHRECSSM, Core.Key),
379	SSMFIELD_ENTRY_IGNORE( PATMPATCHRECSSM, Core.pLeft),
380	SSMFIELD_ENTRY_IGNORE( PATMPATCHRECSSM, Core.pRight),
381	SSMFIELD_ENTRY_IGNORE( PATMPATCHRECSSM, Core.uchHeight),
382	SSMFIELD_ENTRY_PAD_HC_AUTO( 3, 3),
383	SSMFIELD_ENTRY( PATMPATCHRECSSM, CoreOffset.Key),
384	SSMFIELD_ENTRY_IGNORE( PATMPATCHRECSSM, CoreOffset.pLeft),
385	SSMFIELD_ENTRY_IGNORE( PATMPATCHRECSSM, CoreOffset.pRight),
386	SSMFIELD_ENTRY_IGNORE( PATMPATCHRECSSM, CoreOffset.uchHeight),
387	SSMFIELD_ENTRY_PAD_HC_AUTO( 3, 3),
388	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.uState),
389	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.uOldState),
390	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.uOpMode),
391	SSMFIELD_ENTRY_RCPTR( PATMPATCHRECSSM, patch.pPrivInstrGC),
392	SSMFIELD_ENTRY_IGN_HCPTR( PATMPATCHRECSSM, patch.unusedHC),
393	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.aPrivInstr),
394	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.cbPrivInstr),
395	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.opcode),
396	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.cbPatchJump),
397	SSMFIELD_ENTRY_RCPTR( PATMPATCHRECSSM, patch.pPatchJumpDestGC),
398	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.pPatchBlockOffset),
399	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.cbPatchBlockSize),
400	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.uCurPatchOffset),
401	SSMFIELD_ENTRY_PAD_HC64( PATMPATCHRECSSM, patch.Alignment0, sizeof(uint32_t)),
402	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.flags),
403	SSMFIELD_ENTRY_RCPTR( PATMPATCHRECSSM, patch.pInstrGCLowest),
404	SSMFIELD_ENTRY_RCPTR( PATMPATCHRECSSM, patch.pInstrGCHighest),
405	SSMFIELD_ENTRY_IGN_HCPTR( PATMPATCHRECSSM, patch.FixupTree),
406	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.nrFixups),
407	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.nrJumpRecs), // should be zero?
408	SSMFIELD_ENTRY_IGN_HCPTR( PATMPATCHRECSSM, patch.JumpTree),
409	SSMFIELD_ENTRY_IGN_HCPTR( PATMPATCHRECSSM, patch.Patch2GuestAddrTree),
410	SSMFIELD_ENTRY_IGN_HCPTR( PATMPATCHRECSSM, patch.Guest2PatchAddrTree),
411	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.nrPatch2GuestRecs),
412	SSMFIELD_ENTRY_PAD_HC64( PATMPATCHRECSSM, patch.Alignment1, sizeof(uint32_t)),
413	SSMFIELD_ENTRY_IGN_HCPTR( PATMPATCHRECSSM, patch.unused.pPatchLocStartHC), // saved as zero
414	SSMFIELD_ENTRY_IGN_HCPTR( PATMPATCHRECSSM, patch.unused.pPatchLocEndHC), // ditto
415	SSMFIELD_ENTRY_IGN_RCPTR( PATMPATCHRECSSM, patch.unused.pGuestLoc), // ditto
416	SSMFIELD_ENTRY_IGNORE( PATMPATCHRECSSM, patch.unused.opsize), // ditto
417	SSMFIELD_ENTRY_IGN_HCPTR( PATMPATCHRECSSM, patch.pTempInfo),
418	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.cCodeWrites),
419	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.cTraps),
420	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.cInvalidWrites),
421	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.uPatchIdx),
422	SSMFIELD_ENTRY( PATMPATCHRECSSM, patch.bDirtyOpcode),
423	SSMFIELD_ENTRY_IGNORE( PATMPATCHRECSSM, patch.Alignment2),
424	SSMFIELD_ENTRY_TERM()
425	};
426
427	/**
428	* SSM descriptor table for the RELOCREC structure.
429	*/
430	static SSMFIELD const g_aPatmRelocRec[] =
431	{
432	SSMFIELD_ENTRY_HCPTR_HACK_U32( RELOCREC, Core.Key), // Used to store the relocation type
433	SSMFIELD_ENTRY_IGN_HCPTR( RELOCREC, Core.pLeft),
434	SSMFIELD_ENTRY_IGN_HCPTR( RELOCREC, Core.pRight),
435	SSMFIELD_ENTRY_IGNORE( RELOCREC, Core.uchHeight),
436	SSMFIELD_ENTRY_PAD_HC_AUTO( 3, 7),
437	SSMFIELD_ENTRY( RELOCREC, uType),
438	SSMFIELD_ENTRY_PAD_HC_AUTO( 0, 4),
439	SSMFIELD_ENTRY_HCPTR_HACK_U32( RELOCREC, pRelocPos), // converted to a patch member offset.
440	SSMFIELD_ENTRY_RCPTR( RELOCREC, pSource),
441	SSMFIELD_ENTRY_RCPTR( RELOCREC, pDest),
442	SSMFIELD_ENTRY_TERM()
443	};
444
445	/**
446	* SSM descriptor table for the RECPATCHTOGUEST structure.
447	*/
448	static SSMFIELD const g_aPatmRecPatchToGuest[] =
449	{
450	SSMFIELD_ENTRY( RECPATCHTOGUEST, Core.Key),
451	SSMFIELD_ENTRY_PAD_HC_AUTO( 0, 4),
452	SSMFIELD_ENTRY_IGN_HCPTR( RECPATCHTOGUEST, Core.pLeft),
453	SSMFIELD_ENTRY_IGN_HCPTR( RECPATCHTOGUEST, Core.pRight),
454	SSMFIELD_ENTRY_IGNORE( RECPATCHTOGUEST, Core.uchHeight),
455	SSMFIELD_ENTRY_PAD_HC_AUTO( 3, 7),
456	SSMFIELD_ENTRY_RCPTR( RECPATCHTOGUEST, pOrgInstrGC),
457	SSMFIELD_ENTRY( RECPATCHTOGUEST, enmType),
458	SSMFIELD_ENTRY( RECPATCHTOGUEST, fDirty),
459	SSMFIELD_ENTRY( RECPATCHTOGUEST, fJumpTarget),
460	SSMFIELD_ENTRY( RECPATCHTOGUEST, u8DirtyOpcode),
461	SSMFIELD_ENTRY_PAD_HC_AUTO( 1, 5),
462	SSMFIELD_ENTRY_TERM()
463	};
464
465	#ifdef VBOX_STRICT
466
467	/**
468	* Callback function for RTAvlPVDoWithAll
469	*
470	* Counts the number of patches in the tree
471	*
472	* @returns VBox status code.
473	* @param pNode Current node
474	* @param pcPatches Pointer to patch counter (uint32_t)
475	*/
476	static DECLCALLBACK(int) patmCountLeafPV(PAVLPVNODECORE pNode, void *pcPatches)
477	{
478	NOREF(pNode);
479	(uint32_t )pcPatches = (uint32_t )pcPatches + 1;
480	return VINF_SUCCESS;
481	}
482
483	/**
484	* Callback function for RTAvlU32DoWithAll
485	*
486	* Counts the number of patches in the tree
487	*
488	* @returns VBox status code.
489	* @param pNode Current node
490	* @param pcPatches Pointer to patch counter (uint32_t)
491	*/
492	static DECLCALLBACK(int) patmCountLeaf(PAVLU32NODECORE pNode, void *pcPatches)
493	{
494	NOREF(pNode);
495	(uint32_t )pcPatches = (uint32_t )pcPatches + 1;
496	return VINF_SUCCESS;
497	}
498
499	#endif /* VBOX_STRICT */
500
501	/**
502	* Callback function for RTAvloU32DoWithAll
503	*
504	* Counts the number of patches in the tree
505	*
506	* @returns VBox status code.
507	* @param pNode Current node
508	* @param pcPatches Pointer to patch counter
509	*/
510	static DECLCALLBACK(int) patmCountPatch(PAVLOU32NODECORE pNode, void *pcPatches)
511	{
512	NOREF(pNode);
513	(uint32_t )pcPatches = (uint32_t )pcPatches + 1;
514	return VINF_SUCCESS;
515	}
516
517	/**
518	* Callback function for RTAvlU32DoWithAll
519	*
520	* Saves all patch to guest lookup records.
