PGMSavedState.cpp@ 64115

Last change on this file since 64115 was 64115, checked in by vboxsync, 8 years ago
PDM,IOM,PGM: Morphed the MMIO2 API into a mixed MMIO2 and pre-registered MMIO API that is able to deal with really large (<= 64GB) MMIO ranges. Limited testing, so back out at first sign of trouble.
Property svn:eol-style set to `native` Property svn:keywords set to `Id Revision`
File size: 128.8 KB

Line
1	/* $Id: PGMSavedState.cpp 64115 2016-09-30 20:14:27Z vboxsync $ */
2	/** @file
3	* PGM - Page Manager and Monitor, The Saved State Part.
4	*/
5
6	/*
7	* Copyright (C) 2006-2016 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Header Files *
21	*********************************************************************************************************************************/
22	#define LOG_GROUP LOG_GROUP_PGM
23	#include <VBox/vmm/pgm.h>
24	#include <VBox/vmm/stam.h>
25	#include <VBox/vmm/ssm.h>
26	#include <VBox/vmm/pdmdrv.h>
27	#include <VBox/vmm/pdmdev.h>
28	#include "PGMInternal.h"
29	#include <VBox/vmm/vm.h>
30	#include "PGMInline.h"
31
32	#include <VBox/param.h>
33	#include <VBox/err.h>
34	#include <VBox/vmm/ftm.h>
35
36	#include <iprt/asm.h>
37	#include <iprt/assert.h>
38	#include <iprt/crc.h>
39	#include <iprt/mem.h>
40	#include <iprt/sha.h>
41	#include <iprt/string.h>
42	#include <iprt/thread.h>
43
44
45	/*********************************************************************************************************************************
46	* Defined Constants And Macros *
47	*********************************************************************************************************************************/
48	/** Saved state data unit version. */
49	#define PGM_SAVED_STATE_VERSION 14
50	/** Saved state data unit version before the PAE PDPE registers. */
51	#define PGM_SAVED_STATE_VERSION_PRE_PAE 13
52	/** Saved state data unit version after this includes ballooned page flags in
53	* the state (see @bugref{5515}). */
54	#define PGM_SAVED_STATE_VERSION_BALLOON_BROKEN 12
55	/** Saved state before the balloon change. */
56	#define PGM_SAVED_STATE_VERSION_PRE_BALLOON 11
57	/** Saved state data unit version used during 3.1 development, misses the RAM
58	* config. */
59	#define PGM_SAVED_STATE_VERSION_NO_RAM_CFG 10
60	/** Saved state data unit version for 3.0 (pre teleportation). */
61	#define PGM_SAVED_STATE_VERSION_3_0_0 9
62	/** Saved state data unit version for 2.2.2 and later. */
63	#define PGM_SAVED_STATE_VERSION_2_2_2 8
64	/** Saved state data unit version for 2.2.0. */
65	#define PGM_SAVED_STATE_VERSION_RR_DESC 7
66	/** Saved state data unit version. */
67	#define PGM_SAVED_STATE_VERSION_OLD_PHYS_CODE 6
68
69
70	/** @name Sparse state record types
71	* @{ */
72	/** Zero page. No data. */
73	#define PGM_STATE_REC_RAM_ZERO UINT8_C(0x00)
74	/** Raw page. */
75	#define PGM_STATE_REC_RAM_RAW UINT8_C(0x01)
76	/** Raw MMIO2 page. */
77	#define PGM_STATE_REC_MMIO2_RAW UINT8_C(0x02)
78	/** Zero MMIO2 page. */
79	#define PGM_STATE_REC_MMIO2_ZERO UINT8_C(0x03)
80	/** Virgin ROM page. Followed by protection (8-bit) and the raw bits. */
81	#define PGM_STATE_REC_ROM_VIRGIN UINT8_C(0x04)
82	/** Raw shadowed ROM page. The protection (8-bit) precedes the raw bits. */
83	#define PGM_STATE_REC_ROM_SHW_RAW UINT8_C(0x05)
84	/** Zero shadowed ROM page. The protection (8-bit) is the only payload. */
85	#define PGM_STATE_REC_ROM_SHW_ZERO UINT8_C(0x06)
86	/** ROM protection (8-bit). */
87	#define PGM_STATE_REC_ROM_PROT UINT8_C(0x07)
88	/** Ballooned page. No data. */
89	#define PGM_STATE_REC_RAM_BALLOONED UINT8_C(0x08)
90	/** The last record type. */
91	#define PGM_STATE_REC_LAST PGM_STATE_REC_RAM_BALLOONED
92	/** End marker. */
93	#define PGM_STATE_REC_END UINT8_C(0xff)
94	/** Flag indicating that the data is preceded by the page address.
95	* For RAW pages this is a RTGCPHYS. For MMIO2 and ROM pages this is a 8-bit
96	* range ID and a 32-bit page index.
97	*/
98	#define PGM_STATE_REC_FLAG_ADDR UINT8_C(0x80)
99	/** @} */
100
101	/** The CRC-32 for a zero page. */
102	#define PGM_STATE_CRC32_ZERO_PAGE UINT32_C(0xc71c0011)
103	/** The CRC-32 for a zero half page. */
104	#define PGM_STATE_CRC32_ZERO_HALF_PAGE UINT32_C(0xf1e8ba9e)
105
106
107
108	/** @name Old Page types used in older saved states.
109	* @{ */
110	/** Old saved state: The usual invalid zero entry. */
111	#define PGMPAGETYPE_OLD_INVALID 0
112	/** Old saved state: RAM page. (RWX) */
113	#define PGMPAGETYPE_OLD_RAM 1
114	/** Old saved state: MMIO2 page. (RWX) */
115	#define PGMPAGETYPE_OLD_MMIO2 1
116	/** Old saved state: MMIO2 page aliased over an MMIO page. (RWX)
117	* See PGMHandlerPhysicalPageAlias(). */
118	#define PGMPAGETYPE_OLD_MMIO2_ALIAS_MMIO 2
119	/** Old saved state: Shadowed ROM. (RWX) */
120	#define PGMPAGETYPE_OLD_ROM_SHADOW 3
121	/** Old saved state: ROM page. (R-X) */
122	#define PGMPAGETYPE_OLD_ROM 4
123	/** Old saved state: MMIO page. (---) */
124	#define PGMPAGETYPE_OLD_MMIO 5
125	/** @} */
126
127
128	/*********************************************************************************************************************************
129	* Structures and Typedefs *
130	*********************************************************************************************************************************/
131	/** For loading old saved states. (pre-smp) */
132	typedef struct
133	{
134	/** If set no conflict checks are required. (boolean) */
135	bool fMappingsFixed;
136	/** Size of fixed mapping */
137	uint32_t cbMappingFixed;
138	/** Base address (GC) of fixed mapping */
139	RTGCPTR GCPtrMappingFixed;
140	/** A20 gate mask.
141	* Our current approach to A20 emulation is to let REM do it and don't bother
142	* anywhere else. The interesting guests will be operating with it enabled anyway.
143	* But should the need arise, we'll subject physical addresses to this mask. */
144	RTGCPHYS GCPhysA20Mask;
145	/** A20 gate state - boolean! */
146	bool fA20Enabled;
147	/** The guest paging mode. */
148	PGMMODE enmGuestMode;
149	} PGMOLD;
150
151
152	/*********************************************************************************************************************************
153	* Global Variables *
154	*********************************************************************************************************************************/
155	/** PGM fields to save/load. */
156
157	static const SSMFIELD s_aPGMFields[] =
158	{
159	SSMFIELD_ENTRY( PGM, fMappingsFixed),
160	SSMFIELD_ENTRY_GCPTR( PGM, GCPtrMappingFixed),
161	SSMFIELD_ENTRY( PGM, cbMappingFixed),
162	SSMFIELD_ENTRY( PGM, cBalloonedPages),
163	SSMFIELD_ENTRY_TERM()
164	};
165
166	static const SSMFIELD s_aPGMFieldsPreBalloon[] =
167	{
168	SSMFIELD_ENTRY( PGM, fMappingsFixed),
169	SSMFIELD_ENTRY_GCPTR( PGM, GCPtrMappingFixed),
170	SSMFIELD_ENTRY( PGM, cbMappingFixed),
171	SSMFIELD_ENTRY_TERM()
172	};
173
174	static const SSMFIELD s_aPGMCpuFields[] =
175	{
176	SSMFIELD_ENTRY( PGMCPU, fA20Enabled),
177	SSMFIELD_ENTRY_GCPHYS( PGMCPU, GCPhysA20Mask),
178	SSMFIELD_ENTRY( PGMCPU, enmGuestMode),
179	SSMFIELD_ENTRY( PGMCPU, aGCPhysGstPaePDs[0]),
180	SSMFIELD_ENTRY( PGMCPU, aGCPhysGstPaePDs[1]),
181	SSMFIELD_ENTRY( PGMCPU, aGCPhysGstPaePDs[2]),
182	SSMFIELD_ENTRY( PGMCPU, aGCPhysGstPaePDs[3]),
183	SSMFIELD_ENTRY_TERM()
184	};
185
186	static const SSMFIELD s_aPGMCpuFieldsPrePae[] =
187	{
188	SSMFIELD_ENTRY( PGMCPU, fA20Enabled),
189	SSMFIELD_ENTRY_GCPHYS( PGMCPU, GCPhysA20Mask),
190	SSMFIELD_ENTRY( PGMCPU, enmGuestMode),
191	SSMFIELD_ENTRY_TERM()
192	};
193
194	static const SSMFIELD s_aPGMFields_Old[] =
195	{
196	SSMFIELD_ENTRY( PGMOLD, fMappingsFixed),
197	SSMFIELD_ENTRY_GCPTR( PGMOLD, GCPtrMappingFixed),
198	SSMFIELD_ENTRY( PGMOLD, cbMappingFixed),
199	SSMFIELD_ENTRY( PGMOLD, fA20Enabled),
200	SSMFIELD_ENTRY_GCPHYS( PGMOLD, GCPhysA20Mask),
201	SSMFIELD_ENTRY( PGMOLD, enmGuestMode),
202	SSMFIELD_ENTRY_TERM()
203	};
204
205
206	/**
207	* Find the ROM tracking structure for the given page.
208	*
209	* @returns Pointer to the ROM page structure. NULL if the caller didn't check
210	* that it's a ROM page.
211	* @param pVM The cross context VM structure.
212	* @param GCPhys The address of the ROM page.
213	*/
214	static PPGMROMPAGE pgmR3GetRomPage(PVM pVM, RTGCPHYS GCPhys) /** @todo change this to take a hint. */
215	{
216	for (PPGMROMRANGE pRomRange = pVM->pgm.s.CTX_SUFF(pRomRanges);
217	pRomRange;
218	pRomRange = pRomRange->CTX_SUFF(pNext))
219	{
220	RTGCPHYS off = GCPhys - pRomRange->GCPhys;
221	if (GCPhys - pRomRange->GCPhys < pRomRange->cb)
222	return &pRomRange->aPages[off >> PAGE_SHIFT];
223	}
224	return NULL;
225	}
226
227
228	/**
229	* Prepares the ROM pages for a live save.
230	*
231	* @returns VBox status code.
232	* @param pVM The cross context VM structure.
233	*/
234	static int pgmR3PrepRomPages(PVM pVM)
235	{
236	/*
237	* Initialize the live save tracking in the ROM page descriptors.
238	*/
239	pgmLock(pVM);
240	for (PPGMROMRANGE pRom = pVM->pgm.s.pRomRangesR3; pRom; pRom = pRom->pNextR3)
241	{
242	PPGMRAMRANGE pRamHint = NULL;;
243	uint32_t const cPages = pRom->cb >> PAGE_SHIFT;
244
245	for (uint32_t iPage = 0; iPage < cPages; iPage++)
246	{
247	pRom->aPages[iPage].LiveSave.u8Prot = (uint8_t)PGMROMPROT_INVALID;
248	pRom->aPages[iPage].LiveSave.fWrittenTo = false;
249	pRom->aPages[iPage].LiveSave.fDirty = true;
250	pRom->aPages[iPage].LiveSave.fDirtiedRecently = true;
251	if (!(pRom->fFlags & PGMPHYS_ROM_FLAGS_SHADOWED))
252	{
253	if (PGMROMPROT_IS_ROM(pRom->aPages[iPage].enmProt))
254	pRom->aPages[iPage].LiveSave.fWrittenTo = !PGM_PAGE_IS_ZERO(&pRom->aPages[iPage].Shadow) && !PGM_PAGE_IS_BALLOONED(&pRom->aPages[iPage].Shadow);
255	else
256	{
257	RTGCPHYS GCPhys = pRom->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT);
258	PPGMPAGE pPage;
259	int rc = pgmPhysGetPageWithHintEx(pVM, GCPhys, &pPage, &pRamHint);
260	AssertLogRelMsgRC(rc, ("%Rrc GCPhys=%RGp\n", rc, GCPhys));
261	if (RT_SUCCESS(rc))
262	pRom->aPages[iPage].LiveSave.fWrittenTo = !PGM_PAGE_IS_ZERO(pPage) && !PGM_PAGE_IS_BALLOONED(pPage);
263	else
264	pRom->aPages[iPage].LiveSave.fWrittenTo = !PGM_PAGE_IS_ZERO(&pRom->aPages[iPage].Shadow) && !PGM_PAGE_IS_BALLOONED(&pRom->aPages[iPage].Shadow);
265	}
266	}
267	}
268
269	pVM->pgm.s.LiveSave.Rom.cDirtyPages += cPages;
270	if (pRom->fFlags & PGMPHYS_ROM_FLAGS_SHADOWED)
271	pVM->pgm.s.LiveSave.Rom.cDirtyPages += cPages;
272	}
273	pgmUnlock(pVM);
274
275	return VINF_SUCCESS;
276	}
277
278
279	/**
280	* Assigns IDs to the ROM ranges and saves them.
281	*
282	* @returns VBox status code.
283	* @param pVM The cross context VM structure.
284	* @param pSSM Saved state handle.
285	*/
286	static int pgmR3SaveRomRanges(PVM pVM, PSSMHANDLE pSSM)
287	{
288	pgmLock(pVM);
289	uint8_t id = 1;
290	for (PPGMROMRANGE pRom = pVM->pgm.s.pRomRangesR3; pRom; pRom = pRom->pNextR3, id++)
291	{
292	pRom->idSavedState = id;
293	SSMR3PutU8(pSSM, id);
294	SSMR3PutStrZ(pSSM, ""); /* device name */
295	SSMR3PutU32(pSSM, 0); /* device instance */
296	SSMR3PutU8(pSSM, 0); /* region */
297	SSMR3PutStrZ(pSSM, pRom->pszDesc);
298	SSMR3PutGCPhys(pSSM, pRom->GCPhys);
299	int rc = SSMR3PutGCPhys(pSSM, pRom->cb);
300	if (RT_FAILURE(rc))
301	break;
302	}
303	pgmUnlock(pVM);
304	return SSMR3PutU8(pSSM, UINT8_MAX);
305	}
306
307
308	/**
309	* Loads the ROM range ID assignments.
310	*
311	* @returns VBox status code.
312	*
313	* @param pVM The cross context VM structure.
314	* @param pSSM The saved state handle.
315	*/
316	static int pgmR3LoadRomRanges(PVM pVM, PSSMHANDLE pSSM)
317	{
318	PGM_LOCK_ASSERT_OWNER(pVM);
319
320	for (PPGMROMRANGE pRom = pVM->pgm.s.pRomRangesR3; pRom; pRom = pRom->pNextR3)
321	pRom->idSavedState = UINT8_MAX;
322
323	for (;;)
324	{
325	/*
326	* Read the data.