521	*
522	* @returns VBox status code.
523	* @param pNode Current node
524	* @param pVM1 Pointer to the VM
525	*/
526	static DECLCALLBACK(int) patmSaveP2GLookupRecords(PAVLU32NODECORE pNode, void *pVM1)
527	{
528	PVM pVM = (PVM)pVM1;
529	PSSMHANDLE pSSM = pVM->patm.s.savedstate.pSSM;
530	PRECPATCHTOGUEST pPatchToGuestRec = (PRECPATCHTOGUEST)pNode;
531
532	/* Save the lookup record. */
533	int rc = SSMR3PutStructEx(pSSM, pPatchToGuestRec, sizeof(RECPATCHTOGUEST), 0 /fFlags/, &g_aPatmRecPatchToGuest[0], NULL);
534	AssertRCReturn(rc, rc);
535
536	return VINF_SUCCESS;
537	}
538
539	/**
540	* Callback function for RTAvlPVDoWithAll
541	*
542	* Saves all patch to guest lookup records.
543	*
544	* @returns VBox status code.
545	* @param pNode Current node
546	* @param pVM1 Pointer to the VM
547	*/
548	static DECLCALLBACK(int) patmSaveFixupRecords(PAVLPVNODECORE pNode, void *pVM1)
549	{
550	PVM pVM = (PVM)pVM1;
551	PSSMHANDLE pSSM = pVM->patm.s.savedstate.pSSM;
552	RELOCREC rec = *(PRELOCREC)pNode;
553	RTRCPTR pFixup = (RTRCPTR )rec.pRelocPos;
554
555	/* Convert pointer to an offset into patch memory. May not be applicable
556	to all fixup types, thus the UINT32_MAX. */
557	Assert(rec.pRelocPos);
558	uintptr_t offRelocPos = (uintptr_t)rec.pRelocPos - (uintptr_t)pVM->patm.s.pPatchMemHC;
559	if (offRelocPos > pVM->patm.s.cbPatchMem)
560	offRelocPos = UINT32_MAX;
561	rec.pRelocPos = (uint8_t *)offRelocPos;
562
563	/* Zero rec.Core.Key since it's unused and may trigger SSM check due to the hack below. */
564	rec.Core.Key = 0;
565
566
567	/* Save the lookup record. */
568	int rc = SSMR3PutStructEx(pSSM, &rec, sizeof(rec), 0 /fFlags/, &g_aPatmRelocRec[0], NULL);
569	AssertRCReturn(rc, rc);
570
571	return VINF_SUCCESS;
572	}
573
574	/**
575	* Converts a saved state patch record to the memory record.
576	*
577	* @returns nothing.
578	* @param pPatch The memory record.
579	* @param pPatchSSM The SSM version of the patch record.
580	*/
581	static void patmR3PatchConvertSSM2Mem(PPATMPATCHREC pPatch, PPATMPATCHRECSSM pPatchSSM)
582	{
583	/*
584	* Only restore the patch part of the tree record; not the internal data (except the key of course)
585	*/
586	pPatch->Core.Key = pPatchSSM->Core.Key;
587	pPatch->CoreOffset.Key = pPatchSSM->CoreOffset.Key;
588	pPatch->patch.uState = pPatchSSM->patch.uState;
589	pPatch->patch.uOldState = pPatchSSM->patch.uOldState;
590	pPatch->patch.uOpMode = pPatchSSM->patch.uOpMode;
591	pPatch->patch.pPrivInstrGC = pPatchSSM->patch.pPrivInstrGC;
592	pPatch->patch.unusedHC = pPatchSSM->patch.unusedHC;
593	memcpy(&pPatch->patch.aPrivInstr[0], &pPatchSSM->patch.aPrivInstr[0], MAX_INSTR_SIZE);
594	pPatch->patch.cbPrivInstr = pPatchSSM->patch.cbPrivInstr;
595	pPatch->patch.opcode = pPatchSSM->patch.opcode;
596	pPatch->patch.cbPatchJump = pPatchSSM->patch.cbPatchJump;
597	pPatch->patch.pPatchJumpDestGC = pPatchSSM->patch.pPatchJumpDestGC;
598	pPatch->patch.pPatchBlockOffset = pPatchSSM->patch.pPatchBlockOffset;
599	pPatch->patch.cbPatchBlockSize = pPatchSSM->patch.cbPatchBlockSize;
600	pPatch->patch.uCurPatchOffset = pPatchSSM->patch.uCurPatchOffset;
601	pPatch->patch.flags = pPatchSSM->patch.flags;
602	pPatch->patch.pInstrGCLowest = pPatchSSM->patch.pInstrGCLowest;
603	pPatch->patch.pInstrGCHighest = pPatchSSM->patch.pInstrGCHighest;
604	pPatch->patch.FixupTree = pPatchSSM->patch.FixupTree;
605	pPatch->patch.nrFixups = pPatchSSM->patch.nrFixups;
606	pPatch->patch.nrJumpRecs = pPatchSSM->patch.nrJumpRecs;
607	pPatch->patch.JumpTree = pPatchSSM->patch.JumpTree;
608	pPatch->patch.Patch2GuestAddrTree = pPatchSSM->patch.Patch2GuestAddrTree;
609	pPatch->patch.Guest2PatchAddrTree = pPatchSSM->patch.Guest2PatchAddrTree;
610	pPatch->patch.nrPatch2GuestRecs = pPatchSSM->patch.nrPatch2GuestRecs;
611	pPatch->patch.unused = pPatchSSM->patch.unused;
612	pPatch->patch.pTempInfo = pPatchSSM->patch.pTempInfo;
613	pPatch->patch.cCodeWrites = pPatchSSM->patch.cCodeWrites;
614	pPatch->patch.cTraps = pPatchSSM->patch.cTraps;
615	pPatch->patch.cInvalidWrites = pPatchSSM->patch.cInvalidWrites;
616	pPatch->patch.uPatchIdx = pPatchSSM->patch.uPatchIdx;
617	pPatch->patch.bDirtyOpcode = pPatchSSM->patch.bDirtyOpcode;
618	pPatch->patch.pTrampolinePatchesHead = NULL;
619	}
620
621	/**
622	* Converts a memory patch record to the saved state version.
623	*
624	* @returns nothing.
625	* @param pPatchSSM The saved state record.
626	* @param pPatch The memory version to save.
627	*/
628	static void patmR3PatchConvertMem2SSM(PPATMPATCHRECSSM pPatchSSM, PPATMPATCHREC pPatch)
629	{
630	pPatchSSM->Core = pPatch->Core;
631	pPatchSSM->CoreOffset = pPatch->CoreOffset;
632	pPatchSSM->patch.uState = pPatch->patch.uState;
633	pPatchSSM->patch.uOldState = pPatch->patch.uOldState;
634	pPatchSSM->patch.uOpMode = pPatch->patch.uOpMode;
635	pPatchSSM->patch.pPrivInstrGC = pPatch->patch.pPrivInstrGC;
636	pPatchSSM->patch.unusedHC = pPatch->patch.unusedHC;
637	memcpy(&pPatchSSM->patch.aPrivInstr[0], &pPatch->patch.aPrivInstr[0], MAX_INSTR_SIZE);
638	pPatchSSM->patch.cbPrivInstr = pPatch->patch.cbPrivInstr;
639	pPatchSSM->patch.opcode = pPatch->patch.opcode;
640	pPatchSSM->patch.cbPatchJump = pPatch->patch.cbPatchJump;
641	pPatchSSM->patch.pPatchJumpDestGC = pPatch->patch.pPatchJumpDestGC;
642	pPatchSSM->patch.pPatchBlockOffset = pPatch->patch.pPatchBlockOffset;
643	pPatchSSM->patch.cbPatchBlockSize = pPatch->patch.cbPatchBlockSize;
644	pPatchSSM->patch.uCurPatchOffset = pPatch->patch.uCurPatchOffset;
645	pPatchSSM->patch.flags = pPatch->patch.flags;
646	pPatchSSM->patch.pInstrGCLowest = pPatch->patch.pInstrGCLowest;
647	pPatchSSM->patch.pInstrGCHighest = pPatch->patch.pInstrGCHighest;
648	pPatchSSM->patch.FixupTree = pPatch->patch.FixupTree;
649	pPatchSSM->patch.nrFixups = pPatch->patch.nrFixups;
650	pPatchSSM->patch.nrJumpRecs = pPatch->patch.nrJumpRecs;
651	pPatchSSM->patch.JumpTree = pPatch->patch.JumpTree;
652	pPatchSSM->patch.Patch2GuestAddrTree = pPatch->patch.Patch2GuestAddrTree;
653	pPatchSSM->patch.Guest2PatchAddrTree = pPatch->patch.Guest2PatchAddrTree;
654	pPatchSSM->patch.nrPatch2GuestRecs = pPatch->patch.nrPatch2GuestRecs;
655	pPatchSSM->patch.unused = pPatch->patch.unused;
656	pPatchSSM->patch.pTempInfo = pPatch->patch.pTempInfo;
657	pPatchSSM->patch.cCodeWrites = pPatch->patch.cCodeWrites;
658	pPatchSSM->patch.cTraps = pPatch->patch.cTraps;
659	pPatchSSM->patch.cInvalidWrites = pPatch->patch.cInvalidWrites;
660	pPatchSSM->patch.uPatchIdx = pPatch->patch.uPatchIdx;
661	pPatchSSM->patch.bDirtyOpcode = pPatch->patch.bDirtyOpcode;
662	}
663
664	/**
665	* Callback function for RTAvloU32DoWithAll
666	*
667	* Saves the state of the patch that's being enumerated
668	*
669	* @returns VBox status code.
670	* @param pNode Current node
671	* @param pVM1 Pointer to the VM
672	*/
673	static DECLCALLBACK(int) patmSavePatchState(PAVLOU32NODECORE pNode, void *pVM1)
674	{
675	PVM pVM = (PVM)pVM1;
676	PPATMPATCHREC pPatch = (PPATMPATCHREC)pNode;
677	PATMPATCHRECSSM patch;
678	PSSMHANDLE pSSM = pVM->patm.s.savedstate.pSSM;
679	int rc;
680
681	Assert(!(pPatch->patch.flags & PATMFL_GLOBAL_FUNCTIONS));
682
683	patmR3PatchConvertMem2SSM(&patch, pPatch);
684	Log4(("patmSavePatchState: cbPatchJump=%u uCurPathOffset=%#x pInstrGCLowest/Higest=%#x/%#x nrFixups=%#x nrJumpRecs=%#x\n",
685	patch.patch.cbPatchJump, patch.patch.uCurPatchOffset, patch.patch.pInstrGCLowest, patch.patch.pInstrGCHighest,
686	patch.patch.nrFixups, patch.patch.nrJumpRecs));
687
688	/*
689	* Reset HC pointers that need to be recalculated when loading the state
690	*/
691	AssertMsg(patch.patch.uState == PATCH_REFUSED \|\| (patch.patch.pPatchBlockOffset \|\| (patch.patch.flags & (PATMFL_SYSENTER_XP\|PATMFL_INT3_REPLACEMENT))),
692	("State = %x pPatchBlockHC=%08x flags=%x\n", patch.patch.uState, PATCHCODE_PTR_HC(&patch.patch), patch.patch.flags));
693	Assert(pPatch->patch.JumpTree == 0);
694	Assert(!pPatch->patch.pTempInfo \|\| pPatch->patch.pTempInfo->DisasmJumpTree == 0);
695	Assert(!pPatch->patch.pTempInfo \|\| pPatch->patch.pTempInfo->IllegalInstrTree == 0);
696
697	/* Save the patch record itself */
698	rc = SSMR3PutStructEx(pSSM, &patch, sizeof(patch), 0 /fFlags/, &g_aPatmPatchRecFields[0], NULL);
699	AssertRCReturn(rc, rc);
700
701	/*
702	* Reset HC pointers in fixup records and save them.
703	*/
704	#ifdef VBOX_STRICT
705	uint32_t nrFixupRecs = 0;
706	RTAvlPVDoWithAll(&pPatch->patch.FixupTree, true, patmCountLeafPV, &nrFixupRecs);
707	AssertMsg(nrFixupRecs == pPatch->patch.nrFixups, ("Fixup inconsistency! counted %d vs %d\n", nrFixupRecs, pPatch->patch.nrFixups));
708	#endif
709	rc = RTAvlPVDoWithAll(&pPatch->patch.FixupTree, true, patmSaveFixupRecords, pVM);
710	AssertRCReturn(rc, rc);
711
712	#ifdef VBOX_STRICT
713	uint32_t nrLookupRecords = 0;
714	RTAvlU32DoWithAll(&pPatch->patch.Patch2GuestAddrTree, true, patmCountLeaf, &nrLookupRecords);
715	Assert(nrLookupRecords == pPatch->patch.nrPatch2GuestRecs);
716	#endif
717
718	rc = RTAvlU32DoWithAll(&pPatch->patch.Patch2GuestAddrTree, true, patmSaveP2GLookupRecords, pVM);
719	AssertRCReturn(rc, rc);
720
721	return VINF_SUCCESS;
722	}
723
724	/**
725	* Execute state save operation.
726	*
727	* @returns VBox status code.
728	* @param pVM Pointer to the VM.
729	* @param pSSM SSM operation handle.
730	*/
731	DECLCALLBACK(int) patmR3Save(PVM pVM, PSSMHANDLE pSSM)
732	{
733	PATM patmInfo = pVM->patm.s;
734	int rc;
735
736	pVM->patm.s.savedstate.pSSM = pSSM;
737
738	/*
739	* Reset HC pointers that need to be recalculated when loading the state
740	*/
741	patmInfo.pPatchMemHC = NULL;
742	patmInfo.pGCStateHC = 0;
743	patmInfo.pvFaultMonitor = 0;
744
745	Assert(patmInfo.ulCallDepth == 0);
746
747	/*
748	* Count the number of patches in the tree (feeling lazy)
749	*/
750	patmInfo.savedstate.cPatches = 0;
751	RTAvloU32DoWithAll(&pVM->patm.s.PatchLookupTreeHC->PatchTree, true, patmCountPatch, &patmInfo.savedstate.cPatches);
752
753	/*
754	* Save PATM structure
755	*/
756	rc = SSMR3PutStructEx(pSSM, &patmInfo, sizeof(patmInfo), 0 /fFlags/, &g_aPatmFields[0], NULL);
757	AssertRCReturn(rc, rc);
758
759	/*
760	* Save patch memory contents
761	*/
762	rc = SSMR3PutMem(pSSM, pVM->patm.s.pPatchMemHC, pVM->patm.s.cbPatchMem);
763	AssertRCReturn(rc, rc);
764
765	/*
766	* Save GC state memory
767	*/
768	rc = SSMR3PutStructEx(pSSM, pVM->patm.s.pGCStateHC, sizeof(PATMGCSTATE), 0 /fFlags/, &g_aPatmGCStateFields[0], NULL);
769	AssertRCReturn(rc, rc);
770
771	/*
772	* Save PATM stack page
773	*/
774	SSMR3PutU32(pSSM, PATM_STACK_TOTAL_SIZE);
775	rc = SSMR3PutMem(pSSM, pVM->patm.s.pGCStackHC, PATM_STACK_TOTAL_SIZE);
776	AssertRCReturn(rc, rc);
777
778	/*
779	* Save all patches
780	*/
781	rc = RTAvloU32DoWithAll(&pVM->patm.s.PatchLookupTreeHC->PatchTree, true, patmSavePatchState, pVM);
782	AssertRCReturn(rc, rc);
783
784	/** @note patch statistics are not saved. */
785
786	return VINF_SUCCESS;
787	}
788
789
790	/**
791	* Execute state load operation.
792	*
793	* @returns VBox status code.
794	* @param pVM Pointer to the VM.
795	* @param pSSM SSM operation handle.
796	* @param uVersion Data layout version.
797	* @param uPass The data pass.