327	*/
328	uint8_t id;
329	int rc = SSMR3GetU8(pSSM, &id);
330	if (RT_FAILURE(rc))
331	return rc;
332	if (id == UINT8_MAX)
333	{
334	for (PPGMROMRANGE pRom = pVM->pgm.s.pRomRangesR3; pRom; pRom = pRom->pNextR3)
335	AssertLogRelMsg(pRom->idSavedState != UINT8_MAX,
336	("The \"%s\" ROM was not found in the saved state. Probably due to some misconfiguration\n",
337	pRom->pszDesc));
338	return VINF_SUCCESS; /* the end */
339	}
340	AssertLogRelReturn(id != 0, VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
341
342	char szDevName[RT_SIZEOFMEMB(PDMDEVREG, szName)];
343	rc = SSMR3GetStrZ(pSSM, szDevName, sizeof(szDevName));
344	AssertLogRelRCReturn(rc, rc);
345
346	uint32_t uInstance;
347	SSMR3GetU32(pSSM, &uInstance);
348	uint8_t iRegion;
349	SSMR3GetU8(pSSM, &iRegion);
350
351	char szDesc[64];
352	rc = SSMR3GetStrZ(pSSM, szDesc, sizeof(szDesc));
353	AssertLogRelRCReturn(rc, rc);
354
355	RTGCPHYS GCPhys;
356	SSMR3GetGCPhys(pSSM, &GCPhys);
357	RTGCPHYS cb;
358	rc = SSMR3GetGCPhys(pSSM, &cb);
359	if (RT_FAILURE(rc))
360	return rc;
361	AssertLogRelMsgReturn(!(GCPhys & PAGE_OFFSET_MASK), ("GCPhys=%RGp %s\n", GCPhys, szDesc), VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
362	AssertLogRelMsgReturn(!(cb & PAGE_OFFSET_MASK), ("cb=%RGp %s\n", cb, szDesc), VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
363
364	/*
365	* Locate a matching ROM range.
366	*/
367	AssertLogRelMsgReturn( uInstance == 0
368	&& iRegion == 0
369	&& szDevName[0] == '\0',
370	("GCPhys=%RGp %s\n", GCPhys, szDesc),
371	VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
372	PPGMROMRANGE pRom;
373	for (pRom = pVM->pgm.s.pRomRangesR3; pRom; pRom = pRom->pNextR3)
374	{
375	if ( pRom->idSavedState == UINT8_MAX
376	&& !strcmp(pRom->pszDesc, szDesc))
377	{
378	pRom->idSavedState = id;
379	break;
380	}
381	}
382	if (!pRom)
383	return SSMR3SetCfgError(pSSM, RT_SRC_POS, N_("ROM at %RGp by the name '%s' was not found"), GCPhys, szDesc);
384	} /* forever */
385	}
386
387
388	/**
389	* Scan ROM pages.
390	*
391	* @param pVM The cross context VM structure.
392	*/
393	static void pgmR3ScanRomPages(PVM pVM)
394	{
395	/*
396	* The shadow ROMs.
397	*/
398	pgmLock(pVM);
399	for (PPGMROMRANGE pRom = pVM->pgm.s.pRomRangesR3; pRom; pRom = pRom->pNextR3)
400	{
401	if (pRom->fFlags & PGMPHYS_ROM_FLAGS_SHADOWED)
402	{
403	uint32_t const cPages = pRom->cb >> PAGE_SHIFT;
404	for (uint32_t iPage = 0; iPage < cPages; iPage++)
405	{
406	PPGMROMPAGE pRomPage = &pRom->aPages[iPage];
407	if (pRomPage->LiveSave.fWrittenTo)
408	{
409	pRomPage->LiveSave.fWrittenTo = false;
410	if (!pRomPage->LiveSave.fDirty)
411	{
412	pRomPage->LiveSave.fDirty = true;
413	pVM->pgm.s.LiveSave.Rom.cReadyPages--;
414	pVM->pgm.s.LiveSave.Rom.cDirtyPages++;
415	}
416	pRomPage->LiveSave.fDirtiedRecently = true;
417	}
418	else
419	pRomPage->LiveSave.fDirtiedRecently = false;
420	}
421	}
422	}
423	pgmUnlock(pVM);
424	}
425
426
427	/**
428	* Takes care of the virgin ROM pages in the first pass.
429	*
430	* This is an attempt at simplifying the handling of ROM pages a little bit.
431	* This ASSUMES that no new ROM ranges will be added and that they won't be
432	* relinked in any way.
433	*
434	* @param pVM The cross context VM structure.
435	* @param pSSM The SSM handle.
436	* @param fLiveSave Whether we're in a live save or not.
437	*/
438	static int pgmR3SaveRomVirginPages(PVM pVM, PSSMHANDLE pSSM, bool fLiveSave)
439	{
440	if (FTMIsDeltaLoadSaveActive(pVM))
441	return VINF_SUCCESS; /* nothing to do as nothing has changed here */
442
443	pgmLock(pVM);
444	for (PPGMROMRANGE pRom = pVM->pgm.s.pRomRangesR3; pRom; pRom = pRom->pNextR3)
445	{
446	uint32_t const cPages = pRom->cb >> PAGE_SHIFT;
447	for (uint32_t iPage = 0; iPage < cPages; iPage++)
448	{
449	RTGCPHYS GCPhys = pRom->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT);
450	PGMROMPROT enmProt = pRom->aPages[iPage].enmProt;
451
452	/* Get the virgin page descriptor. */
453	PPGMPAGE pPage;
454	if (PGMROMPROT_IS_ROM(enmProt))
455	pPage = pgmPhysGetPage(pVM, GCPhys);
456	else
457	pPage = &pRom->aPages[iPage].Virgin;
458
459	/* Get the page bits. (Cannot use pgmPhysGCPhys2CCPtrInternalReadOnly here!) */
460	int rc = VINF_SUCCESS;
461	char abPage[PAGE_SIZE];
462	if ( !PGM_PAGE_IS_ZERO(pPage)
463	&& !PGM_PAGE_IS_BALLOONED(pPage))
464	{
465	void const *pvPage;
466	rc = pgmPhysPageMapReadOnly(pVM, pPage, GCPhys, &pvPage);
467	if (RT_SUCCESS(rc))
468	memcpy(abPage, pvPage, PAGE_SIZE);
469	}
470	else
471	ASMMemZeroPage(abPage);
472	pgmUnlock(pVM);
473	AssertLogRelMsgRCReturn(rc, ("rc=%Rrc GCPhys=%RGp\n", rc, GCPhys), rc);
474
475	/* Save it. */
476	if (iPage > 0)
477	SSMR3PutU8(pSSM, PGM_STATE_REC_ROM_VIRGIN);
478	else
479	{
480	SSMR3PutU8(pSSM, PGM_STATE_REC_ROM_VIRGIN \| PGM_STATE_REC_FLAG_ADDR);
481	SSMR3PutU8(pSSM, pRom->idSavedState);
482	SSMR3PutU32(pSSM, iPage);
483	}
484	SSMR3PutU8(pSSM, (uint8_t)enmProt);
485	rc = SSMR3PutMem(pSSM, abPage, PAGE_SIZE);
486	if (RT_FAILURE(rc))
487	return rc;
488
489	/* Update state. */
490	pgmLock(pVM);
491	pRom->aPages[iPage].LiveSave.u8Prot = (uint8_t)enmProt;
492	if (fLiveSave)
493	{
494	pVM->pgm.s.LiveSave.Rom.cDirtyPages--;
495	pVM->pgm.s.LiveSave.Rom.cReadyPages++;
496	pVM->pgm.s.LiveSave.cSavedPages++;
497	}
498	}
499	}
500	pgmUnlock(pVM);
501	return VINF_SUCCESS;
502	}
503
504
505	/**
506	* Saves dirty pages in the shadowed ROM ranges.
507	*
508	* Used by pgmR3LiveExecPart2 and pgmR3SaveExecMemory.
509	*
510	* @returns VBox status code.
511	* @param pVM The cross context VM structure.
512	* @param pSSM The SSM handle.
513	* @param fLiveSave Whether it's a live save or not.
514	* @param fFinalPass Whether this is the final pass or not.
515	*/
516	static int pgmR3SaveShadowedRomPages(PVM pVM, PSSMHANDLE pSSM, bool fLiveSave, bool fFinalPass)
517	{
518	if (FTMIsDeltaLoadSaveActive(pVM))
519	return VINF_SUCCESS; /* nothing to do as we deal with those pages separately */
520
521	/*
522	* The Shadowed ROMs.
523	*
524	* ASSUMES that the ROM ranges are fixed.
525	* ASSUMES that all the ROM ranges are mapped.
526	*/
527	pgmLock(pVM);
528	for (PPGMROMRANGE pRom = pVM->pgm.s.pRomRangesR3; pRom; pRom = pRom->pNextR3)
529	{
530	if (pRom->fFlags & PGMPHYS_ROM_FLAGS_SHADOWED)
531	{
532	uint32_t const cPages = pRom->cb >> PAGE_SHIFT;
533	uint32_t iPrevPage = cPages;
534	for (uint32_t iPage = 0; iPage < cPages; iPage++)
535	{
536	PPGMROMPAGE pRomPage = &pRom->aPages[iPage];
537	if ( !fLiveSave
538	\|\| ( pRomPage->LiveSave.fDirty
539	&& ( ( !pRomPage->LiveSave.fDirtiedRecently
540	&& !pRomPage->LiveSave.fWrittenTo)
541	\|\| fFinalPass
542	)
543	)
544	)
545	{
546	uint8_t abPage[PAGE_SIZE];
547	PGMROMPROT enmProt = pRomPage->enmProt;
548	RTGCPHYS GCPhys = pRom->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT);
549	PPGMPAGE pPage = PGMROMPROT_IS_ROM(enmProt) ? &pRomPage->Shadow : pgmPhysGetPage(pVM, GCPhys);
550	bool fZero = PGM_PAGE_IS_ZERO(pPage) \|\| PGM_PAGE_IS_BALLOONED(pPage); Assert(!PGM_PAGE_IS_BALLOONED(pPage)); /* Shouldn't be ballooned. */
551	int rc = VINF_SUCCESS;
552	if (!fZero)
553	{
554	void const *pvPage;
555	rc = pgmPhysPageMapReadOnly(pVM, pPage, GCPhys, &pvPage);
556	if (RT_SUCCESS(rc))
557	memcpy(abPage, pvPage, PAGE_SIZE);
558	}
559	if (fLiveSave && RT_SUCCESS(rc))
560	{
561	pRomPage->LiveSave.u8Prot = (uint8_t)enmProt;
562	pRomPage->LiveSave.fDirty = false;
563	pVM->pgm.s.LiveSave.Rom.cReadyPages++;
564	pVM->pgm.s.LiveSave.Rom.cDirtyPages--;
565	pVM->pgm.s.LiveSave.cSavedPages++;
566	}
567	pgmUnlock(pVM);
568	AssertLogRelMsgRCReturn(rc, ("rc=%Rrc GCPhys=%RGp\n", rc, GCPhys), rc);
569
570	if (iPage - 1U == iPrevPage && iPage > 0)
571	SSMR3PutU8(pSSM, (fZero ? PGM_STATE_REC_ROM_SHW_ZERO : PGM_STATE_REC_ROM_SHW_RAW));
572	else
573	{
574	SSMR3PutU8(pSSM, (fZero ? PGM_STATE_REC_ROM_SHW_ZERO : PGM_STATE_REC_ROM_SHW_RAW) \| PGM_STATE_REC_FLAG_ADDR);
575	SSMR3PutU8(pSSM, pRom->idSavedState);
576	SSMR3PutU32(pSSM, iPage);
577	}
578	rc = SSMR3PutU8(pSSM, (uint8_t)enmProt);
579	if (!fZero)
580	rc = SSMR3PutMem(pSSM, abPage, PAGE_SIZE);
581	if (RT_FAILURE(rc))
582	return rc;
583
584	pgmLock(pVM);
585	iPrevPage = iPage;
586	}
587	/*
588	* In the final pass, make sure the protection is in sync.
589	*/
590	else if ( fFinalPass
591	&& pRomPage->LiveSave.u8Prot != pRomPage->enmProt)
592	{
593	PGMROMPROT enmProt = pRomPage->enmProt;
594	pRomPage->LiveSave.u8Prot = (uint8_t)enmProt;
595	pgmUnlock(pVM);
596
597	if (iPage - 1U == iPrevPage && iPage > 0)
598	SSMR3PutU8(pSSM, PGM_STATE_REC_ROM_PROT);
599	else
600	{
601	SSMR3PutU8(pSSM, PGM_STATE_REC_ROM_PROT \| PGM_STATE_REC_FLAG_ADDR);
602	SSMR3PutU8(pSSM, pRom->idSavedState);
603	SSMR3PutU32(pSSM, iPage);
604	}
605	int rc = SSMR3PutU8(pSSM, (uint8_t)enmProt);
606	if (RT_FAILURE(rc))
607	return rc;
608
609	pgmLock(pVM);
610	iPrevPage = iPage;
611	}
612	}
613	}
614	}
615	pgmUnlock(pVM);
616	return VINF_SUCCESS;
617	}
618
619
620	/**
621	* Cleans up ROM pages after a live save.
622	*
623	* @param pVM The cross context VM structure.
624	*/
625	static void pgmR3DoneRomPages(PVM pVM)
626	{
627	NOREF(pVM);
628	}
629
630
631	/**
632	* Prepares the MMIO2 pages for a live save.
633	*
634	* @returns VBox status code.
635	* @param pVM The cross context VM structure.
636	*/
637	static int pgmR3PrepMmio2Pages(PVM pVM)
638	{
639	/*
640	* Initialize the live save tracking in the MMIO2 ranges.
641	* ASSUME nothing changes here.
642	*/
643	pgmLock(pVM);
644	for (PPGMREGMMIORANGE pRegMmio = pVM->pgm.s.pRegMmioRangesR3; pRegMmio; pRegMmio = pRegMmio->pNextR3)
645	{
646	if (pRegMmio->fMmio2)
647	{
648	uint32_t const cPages = pRegMmio->RamRange.cb >> PAGE_SHIFT;
649	pgmUnlock(pVM);
650
651	PPGMLIVESAVEMMIO2PAGE paLSPages = (PPGMLIVESAVEMMIO2PAGE)MMR3HeapAllocZ(pVM, MM_TAG_PGM, sizeof(PGMLIVESAVEMMIO2PAGE) * cPages);
652	if (!paLSPages)
653	return VERR_NO_MEMORY;
654	for (uint32_t iPage = 0; iPage < cPages; iPage++)
655	{
656	/* Initialize it as a dirty zero page. */
657	paLSPages[iPage].fDirty = true;
658	paLSPages[iPage].cUnchangedScans = 0;
659	paLSPages[iPage].fZero = true;
660	paLSPages[iPage].u32CrcH1 = PGM_STATE_CRC32_ZERO_HALF_PAGE;
661	paLSPages[iPage].u32CrcH2 = PGM_STATE_CRC32_ZERO_HALF_PAGE;
662	}
663
664	pgmLock(pVM);
665	pRegMmio->paLSPages = paLSPages;
666	pVM->pgm.s.LiveSave.Mmio2.cDirtyPages += cPages;
667	}
668	}
669	pgmUnlock(pVM);
670	return VINF_SUCCESS;
671	}
672
673
674	/**
675	* Assigns IDs to the MMIO2 ranges and saves them.
676	*
677	* @returns VBox status code.
678	* @param pVM The cross context VM structure.
679	* @param pSSM Saved state handle.
680	*/
681	static int pgmR3SaveMmio2Ranges(PVM pVM, PSSMHANDLE pSSM)
682	{
683	pgmLock(pVM);
684	uint8_t id = 1;
685	for (PPGMREGMMIORANGE pRegMmio = pVM->pgm.s.pRegMmioRangesR3; pRegMmio; pRegMmio = pRegMmio->pNextR3)
686	{
687	if (pRegMmio->fMmio2)
688	{
689	pRegMmio->idSavedState = id;
690	SSMR3PutU8(pSSM, id);
691	SSMR3PutStrZ(pSSM, pRegMmio->pDevInsR3->pReg->szName);
692	SSMR3PutU32(pSSM, pRegMmio->pDevInsR3->iInstance);
693	SSMR3PutU8(pSSM, pRegMmio->iRegion);
694	SSMR3PutStrZ(pSSM, pRegMmio->RamRange.pszDesc);
695	int rc = SSMR3PutGCPhys(pSSM, pRegMmio->RamRange.cb);
696	if (RT_FAILURE(rc))
697	break;
698	id++;
699	}
700	}
701	pgmUnlock(pVM);
702	return SSMR3PutU8(pSSM, UINT8_MAX);
703	}
704
705
706	/**
707	* Loads the MMIO2 range ID assignments.
708	*
709	* @returns VBox status code.
710	*
711	* @param pVM The cross context VM structure.
712	* @param pSSM The saved state handle.
713	*/
714	static int pgmR3LoadMmio2Ranges(PVM pVM, PSSMHANDLE pSSM)
715	{
716	PGM_LOCK_ASSERT_OWNER(pVM);
717
718	for (PPGMREGMMIORANGE pRegMmio = pVM->pgm.s.pRegMmioRangesR3; pRegMmio; pRegMmio = pRegMmio->pNextR3)
719	if (pRegMmio->fMmio2)
720	pRegMmio->idSavedState = UINT8_MAX;
721
722	for (;;)
723	{
724	/*
725	* Read the data.