798	*/
799	DECLCALLBACK(int) patmR3Load(PVM pVM, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass)
800	{
801	PATM patmInfo;
802	int rc;
803
804	if ( uVersion != PATM_SAVED_STATE_VERSION
805	&& uVersion != PATM_SAVED_STATE_VERSION_MEM
806	&& uVersion != PATM_SAVED_STATE_VERSION_FIXUP_HACK
807	&& uVersion != PATM_SAVED_STATE_VERSION_VER16
808	)
809	{
810	AssertMsgFailed(("patmR3Load: Invalid version uVersion=%d!\n", uVersion));
811	return VERR_SSM_UNSUPPORTED_DATA_UNIT_VERSION;
812	}
813	uint32_t const fStructRestoreFlags = uVersion <= PATM_SAVED_STATE_VERSION_MEM ? SSMSTRUCT_FLAGS_MEM_BAND_AID_RELAXED : 0;
814	Assert(uPass == SSM_PASS_FINAL); NOREF(uPass);
815
816	pVM->patm.s.savedstate.pSSM = pSSM;
817
818	/*
819	* Restore PATM structure
820	*/
821	RT_ZERO(patmInfo);
822	if ( uVersion == PATM_SAVED_STATE_VERSION_MEM
823	&& SSMR3HandleRevision(pSSM) >= 86139
824	&& SSMR3HandleVersion(pSSM) >= VBOX_FULL_VERSION_MAKE(4, 2, 51))
825	rc = SSMR3GetStructEx(pSSM, &patmInfo, sizeof(patmInfo), SSMSTRUCT_FLAGS_MEM_BAND_AID_RELAXED,
826	&g_aPatmFields86139[0], NULL);
827	else
828	rc = SSMR3GetStructEx(pSSM, &patmInfo, sizeof(patmInfo), fStructRestoreFlags, &g_aPatmFields[0], NULL);
829	AssertRCReturn(rc, rc);
830
831	/* Relative calls are made to the helper functions. Therefor their relative location must not change! */
832	/* Note: we reuse the saved global helpers and assume they are identical, which is kind of dangerous. */
833	AssertLogRelReturn((pVM->patm.s.pfnHelperCallGC - pVM->patm.s.pPatchMemGC) == (patmInfo.pfnHelperCallGC - patmInfo.pPatchMemGC),
834	VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
835	AssertLogRelReturn((pVM->patm.s.pfnHelperRetGC - pVM->patm.s.pPatchMemGC) == (patmInfo.pfnHelperRetGC - patmInfo.pPatchMemGC),
836	VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
837	AssertLogRelReturn((pVM->patm.s.pfnHelperJumpGC - pVM->patm.s.pPatchMemGC) == (patmInfo.pfnHelperJumpGC - patmInfo.pPatchMemGC),
838	VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
839	AssertLogRelReturn((pVM->patm.s.pfnHelperIretGC - pVM->patm.s.pPatchMemGC) == (patmInfo.pfnHelperIretGC - patmInfo.pPatchMemGC),
840	VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
841	AssertLogRelReturn(pVM->patm.s.cbPatchMem == patmInfo.cbPatchMem, VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
842
843	pVM->patm.s.offPatchMem = patmInfo.offPatchMem;
844	pVM->patm.s.deltaReloc = patmInfo.deltaReloc;
845	pVM->patm.s.uCurrentPatchIdx = patmInfo.uCurrentPatchIdx;
846	pVM->patm.s.fOutOfMemory = patmInfo.fOutOfMemory;
847
848	/* Lowest and highest patched instruction */
849	pVM->patm.s.pPatchedInstrGCLowest = patmInfo.pPatchedInstrGCLowest;
850	pVM->patm.s.pPatchedInstrGCHighest = patmInfo.pPatchedInstrGCHighest;
851
852	/* Sysenter handlers */
853	pVM->patm.s.pfnSysEnterGC = patmInfo.pfnSysEnterGC;
854	pVM->patm.s.pfnSysEnterPatchGC = patmInfo.pfnSysEnterPatchGC;
855	pVM->patm.s.uSysEnterPatchIdx = patmInfo.uSysEnterPatchIdx;
856
857	Assert(patmInfo.ulCallDepth == 0 && pVM->patm.s.ulCallDepth == 0);
858
859	Log(("pPatchMemGC %RRv vs old %RRv\n", pVM->patm.s.pPatchMemGC, patmInfo.pPatchMemGC));
860	Log(("pGCStateGC %RRv vs old %RRv\n", pVM->patm.s.pGCStateGC, patmInfo.pGCStateGC));
861	Log(("pGCStackGC %RRv vs old %RRv\n", pVM->patm.s.pGCStackGC, patmInfo.pGCStackGC));
862	Log(("pCPUMCtxGC %RRv vs old %RRv\n", pVM->patm.s.pCPUMCtxGC, patmInfo.pCPUMCtxGC));
863
864
865	/** @note patch statistics are not restored. */
866
867	/*
868	* Restore patch memory contents
869	*/
870	Log(("Restore patch memory: new %RRv old %RRv\n", pVM->patm.s.pPatchMemGC, patmInfo.pPatchMemGC));
871	rc = SSMR3GetMem(pSSM, pVM->patm.s.pPatchMemHC, pVM->patm.s.cbPatchMem);
872	AssertRCReturn(rc, rc);
873
874	/*
875	* Restore GC state memory
876	*/
877	RT_BZERO(pVM->patm.s.pGCStateHC, sizeof(PATMGCSTATE));
878	rc = SSMR3GetStructEx(pSSM, pVM->patm.s.pGCStateHC, sizeof(PATMGCSTATE), fStructRestoreFlags, &g_aPatmGCStateFields[0], NULL);
879	AssertRCReturn(rc, rc);
880
881	/*
882	* Restore PATM stack page
883	*/
884	uint32_t cbStack = PATM_STACK_TOTAL_SIZE;
885	if (uVersion > PATM_SAVED_STATE_VERSION_MEM)
886	{
887	rc = SSMR3GetU32(pSSM, &cbStack);
888	AssertRCReturn(rc, rc);
889	}
890	AssertCompile(!(PATM_STACK_TOTAL_SIZE & 31));
891	AssertLogRelMsgReturn(cbStack > 0 && cbStack <= PATM_STACK_TOTAL_SIZE && !(cbStack & 31),
892	("cbStack=%#x vs %#x", cbStack, PATM_STACK_TOTAL_SIZE),
893	VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
894	rc = SSMR3GetMem(pSSM, pVM->patm.s.pGCStackHC, cbStack);
895	AssertRCReturn(rc, rc);
896	if (cbStack < PATM_STACK_TOTAL_SIZE)
897	memset((uint8_t *)pVM->patm.s.pGCStackHC + cbStack, 0, PATM_STACK_TOTAL_SIZE - cbStack);
898
899	/*
900	* Load all patches
901	*/
902	for (unsigned i = 0; i < patmInfo.savedstate.cPatches; i++)
903	{
904	PATMPATCHRECSSM patch;
905	PATMPATCHREC *pPatchRec;
906
907	RT_ZERO(patch);
908	rc = SSMR3GetStructEx(pSSM, &patch, sizeof(patch), fStructRestoreFlags, &g_aPatmPatchRecFields[0], NULL);
909	AssertRCReturn(rc, rc);
910	Log4(("patmR3Load: cbPatchJump=%u uCurPathOffset=%#x pInstrGCLowest/Higest=%#x/%#x nrFixups=%#x nrJumpRecs=%#x\n",
911	patch.patch.cbPatchJump, patch.patch.uCurPatchOffset, patch.patch.pInstrGCLowest, patch.patch.pInstrGCHighest,
912	patch.patch.nrFixups, patch.patch.nrJumpRecs));
913
914	Assert(!(patch.patch.flags & PATMFL_GLOBAL_FUNCTIONS));
915
916	rc = MMHyperAlloc(pVM, sizeof(PATMPATCHREC), 0, MM_TAG_PATM_PATCH, (void **)&pPatchRec);
917	if (RT_FAILURE(rc))
918	{
919	AssertMsgFailed(("Out of memory!!!!\n"));
920	return VERR_NO_MEMORY;
921	}
922
923	/* Convert SSM version to memory. */
924	patmR3PatchConvertSSM2Mem(pPatchRec, &patch);
925
926	Log(("Restoring patch %RRv -> %RRv state %x\n", pPatchRec->patch.pPrivInstrGC, patmInfo.pPatchMemGC + pPatchRec->patch.pPatchBlockOffset, pPatchRec->patch.uState));
927	bool ret = RTAvloU32Insert(&pVM->patm.s.PatchLookupTreeHC->PatchTree, &pPatchRec->Core);
928	Assert(ret);
929	if (pPatchRec->patch.uState != PATCH_REFUSED)
930	{
931	if (pPatchRec->patch.pPatchBlockOffset)
932	{
933	/* We actually generated code for this patch. */
934	ret = RTAvloU32Insert(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPatchAddr, &pPatchRec->CoreOffset);