726	*/
727	uint8_t id;
728	int rc = SSMR3GetU8(pSSM, &id);
729	if (RT_FAILURE(rc))
730	return rc;
731	if (id == UINT8_MAX)
732	{
733	for (PPGMREGMMIORANGE pRegMmio = pVM->pgm.s.pRegMmioRangesR3; pRegMmio; pRegMmio = pRegMmio->pNextR3)
734	AssertLogRelMsg(pRegMmio->idSavedState != UINT8_MAX \|\| !pRegMmio->fMmio2, ("%s\n", pRegMmio->RamRange.pszDesc));
735	return VINF_SUCCESS; /* the end */
736	}
737	AssertLogRelReturn(id != 0, VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
738
739	char szDevName[RT_SIZEOFMEMB(PDMDEVREG, szName)];
740	rc = SSMR3GetStrZ(pSSM, szDevName, sizeof(szDevName));
741	AssertLogRelRCReturn(rc, rc);
742
743	uint32_t uInstance;
744	SSMR3GetU32(pSSM, &uInstance);
745	uint8_t iRegion;
746	SSMR3GetU8(pSSM, &iRegion);
747
748	char szDesc[64];
749	rc = SSMR3GetStrZ(pSSM, szDesc, sizeof(szDesc));
750	AssertLogRelRCReturn(rc, rc);
751
752	RTGCPHYS cb;
753	rc = SSMR3GetGCPhys(pSSM, &cb);
754	AssertLogRelMsgReturn(!(cb & PAGE_OFFSET_MASK), ("cb=%RGp %s\n", cb, szDesc), VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
755
756	/*
757	* Locate a matching MMIO2 range.
758	*/
759	PPGMREGMMIORANGE pRegMmio;
760	for (pRegMmio = pVM->pgm.s.pRegMmioRangesR3; pRegMmio; pRegMmio = pRegMmio->pNextR3)
761	{
762	if ( pRegMmio->idSavedState == UINT8_MAX
763	&& pRegMmio->iRegion == iRegion
764	&& pRegMmio->pDevInsR3->iInstance == uInstance
765	&& pRegMmio->fMmio2
766	&& !strcmp(pRegMmio->pDevInsR3->pReg->szName, szDevName))
767	{
768	pRegMmio->idSavedState = id;
769	break;
770	}
771	}
772	if (!pRegMmio)
773	return SSMR3SetCfgError(pSSM, RT_SRC_POS, N_("Failed to locate a MMIO2 range called '%s' owned by %s/%u, region %d"),
774	szDesc, szDevName, uInstance, iRegion);
775
776	/*
777	* Validate the configuration, the size of the MMIO2 region should be
778	* the same.
779	*/
780	if (cb != pRegMmio->RamRange.cb)
781	{
782	LogRel(("PGM: MMIO2 region \"%s\" size mismatch: saved=%RGp config=%RGp\n",
783	pRegMmio->RamRange.pszDesc, cb, pRegMmio->RamRange.cb));
784	if (cb > pRegMmio->RamRange.cb) /* bad idea? */
785	return SSMR3SetCfgError(pSSM, RT_SRC_POS, N_("MMIO2 region \"%s\" size mismatch: saved=%RGp config=%RGp"),
786	pRegMmio->RamRange.pszDesc, cb, pRegMmio->RamRange.cb);
787	}
788	} /* forever */
789	}
790
791
792	/**
793	* Scans one MMIO2 page.
794	*
795	* @returns True if changed, false if unchanged.
796	*
797	* @param pVM The cross context VM structure.
798	* @param pbPage The page bits.
799	* @param pLSPage The live save tracking structure for the page.
800	*
801	*/
802	DECLINLINE(bool) pgmR3ScanMmio2Page(PVM pVM, uint8_t const *pbPage, PPGMLIVESAVEMMIO2PAGE pLSPage)
803	{
804	/*
805	* Special handling of zero pages.
806	*/
807	bool const fZero = pLSPage->fZero;
808	if (fZero)
809	{
810	if (ASMMemIsZeroPage(pbPage))
811	{
812	/* Not modified. */
813	if (pLSPage->fDirty)
814	pLSPage->cUnchangedScans++;
815	return false;
816	}
817
818	pLSPage->fZero = false;
819	pLSPage->u32CrcH1 = RTCrc32(pbPage, PAGE_SIZE / 2);
820	}
821	else
822	{
823	/*
824	* CRC the first half, if it doesn't match the page is dirty and
825	* we won't check the 2nd half (we'll do that next time).
826	*/
827	uint32_t u32CrcH1 = RTCrc32(pbPage, PAGE_SIZE / 2);
828	if (u32CrcH1 == pLSPage->u32CrcH1)
829	{
830	uint32_t u32CrcH2 = RTCrc32(pbPage + PAGE_SIZE / 2, PAGE_SIZE / 2);
831	if (u32CrcH2 == pLSPage->u32CrcH2)
832	{
833	/* Probably not modified. */
834	if (pLSPage->fDirty)
835	pLSPage->cUnchangedScans++;
836	return false;
837	}
838
839	pLSPage->u32CrcH2 = u32CrcH2;
840	}
841	else
842	{
843	pLSPage->u32CrcH1 = u32CrcH1;
844	if ( u32CrcH1 == PGM_STATE_CRC32_ZERO_HALF_PAGE
845	&& ASMMemIsZeroPage(pbPage))
846	{
847	pLSPage->u32CrcH2 = PGM_STATE_CRC32_ZERO_HALF_PAGE;
848	pLSPage->fZero = true;
849	}
850	}
851	}
852
853	/* dirty page path */
854	pLSPage->cUnchangedScans = 0;
855	if (!pLSPage->fDirty)
856	{
857	pLSPage->fDirty = true;
858	pVM->pgm.s.LiveSave.Mmio2.cReadyPages--;
859	pVM->pgm.s.LiveSave.Mmio2.cDirtyPages++;
860	if (fZero)
861	pVM->pgm.s.LiveSave.Mmio2.cZeroPages--;
862	}
863	return true;
864	}
865
866
867	/**
868	* Scan for MMIO2 page modifications.
869	*
870	* @param pVM The cross context VM structure.
871	* @param uPass The pass number.
872	*/
873	static void pgmR3ScanMmio2Pages(PVM pVM, uint32_t uPass)
874	{
875	/*
876	* Since this is a bit expensive we lower the scan rate after a little while.
877	*/
878	if ( ( (uPass & 3) != 0
879	&& uPass > 10)
880	\|\| uPass == SSM_PASS_FINAL)
881	return;
882
883	pgmLock(pVM); /* paranoia */
884	for (PPGMREGMMIORANGE pRegMmio = pVM->pgm.s.pRegMmioRangesR3; pRegMmio; pRegMmio = pRegMmio->pNextR3)
885	if (pRegMmio->fMmio2)
886	{
887	PPGMLIVESAVEMMIO2PAGE paLSPages = pRegMmio->paLSPages;
888	uint32_t cPages = pRegMmio->RamRange.cb >> PAGE_SHIFT;
889	pgmUnlock(pVM);
890
891	for (uint32_t iPage = 0; iPage < cPages; iPage++)
892	{
893	uint8_t const pbPage = (uint8_t const )pRegMmio->pvR3 + iPage * PAGE_SIZE;
894	pgmR3ScanMmio2Page(pVM, pbPage, &paLSPages[iPage]);
895	}
896
897	pgmLock(pVM);
898	}
899	pgmUnlock(pVM);
900
901	}
902
903
904	/**
905	* Save quiescent MMIO2 pages.
906	*
907	* @returns VBox status code.
908	* @param pVM The cross context VM structure.
909	* @param pSSM The SSM handle.
910	* @param fLiveSave Whether it's a live save or not.
911	* @param uPass The pass number.
912	*/
913	static int pgmR3SaveMmio2Pages(PVM pVM, PSSMHANDLE pSSM, bool fLiveSave, uint32_t uPass)
914	{
915	/** @todo implement live saving of MMIO2 pages. (Need some way of telling the
916	* device that we wish to know about changes.) */
917
918	int rc = VINF_SUCCESS;
919	if (uPass == SSM_PASS_FINAL)
920	{
921	/*
922	* The mop up round.
923	*/
924	pgmLock(pVM);
925	for (PPGMREGMMIORANGE pRegMmio = pVM->pgm.s.pRegMmioRangesR3;
926	pRegMmio && RT_SUCCESS(rc);
927	pRegMmio = pRegMmio->pNextR3)
928	if (pRegMmio->fMmio2)
929	{
930	PPGMLIVESAVEMMIO2PAGE paLSPages = pRegMmio->paLSPages;
931	uint8_t const pbPage = (uint8_t const )pRegMmio->RamRange.pvR3;
932	uint32_t cPages = pRegMmio->RamRange.cb >> PAGE_SHIFT;
933	uint32_t iPageLast = cPages;
934	for (uint32_t iPage = 0; iPage < cPages; iPage++, pbPage += PAGE_SIZE)
935	{
936	uint8_t u8Type;
937	if (!fLiveSave)
938	u8Type = ASMMemIsZeroPage(pbPage) ? PGM_STATE_REC_MMIO2_ZERO : PGM_STATE_REC_MMIO2_RAW;
939	else
940	{
941	/* Try figure if it's a clean page, compare the SHA-1 to be really sure. */
942	if ( !paLSPages[iPage].fDirty
943	&& !pgmR3ScanMmio2Page(pVM, pbPage, &paLSPages[iPage]))
944	{
945	if (paLSPages[iPage].fZero)
946	continue;
947
948	uint8_t abSha1Hash[RTSHA1_HASH_SIZE];
949	RTSha1(pbPage, PAGE_SIZE, abSha1Hash);
950	if (!memcmp(abSha1Hash, paLSPages[iPage].abSha1Saved, sizeof(abSha1Hash)))
951	continue;
952	}
953	u8Type = paLSPages[iPage].fZero ? PGM_STATE_REC_MMIO2_ZERO : PGM_STATE_REC_MMIO2_RAW;
954	pVM->pgm.s.LiveSave.cSavedPages++;
955	}
956
957	if (iPage != 0 && iPage == iPageLast + 1)
958	rc = SSMR3PutU8(pSSM, u8Type);
959	else
960	{
961	SSMR3PutU8(pSSM, u8Type \| PGM_STATE_REC_FLAG_ADDR);
962	SSMR3PutU8(pSSM, pRegMmio->idSavedState);
963	rc = SSMR3PutU32(pSSM, iPage);
964	}
965	if (u8Type == PGM_STATE_REC_MMIO2_RAW)
966	rc = SSMR3PutMem(pSSM, pbPage, PAGE_SIZE);
967	if (RT_FAILURE(rc))
968	break;
969	iPageLast = iPage;
970	}
971	}
972	pgmUnlock(pVM);
973	}
974	/*
975	* Reduce the rate after a little while since the current MMIO2 approach is
976	* a bit expensive.
977	* We position it two passes after the scan pass to avoid saving busy pages.
978	*/
979	else if ( uPass <= 10
980	\|\| (uPass & 3) == 2)
981	{
982	pgmLock(pVM);
983	for (PPGMREGMMIORANGE pRegMmio = pVM->pgm.s.pRegMmioRangesR3;
984	pRegMmio && RT_SUCCESS(rc);
985	pRegMmio = pRegMmio->pNextR3)
986	if (pRegMmio->fMmio2)
987	{
988	PPGMLIVESAVEMMIO2PAGE paLSPages = pRegMmio->paLSPages;
989	uint8_t const pbPage = (uint8_t const )pRegMmio->RamRange.pvR3;
990	uint32_t cPages = pRegMmio->RamRange.cb >> PAGE_SHIFT;
991	uint32_t iPageLast = cPages;
992	pgmUnlock(pVM);
993
994	for (uint32_t iPage = 0; iPage < cPages; iPage++, pbPage += PAGE_SIZE)
995	{
996	/* Skip clean pages and pages which hasn't quiesced. */
997	if (!paLSPages[iPage].fDirty)
998	continue;
999	if (paLSPages[iPage].cUnchangedScans < 3)
1000	continue;
1001	if (pgmR3ScanMmio2Page(pVM, pbPage, &paLSPages[iPage]))
1002	continue;
1003
1004	/* Save it. */
1005	bool const fZero = paLSPages[iPage].fZero;
1006	uint8_t abPage[PAGE_SIZE];
1007	if (!fZero)
1008	{
1009	memcpy(abPage, pbPage, PAGE_SIZE);
1010	RTSha1(abPage, PAGE_SIZE, paLSPages[iPage].abSha1Saved);
1011	}
1012
1013	uint8_t u8Type = paLSPages[iPage].fZero ? PGM_STATE_REC_MMIO2_ZERO : PGM_STATE_REC_MMIO2_RAW;
1014	if (iPage != 0 && iPage == iPageLast + 1)
1015	rc = SSMR3PutU8(pSSM, u8Type);
1016	else
1017	{
1018	SSMR3PutU8(pSSM, u8Type \| PGM_STATE_REC_FLAG_ADDR);
1019	SSMR3PutU8(pSSM, pRegMmio->idSavedState);
1020	rc = SSMR3PutU32(pSSM, iPage);
1021	}
1022	if (u8Type == PGM_STATE_REC_MMIO2_RAW)
1023	rc = SSMR3PutMem(pSSM, abPage, PAGE_SIZE);
1024	if (RT_FAILURE(rc))
1025	break;
1026
1027	/* Housekeeping. */
1028	paLSPages[iPage].fDirty = false;
1029	pVM->pgm.s.LiveSave.Mmio2.cDirtyPages--;
1030	pVM->pgm.s.LiveSave.Mmio2.cReadyPages++;
1031	if (u8Type == PGM_STATE_REC_MMIO2_ZERO)
1032	pVM->pgm.s.LiveSave.Mmio2.cZeroPages++;
1033	pVM->pgm.s.LiveSave.cSavedPages++;
1034	iPageLast = iPage;
1035	}
1036
1037	pgmLock(pVM);
1038	}
1039	pgmUnlock(pVM);
1040	}
1041
1042	return rc;
1043	}
1044
1045
1046	/**
1047	* Cleans up MMIO2 pages after a live save.
1048	*
1049	* @param pVM The cross context VM structure.
1050	*/
1051	static void pgmR3DoneMmio2Pages(PVM pVM)
1052	{
1053	/*
1054	* Free the tracking structures for the MMIO2 pages.
1055	* We do the freeing outside the lock in case the VM is running.
1056	*/
1057	pgmLock(pVM);
1058	for (PPGMREGMMIORANGE pRegMmio = pVM->pgm.s.pRegMmioRangesR3; pRegMmio; pRegMmio = pRegMmio->pNextR3)
1059	if (pRegMmio->fMmio2)
1060	{
1061	void *pvMmio2ToFree = pRegMmio->paLSPages;
1062	if (pvMmio2ToFree)
1063	{
1064	pRegMmio->paLSPages = NULL;
1065	pgmUnlock(pVM);
1066	MMR3HeapFree(pvMmio2ToFree);
1067	pgmLock(pVM);
1068	}
1069	}
1070	pgmUnlock(pVM);
1071	}
1072
1073
1074	/**
1075	* Prepares the RAM pages for a live save.
1076	*
1077	* @returns VBox status code.
1078	* @param pVM The cross context VM structure.
1079	*/
1080	static int pgmR3PrepRamPages(PVM pVM)
1081	{
1082
1083	/*
1084	* Try allocating tracking structures for the ram ranges.
1085	*
1086	* To avoid lock contention, we leave the lock every time we're allocating
1087	* a new array. This means we'll have to ditch the allocation and start
1088	* all over again if the RAM range list changes in-between.
1089	*
1090	* Note! pgmR3SaveDone will always be called and it is therefore responsible
1091	* for cleaning up.
1092	*/
1093	PPGMRAMRANGE pCur;
1094	pgmLock(pVM);
1095	do
1096	{
1097	for (pCur = pVM->pgm.s.pRamRangesXR3; pCur; pCur = pCur->pNextR3)
1098	{
1099	if ( !pCur->paLSPages
1100	&& !PGM_RAM_RANGE_IS_AD_HOC(pCur))
1101	{
1102	uint32_t const idRamRangesGen = pVM->pgm.s.idRamRangesGen;
1103	uint32_t const cPages = pCur->cb >> PAGE_SHIFT;
1104	pgmUnlock(pVM);
1105	PPGMLIVESAVERAMPAGE paLSPages = (PPGMLIVESAVERAMPAGE)MMR3HeapAllocZ(pVM, MM_TAG_PGM, cPages * sizeof(PGMLIVESAVERAMPAGE));
1106	if (!paLSPages)
1107	return VERR_NO_MEMORY;
1108	pgmLock(pVM);
1109	if (pVM->pgm.s.idRamRangesGen != idRamRangesGen)
1110	{
1111	pgmUnlock(pVM);
1112	MMR3HeapFree(paLSPages);
1113	pgmLock(pVM);
1114	break; /* try again */
1115	}
1116	pCur->paLSPages = paLSPages;
1117
1118	/*
1119	* Initialize the array.
1120	*/
1121	uint32_t iPage = cPages;
1122	while (iPage-- > 0)
1123	{
1124	/** @todo yield critsect! (after moving this away from EMT0) */
1125	PCPGMPAGE pPage = &pCur->aPages[iPage];
1126	paLSPages[iPage].cDirtied = 0;
1127	paLSPages[iPage].fDirty = 1; /* everything is dirty at this time */
1128	paLSPages[iPage].fWriteMonitored = 0;
1129	paLSPages[iPage].fWriteMonitoredJustNow = 0;
1130	paLSPages[iPage].u2Reserved = 0;
1131	switch (PGM_PAGE_GET_TYPE(pPage))
1132	{
1133	case PGMPAGETYPE_RAM:
1134	if ( PGM_PAGE_IS_ZERO(pPage)
1135	\|\| PGM_PAGE_IS_BALLOONED(pPage))
1136	{
1137	paLSPages[iPage].fZero = 1;
1138	paLSPages[iPage].fShared = 0;
1139	#ifdef PGMLIVESAVERAMPAGE_WITH_CRC32
1140	paLSPages[iPage].u32Crc = PGM_STATE_CRC32_ZERO_PAGE;
1141	#endif
1142	}
1143	else if (PGM_PAGE_IS_SHARED(pPage))
1144	{
1145	paLSPages[iPage].fZero = 0;
1146	paLSPages[iPage].fShared = 1;
1147	#ifdef PGMLIVESAVERAMPAGE_WITH_CRC32
1148	paLSPages[iPage].u32Crc = UINT32_MAX;
1149	#endif
1150	}
1151	else
1152	{
1153	paLSPages[iPage].fZero = 0;
1154	paLSPages[iPage].fShared = 0;
1155	#ifdef PGMLIVESAVERAMPAGE_WITH_CRC32
1156	paLSPages[iPage].u32Crc = UINT32_MAX;
1157	#endif
1158	}
1159	paLSPages[iPage].fIgnore = 0;
1160	pVM->pgm.s.LiveSave.Ram.cDirtyPages++;
1161	break;
1162
1163	case PGMPAGETYPE_ROM_SHADOW:
1164	case PGMPAGETYPE_ROM:
1165	{
1166	paLSPages[iPage].fZero = 0;
1167	paLSPages[iPage].fShared = 0;
1168	paLSPages[iPage].fDirty = 0;
1169	paLSPages[iPage].fIgnore = 1;
1170	#ifdef PGMLIVESAVERAMPAGE_WITH_CRC32
1171	paLSPages[iPage].u32Crc = UINT32_MAX;
1172	#endif
1173	pVM->pgm.s.LiveSave.cIgnoredPages++;
1174	break;
1175	}
1176
1177	default:
1178	AssertMsgFailed(("%R[pgmpage]", pPage));
1179	case PGMPAGETYPE_MMIO2:
1180	case PGMPAGETYPE_MMIO2_ALIAS_MMIO:
1181	paLSPages[iPage].fZero = 0;
1182	paLSPages[iPage].fShared = 0;
1183	paLSPages[iPage].fDirty = 0;
1184	paLSPages[iPage].fIgnore = 1;
1185	#ifdef PGMLIVESAVERAMPAGE_WITH_CRC32
1186	paLSPages[iPage].u32Crc = UINT32_MAX;
1187	#endif
1188	pVM->pgm.s.LiveSave.cIgnoredPages++;
1189	break;
1190
1191	case PGMPAGETYPE_MMIO:
1192	case PGMPAGETYPE_SPECIAL_ALIAS_MMIO:
1193	paLSPages[iPage].fZero = 0;
1194	paLSPages[iPage].fShared = 0;
1195	paLSPages[iPage].fDirty = 0;
1196	paLSPages[iPage].fIgnore = 1;
1197	#ifdef PGMLIVESAVERAMPAGE_WITH_CRC32
1198	paLSPages[iPage].u32Crc = UINT32_MAX;
1199	#endif
1200	pVM->pgm.s.LiveSave.cIgnoredPages++;
1201	break;
1202	}
1203	}
1204	}
1205	}
1206	} while (pCur);
1207	pgmUnlock(pVM);
1208
1209	return VINF_SUCCESS;
1210	}
1211
1212
1213	/**
1214	* Saves the RAM configuration.
1215	*
1216	* @returns VBox status code.
1217	* @param pVM The cross context VM structure.
1218	* @param pSSM The saved state handle.
1219	*/
1220	static int pgmR3SaveRamConfig(PVM pVM, PSSMHANDLE pSSM)
1221	{
1222	uint32_t cbRamHole = 0;
1223	int rc = CFGMR3QueryU32Def(CFGMR3GetRoot(pVM), "RamHoleSize", &cbRamHole, MM_RAM_HOLE_SIZE_DEFAULT);
1224	AssertRCReturn(rc, rc);
1225
1226	uint64_t cbRam = 0;
1227	rc = CFGMR3QueryU64Def(CFGMR3GetRoot(pVM), "RamSize", &cbRam, 0);
1228	AssertRCReturn(rc, rc);
1229
1230	SSMR3PutU32(pSSM, cbRamHole);
1231	return SSMR3PutU64(pSSM, cbRam);
1232	}
1233
1234
1235	/**
1236	* Loads and verifies the RAM configuration.
1237	*
1238	* @returns VBox status code.
1239	* @param pVM The cross context VM structure.
1240	* @param pSSM The saved state handle.
1241	*/
1242	static int pgmR3LoadRamConfig(PVM pVM, PSSMHANDLE pSSM)
1243	{
1244	uint32_t cbRamHoleCfg = 0;
1245	int rc = CFGMR3QueryU32Def(CFGMR3GetRoot(pVM), "RamHoleSize", &cbRamHoleCfg, MM_RAM_HOLE_SIZE_DEFAULT);
1246	AssertRCReturn(rc, rc);
1247
1248	uint64_t cbRamCfg = 0;
1249	rc = CFGMR3QueryU64Def(CFGMR3GetRoot(pVM), "RamSize", &cbRamCfg, 0);
1250	AssertRCReturn(rc, rc);
1251
1252	uint32_t cbRamHoleSaved;
1253	SSMR3GetU32(pSSM, &cbRamHoleSaved);
1254
1255	uint64_t cbRamSaved;
1256	rc = SSMR3GetU64(pSSM, &cbRamSaved);
1257	AssertRCReturn(rc, rc);
1258
1259	if ( cbRamHoleCfg != cbRamHoleSaved
1260	\|\| cbRamCfg != cbRamSaved)
1261	return SSMR3SetCfgError(pSSM, RT_SRC_POS, N_("Ram config mismatch: saved=%RX64/%RX32 config=%RX64/%RX32 (RAM/Hole)"),
1262	cbRamSaved, cbRamHoleSaved, cbRamCfg, cbRamHoleCfg);
1263	return VINF_SUCCESS;
1264	}
1265
1266	#ifdef PGMLIVESAVERAMPAGE_WITH_CRC32
1267
1268	/**
1269	* Calculates the CRC-32 for a RAM page and updates the live save page tracking
1270	* info with it.
1271	*
1272	* @param pVM The cross context VM structure.
1273	* @param pCur The current RAM range.
1274	* @param paLSPages The current array of live save page tracking
1275	* structures.
1276	* @param iPage The page index.
1277	*/
1278	static void pgmR3StateCalcCrc32ForRamPage(PVM pVM, PPGMRAMRANGE pCur, PPGMLIVESAVERAMPAGE paLSPages, uint32_t iPage)
1279	{
1280	RTGCPHYS GCPhys = pCur->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT);
1281	PGMPAGEMAPLOCK PgMpLck;
1282	void const *pvPage;
1283	int rc = pgmPhysGCPhys2CCPtrInternalReadOnly(pVM, &pCur->aPages[iPage], GCPhys, &pvPage, &PgMpLck);
1284	if (RT_SUCCESS(rc))
1285	{
1286	paLSPages[iPage].u32Crc = RTCrc32(pvPage, PAGE_SIZE);
1287	pgmPhysReleaseInternalPageMappingLock(pVM, &PgMpLck);
1288	}
1289	else
1290	paLSPages[iPage].u32Crc = UINT32_MAX; /* Invalid */
1291	}
1292
1293
1294	/**
1295	* Verifies the CRC-32 for a page given it's raw bits.
1296	*
1297	* @param pvPage The page bits.
1298	* @param pCur The current RAM range.
1299	* @param paLSPages The current array of live save page tracking
1300	* structures.
1301	* @param iPage The page index.
1302	*/
1303	static void pgmR3StateVerifyCrc32ForPage(void const pvPage, PPGMRAMRANGE pCur, PPGMLIVESAVERAMPAGE paLSPages, uint32_t iPage, const char pszWhere)
1304	{
1305	if (paLSPages[iPage].u32Crc != UINT32_MAX)
1306	{
1307	uint32_t u32Crc = RTCrc32(pvPage, PAGE_SIZE);
1308	Assert( ( !PGM_PAGE_IS_ZERO(&pCur->aPages[iPage])
1309	&& !PGM_PAGE_IS_BALLOONED(&pCur->aPages[iPage]))
1310	\|\| u32Crc == PGM_STATE_CRC32_ZERO_PAGE);
1311	AssertMsg(paLSPages[iPage].u32Crc == u32Crc,
1312	("%08x != %08x for %RGp %R[pgmpage] %s\n", paLSPages[iPage].u32Crc, u32Crc,
1313	pCur->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT), &pCur->aPages[iPage], pszWhere));
1314	}
1315	}
1316
1317
1318	/**
1319	* Verifies the CRC-32 for a RAM page.
1320	*
1321	* @param pVM The cross context VM structure.
1322	* @param pCur The current RAM range.
1323	* @param paLSPages The current array of live save page tracking
1324	* structures.
1325	* @param iPage The page index.
1326	*/
1327	static void pgmR3StateVerifyCrc32ForRamPage(PVM pVM, PPGMRAMRANGE pCur, PPGMLIVESAVERAMPAGE paLSPages, uint32_t iPage, const char *pszWhere)
1328	{
1329	if (paLSPages[iPage].u32Crc != UINT32_MAX)
1330	{
1331	RTGCPHYS GCPhys = pCur->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT);
1332	PGMPAGEMAPLOCK PgMpLck;
1333	void const *pvPage;
1334	int rc = pgmPhysGCPhys2CCPtrInternalReadOnly(pVM, &pCur->aPages[iPage], GCPhys, &pvPage, &PgMpLck);
1335	if (RT_SUCCESS(rc))
1336	{
1337	pgmR3StateVerifyCrc32ForPage(pvPage, pCur, paLSPages, iPage, pszWhere);
1338	pgmPhysReleaseInternalPageMappingLock(pVM, &PgMpLck);
1339	}
1340	}
1341	}
1342
1343	#endif /* PGMLIVESAVERAMPAGE_WITH_CRC32 */
1344
1345	/**
1346	* Scan for RAM page modifications and reprotect them.
1347	*
1348	* @param pVM The cross context VM structure.
1349	* @param fFinalPass Whether this is the final pass or not.
1350	*/
1351	static void pgmR3ScanRamPages(PVM pVM, bool fFinalPass)
1352	{
1353	/*
1354	* The RAM.
1355	*/
1356	RTGCPHYS GCPhysCur = 0;
1357	PPGMRAMRANGE pCur;
1358	pgmLock(pVM);
1359	do
1360	{
1361	uint32_t const idRamRangesGen = pVM->pgm.s.idRamRangesGen;
1362	for (pCur = pVM->pgm.s.pRamRangesXR3; pCur; pCur = pCur->pNextR3)
1363	{
1364	if ( pCur->GCPhysLast > GCPhysCur
1365	&& !PGM_RAM_RANGE_IS_AD_HOC(pCur))
1366	{
1367	PPGMLIVESAVERAMPAGE paLSPages = pCur->paLSPages;
1368	uint32_t cPages = pCur->cb >> PAGE_SHIFT;
1369	uint32_t iPage = GCPhysCur <= pCur->GCPhys ? 0 : (GCPhysCur - pCur->GCPhys) >> PAGE_SHIFT;
1370	GCPhysCur = 0;
1371	for (; iPage < cPages; iPage++)
1372	{
1373	/* Do yield first. */
1374	if ( !fFinalPass
1375	#ifndef PGMLIVESAVERAMPAGE_WITH_CRC32
1376	&& (iPage & 0x7ff) == 0x100
1377	#endif
1378	&& PDMR3CritSectYield(&pVM->pgm.s.CritSectX)
1379	&& pVM->pgm.s.idRamRangesGen != idRamRangesGen)
1380	{
1381	GCPhysCur = pCur->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT);
1382	break; /* restart */
1383	}
1384
1385	/* Skip already ignored pages. */
1386	if (paLSPages[iPage].fIgnore)
1387	continue;
1388
1389	if (RT_LIKELY(PGM_PAGE_GET_TYPE(&pCur->aPages[iPage]) == PGMPAGETYPE_RAM))
1390	{
1391	/*
1392	* A RAM page.