935	AssertMsg(ret, ("Inserting patch %RRv offset %08RX32 failed!!\n", pPatchRec->patch.pPrivInstrGC, pPatchRec->CoreOffset.Key));
936	}
937	}
938	/* Set to zero as we don't need it anymore. */
939	pPatchRec->patch.pTempInfo = 0;
940
941	PATMP2GLOOKUPREC cacheRec;
942	RT_ZERO(cacheRec);
943	cacheRec.pPatch = &pPatchRec->patch;
944
945	uint8_t *pPrivInstrHC = patmR3GCVirtToHCVirt(pVM, &cacheRec, pPatchRec->patch.pPrivInstrGC);
946	/* Can fail due to page or page table not present. */
947
948	/*
949	* Restore fixup records and correct HC pointers in fixup records
950	*/
951	pPatchRec->patch.FixupTree = 0;
952	pPatchRec->patch.nrFixups = 0; /* increased by patmPatchAddReloc32 */
953	for (unsigned j = 0; j < patch.patch.nrFixups; j++)
954	{
955	RELOCREC rec;
956	int32_t offset;
957	RTRCPTR *pFixup;
958
959	RT_ZERO(rec);
960	rc = SSMR3GetStructEx(pSSM, &rec, sizeof(rec), fStructRestoreFlags, &g_aPatmRelocRec[0], NULL);
961	AssertRCReturn(rc, rc);
962
963	if (pPrivInstrHC)
964	{
965	/* rec.pRelocPos now contains the relative position inside the hypervisor area. */
966	offset = (int32_t)(intptr_t)rec.pRelocPos;
967	/* Convert to HC pointer again. */
968	if ((uintptr_t)rec.pRelocPos < pVM->patm.s.cbPatchMem)
969	rec.pRelocPos = pVM->patm.s.pPatchMemHC + (uintptr_t)rec.pRelocPos;
970	else
971	rec.pRelocPos = NULL;
972	pFixup = (RTRCPTR *)rec.pRelocPos;
973
974	if (pPatchRec->patch.uState != PATCH_REFUSED)
975	{
976	if ( rec.uType == FIXUP_REL_JMPTOPATCH
977	&& (pPatchRec->patch.flags & PATMFL_PATCHED_GUEST_CODE))
978	{
979	Assert(pPatchRec->patch.cbPatchJump == SIZEOF_NEARJUMP32 \|\| pPatchRec->patch.cbPatchJump == SIZEOF_NEAR_COND_JUMP32);
980	unsigned offset2 = (pPatchRec->patch.cbPatchJump == SIZEOF_NEARJUMP32) ? 1 : 2;
981
982	rec.pRelocPos = pPrivInstrHC + offset2;
983	pFixup = (RTRCPTR *)rec.pRelocPos;
984	}
985
986	rc = patmCorrectFixup(pVM, uVersion, patmInfo, &pPatchRec->patch, &rec, offset, pFixup);
987	AssertRCReturn(rc, rc);
988	}
989
990	rc = patmPatchAddReloc32(pVM, &pPatchRec->patch, rec.pRelocPos, rec.uType, rec.pSource, rec.pDest);
991	AssertRCReturn(rc, rc);
992	}
993	}
994	/* Release previous lock if any. */
995	if (cacheRec.Lock.pvMap)
996	PGMPhysReleasePageMappingLock(pVM, &cacheRec.Lock);
997
998	/* And all patch to guest lookup records */
999	Assert(pPatchRec->patch.nrPatch2GuestRecs \|\| pPatchRec->patch.uState == PATCH_REFUSED \|\| (pPatchRec->patch.flags & (PATMFL_SYSENTER_XP \| PATMFL_IDTHANDLER \| PATMFL_TRAPHANDLER \| PATMFL_INT3_REPLACEMENT)));
1000
1001	pPatchRec->patch.Patch2GuestAddrTree = 0;
1002	pPatchRec->patch.Guest2PatchAddrTree = 0;
1003	if (pPatchRec->patch.nrPatch2GuestRecs)
1004	{
1005	RECPATCHTOGUEST rec;
1006	uint32_t nrPatch2GuestRecs = pPatchRec->patch.nrPatch2GuestRecs;
1007
1008	pPatchRec->patch.nrPatch2GuestRecs = 0; /* incremented by patmr3AddP2GLookupRecord */
1009	for (uint32_t j=0;j<nrPatch2GuestRecs;j++)
1010	{
1011	RT_ZERO(rec);
1012	rc = SSMR3GetStructEx(pSSM, &rec, sizeof(rec), fStructRestoreFlags, &g_aPatmRecPatchToGuest[0], NULL);
1013	AssertRCReturn(rc, rc);
1014
1015	patmR3AddP2GLookupRecord(pVM, &pPatchRec->patch, (uintptr_t)rec.Core.Key + pVM->patm.s.pPatchMemHC, rec.pOrgInstrGC, rec.enmType, rec.fDirty);
1016	}
1017	Assert(pPatchRec->patch.Patch2GuestAddrTree);
1018	}
1019
1020	if (pPatchRec->patch.flags & PATMFL_CODE_MONITORED)
1021	{
1022	/* Insert the guest page lookup records (for detection self-modifying code) */
1023	rc = patmInsertPatchPages(pVM, &pPatchRec->patch);
1024	AssertRCReturn(rc, rc);
1025	}
1026
1027	#if 0 /* can fail def LOG_ENABLED */
1028	if ( pPatchRec->patch.uState != PATCH_REFUSED
1029	&& !(pPatchRec->patch.flags & PATMFL_INT3_REPLACEMENT))
1030	{
1031	pPatchRec->patch.pTempInfo = (PPATCHINFOTEMP)MMR3HeapAllocZ(pVM, MM_TAG_PATM_PATCH, sizeof(PATCHINFOTEMP));
1032	Log(("Patch code ----------------------------------------------------------\n"));
1033	patmr3DisasmCodeStream(pVM, PATCHCODE_PTR_GC(&pPatchRec->patch), PATCHCODE_PTR_GC(&pPatchRec->patch), patmr3DisasmCallback, &pPatchRec->patch);
1034	Log(("Patch code ends -----------------------------------------------------\n"));
1035	MMR3HeapFree(pPatchRec->patch.pTempInfo);
1036	pPatchRec->patch.pTempInfo = NULL;
1037	}
1038	#endif
1039	/* Remove the patch in case the gc mapping is not present. */
1040	if ( !pPrivInstrHC
1041	&& pPatchRec->patch.uState == PATCH_ENABLED)
1042	{
1043	Log(("Remove patch %RGv due to failed HC address translation\n", pPatchRec->patch.pPrivInstrGC));
1044	PATMR3RemovePatch(pVM, pPatchRec->patch.pPrivInstrGC);
1045	}
1046	}
1047
1048	/*
1049	* Correct absolute fixups in the global patch. (helper functions)
1050	* Bit of a mess. Uses the new patch record, but restored patch functions.
1051	*/
1052	PRELOCREC pRec = 0;
1053	AVLPVKEY key = 0;
1054
1055	Log(("Correct fixups in global helper functions\n"));
1056	while (true)
1057	{
1058	int32_t offset;
1059	RTRCPTR *pFixup;
1060
1061	/* Get the record that's closest from above */
1062	pRec = (PRELOCREC)RTAvlPVGetBestFit(&pVM->patm.s.pGlobalPatchRec->patch.FixupTree, key, true);
1063	if (pRec == 0)
1064	break;
1065
1066	key = (AVLPVKEY)(pRec->pRelocPos + 1); /* search for the next record during the next round. */
1067
1068	/* rec.pRelocPos now contains the relative position inside the hypervisor area. */
1069	offset = (int32_t)(pRec->pRelocPos - pVM->patm.s.pPatchMemHC);
1070	pFixup = (RTRCPTR *)pRec->pRelocPos;
1071
1072	/* Correct fixups that refer to PATM structures in the hypervisor region (their addresses might have changed). */
1073	rc = patmCorrectFixup(pVM, uVersion, patmInfo, &pVM->patm.s.pGlobalPatchRec->patch, pRec, offset, pFixup);
1074	AssertRCReturn(rc, rc);
1075	}
1076
1077	#ifdef VBOX_WITH_STATISTICS
1078	/*
1079	* Restore relevant old statistics
1080	*/
1081	pVM->patm.s.StatDisabled = patmInfo.StatDisabled;
1082	pVM->patm.s.StatUnusable = patmInfo.StatUnusable;
1083	pVM->patm.s.StatEnabled = patmInfo.StatEnabled;
1084	pVM->patm.s.StatInstalled = patmInfo.StatInstalled;
1085	#endif
1086
1087	return VINF_SUCCESS;
1088	}
1089
1090	/**
1091	* Correct fixups to predefined hypervisor PATM regions. (their addresses might have changed)
1092	*
1093	* @returns VBox status code.