1393	*/
1394	switch (PGM_PAGE_GET_STATE(&pCur->aPages[iPage]))
1395	{
1396	case PGM_PAGE_STATE_ALLOCATED:
1397	/** @todo Optimize this: Don't always re-enable write
1398	* monitoring if the page is known to be very busy. */
1399	if (PGM_PAGE_IS_WRITTEN_TO(&pCur->aPages[iPage]))
1400	{
1401	AssertMsg(paLSPages[iPage].fWriteMonitored,
1402	("%RGp %R[pgmpage]\n", pCur->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT), &pCur->aPages[iPage]));
1403	PGM_PAGE_CLEAR_WRITTEN_TO(pVM, &pCur->aPages[iPage]);
1404	Assert(pVM->pgm.s.cWrittenToPages > 0);
1405	pVM->pgm.s.cWrittenToPages--;
1406	}
1407	else
1408	{
1409	AssertMsg(!paLSPages[iPage].fWriteMonitored,
1410	("%RGp %R[pgmpage]\n", pCur->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT), &pCur->aPages[iPage]));
1411	pVM->pgm.s.LiveSave.Ram.cMonitoredPages++;
1412	}
1413
1414	if (!paLSPages[iPage].fDirty)
1415	{
1416	pVM->pgm.s.LiveSave.Ram.cReadyPages--;
1417	if (paLSPages[iPage].fZero)
1418	pVM->pgm.s.LiveSave.Ram.cZeroPages--;
1419	pVM->pgm.s.LiveSave.Ram.cDirtyPages++;
1420	if (++paLSPages[iPage].cDirtied > PGMLIVSAVEPAGE_MAX_DIRTIED)
1421	paLSPages[iPage].cDirtied = PGMLIVSAVEPAGE_MAX_DIRTIED;
1422	}
1423
1424	pgmPhysPageWriteMonitor(pVM, &pCur->aPages[iPage],
1425	pCur->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT));
1426	paLSPages[iPage].fWriteMonitored = 1;
1427	paLSPages[iPage].fWriteMonitoredJustNow = 1;
1428	paLSPages[iPage].fDirty = 1;
1429	paLSPages[iPage].fZero = 0;
1430	paLSPages[iPage].fShared = 0;
1431	#ifdef PGMLIVESAVERAMPAGE_WITH_CRC32
1432	paLSPages[iPage].u32Crc = UINT32_MAX; /* invalid */
1433	#endif
1434	break;
1435
1436	case PGM_PAGE_STATE_WRITE_MONITORED:
1437	Assert(paLSPages[iPage].fWriteMonitored);
1438	if (PGM_PAGE_GET_WRITE_LOCKS(&pCur->aPages[iPage]) == 0)
1439	{
1440	#ifdef PGMLIVESAVERAMPAGE_WITH_CRC32
1441	if (paLSPages[iPage].fWriteMonitoredJustNow)
1442	pgmR3StateCalcCrc32ForRamPage(pVM, pCur, paLSPages, iPage);
1443	else
1444	pgmR3StateVerifyCrc32ForRamPage(pVM, pCur, paLSPages, iPage, "scan");
1445	#endif
1446	paLSPages[iPage].fWriteMonitoredJustNow = 0;
1447	}
1448	else
1449	{
1450	paLSPages[iPage].fWriteMonitoredJustNow = 1;
1451	#ifdef PGMLIVESAVERAMPAGE_WITH_CRC32
1452	paLSPages[iPage].u32Crc = UINT32_MAX; /* invalid */
1453	#endif
1454	if (!paLSPages[iPage].fDirty)
1455	{
1456	pVM->pgm.s.LiveSave.Ram.cReadyPages--;
1457	pVM->pgm.s.LiveSave.Ram.cDirtyPages++;
1458	if (++paLSPages[iPage].cDirtied > PGMLIVSAVEPAGE_MAX_DIRTIED)
1459	paLSPages[iPage].cDirtied = PGMLIVSAVEPAGE_MAX_DIRTIED;
1460	}
1461	}
1462	break;
1463
1464	case PGM_PAGE_STATE_ZERO:
1465	case PGM_PAGE_STATE_BALLOONED:
1466	if (!paLSPages[iPage].fZero)
1467	{
1468	if (!paLSPages[iPage].fDirty)
1469	{
1470	paLSPages[iPage].fDirty = 1;
1471	pVM->pgm.s.LiveSave.Ram.cReadyPages--;
1472	pVM->pgm.s.LiveSave.Ram.cDirtyPages++;
1473	}
1474	paLSPages[iPage].fZero = 1;
1475	paLSPages[iPage].fShared = 0;
1476	#ifdef PGMLIVESAVERAMPAGE_WITH_CRC32
1477	paLSPages[iPage].u32Crc = PGM_STATE_CRC32_ZERO_PAGE;
1478	#endif
1479	}
1480	break;
1481
1482	case PGM_PAGE_STATE_SHARED:
1483	if (!paLSPages[iPage].fShared)
1484	{
1485	if (!paLSPages[iPage].fDirty)
1486	{
1487	paLSPages[iPage].fDirty = 1;
1488	pVM->pgm.s.LiveSave.Ram.cReadyPages--;
1489	if (paLSPages[iPage].fZero)
1490	pVM->pgm.s.LiveSave.Ram.cZeroPages--;
1491	pVM->pgm.s.LiveSave.Ram.cDirtyPages++;
1492	}
1493	paLSPages[iPage].fZero = 0;
1494	paLSPages[iPage].fShared = 1;
1495	#ifdef PGMLIVESAVERAMPAGE_WITH_CRC32
1496	pgmR3StateCalcCrc32ForRamPage(pVM, pCur, paLSPages, iPage);
1497	#endif
1498	}
1499	break;
1500	}
1501	}
1502	else
1503	{
1504	/*
1505	* All other types => Ignore the page.
1506	*/
1507	Assert(!paLSPages[iPage].fIgnore); /* skipped before switch */
1508	paLSPages[iPage].fIgnore = 1;
1509	if (paLSPages[iPage].fWriteMonitored)
1510	{
1511	/** @todo this doesn't hold water when we start monitoring MMIO2 and ROM shadow
1512	* pages! */
1513	if (RT_UNLIKELY(PGM_PAGE_GET_STATE(&pCur->aPages[iPage]) == PGM_PAGE_STATE_WRITE_MONITORED))
1514	{
1515	AssertMsgFailed(("%R[pgmpage]", &pCur->aPages[iPage])); /* shouldn't happen. */
1516	PGM_PAGE_SET_STATE(pVM, &pCur->aPages[iPage], PGM_PAGE_STATE_ALLOCATED);
1517	Assert(pVM->pgm.s.cMonitoredPages > 0);
1518	pVM->pgm.s.cMonitoredPages--;
1519	}
1520	if (PGM_PAGE_IS_WRITTEN_TO(&pCur->aPages[iPage]))
1521	{
1522	PGM_PAGE_CLEAR_WRITTEN_TO(pVM, &pCur->aPages[iPage]);
1523	Assert(pVM->pgm.s.cWrittenToPages > 0);
1524	pVM->pgm.s.cWrittenToPages--;
1525	}
1526	pVM->pgm.s.LiveSave.Ram.cMonitoredPages--;
1527	}
1528
1529	/** @todo the counting doesn't quite work out here. fix later? */
1530	if (paLSPages[iPage].fDirty)
1531	pVM->pgm.s.LiveSave.Ram.cDirtyPages--;
1532	else
1533	{
1534	pVM->pgm.s.LiveSave.Ram.cReadyPages--;
1535	if (paLSPages[iPage].fZero)
1536	pVM->pgm.s.LiveSave.Ram.cZeroPages--;
1537	}
1538	pVM->pgm.s.LiveSave.cIgnoredPages++;
1539	}
1540	} /* for each page in range */
1541
1542	if (GCPhysCur != 0)
1543	break; /* Yield + ramrange change */
1544	GCPhysCur = pCur->GCPhysLast;
1545	}
1546	} /* for each range */
1547	} while (pCur);
1548	pgmUnlock(pVM);
1549	}
1550
1551
1552	/**
1553	* Save quiescent RAM pages.
1554	*
1555	* @returns VBox status code.
1556	* @param pVM The cross context VM structure.
1557	* @param pSSM The SSM handle.
1558	* @param fLiveSave Whether it's a live save or not.
1559	* @param uPass The pass number.
1560	*/
1561	static int pgmR3SaveRamPages(PVM pVM, PSSMHANDLE pSSM, bool fLiveSave, uint32_t uPass)
1562	{
1563	NOREF(fLiveSave);
1564
1565	/*
1566	* The RAM.
1567	*/
1568	RTGCPHYS GCPhysLast = NIL_RTGCPHYS;
1569	RTGCPHYS GCPhysCur = 0;
1570	PPGMRAMRANGE pCur;
1571	bool fFTMDeltaSaveActive = FTMIsDeltaLoadSaveActive(pVM);
1572
1573	pgmLock(pVM);
1574	do
1575	{
1576	uint32_t const idRamRangesGen = pVM->pgm.s.idRamRangesGen;
1577	for (pCur = pVM->pgm.s.pRamRangesXR3; pCur; pCur = pCur->pNextR3)
1578	{
1579	if ( pCur->GCPhysLast > GCPhysCur
1580	&& !PGM_RAM_RANGE_IS_AD_HOC(pCur))
1581	{
1582	PPGMLIVESAVERAMPAGE paLSPages = pCur->paLSPages;
1583	uint32_t cPages = pCur->cb >> PAGE_SHIFT;
1584	uint32_t iPage = GCPhysCur <= pCur->GCPhys ? 0 : (GCPhysCur - pCur->GCPhys) >> PAGE_SHIFT;
1585	GCPhysCur = 0;
1586	for (; iPage < cPages; iPage++)
1587	{
1588	/* Do yield first. */
1589	if ( uPass != SSM_PASS_FINAL
1590	&& (iPage & 0x7ff) == 0x100
1591	&& PDMR3CritSectYield(&pVM->pgm.s.CritSectX)
1592	&& pVM->pgm.s.idRamRangesGen != idRamRangesGen)
1593	{
1594	GCPhysCur = pCur->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT);
1595	break; /* restart */
1596	}
1597
1598	PPGMPAGE pCurPage = &pCur->aPages[iPage];
1599
1600	/*
1601	* Only save pages that haven't changed since last scan and are dirty.
1602	*/
1603	if ( uPass != SSM_PASS_FINAL
1604	&& paLSPages)
1605	{
1606	if (!paLSPages[iPage].fDirty)
1607	continue;
1608	if (paLSPages[iPage].fWriteMonitoredJustNow)
1609	continue;
1610	if (paLSPages[iPage].fIgnore)
1611	continue;
1612	if (PGM_PAGE_GET_TYPE(pCurPage) != PGMPAGETYPE_RAM) /* in case of recent remappings */
1613	continue;
1614	if ( PGM_PAGE_GET_STATE(pCurPage)
1615	!= ( paLSPages[iPage].fZero
1616	? PGM_PAGE_STATE_ZERO
1617	: paLSPages[iPage].fShared
1618	? PGM_PAGE_STATE_SHARED
1619	: PGM_PAGE_STATE_WRITE_MONITORED))
1620	continue;
1621	if (PGM_PAGE_GET_WRITE_LOCKS(&pCur->aPages[iPage]) > 0)
1622	continue;
1623	}
1624	else
1625	{
1626	if ( paLSPages
1627	&& !paLSPages[iPage].fDirty
1628	&& !paLSPages[iPage].fIgnore)
1629	{
1630	#ifdef PGMLIVESAVERAMPAGE_WITH_CRC32
1631	if (PGM_PAGE_GET_TYPE(pCurPage) != PGMPAGETYPE_RAM)
1632	pgmR3StateVerifyCrc32ForRamPage(pVM, pCur, paLSPages, iPage, "save#1");
1633	#endif
1634	continue;
1635	}
1636	if (PGM_PAGE_GET_TYPE(pCurPage) != PGMPAGETYPE_RAM)
1637	continue;
1638	}
1639
1640	/*
1641	* Do the saving outside the PGM critsect since SSM may block on I/O.
1642	*/
1643	int rc;
1644	RTGCPHYS GCPhys = pCur->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT);
1645	bool fZero = PGM_PAGE_IS_ZERO(pCurPage);
1646	bool fBallooned = PGM_PAGE_IS_BALLOONED(pCurPage);
1647	bool fSkipped = false;
1648
1649	if (!fZero && !fBallooned)
1650	{
1651	/*
1652	* Copy the page and then save it outside the lock (since any
1653	* SSM call may block).
1654	*/
1655	uint8_t abPage[PAGE_SIZE];
1656	PGMPAGEMAPLOCK PgMpLck;
1657	void const *pvPage;
1658	rc = pgmPhysGCPhys2CCPtrInternalReadOnly(pVM, pCurPage, GCPhys, &pvPage, &PgMpLck);
1659	if (RT_SUCCESS(rc))
1660	{
1661	memcpy(abPage, pvPage, PAGE_SIZE);
1662	#ifdef PGMLIVESAVERAMPAGE_WITH_CRC32
1663	if (paLSPages)
1664	pgmR3StateVerifyCrc32ForPage(abPage, pCur, paLSPages, iPage, "save#3");
1665	#endif
1666	pgmPhysReleaseInternalPageMappingLock(pVM, &PgMpLck);
1667	}
1668	pgmUnlock(pVM);
1669	AssertLogRelMsgRCReturn(rc, ("rc=%Rrc GCPhys=%RGp\n", rc, GCPhys), rc);
1670
1671	/* Try save some memory when restoring. */
1672	if (!ASMMemIsZeroPage(pvPage))
1673	{
1674	if (fFTMDeltaSaveActive)
1675	{
1676	if ( PGM_PAGE_IS_WRITTEN_TO(pCurPage)
1677	\|\| PGM_PAGE_IS_FT_DIRTY(pCurPage))
1678	{
1679	if (GCPhys == GCPhysLast + PAGE_SIZE)
1680	SSMR3PutU8(pSSM, PGM_STATE_REC_RAM_RAW);
1681	else
1682	{
1683	SSMR3PutU8(pSSM, PGM_STATE_REC_RAM_RAW \| PGM_STATE_REC_FLAG_ADDR);
1684	SSMR3PutGCPhys(pSSM, GCPhys);
1685	}
1686	rc = SSMR3PutMem(pSSM, abPage, PAGE_SIZE);
1687	PGM_PAGE_CLEAR_WRITTEN_TO(pVM, pCurPage);
1688	PGM_PAGE_CLEAR_FT_DIRTY(pCurPage);
1689	}
1690	/* else nothing changed, so skip it. */
1691	else
1692	fSkipped = true;
1693	}
1694	else
1695	{
1696	if (GCPhys == GCPhysLast + PAGE_SIZE)
1697	SSMR3PutU8(pSSM, PGM_STATE_REC_RAM_RAW);
1698	else
1699	{
1700	SSMR3PutU8(pSSM, PGM_STATE_REC_RAM_RAW \| PGM_STATE_REC_FLAG_ADDR);
1701	SSMR3PutGCPhys(pSSM, GCPhys);
1702	}
1703	rc = SSMR3PutMem(pSSM, abPage, PAGE_SIZE);
1704	}
1705	}
1706	else
1707	{
1708	if (GCPhys == GCPhysLast + PAGE_SIZE)
1709	rc = SSMR3PutU8(pSSM, PGM_STATE_REC_RAM_ZERO);
1710	else
1711	{
1712	SSMR3PutU8(pSSM, PGM_STATE_REC_RAM_ZERO \| PGM_STATE_REC_FLAG_ADDR);
1713	rc = SSMR3PutGCPhys(pSSM, GCPhys);
1714	}
1715	}
1716	}
1717	else
1718	{
1719	/*
1720	* Dirty zero or ballooned page.
1721	*/
1722	#ifdef PGMLIVESAVERAMPAGE_WITH_CRC32
1723	if (paLSPages)
1724	pgmR3StateVerifyCrc32ForRamPage(pVM, pCur, paLSPages, iPage, "save#2");
1725	#endif
1726	pgmUnlock(pVM);
1727
1728	uint8_t u8RecType = fBallooned ? PGM_STATE_REC_RAM_BALLOONED : PGM_STATE_REC_RAM_ZERO;
1729	if (GCPhys == GCPhysLast + PAGE_SIZE)
1730	rc = SSMR3PutU8(pSSM, u8RecType);
1731	else
1732	{
1733	SSMR3PutU8(pSSM, u8RecType \| PGM_STATE_REC_FLAG_ADDR);
1734	rc = SSMR3PutGCPhys(pSSM, GCPhys);
1735	}
1736	}
1737	if (RT_FAILURE(rc))
1738	return rc;
1739
1740	pgmLock(pVM);
1741	if (!fSkipped)
1742	GCPhysLast = GCPhys;
1743	if (paLSPages)
1744	{
1745	paLSPages[iPage].fDirty = 0;
1746	pVM->pgm.s.LiveSave.Ram.cReadyPages++;
1747	if (fZero)
1748	pVM->pgm.s.LiveSave.Ram.cZeroPages++;
1749	pVM->pgm.s.LiveSave.Ram.cDirtyPages--;
1750	pVM->pgm.s.LiveSave.cSavedPages++;
1751	}
1752	if (idRamRangesGen != pVM->pgm.s.idRamRangesGen)
1753	{
1754	GCPhysCur = GCPhys \| PAGE_OFFSET_MASK;
1755	break; /* restart */
1756	}
1757
1758	} /* for each page in range */
1759
1760	if (GCPhysCur != 0)
1761	break; /* Yield + ramrange change */
1762	GCPhysCur = pCur->GCPhysLast;
1763	}
1764	} /* for each range */
1765	} while (pCur);
1766
1767	pgmUnlock(pVM);
1768
1769	return VINF_SUCCESS;
1770	}
1771
1772
1773	/**
1774	* Cleans up RAM pages after a live save.
1775	*
1776	* @param pVM The cross context VM structure.
1777	*/
1778	static void pgmR3DoneRamPages(PVM pVM)
1779	{
1780	/*
1781	* Free the tracking arrays and disable write monitoring.
1782	*
1783	* Play nice with the PGM lock in case we're called while the VM is still
1784	* running. This means we have to delay the freeing since we wish to use
1785	* paLSPages as an indicator of which RAM ranges which we need to scan for
1786	* write monitored pages.
1787	*/
1788	void *pvToFree = NULL;
1789	PPGMRAMRANGE pCur;
1790	uint32_t cMonitoredPages = 0;
1791	pgmLock(pVM);
1792	do
1793	{
1794	for (pCur = pVM->pgm.s.pRamRangesXR3; pCur; pCur = pCur->pNextR3)
1795	{
1796	if (pCur->paLSPages)
1797	{
1798	if (pvToFree)
1799	{
1800	uint32_t idRamRangesGen = pVM->pgm.s.idRamRangesGen;
1801	pgmUnlock(pVM);
1802	MMR3HeapFree(pvToFree);
1803	pvToFree = NULL;
1804	pgmLock(pVM);
1805	if (idRamRangesGen != pVM->pgm.s.idRamRangesGen)
1806	break; /* start over again. */
1807	}
1808
1809	pvToFree = pCur->paLSPages;
1810	pCur->paLSPages = NULL;
1811
1812	uint32_t iPage = pCur->cb >> PAGE_SHIFT;
1813	while (iPage--)
1814	{
1815	PPGMPAGE pPage = &pCur->aPages[iPage];
1816	PGM_PAGE_CLEAR_WRITTEN_TO(pVM, pPage);
1817	if (PGM_PAGE_GET_STATE(pPage) == PGM_PAGE_STATE_WRITE_MONITORED)
1818	{
1819	PGM_PAGE_SET_STATE(pVM, pPage, PGM_PAGE_STATE_ALLOCATED);
1820	cMonitoredPages++;
1821	}
1822	}
1823	}
1824	}
1825	} while (pCur);
1826
1827	Assert(pVM->pgm.s.cMonitoredPages >= cMonitoredPages);
1828	if (pVM->pgm.s.cMonitoredPages < cMonitoredPages)
1829	pVM->pgm.s.cMonitoredPages = 0;
1830	else
1831	pVM->pgm.s.cMonitoredPages -= cMonitoredPages;
1832
1833	pgmUnlock(pVM);
1834
1835	MMR3HeapFree(pvToFree);
1836	pvToFree = NULL;
1837	}
1838
1839
1840	/**
1841	* @callback_method_impl{FNSSMINTLIVEEXEC}
1842	*/
1843	static DECLCALLBACK(int) pgmR3LiveExec(PVM pVM, PSSMHANDLE pSSM, uint32_t uPass)
1844	{
1845	int rc;
1846
1847	/*
1848	* Save the MMIO2 and ROM range IDs in pass 0.
1849	*/
1850	if (uPass == 0)
1851	{
1852	rc = pgmR3SaveRamConfig(pVM, pSSM);
1853	if (RT_FAILURE(rc))
1854	return rc;
1855	rc = pgmR3SaveRomRanges(pVM, pSSM);
1856	if (RT_FAILURE(rc))
1857	return rc;
1858	rc = pgmR3SaveMmio2Ranges(pVM, pSSM);
1859	if (RT_FAILURE(rc))
1860	return rc;
1861	}
1862	/*
1863	* Reset the page-per-second estimate to avoid inflation by the initial
1864	* load of zero pages. pgmR3LiveVote ASSUMES this is done at pass 7.
1865	*/
1866	else if (uPass == 7)
1867	{
1868	pVM->pgm.s.LiveSave.cSavedPages = 0;
1869	pVM->pgm.s.LiveSave.uSaveStartNS = RTTimeNanoTS();
1870	}
1871
1872	/*
1873	* Do the scanning.
1874	*/
1875	pgmR3ScanRomPages(pVM);
1876	pgmR3ScanMmio2Pages(pVM, uPass);
1877	pgmR3ScanRamPages(pVM, false /fFinalPass/);
1878	pgmR3PoolClearAll(pVM, true /fFlushRemTlb/); /** @todo this could perhaps be optimized a bit. */
1879
1880	/*
1881	* Save the pages.
1882	*/
1883	if (uPass == 0)
1884	rc = pgmR3SaveRomVirginPages( pVM, pSSM, true /fLiveSave/);
1885	else
1886	rc = VINF_SUCCESS;
1887	if (RT_SUCCESS(rc))
1888	rc = pgmR3SaveShadowedRomPages(pVM, pSSM, true /fLiveSave/, false /fFinalPass/);
1889	if (RT_SUCCESS(rc))
1890	rc = pgmR3SaveMmio2Pages( pVM, pSSM, true /fLiveSave/, uPass);
1891	if (RT_SUCCESS(rc))
1892	rc = pgmR3SaveRamPages( pVM, pSSM, true /fLiveSave/, uPass);
1893	SSMR3PutU8(pSSM, PGM_STATE_REC_END); /* (Ignore the rc, SSM takes care of it.) */
1894
1895	return rc;
1896	}
1897
1898
1899	/**
1900	* @callback_method_impl{FNSSMINTLIVEVOTE}
1901	*/
1902	static DECLCALLBACK(int) pgmR3LiveVote(PVM pVM, PSSMHANDLE pSSM, uint32_t uPass)
1903	{
1904	/*
1905	* Update and calculate parameters used in the decision making.
1906	*/
1907	const uint32_t cHistoryEntries = RT_ELEMENTS(pVM->pgm.s.LiveSave.acDirtyPagesHistory);
1908
1909	/* update history. */
1910	pgmLock(pVM);
1911	uint32_t const cWrittenToPages = pVM->pgm.s.cWrittenToPages;
1912	pgmUnlock(pVM);
1913	uint32_t const cDirtyNow = pVM->pgm.s.LiveSave.Rom.cDirtyPages
1914	+ pVM->pgm.s.LiveSave.Mmio2.cDirtyPages
1915	+ pVM->pgm.s.LiveSave.Ram.cDirtyPages
1916	+ cWrittenToPages;
1917	uint32_t i = pVM->pgm.s.LiveSave.iDirtyPagesHistory;
1918	pVM->pgm.s.LiveSave.acDirtyPagesHistory[i] = cDirtyNow;
1919	pVM->pgm.s.LiveSave.iDirtyPagesHistory = (i + 1) % cHistoryEntries;
1920
1921	/* calc shortterm average (4 passes). */
1922	AssertCompile(RT_ELEMENTS(pVM->pgm.s.LiveSave.acDirtyPagesHistory) > 4);
1923	uint64_t cTotal = pVM->pgm.s.LiveSave.acDirtyPagesHistory[i];
1924	cTotal += pVM->pgm.s.LiveSave.acDirtyPagesHistory[(i + cHistoryEntries - 1) % cHistoryEntries];
1925	cTotal += pVM->pgm.s.LiveSave.acDirtyPagesHistory[(i + cHistoryEntries - 2) % cHistoryEntries];
1926	cTotal += pVM->pgm.s.LiveSave.acDirtyPagesHistory[(i + cHistoryEntries - 3) % cHistoryEntries];
1927	uint32_t const cDirtyPagesShort = cTotal / 4;
1928	pVM->pgm.s.LiveSave.cDirtyPagesShort = cDirtyPagesShort;
1929
1930	/* calc longterm average. */
1931	cTotal = 0;
1932	if (uPass < cHistoryEntries)
1933	for (i = 0; i < cHistoryEntries && i <= uPass; i++)
1934	cTotal += pVM->pgm.s.LiveSave.acDirtyPagesHistory[i];
1935	else
1936	for (i = 0; i < cHistoryEntries; i++)
1937	cTotal += pVM->pgm.s.LiveSave.acDirtyPagesHistory[i];
1938	uint32_t const cDirtyPagesLong = cTotal / cHistoryEntries;
1939	pVM->pgm.s.LiveSave.cDirtyPagesLong = cDirtyPagesLong;
1940
1941	/* estimate the speed */
1942	uint64_t cNsElapsed = RTTimeNanoTS() - pVM->pgm.s.LiveSave.uSaveStartNS;
1943	uint32_t cPagesPerSecond = (uint32_t)( pVM->pgm.s.LiveSave.cSavedPages
1944	/ ((long double)cNsElapsed / 1000000000.0) );
1945	pVM->pgm.s.LiveSave.cPagesPerSecond = cPagesPerSecond;
1946
1947	/*
1948	* Try make a decision.
1949	*/
1950	if ( cDirtyPagesShort <= cDirtyPagesLong
1951	&& ( cDirtyNow <= cDirtyPagesShort
1952	\|\| cDirtyNow - cDirtyPagesShort < RT_MIN(cDirtyPagesShort / 8, 16)
1953	)
1954	)
1955	{
1956	if (uPass > 10)
1957	{
1958	uint32_t cMsLeftShort = (uint32_t)(cDirtyPagesShort / (long double)cPagesPerSecond * 1000.0);
1959	uint32_t cMsLeftLong = (uint32_t)(cDirtyPagesLong / (long double)cPagesPerSecond * 1000.0);
1960	uint32_t cMsMaxDowntime = SSMR3HandleMaxDowntime(pSSM);
1961	if (cMsMaxDowntime < 32)
1962	cMsMaxDowntime = 32;
1963	if ( ( cMsLeftLong <= cMsMaxDowntime
1964	&& cMsLeftShort < cMsMaxDowntime)
1965	\|\| cMsLeftShort < cMsMaxDowntime / 2
1966	)
1967	{
1968	Log(("pgmR3LiveVote: VINF_SUCCESS - pass=%d cDirtyPagesShort=%u\|%ums cDirtyPagesLong=%u\|%ums cMsMaxDowntime=%u\n",
1969	uPass, cDirtyPagesShort, cMsLeftShort, cDirtyPagesLong, cMsLeftLong, cMsMaxDowntime));
1970	return VINF_SUCCESS;
1971	}
1972	}
1973	else
1974	{
1975	if ( ( cDirtyPagesShort <= 128
1976	&& cDirtyPagesLong <= 1024)
1977	\|\| cDirtyPagesLong <= 256
1978	)
1979	{
1980	Log(("pgmR3LiveVote: VINF_SUCCESS - pass=%d cDirtyPagesShort=%u cDirtyPagesLong=%u\n", uPass, cDirtyPagesShort, cDirtyPagesLong));
1981	return VINF_SUCCESS;
1982	}
1983	}
1984	}
1985
1986	/*
1987	* Come up with a completion percentage. Currently this is a simple
1988	* dirty page (long term) vs. total pages ratio + some pass trickery.
1989	*/
1990	unsigned uPctDirty = (unsigned)( (long double)cDirtyPagesLong
1991	/ (pVM->pgm.s.cAllPages - pVM->pgm.s.LiveSave.cIgnoredPages - pVM->pgm.s.cZeroPages) );
1992	if (uPctDirty <= 100)
1993	SSMR3HandleReportLivePercent(pSSM, RT_MIN(100 - uPctDirty, uPass * 2));
1994	else
1995	AssertMsgFailed(("uPctDirty=%u cDirtyPagesLong=%#x cAllPages=%#x cIgnoredPages=%#x cZeroPages=%#x\n",
1996	uPctDirty, cDirtyPagesLong, pVM->pgm.s.cAllPages, pVM->pgm.s.LiveSave.cIgnoredPages, pVM->pgm.s.cZeroPages));
1997
1998	return VINF_SSM_VOTE_FOR_ANOTHER_PASS;
1999	}
2000
2001
2002	/**
2003	* @callback_method_impl{FNSSMINTLIVEPREP}
2004	*
2005	* This will attempt to allocate and initialize the tracking structures. It
2006	* will also prepare for write monitoring of pages and initialize PGM::LiveSave.
2007	* pgmR3SaveDone will do the cleanups.
2008	*/
2009	static DECLCALLBACK(int) pgmR3LivePrep(PVM pVM, PSSMHANDLE pSSM)
2010	{
2011	/*
2012	* Indicate that we will be using the write monitoring.
2013	*/
2014	pgmLock(pVM);
2015	/** @todo find a way of mediating this when more users are added. */
2016	if (pVM->pgm.s.fPhysWriteMonitoringEngaged)
2017	{
2018	pgmUnlock(pVM);
2019	AssertLogRelFailedReturn(VERR_PGM_WRITE_MONITOR_ENGAGED);
2020	}
2021	pVM->pgm.s.fPhysWriteMonitoringEngaged = true;
2022	pgmUnlock(pVM);
2023
2024	/*
2025	* Initialize the statistics.
2026	*/
2027	pVM->pgm.s.LiveSave.Rom.cReadyPages = 0;
2028	pVM->pgm.s.LiveSave.Rom.cDirtyPages = 0;
2029	pVM->pgm.s.LiveSave.Mmio2.cReadyPages = 0;
2030	pVM->pgm.s.LiveSave.Mmio2.cDirtyPages = 0;
2031	pVM->pgm.s.LiveSave.Ram.cReadyPages = 0;
2032	pVM->pgm.s.LiveSave.Ram.cDirtyPages = 0;
2033	pVM->pgm.s.LiveSave.cIgnoredPages = 0;
2034	pVM->pgm.s.LiveSave.fActive = true;
2035	for (unsigned i = 0; i < RT_ELEMENTS(pVM->pgm.s.LiveSave.acDirtyPagesHistory); i++)
2036	pVM->pgm.s.LiveSave.acDirtyPagesHistory[i] = UINT32_MAX / 2;
2037	pVM->pgm.s.LiveSave.iDirtyPagesHistory = 0;
2038	pVM->pgm.s.LiveSave.cSavedPages = 0;
2039	pVM->pgm.s.LiveSave.uSaveStartNS = RTTimeNanoTS();
2040	pVM->pgm.s.LiveSave.cPagesPerSecond = 8192;
2041
2042	/*
2043	* Per page type.
2044	*/
2045	int rc = pgmR3PrepRomPages(pVM);
2046	if (RT_SUCCESS(rc))
2047	rc = pgmR3PrepMmio2Pages(pVM);
2048	if (RT_SUCCESS(rc))
2049	rc = pgmR3PrepRamPages(pVM);
2050
2051	NOREF(pSSM);
2052	return rc;
2053	}
2054
2055
2056	/**
2057	* @callback_method_impl{FNSSMINTSAVEEXEC}
2058	*/
2059	static DECLCALLBACK(int) pgmR3SaveExec(PVM pVM, PSSMHANDLE pSSM)
2060	{
2061	int rc = VINF_SUCCESS;
2062	PPGM pPGM = &pVM->pgm.s;
2063
2064	/*
2065	* Lock PGM and set the no-more-writes indicator.
2066	*/
2067	pgmLock(pVM);
2068	pVM->pgm.s.fNoMorePhysWrites = true;
2069
2070	/*
2071	* Save basic data (required / unaffected by relocation).
2072	*/
2073	bool const fMappingsFixed = pVM->pgm.s.fMappingsFixed;
2074	pVM->pgm.s.fMappingsFixed \|= pVM->pgm.s.fMappingsFixedRestored;
2075	SSMR3PutStruct(pSSM, pPGM, &s_aPGMFields[0]);
2076	pVM->pgm.s.fMappingsFixed = fMappingsFixed;
2077
2078	for (VMCPUID idCpu = 0; idCpu < pVM->cCpus; idCpu++)
2079	rc = SSMR3PutStruct(pSSM, &pVM->aCpus[idCpu].pgm.s, &s_aPGMCpuFields[0]);
2080
2081	/*
2082	* Save the (remainder of the) memory.
2083	*/
2084	if (RT_SUCCESS(rc))
2085	{
2086	if (pVM->pgm.s.LiveSave.fActive)
2087	{
2088	pgmR3ScanRomPages(pVM);
2089	pgmR3ScanMmio2Pages(pVM, SSM_PASS_FINAL);
2090	pgmR3ScanRamPages(pVM, true /fFinalPass/);
2091
2092	rc = pgmR3SaveShadowedRomPages( pVM, pSSM, true /fLiveSave/, true /fFinalPass/);
2093	if (RT_SUCCESS(rc))
2094	rc = pgmR3SaveMmio2Pages( pVM, pSSM, true /fLiveSave/, SSM_PASS_FINAL);
2095	if (RT_SUCCESS(rc))
2096	rc = pgmR3SaveRamPages( pVM, pSSM, true /fLiveSave/, SSM_PASS_FINAL);
2097	}
2098	else
2099	{
2100	rc = pgmR3SaveRamConfig(pVM, pSSM);
2101	if (RT_SUCCESS(rc))
2102	rc = pgmR3SaveRomRanges(pVM, pSSM);
2103	if (RT_SUCCESS(rc))
2104	rc = pgmR3SaveMmio2Ranges(pVM, pSSM);
2105	if (RT_SUCCESS(rc))
2106	rc = pgmR3SaveRomVirginPages( pVM, pSSM, false /fLiveSave/);
2107	if (RT_SUCCESS(rc))
2108	rc = pgmR3SaveShadowedRomPages(pVM, pSSM, false /fLiveSave/, true /fFinalPass/);
2109	if (RT_SUCCESS(rc))
2110	rc = pgmR3SaveMmio2Pages( pVM, pSSM, false /fLiveSave/, SSM_PASS_FINAL);
2111	if (RT_SUCCESS(rc))
2112	rc = pgmR3SaveRamPages( pVM, pSSM, false /fLiveSave/, SSM_PASS_FINAL);
2113	}
2114	SSMR3PutU8(pSSM, PGM_STATE_REC_END); /* (Ignore the rc, SSM takes of it.) */
2115	}
2116
2117	pgmUnlock(pVM);
2118	return rc;
2119	}
2120
2121
2122	/**
2123	* @callback_method_impl{FNSSMINTSAVEDONE}
2124	*/
2125	static DECLCALLBACK(int) pgmR3SaveDone(PVM pVM, PSSMHANDLE pSSM)
2126	{
2127	/*
2128	* Do per page type cleanups first.