1094	* @param pVM Pointer to the VM.
1095	* @param uVersion Saved state version.
1096	* @param patmInfo Saved PATM structure
1097	* @param pPatch Patch record
1098	* @param pRec Relocation record
1099	* @param offset Offset of referenced data/code
1100	* @param pFixup Fixup address
1101	*/
1102	static int patmCorrectFixup(PVM pVM, unsigned uVersion, PATM &patmInfo, PPATCHINFO pPatch, PRELOCREC pRec,
1103	int32_t offset, RTRCPTR *pFixup)
1104	{
1105	int32_t delta = pVM->patm.s.pPatchMemGC - patmInfo.pPatchMemGC;
1106
1107	switch (pRec->uType)
1108	{
1109	case FIXUP_ABSOLUTE:
1110	case FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL:
1111	{
1112	Assert( pRec->uType != PATM_SAVED_STATE_VERSION_NO_RAW_MEM
1113	\|\| (pRec->pSource == pRec->pDest && PATM_IS_ASMFIX(pRec->pSource)) );
1114
1115	/* bird: What is this for exactly? Only the MMIO fixups used to have pSource set. */
1116	if ( pRec->pSource
1117	&& !PATMIsPatchGCAddr(pVM, (RTRCUINTPTR)pRec->pSource)
1118	&& pRec->uType != FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL)
1119	break;
1120
1121	RTRCPTR const uFixup = *pFixup;
1122	if ( uFixup >= patmInfo.pGCStateGC
1123	&& uFixup < patmInfo.pGCStateGC + sizeof(PATMGCSTATE))
1124	{
1125	LogFlow(("Changing absolute GCState at %RRv from %RRv to %RRv\n", patmInfo.pPatchMemGC + offset, uFixup, (uFixup - patmInfo.pGCStateGC) + pVM->patm.s.pGCStateGC));
1126	*pFixup = (uFixup - patmInfo.pGCStateGC) + pVM->patm.s.pGCStateGC;
1127	}
1128	else if ( uFixup >= patmInfo.pCPUMCtxGC
1129	&& uFixup < patmInfo.pCPUMCtxGC + sizeof(CPUMCTX))
1130	{
1131	LogFlow(("Changing absolute CPUMCTX at %RRv from %RRv to %RRv\n", patmInfo.pPatchMemGC + offset, uFixup, (uFixup - patmInfo.pCPUMCtxGC) + pVM->patm.s.pCPUMCtxGC));
1132
1133	/* The CPUMCTX structure has completely changed, so correct the offsets too. */
1134	if (uVersion == PATM_SAVED_STATE_VERSION_VER16)
1135	{
1136	unsigned offCpumCtx = uFixup - patmInfo.pCPUMCtxGC;
1137
1138	/* ''case RT_OFFSETOF()'' does not work as gcc refuses to use & as a constant expression.
1139	* Defining RT_OFFSETOF as __builtin_offsetof for gcc would make this possible. But this
1140	* function is not available in older gcc versions, at least not in gcc-3.3 */
1141	if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, dr0))
1142	{
1143	LogFlow(("Changing dr[0] offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, dr[0])));
1144	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, dr[0]);
1145	}
1146	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, dr1))
1147	{
1148	LogFlow(("Changing dr[1] offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, dr[1])));
1149	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, dr[1]);
1150	}
1151	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, dr2))
1152	{
1153	LogFlow(("Changing dr[2] offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, dr[2])));
1154	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, dr[2]);
1155	}
1156	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, dr3))
1157	{
1158	LogFlow(("Changing dr[3] offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, dr[3])));
1159	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, dr[3]);
1160	}
1161	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, dr4))
1162	{
1163	LogFlow(("Changing dr[4] offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, dr[4])));
1164	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, dr[4]);
1165	}
1166	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, dr5))
1167	{
1168	LogFlow(("Changing dr[5] offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, dr[5])));
1169	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, dr[5]);
1170	}
1171	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, dr6))
1172	{
1173	LogFlow(("Changing dr[6] offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, dr[6])));
1174	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, dr[6]);
1175	}
1176	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, dr7))
1177	{
1178	LogFlow(("Changing dr[7] offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, dr[7])));
1179	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, dr[7]);
1180	}
1181	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, cr0))
1182	{
1183	LogFlow(("Changing cr0 offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, cr0)));
1184	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, cr0);
1185	}
1186	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, cr2))
1187	{
1188	LogFlow(("Changing cr2 offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, cr2)));
1189	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, cr2);
1190	}
1191	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, cr3))
1192	{
1193	LogFlow(("Changing cr3 offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, cr3)));
1194	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, cr3);
1195	}
1196	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, cr4))
1197	{
1198	LogFlow(("Changing cr4 offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, cr4)));
1199	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, cr4);
1200	}
1201	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, tr))
1202	{
1203	LogFlow(("Changing tr offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, tr)));
1204	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, tr);
1205	}
1206	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, ldtr))
1207	{
1208	LogFlow(("Changing ldtr offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, ldtr)));
1209	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, ldtr);
1210	}
1211	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, gdtr.pGdt))
1212	{
1213	LogFlow(("Changing pGdt offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, gdtr.pGdt)));
1214	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, gdtr.pGdt);
1215	}
1216	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, gdtr.cbGdt))
1217	{
1218	LogFlow(("Changing cbGdt offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, gdtr.cbGdt)));
1219	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, gdtr.cbGdt);
1220	}
1221	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, idtr.pIdt))
1222	{
1223	LogFlow(("Changing pIdt offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, idtr.pIdt)));
1224	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, idtr.pIdt);
1225	}
1226	else if (offCpumCtx == (unsigned)RT_OFFSETOF(CPUMCTX_VER1_6, idtr.cbIdt))
1227	{
1228	LogFlow(("Changing cbIdt offset from %x to %x\n", offCpumCtx, RT_OFFSETOF(CPUMCTX, idtr.cbIdt)));
1229	*pFixup = pVM->patm.s.pCPUMCtxGC + RT_OFFSETOF(CPUMCTX, idtr.cbIdt);
1230	}
1231	else
1232	AssertMsgFailed(("Unexpected CPUMCTX offset %x\n", offCpumCtx));
1233	}
1234	else
1235	*pFixup = (uFixup - patmInfo.pCPUMCtxGC) + pVM->patm.s.pCPUMCtxGC;
1236	}
1237	else if ( uFixup >= patmInfo.pStatsGC
1238	&& uFixup < patmInfo.pStatsGC + PATM_STAT_MEMSIZE)
1239	{
1240	LogFlow(("Changing absolute Stats at %RRv from %RRv to %RRv\n", patmInfo.pPatchMemGC + offset, uFixup, (uFixup - patmInfo.pStatsGC) + pVM->patm.s.pStatsGC));
1241	*pFixup = (uFixup - patmInfo.pStatsGC) + pVM->patm.s.pStatsGC;
1242	}
1243	else if ( uFixup >= patmInfo.pGCStackGC
1244	&& uFixup < patmInfo.pGCStackGC + PATM_STACK_TOTAL_SIZE)
1245	{
1246	LogFlow(("Changing absolute Stack at %RRv from %RRv to %RRv\n", patmInfo.pPatchMemGC + offset, uFixup, (uFixup - patmInfo.pGCStackGC) + pVM->patm.s.pGCStackGC));
1247	*pFixup = (uFixup - patmInfo.pGCStackGC) + pVM->patm.s.pGCStackGC;
1248	}
1249	else if ( uFixup >= patmInfo.pPatchMemGC
1250	&& uFixup < patmInfo.pPatchMemGC + patmInfo.cbPatchMem)
1251	{
1252	LogFlow(("Changing absolute PatchMem at %RRv from %RRv to %RRv\n", patmInfo.pPatchMemGC + offset, uFixup, (uFixup - patmInfo.pPatchMemGC) + pVM->patm.s.pPatchMemGC));
1253	*pFixup = (uFixup - patmInfo.pPatchMemGC) + pVM->patm.s.pPatchMemGC;
1254	}
1255	/*
1256	* For PATM_SAVED_STATE_VERSION_FIXUP_HACK and earlier boldly ASSUME:
1257	* 1. That pCPUMCtxGC is in the VM structure and that its location is
1258	* at the first page of the same 4 MB chunk.