2129	*/
2130	if (pVM->pgm.s.LiveSave.fActive)
2131	{
2132	pgmR3DoneRomPages(pVM);
2133	pgmR3DoneMmio2Pages(pVM);
2134	pgmR3DoneRamPages(pVM);
2135	}
2136
2137	/*
2138	* Clear the live save indicator and disengage write monitoring.
2139	*/
2140	pgmLock(pVM);
2141	pVM->pgm.s.LiveSave.fActive = false;
2142	/** @todo this is blindly assuming that we're the only user of write
2143	* monitoring. Fix this when more users are added. */
2144	pVM->pgm.s.fPhysWriteMonitoringEngaged = false;
2145	pgmUnlock(pVM);
2146
2147	NOREF(pSSM);
2148	return VINF_SUCCESS;
2149	}
2150
2151
2152	/**
2153	* @callback_method_impl{FNSSMINTLOADPREP}
2154	*/
2155	static DECLCALLBACK(int) pgmR3LoadPrep(PVM pVM, PSSMHANDLE pSSM)
2156	{
2157	/*
2158	* Call the reset function to make sure all the memory is cleared.
2159	*/
2160	PGMR3Reset(pVM);
2161	pVM->pgm.s.LiveSave.fActive = false;
2162	NOREF(pSSM);
2163	return VINF_SUCCESS;
2164	}
2165
2166
2167	/**
2168	* Load an ignored page.
2169	*
2170	* @returns VBox status code.
2171	* @param pSSM The saved state handle.
2172	*/
2173	static int pgmR3LoadPageToDevNullOld(PSSMHANDLE pSSM)
2174	{
2175	uint8_t abPage[PAGE_SIZE];
2176	return SSMR3GetMem(pSSM, &abPage[0], sizeof(abPage));
2177	}
2178
2179
2180	/**
2181	* Compares a page with an old save type value.
2182	*
2183	* @returns true if equal, false if not.
2184	* @param pPage The page to compare.
2185	* @param uOldType The old type value from the saved state.
2186	*/
2187	DECLINLINE(bool) pgmR3CompareNewAndOldPageTypes(PPGMPAGE pPage, uint8_t uOldType)
2188	{
2189	uint8_t uOldPageType;
2190	switch (PGM_PAGE_GET_TYPE(pPage))
2191	{
2192	case PGMPAGETYPE_INVALID: uOldPageType = PGMPAGETYPE_OLD_INVALID; break;
2193	case PGMPAGETYPE_RAM: uOldPageType = PGMPAGETYPE_OLD_RAM; break;
2194	case PGMPAGETYPE_MMIO2: uOldPageType = PGMPAGETYPE_OLD_MMIO2; break;
2195	case PGMPAGETYPE_MMIO2_ALIAS_MMIO: uOldPageType = PGMPAGETYPE_OLD_MMIO2_ALIAS_MMIO; break;
2196	case PGMPAGETYPE_ROM_SHADOW: uOldPageType = PGMPAGETYPE_OLD_ROM_SHADOW; break;
2197	case PGMPAGETYPE_ROM: uOldPageType = PGMPAGETYPE_OLD_ROM; break;
2198	case PGMPAGETYPE_SPECIAL_ALIAS_MMIO: /* fall thru */
2199	case PGMPAGETYPE_MMIO: uOldPageType = PGMPAGETYPE_OLD_MMIO; break;
2200	default:
2201	AssertFailed();
2202	uOldPageType = PGMPAGETYPE_OLD_INVALID;
2203	break;
2204	}
2205	return uOldPageType == uOldType;
2206	}
2207
2208
2209	/**
2210	* Loads a page without any bits in the saved state, i.e. making sure it's
2211	* really zero.
2212	*
2213	* @returns VBox status code.
2214	* @param pVM The cross context VM structure.
2215	* @param uOldType The page type or PGMPAGETYPE_OLD_INVALID (old saved
2216	* state).
2217	* @param pPage The guest page tracking structure.
2218	* @param GCPhys The page address.
2219	* @param pRam The ram range (logging).
2220	*/
2221	static int pgmR3LoadPageZeroOld(PVM pVM, uint8_t uOldType, PPGMPAGE pPage, RTGCPHYS GCPhys, PPGMRAMRANGE pRam)
2222	{
2223	if ( uOldType != PGMPAGETYPE_OLD_INVALID
2224	&& !pgmR3CompareNewAndOldPageTypes(pPage, uOldType))
2225	return VERR_SSM_UNEXPECTED_DATA;
2226
2227	/* I think this should be sufficient. */
2228	if ( !PGM_PAGE_IS_ZERO(pPage)
2229	&& !PGM_PAGE_IS_BALLOONED(pPage))
2230	return VERR_SSM_UNEXPECTED_DATA;
2231
2232	NOREF(pVM);
2233	NOREF(GCPhys);
2234	NOREF(pRam);
2235	return VINF_SUCCESS;
2236	}
2237
2238
2239	/**
2240	* Loads a page from the saved state.
2241	*
2242	* @returns VBox status code.
2243	* @param pVM The cross context VM structure.
2244	* @param pSSM The SSM handle.
2245	* @param uOldType The page type or PGMPAGETYPE_OLD_INVALID (old saved
2246	* state).
2247	* @param pPage The guest page tracking structure.
2248	* @param GCPhys The page address.
2249	* @param pRam The ram range (logging).
2250	*/
2251	static int pgmR3LoadPageBitsOld(PVM pVM, PSSMHANDLE pSSM, uint8_t uOldType, PPGMPAGE pPage, RTGCPHYS GCPhys, PPGMRAMRANGE pRam)
2252	{
2253	/*
2254	* Match up the type, dealing with MMIO2 aliases (dropped).
2255	*/
2256	AssertLogRelMsgReturn( uOldType == PGMPAGETYPE_INVALID
2257	\|\| pgmR3CompareNewAndOldPageTypes(pPage, uOldType)
2258	/* kudge for the expanded PXE bios (r67885) - @bugref{5687}: */
2259	\|\| ( uOldType == PGMPAGETYPE_OLD_RAM
2260	&& GCPhys >= 0xed000
2261	&& GCPhys <= 0xeffff
2262	&& PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_ROM)
2263	,
2264	("pPage=%R[pgmpage] GCPhys=%#x %s\n", pPage, GCPhys, pRam->pszDesc),
2265	VERR_SSM_UNEXPECTED_DATA);
2266
2267	/*
2268	* Load the page.
2269	*/
2270	PGMPAGEMAPLOCK PgMpLck;
2271	void *pvPage;
2272	int rc = pgmPhysGCPhys2CCPtrInternal(pVM, pPage, GCPhys, &pvPage, &PgMpLck);
2273	if (RT_SUCCESS(rc))
2274	{
2275	rc = SSMR3GetMem(pSSM, pvPage, PAGE_SIZE);
2276	pgmPhysReleaseInternalPageMappingLock(pVM, &PgMpLck);
2277	}
2278
2279	return rc;
2280	}
2281
2282
2283	/**
2284	* Loads a page (counter part to pgmR3SavePage).
2285	*
2286	* @returns VBox status code, fully bitched errors.
2287	* @param pVM The cross context VM structure.
2288	* @param pSSM The SSM handle.
2289	* @param uOldType The page type.
2290	* @param pPage The page.
2291	* @param GCPhys The page address.
2292	* @param pRam The RAM range (for error messages).
2293	*/
2294	static int pgmR3LoadPageOld(PVM pVM, PSSMHANDLE pSSM, uint8_t uOldType, PPGMPAGE pPage, RTGCPHYS GCPhys, PPGMRAMRANGE pRam)
2295	{
2296	uint8_t uState;
2297	int rc = SSMR3GetU8(pSSM, &uState);
2298	AssertLogRelMsgRCReturn(rc, ("pPage=%R[pgmpage] GCPhys=%#x %s rc=%Rrc\n", pPage, GCPhys, pRam->pszDesc, rc), rc);
2299	if (uState == 0 /* zero */)
2300	rc = pgmR3LoadPageZeroOld(pVM, uOldType, pPage, GCPhys, pRam);
2301	else if (uState == 1)
2302	rc = pgmR3LoadPageBitsOld(pVM, pSSM, uOldType, pPage, GCPhys, pRam);
2303	else
2304	rc = VERR_PGM_INVALID_SAVED_PAGE_STATE;
2305	AssertLogRelMsgRCReturn(rc, ("pPage=%R[pgmpage] uState=%d uOldType=%d GCPhys=%RGp %s rc=%Rrc\n",
2306	pPage, uState, uOldType, GCPhys, pRam->pszDesc, rc),
2307	rc);
2308	return VINF_SUCCESS;
2309	}
2310
2311
2312	/**
2313	* Loads a shadowed ROM page.
2314	*
2315	* @returns VBox status code, errors are fully bitched.
2316	* @param pVM The cross context VM structure.
2317	* @param pSSM The saved state handle.
2318	* @param pPage The page.
2319	* @param GCPhys The page address.
2320	* @param pRam The RAM range (for error messages).
2321	*/
2322	static int pgmR3LoadShadowedRomPageOld(PVM pVM, PSSMHANDLE pSSM, PPGMPAGE pPage, RTGCPHYS GCPhys, PPGMRAMRANGE pRam)
2323	{
2324	/*
2325	* Load and set the protection first, then load the two pages, the first
2326	* one is the active the other is the passive.
2327	*/
2328	PPGMROMPAGE pRomPage = pgmR3GetRomPage(pVM, GCPhys);
2329	AssertLogRelMsgReturn(pRomPage, ("GCPhys=%RGp %s\n", GCPhys, pRam->pszDesc), VERR_PGM_SAVED_ROM_PAGE_NOT_FOUND);
2330
2331	uint8_t uProt;
2332	int rc = SSMR3GetU8(pSSM, &uProt);
2333	AssertLogRelMsgRCReturn(rc, ("pPage=%R[pgmpage] GCPhys=%#x %s\n", pPage, GCPhys, pRam->pszDesc), rc);
2334	PGMROMPROT enmProt = (PGMROMPROT)uProt;
2335	AssertLogRelMsgReturn( enmProt >= PGMROMPROT_INVALID
2336	&& enmProt < PGMROMPROT_END,
2337	("enmProt=%d pPage=%R[pgmpage] GCPhys=%#x %s\n", enmProt, pPage, GCPhys, pRam->pszDesc),
2338	VERR_SSM_UNEXPECTED_DATA);
2339
2340	if (pRomPage->enmProt != enmProt)
2341	{
2342	rc = PGMR3PhysRomProtect(pVM, GCPhys, PAGE_SIZE, enmProt);
2343	AssertLogRelRCReturn(rc, rc);
2344	AssertLogRelReturn(pRomPage->enmProt == enmProt, VERR_PGM_SAVED_ROM_PAGE_PROT);
2345	}
2346
2347	PPGMPAGE pPageActive = PGMROMPROT_IS_ROM(enmProt) ? &pRomPage->Virgin : &pRomPage->Shadow;
2348	PPGMPAGE pPagePassive = PGMROMPROT_IS_ROM(enmProt) ? &pRomPage->Shadow : &pRomPage->Virgin;
2349	uint8_t u8ActiveType = PGMROMPROT_IS_ROM(enmProt) ? PGMPAGETYPE_ROM : PGMPAGETYPE_ROM_SHADOW;
2350	uint8_t u8PassiveType= PGMROMPROT_IS_ROM(enmProt) ? PGMPAGETYPE_ROM_SHADOW : PGMPAGETYPE_ROM;
2351
2352	/** @todo this isn't entirely correct as long as pgmPhysGCPhys2CCPtrInternal is
2353	* used down the line (will the 2nd page will be written to the first
2354	* one because of a false TLB hit since the TLB is using GCPhys and
2355	* doesn't check the HCPhys of the desired page). */
2356	rc = pgmR3LoadPageOld(pVM, pSSM, u8ActiveType, pPage, GCPhys, pRam);
2357	if (RT_SUCCESS(rc))
2358	{
2359	pPageActive = pPage;
2360	rc = pgmR3LoadPageOld(pVM, pSSM, u8PassiveType, pPagePassive, GCPhys, pRam);
2361	}
2362	return rc;
2363	}
2364
2365	/**
2366	* Ram range flags and bits for older versions of the saved state.
2367	*
2368	* @returns VBox status code.
2369	*
2370	* @param pVM The cross context VM structure.
2371	* @param pSSM The SSM handle.
2372	* @param uVersion The saved state version.
2373	*/
2374	static int pgmR3LoadMemoryOld(PVM pVM, PSSMHANDLE pSSM, uint32_t uVersion)
2375	{
2376	PPGM pPGM = &pVM->pgm.s;
2377
2378	/*
2379	* Ram range flags and bits.
2380	*/
2381	uint32_t i = 0;
2382	for (PPGMRAMRANGE pRam = pPGM->pRamRangesXR3; ; pRam = pRam->pNextR3, i++)
2383	{
2384	/* Check the sequence number / separator. */
2385	uint32_t u32Sep;
2386	int rc = SSMR3GetU32(pSSM, &u32Sep);
2387	if (RT_FAILURE(rc))
2388	return rc;
2389	if (u32Sep == ~0U)
2390	break;
2391	if (u32Sep != i)
2392	{
2393	AssertMsgFailed(("u32Sep=%#x (last)\n", u32Sep));
2394	return VERR_SSM_DATA_UNIT_FORMAT_CHANGED;
2395	}
2396	AssertLogRelReturn(pRam, VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
2397
2398	/* Get the range details. */
2399	RTGCPHYS GCPhys;
2400	SSMR3GetGCPhys(pSSM, &GCPhys);
2401	RTGCPHYS GCPhysLast;
2402	SSMR3GetGCPhys(pSSM, &GCPhysLast);
2403	RTGCPHYS cb;
2404	SSMR3GetGCPhys(pSSM, &cb);
2405	uint8_t fHaveBits;
2406	rc = SSMR3GetU8(pSSM, &fHaveBits);
2407	if (RT_FAILURE(rc))
2408	return rc;
2409	if (fHaveBits & ~1)
2410	{
2411	AssertMsgFailed(("u32Sep=%#x (last)\n", u32Sep));
2412	return VERR_SSM_DATA_UNIT_FORMAT_CHANGED;
2413	}
2414	size_t cchDesc = 0;
2415	char szDesc[256];
2416	szDesc[0] = '\0';
2417	if (uVersion >= PGM_SAVED_STATE_VERSION_RR_DESC)
2418	{
2419	rc = SSMR3GetStrZ(pSSM, szDesc, sizeof(szDesc));
2420	if (RT_FAILURE(rc))
2421	return rc;
2422	/* Since we've modified the description strings in r45878, only compare
2423	them if the saved state is more recent. */
2424	if (uVersion != PGM_SAVED_STATE_VERSION_RR_DESC)
2425	cchDesc = strlen(szDesc);
2426	}
2427
2428	/*
2429	* Match it up with the current range.
2430	*
2431	* Note there is a hack for dealing with the high BIOS mapping
2432	* in the old saved state format, this means we might not have
2433	* a 1:1 match on success.
2434	*/
2435	if ( ( GCPhys != pRam->GCPhys
2436	\|\| GCPhysLast != pRam->GCPhysLast
2437	\|\| cb != pRam->cb
2438	\|\| ( cchDesc
2439	&& strcmp(szDesc, pRam->pszDesc)) )
2440	/* Hack for PDMDevHlpPhysReserve(pDevIns, 0xfff80000, 0x80000, "High ROM Region"); */
2441	&& ( uVersion != PGM_SAVED_STATE_VERSION_OLD_PHYS_CODE
2442	\|\| GCPhys != UINT32_C(0xfff80000)
2443	\|\| GCPhysLast != UINT32_C(0xffffffff)
2444	\|\| pRam->GCPhysLast != GCPhysLast
2445	\|\| pRam->GCPhys < GCPhys
2446	\|\| !fHaveBits)
2447	)
2448	{
2449	LogRel(("Ram range: %RGp-%RGp %RGp bytes %s %s\n"
2450	"State : %RGp-%RGp %RGp bytes %s %s\n",
2451	pRam->GCPhys, pRam->GCPhysLast, pRam->cb, pRam->pvR3 ? "bits" : "nobits", pRam->pszDesc,
2452	GCPhys, GCPhysLast, cb, fHaveBits ? "bits" : "nobits", szDesc));
2453	/*
2454	* If we're loading a state for debugging purpose, don't make a fuss if
2455	* the MMIO and ROM stuff isn't 100% right, just skip the mismatches.