1259	* 2. That the forced actions were in the first 32 bytes of the VM
1260	* structure.
1261	* 3. That the CPUM leaves are less than 8KB into the structure.
1262	*/
1263	else if ( uVersion <= PATM_SAVED_STATE_VERSION_FIXUP_HACK
1264	&& uFixup - (patmInfo.pCPUMCtxGC & UINT32_C(0xffc00000)) < UINT32_C(32))
1265	{
1266	LogFlow(("Changing fLocalForcedActions fixup from %RRv to %RRv\n", uFixup, pVM->pVMRC + RT_OFFSETOF(VM, aCpus[0].fLocalForcedActions)));
1267	*pFixup = pVM->pVMRC + RT_OFFSETOF(VM, aCpus[0].fLocalForcedActions);
1268	pRec->pSource = pRec->pDest = PATM_ASMFIX_VM_FORCEDACTIONS;
1269	pRec->uType = FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL;
1270	}
1271	else if ( uVersion <= PATM_SAVED_STATE_VERSION_FIXUP_HACK
1272	&& uFixup - (patmInfo.pCPUMCtxGC & UINT32_C(0xffc00000)) < UINT32_C(8192))
1273	{
1274	static int cCpuidFixup = 0;
1275
1276	/* Very dirty assumptions about the cpuid patch and cpuid ordering. */
1277	switch (cCpuidFixup & 3)
1278	{
1279	case 0:
1280	*pFixup = CPUMR3GetGuestCpuIdPatmDefRCPtr(pVM);
1281	pRec->pSource = pRec->pDest = PATM_ASMFIX_CPUID_DEF_PTR;
1282	pRec->uType = FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL;
1283	break;
1284	case 1:
1285	*pFixup = CPUMR3GetGuestCpuIdPatmStdRCPtr(pVM);
1286	pRec->pSource = pRec->pDest = PATM_ASMFIX_CPUID_STD_PTR;
1287	pRec->uType = FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL;
1288	break;
1289	case 2:
1290	*pFixup = CPUMR3GetGuestCpuIdPatmExtRCPtr(pVM);
1291	pRec->pSource = pRec->pDest = PATM_ASMFIX_CPUID_EXT_PTR;
1292	pRec->uType = FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL;
1293	break;
1294	case 3:
1295	*pFixup = CPUMR3GetGuestCpuIdPatmCentaurRCPtr(pVM);
1296	pRec->pSource = pRec->pDest = PATM_ASMFIX_CPUID_CENTAUR_PTR;
1297	pRec->uType = FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL;
1298	break;
1299	}
1300	LogFlow(("Changing cpuid fixup %d from %RRv to %RRv\n", cCpuidFixup, uFixup, *pFixup));
1301	cCpuidFixup++;
1302	}
1303	/*
1304	* For PATM_SAVED_STATE_VERSION_MEM thru PATM_SAVED_STATE_VERSION_NO_RAW_MEM
1305	* we abused Core.Key to store the type for fixups needing correcting on load.
1306	*/
1307	else if ( uVersion >= PATM_SAVED_STATE_VERSION_MEM
1308	&& uVersion <= PATM_SAVED_STATE_VERSION_NO_RAW_MEM)
1309	{
1310	/* Core.Key abused to store the type of fixup. */
1311	switch ((uintptr_t)pRec->Core.Key)
1312	{
1313	case PATM_FIXUP_CPU_FF_ACTION:
1314	*pFixup = pVM->pVMRC + RT_OFFSETOF(VM, aCpus[0].fLocalForcedActions);
1315	pRec->pSource = pRec->pDest = PATM_ASMFIX_VM_FORCEDACTIONS;
1316	pRec->uType = FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL;
1317	LogFlow(("Changing cpu ff action fixup from %x to %x\n", uFixup, *pFixup));
1318	break;
1319	case PATM_FIXUP_CPUID_DEFAULT:
1320	*pFixup = CPUMR3GetGuestCpuIdPatmDefRCPtr(pVM);
1321	pRec->pSource = pRec->pDest = PATM_ASMFIX_CPUID_DEF_PTR;
1322	pRec->uType = FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL;
1323	LogFlow(("Changing cpuid def fixup from %x to %x\n", uFixup, *pFixup));
1324	break;
1325	case PATM_FIXUP_CPUID_STANDARD:
1326	*pFixup = CPUMR3GetGuestCpuIdPatmStdRCPtr(pVM);
1327	pRec->pSource = pRec->pDest = PATM_ASMFIX_CPUID_STD_PTR;
1328	pRec->uType = FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL;
1329	LogFlow(("Changing cpuid std fixup from %x to %x\n", uFixup, *pFixup));
1330	break;
1331	case PATM_FIXUP_CPUID_EXTENDED:
1332	*pFixup = CPUMR3GetGuestCpuIdPatmExtRCPtr(pVM);
1333	pRec->pSource = pRec->pDest = PATM_ASMFIX_CPUID_EXT_PTR;
1334	pRec->uType = FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL;
1335	LogFlow(("Changing cpuid ext fixup from %x to %x\n", uFixup, *pFixup));
1336	break;
1337	case PATM_FIXUP_CPUID_CENTAUR:
1338	*pFixup = CPUMR3GetGuestCpuIdPatmCentaurRCPtr(pVM);
1339	pRec->pSource = pRec->pDest = PATM_ASMFIX_CPUID_CENTAUR_PTR;
1340	pRec->uType = FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL;
1341	LogFlow(("Changing cpuid centaur fixup from %x to %x\n", uFixup, *pFixup));
1342	break;
1343	default:
1344	AssertMsgFailed(("Unexpected fixup value %p\n", (uintptr_t)pRec->Core.Key));
1345	break;
1346	}
1347	}
1348	/*
1349	* After PATM_SAVED_STATE_VERSION_NO_RAW_MEM we changed the fixup type
1350	* and instead put the patch fixup code in the source and target addresses.
1351	*/
1352	else if ( uVersion > PATM_SAVED_STATE_VERSION_NO_RAW_MEM
1353	&& pRec->uType == FIXUP_ABSOLUTE_IN_PATCH_ASM_TMPL)
1354	{
1355	Assert(pRec->pSource == pRec->pDest); Assert(PATM_IS_ASMFIX(pRec->pSource));
1356	switch (pRec->pSource)
1357	{
1358	case PATM_ASMFIX_VM_FORCEDACTIONS:
1359	*pFixup = pVM->pVMRC + RT_OFFSETOF(VM, aCpus[0].fLocalForcedActions);
1360	break;
1361	case PATM_ASMFIX_CPUID_DEF_PTR:
1362	*pFixup = CPUMR3GetGuestCpuIdPatmDefRCPtr(pVM);
1363	break;
1364	case PATM_ASMFIX_CPUID_STD_PTR: /* Saved again patches only. */
1365	*pFixup = CPUMR3GetGuestCpuIdPatmStdRCPtr(pVM);
1366	break;
1367	case PATM_ASMFIX_CPUID_EXT_PTR: /* Saved again patches only. */
1368	*pFixup = CPUMR3GetGuestCpuIdPatmExtRCPtr(pVM);
1369	break;
1370	case PATM_ASMFIX_CPUID_CENTAUR_PTR: /* Saved again patches only. */
1371	*pFixup = CPUMR3GetGuestCpuIdPatmCentaurRCPtr(pVM);
1372	break;
1373	case PATM_ASMFIX_REUSE_LATER_0: /* Was only used for a few days. Don't want to keep this legacy around. */
1374	case PATM_ASMFIX_REUSE_LATER_1:
1375	AssertLogRelMsgFailedReturn(("Unsupported PATM fixup. You have to discard this saved state or snapshot."),
1376	VERR_INTERNAL_ERROR);
1377	break;
1378	}
1379	}
1380	/*
1381	* Constant that may change between VM version needs fixing up.