2456	*/
2457	if ( SSMR3HandleGetAfter(pSSM) != SSMAFTER_DEBUG_IT
2458	\|\| GCPhys < 8 * _1M)
2459	return SSMR3SetCfgError(pSSM, RT_SRC_POS,
2460	N_("RAM range mismatch; saved={%RGp-%RGp %RGp bytes %s %s} config={%RGp-%RGp %RGp bytes %s %s}"),
2461	GCPhys, GCPhysLast, cb, fHaveBits ? "bits" : "nobits", szDesc,
2462	pRam->GCPhys, pRam->GCPhysLast, pRam->cb, pRam->pvR3 ? "bits" : "nobits", pRam->pszDesc);
2463
2464	AssertMsgFailed(("debug skipping not implemented, sorry\n"));
2465	continue;
2466	}
2467
2468	uint32_t cPages = (GCPhysLast - GCPhys + 1) >> PAGE_SHIFT;
2469	if (uVersion >= PGM_SAVED_STATE_VERSION_RR_DESC)
2470	{
2471	/*
2472	* Load the pages one by one.
2473	*/
2474	for (uint32_t iPage = 0; iPage < cPages; iPage++)
2475	{
2476	RTGCPHYS const GCPhysPage = ((RTGCPHYS)iPage << PAGE_SHIFT) + pRam->GCPhys;
2477	PPGMPAGE pPage = &pRam->aPages[iPage];
2478	uint8_t uOldType;
2479	rc = SSMR3GetU8(pSSM, &uOldType);
2480	AssertLogRelMsgRCReturn(rc, ("pPage=%R[pgmpage] iPage=%#x GCPhysPage=%#x %s\n", pPage, iPage, GCPhysPage, pRam->pszDesc), rc);
2481	if (uOldType == PGMPAGETYPE_OLD_ROM_SHADOW)
2482	rc = pgmR3LoadShadowedRomPageOld(pVM, pSSM, pPage, GCPhysPage, pRam);
2483	else
2484	rc = pgmR3LoadPageOld(pVM, pSSM, uOldType, pPage, GCPhysPage, pRam);
2485	AssertLogRelMsgRCReturn(rc, ("rc=%Rrc iPage=%#x GCPhysPage=%#x %s\n", rc, iPage, GCPhysPage, pRam->pszDesc), rc);
2486	}
2487	}
2488	else
2489	{
2490	/*
2491	* Old format.
2492	*/
2493
2494	/* Of the page flags, pick up MMIO2 and ROM/RESERVED for the !fHaveBits case.
2495	The rest is generally irrelevant and wrong since the stuff have to match registrations. */
2496	uint32_t fFlags = 0;
2497	for (uint32_t iPage = 0; iPage < cPages; iPage++)
2498	{
2499	uint16_t u16Flags;
2500	rc = SSMR3GetU16(pSSM, &u16Flags);
2501	AssertLogRelMsgRCReturn(rc, ("rc=%Rrc iPage=%#x GCPhys=%#x %s\n", rc, iPage, pRam->GCPhys, pRam->pszDesc), rc);
2502	fFlags \|= u16Flags;
2503	}
2504
2505	/* Load the bits */
2506	if ( !fHaveBits
2507	&& GCPhysLast < UINT32_C(0xe0000000))
2508	{
2509	/*
2510	* Dynamic chunks.
2511	*/
2512	const uint32_t cPagesInChunk = (110241024) >> PAGE_SHIFT;
2513	AssertLogRelMsgReturn(cPages % cPagesInChunk == 0,
2514	("cPages=%#x cPagesInChunk=%#x GCPhys=%RGp %s\n", cPages, cPagesInChunk, pRam->GCPhys, pRam->pszDesc),
2515	VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
2516
2517	for (uint32_t iPage = 0; iPage < cPages; /* incremented by inner loop */ )
2518	{
2519	uint8_t fPresent;
2520	rc = SSMR3GetU8(pSSM, &fPresent);
2521	AssertLogRelMsgRCReturn(rc, ("rc=%Rrc iPage=%#x GCPhys=%#x %s\n", rc, iPage, pRam->GCPhys, pRam->pszDesc), rc);
2522	AssertLogRelMsgReturn(fPresent == (uint8_t)true \|\| fPresent == (uint8_t)false,
2523	("fPresent=%#x iPage=%#x GCPhys=%#x %s\n", fPresent, iPage, pRam->GCPhys, pRam->pszDesc),
2524	VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
2525
2526	for (uint32_t iChunkPage = 0; iChunkPage < cPagesInChunk; iChunkPage++, iPage++)
2527	{
2528	RTGCPHYS const GCPhysPage = ((RTGCPHYS)iPage << PAGE_SHIFT) + pRam->GCPhys;
2529	PPGMPAGE pPage = &pRam->aPages[iPage];
2530	if (fPresent)
2531	{
2532	if ( PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_MMIO
2533	\|\| PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_SPECIAL_ALIAS_MMIO)
2534	rc = pgmR3LoadPageToDevNullOld(pSSM);
2535	else
2536	rc = pgmR3LoadPageBitsOld(pVM, pSSM, PGMPAGETYPE_INVALID, pPage, GCPhysPage, pRam);
2537	}
2538	else
2539	rc = pgmR3LoadPageZeroOld(pVM, PGMPAGETYPE_INVALID, pPage, GCPhysPage, pRam);
2540	AssertLogRelMsgRCReturn(rc, ("rc=%Rrc iPage=%#x GCPhysPage=%#x %s\n", rc, iPage, GCPhysPage, pRam->pszDesc), rc);
2541	}
2542	}
2543	}
2544	else if (pRam->pvR3)
2545	{
2546	/*
2547	* MMIO2.
2548	*/
2549	AssertLogRelMsgReturn((fFlags & 0x0f) == RT_BIT(3) /MM_RAM_FLAGS_MMIO2/,
2550	("fFlags=%#x GCPhys=%#x %s\n", fFlags, pRam->GCPhys, pRam->pszDesc),
2551	VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
2552	AssertLogRelMsgReturn(pRam->pvR3,
2553	("GCPhys=%#x %s\n", pRam->GCPhys, pRam->pszDesc),
2554	VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
2555
2556	rc = SSMR3GetMem(pSSM, pRam->pvR3, pRam->cb);
2557	AssertLogRelMsgRCReturn(rc, ("GCPhys=%#x %s\n", pRam->GCPhys, pRam->pszDesc), rc);
2558	}
2559	else if (GCPhysLast < UINT32_C(0xfff80000))
2560	{
2561	/*
2562	* PCI MMIO, no pages saved.
2563	*/
2564	}
2565	else
2566	{
2567	/*
2568	* Load the 0xfff80000..0xffffffff BIOS range.
2569	* It starts with X reserved pages that we have to skip over since
2570	* the RAMRANGE create by the new code won't include those.
2571	*/
2572	AssertLogRelMsgReturn( !(fFlags & RT_BIT(3) /MM_RAM_FLAGS_MMIO2/)
2573	&& (fFlags & RT_BIT(0) /MM_RAM_FLAGS_RESERVED/),
2574	("fFlags=%#x GCPhys=%#x %s\n", fFlags, pRam->GCPhys, pRam->pszDesc),
2575	VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
2576	AssertLogRelMsgReturn(GCPhys == UINT32_C(0xfff80000),
2577	("GCPhys=%RGp pRamRange{GCPhys=%#x %s}\n", GCPhys, pRam->GCPhys, pRam->pszDesc),
2578	VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
2579
2580	/* Skip wasted reserved pages before the ROM. */
2581	while (GCPhys < pRam->GCPhys)
2582	{
2583	rc = pgmR3LoadPageToDevNullOld(pSSM);
2584	GCPhys += PAGE_SIZE;
2585	}
2586
2587	/* Load the bios pages. */
2588	cPages = pRam->cb >> PAGE_SHIFT;
2589	for (uint32_t iPage = 0; iPage < cPages; iPage++)
2590	{
2591	RTGCPHYS const GCPhysPage = ((RTGCPHYS)iPage << PAGE_SHIFT) + pRam->GCPhys;
2592	PPGMPAGE pPage = &pRam->aPages[iPage];
2593
2594	AssertLogRelMsgReturn(PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_ROM,
2595	("GCPhys=%RGp pPage=%R[pgmpage]\n", GCPhys, GCPhys),
2596	VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
2597	rc = pgmR3LoadPageBitsOld(pVM, pSSM, PGMPAGETYPE_ROM, pPage, GCPhysPage, pRam);
2598	AssertLogRelMsgRCReturn(rc, ("rc=%Rrc iPage=%#x GCPhys=%#x %s\n", rc, iPage, pRam->GCPhys, pRam->pszDesc), rc);
2599	}
2600	}
2601	}
2602	}
2603
2604	return VINF_SUCCESS;
2605	}
2606
2607
2608	/**
2609	* Worker for pgmR3Load and pgmR3LoadLocked.
2610	*
2611	* @returns VBox status code.
2612	*
2613	* @param pVM The cross context VM structure.
2614	* @param pSSM The SSM handle.
2615	* @param uVersion The PGM saved state unit version.
2616	* @param uPass The pass number.
2617	*
2618	* @todo This needs splitting up if more record types or code twists are
2619	* added...
2620	*/
2621	static int pgmR3LoadMemory(PVM pVM, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass)
2622	{
2623	NOREF(uPass);
2624
2625	/*
2626	* Process page records until we hit the terminator.
2627	*/
2628	RTGCPHYS GCPhys = NIL_RTGCPHYS;
2629	PPGMRAMRANGE pRamHint = NULL;
2630	uint8_t id = UINT8_MAX;
2631	uint32_t iPage = UINT32_MAX - 10;
2632	PPGMROMRANGE pRom = NULL;
2633	PPGMREGMMIORANGE pRegMmio = NULL;
2634
2635	/*
2636	* We batch up pages that should be freed instead of calling GMM for
2637	* each and every one of them. Note that we'll lose the pages in most
2638	* failure paths - this should probably be addressed one day.
2639	*/
2640	uint32_t cPendingPages = 0;
2641	PGMMFREEPAGESREQ pReq;
2642	int rc = GMMR3FreePagesPrepare(pVM, &pReq, 128 /* batch size */, GMMACCOUNT_BASE);
2643	AssertLogRelRCReturn(rc, rc);
2644
2645	for (;;)
2646	{
2647	/*
2648	* Get the record type and flags.
2649	*/
2650	uint8_t u8;
2651	rc = SSMR3GetU8(pSSM, &u8);
2652	if (RT_FAILURE(rc))
2653	return rc;
2654	if (u8 == PGM_STATE_REC_END)
2655	{
2656	/*
2657	* Finish off any pages pending freeing.
2658	*/
2659	if (cPendingPages)
2660	{
2661	Log(("pgmR3LoadMemory: GMMR3FreePagesPerform pVM=%p cPendingPages=%u\n", pVM, cPendingPages));
2662	rc = GMMR3FreePagesPerform(pVM, pReq, cPendingPages);
2663	AssertLogRelRCReturn(rc, rc);
2664	}
2665	GMMR3FreePagesCleanup(pReq);
2666	return VINF_SUCCESS;
2667	}
2668	AssertLogRelMsgReturn((u8 & ~PGM_STATE_REC_FLAG_ADDR) <= PGM_STATE_REC_LAST, ("%#x\n", u8), VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
2669	switch (u8 & ~PGM_STATE_REC_FLAG_ADDR)
2670	{
2671	/*
2672	* RAM page.
2673	*/
2674	case PGM_STATE_REC_RAM_ZERO:
2675	case PGM_STATE_REC_RAM_RAW:
2676	case PGM_STATE_REC_RAM_BALLOONED:
2677	{
2678	/*
2679	* Get the address and resolve it into a page descriptor.
2680	*/
2681	if (!(u8 & PGM_STATE_REC_FLAG_ADDR))
2682	GCPhys += PAGE_SIZE;
2683	else
2684	{
2685	rc = SSMR3GetGCPhys(pSSM, &GCPhys);
2686	if (RT_FAILURE(rc))
2687	return rc;
2688	}
2689	AssertLogRelMsgReturn(!(GCPhys & PAGE_OFFSET_MASK), ("%RGp\n", GCPhys), VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
2690
2691	PPGMPAGE pPage;
2692	rc = pgmPhysGetPageWithHintEx(pVM, GCPhys, &pPage, &pRamHint);
2693	AssertLogRelMsgRCReturn(rc, ("rc=%Rrc %RGp\n", rc, GCPhys), rc);
2694
2695	/*
2696	* Take action according to the record type.
2697	*/
2698	switch (u8 & ~PGM_STATE_REC_FLAG_ADDR)
2699	{
2700	case PGM_STATE_REC_RAM_ZERO:
2701	{
2702	if (PGM_PAGE_IS_ZERO(pPage))
2703	break;
2704
2705	/* Ballooned pages must be unmarked (live snapshot and
2706	teleportation scenarios). */
2707	if (PGM_PAGE_IS_BALLOONED(pPage))
2708	{
2709	Assert(PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_RAM);
2710	if (uVersion == PGM_SAVED_STATE_VERSION_BALLOON_BROKEN)
2711	break;
2712	PGM_PAGE_SET_STATE(pVM, pPage, PGM_PAGE_STATE_ZERO);
2713	break;
2714	}
2715
2716	AssertLogRelMsgReturn(PGM_PAGE_GET_STATE(pPage) == PGM_PAGE_STATE_ALLOCATED, ("GCPhys=%RGp %R[pgmpage]\n", GCPhys, pPage), VERR_PGM_UNEXPECTED_PAGE_STATE);
2717
2718	/* If this is a ROM page, we must clear it and not try to
2719	* free it. Ditto if the VM is using RamPreAlloc (see
2720	* @bugref{6318}). */
2721	if ( PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_ROM
2722	\|\| PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_ROM_SHADOW
2723	\|\| pVM->pgm.s.fRamPreAlloc)
2724	{
2725	PGMPAGEMAPLOCK PgMpLck;
2726	void *pvDstPage;
2727	rc = pgmPhysGCPhys2CCPtrInternal(pVM, pPage, GCPhys, &pvDstPage, &PgMpLck);
2728	AssertLogRelMsgRCReturn(rc, ("GCPhys=%RGp %R[pgmpage] rc=%Rrc\n", GCPhys, pPage, rc), rc);
2729
2730	ASMMemZeroPage(pvDstPage);
2731	pgmPhysReleaseInternalPageMappingLock(pVM, &PgMpLck);
2732	}
2733	/* Free it only if it's not part of a previously
2734	allocated large page (no need to clear the page). */
2735	else if ( PGM_PAGE_GET_PDE_TYPE(pPage) != PGM_PAGE_PDE_TYPE_PDE
2736	&& PGM_PAGE_GET_PDE_TYPE(pPage) != PGM_PAGE_PDE_TYPE_PDE_DISABLED)
2737	{
2738	rc = pgmPhysFreePage(pVM, pReq, &cPendingPages, pPage, GCPhys);
2739	AssertRCReturn(rc, rc);
2740	}
2741	/** @todo handle large pages (see @bugref{5545}) */
2742	break;
2743	}
2744
2745	case PGM_STATE_REC_RAM_BALLOONED:
2746	{
2747	Assert(PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_RAM);
2748	if (PGM_PAGE_IS_BALLOONED(pPage))
2749	break;
2750
2751	/* We don't map ballooned pages in our shadow page tables, let's
2752	just free it if allocated and mark as ballooned. See @bugref{5515}. */
2753	if (PGM_PAGE_IS_ALLOCATED(pPage))
2754	{
2755	/** @todo handle large pages + ballooning when it works. (see @bugref{5515},
2756	* @bugref{5545}). */
2757	AssertLogRelMsgReturn( PGM_PAGE_GET_PDE_TYPE(pPage) != PGM_PAGE_PDE_TYPE_PDE
2758	&& PGM_PAGE_GET_PDE_TYPE(pPage) != PGM_PAGE_PDE_TYPE_PDE_DISABLED,
2759	("GCPhys=%RGp %R[pgmpage]\n", GCPhys, pPage), VERR_PGM_LOAD_UNEXPECTED_PAGE_TYPE);
2760
2761	rc = pgmPhysFreePage(pVM, pReq, &cPendingPages, pPage, GCPhys);
2762	AssertRCReturn(rc, rc);
2763	}
2764	Assert(PGM_PAGE_IS_ZERO(