1382	*/
1383	else if (pRec->uType == FIXUP_CONSTANT_IN_PATCH_ASM_TMPL)
1384	{
1385	AssertLogRelReturn(uVersion > PATM_SAVED_STATE_VERSION_NO_RAW_MEM, VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
1386	Assert(pRec->pSource == pRec->pDest); Assert(PATM_IS_ASMFIX(pRec->pSource));
1387	switch (pRec->pSource)
1388	{
1389	case PATM_ASMFIX_REUSE_LATER_2: /* Was only used for a few days. Don't want to keep this legacy around. */
1390	case PATM_ASMFIX_REUSE_LATER_3:
1391	AssertLogRelMsgFailedReturn(("Unsupported PATM fixup. You have to discard this saved state or snapshot."),
1392	VERR_INTERNAL_ERROR);
1393	break;
1394	default:
1395	AssertLogRelMsgFailed(("Unknown FIXUP_CONSTANT_IN_PATCH_ASM_TMPL fixup: %#x\n", pRec->pSource));
1396	return VERR_SSM_DATA_UNIT_FORMAT_CHANGED;
1397	}
1398	}
1399	/*
1400	* Relative fixups for calling or jumping to helper functions inside VMMRC.
1401	* (The distance between the helper function and the patch is subject to
1402	* new code being added to VMMRC as well as VM configurations influencing
1403	* heap allocations and so on and so forth.)
1404	*/
1405	else if (pRec->uType == FIXUP_REL_HELPER_IN_PATCH_ASM_TMPL)
1406	{
1407	AssertLogRelReturn(uVersion > PATM_SAVED_STATE_VERSION_NO_RAW_MEM, VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
1408	Assert(pRec->pSource == pRec->pDest); Assert(PATM_IS_ASMFIX(pRec->pSource));
1409	int rc;
1410	RTRCPTR uRCPtrDest;
1411	switch (pRec->pSource)
1412	{
1413	case PATM_ASMFIX_HELPER_CPUM_CPUID:
1414	rc = PDMR3LdrGetSymbolRC(pVM, NULL, "CPUMPatchHlpCpuId", &uRCPtrDest);
1415	AssertLogRelRCReturn(rc, rc);
1416	break;
1417	default:
1418	AssertLogRelMsgFailed(("Unknown FIXUP_REL_HLP_CALL_IN_PATCH_ASM_TMPL fixup: %#x\n", pRec->pSource));
1419	return VERR_SSM_DATA_UNIT_FORMAT_CHANGED;
1420	}
1421	RTRCPTR uRCPtrAfter = pVM->patm.s.pPatchMemGC + ((uintptr_t)&pFixup[1] - (uintptr_t)pVM->patm.s.pPatchMemHC);
1422	*pFixup = uRCPtrDest - uRCPtrAfter;
1423	}
1424
1425	#ifdef RT_OS_WINDOWS
1426	AssertCompile(RT_OFFSETOF(VM, fGlobalForcedActions) < 32);
1427	#endif
1428	break;
1429	}
1430
1431	case FIXUP_REL_JMPTOPATCH:
1432	{
1433	RTRCPTR pTarget = (RTRCPTR)((RTRCINTPTR)pRec->pDest + delta);
1434
1435	if ( pPatch->uState == PATCH_ENABLED
1436	&& (pPatch->flags & PATMFL_PATCHED_GUEST_CODE))
1437	{
1438	uint8_t oldJump[SIZEOF_NEAR_COND_JUMP32];
1439	uint8_t temp[SIZEOF_NEAR_COND_JUMP32];
1440	RTRCPTR pJumpOffGC;
1441	RTRCINTPTR displ = (RTRCINTPTR)pTarget - (RTRCINTPTR)pRec->pSource;
1442	RTRCINTPTR displOld= (RTRCINTPTR)pRec->pDest - (RTRCINTPTR)pRec->pSource;
1443
1444	Log(("Relative fixup (g2p) %08X -> %08X at %08X (source=%08x, target=%08x)\n", (int32_t)pRec->pRelocPos, displ, pRec->pRelocPos, pRec->pSource, pRec->pDest));
1445
1446	Assert(pRec->pSource - pPatch->cbPatchJump == pPatch->pPrivInstrGC);
1447	#ifdef PATM_RESOLVE_CONFLICTS_WITH_JUMP_PATCHES
1448	if (pPatch->cbPatchJump == SIZEOF_NEAR_COND_JUMP32)
1449	{
1450	Assert(pPatch->flags & PATMFL_JUMP_CONFLICT);
1451
1452	pJumpOffGC = pPatch->pPrivInstrGC + 2; //two byte opcode
1453	oldJump[0] = pPatch->aPrivInstr[0];
1454	oldJump[1] = pPatch->aPrivInstr[1];
1455	(RTRCUINTPTR )&oldJump[2] = displOld;
1456	}
1457	else
1458	#endif
1459	if (pPatch->cbPatchJump == SIZEOF_NEARJUMP32)
1460	{
1461	pJumpOffGC = pPatch->pPrivInstrGC + 1; //one byte opcode
1462	oldJump[0] = 0xE9;
1463	(RTRCUINTPTR )&oldJump[1] = displOld;
1464	}
1465	else
1466	{
1467	AssertMsgFailed(("Invalid patch jump size %d\n", pPatch->cbPatchJump));
1468	break;
1469	}
1470	Assert(pPatch->cbPatchJump <= sizeof(temp));
1471
1472	/*
1473	* Read old patch jump and compare it to the one we previously installed
1474	*/
1475	int rc = PGMPhysSimpleReadGCPtr(VMMGetCpu0(pVM), temp, pPatch->pPrivInstrGC, pPatch->cbPatchJump);
1476	Assert(RT_SUCCESS(rc) \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT);
1477
1478	if (rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT)
1479	{
1480	RTRCPTR pPage = pPatch->pPrivInstrGC & PAGE_BASE_GC_MASK;
1481	rc = PGMR3HandlerVirtualRegister(pVM, VMMGetCpu(pVM), pVM->patm.s.hMonitorPageType,
1482	pPage,
1483	pPage + (PAGE_SIZE - 1) /* inclusive! */,
1484	(void )(uintptr_t)pPage, pPage, NULL /pszDesc*/);
1485	Assert(RT_SUCCESS(rc) \|\| rc == VERR_PGM_HANDLER_VIRTUAL_CONFLICT);
1486	}
1487	else
1488	if (memcmp(temp, oldJump, pPatch->cbPatchJump))
1489	{
1490	Log(("PATM: Patch jump was overwritten -> disabling patch!!\n"));
1491	/*
1492	* Disable patch; this is not a good solution
1493	*/
1494	/* @todo hopefully it was completely overwritten (if the read was successful)!!!! */
1495	pPatch->uState = PATCH_DISABLED;
1496	}
1497	else
1498	if (RT_SUCCESS(rc))
1499	{
1500	rc = PGMPhysSimpleDirtyWriteGCPtr(VMMGetCpu0(pVM), pJumpOffGC, &displ, sizeof(displ));
1501	AssertRC(rc);
1502	}
1503	else
1504	AssertMsgFailed(("Unexpected error %d from MMR3PhysReadGCVirt\n", rc));
1505	}
1506	else
1507	Log(("Skip the guest jump to patch code for this disabled patch %08X\n", pRec->pRelocPos));
1508
1509	pRec->pDest = pTarget;
1510	break;
1511	}
1512
1513	case FIXUP_REL_JMPTOGUEST:
1514	{
1515	RTRCPTR pSource = (RTRCPTR)((RTRCINTPTR)pRec->pSource + delta);
1516	RTRCINTPTR displ = (RTRCINTPTR)pRec->pDest - (RTRCINTPTR)pSource;
1517
1518	Assert(!(pPatch->flags & PATMFL_GLOBAL_FUNCTIONS));
1519	Log(("Relative fixup (p2g) %08X -> %08X at %08X (source=%08x, target=%08x)\n", (int32_t)pRec->pRelocPos, displ, pRec->pRelocPos, pRec->pSource, pRec->pDest));
1520	(RTRCUINTPTR )pRec->pRelocPos = displ;
1521	pRec->pSource = pSource;
1522	break;
1523
1524	}
1525	}
1526	return VINF_SUCCESS;
1527	}
1528

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMR3/PATMSSM.cpp@ 55889

Download in other formats: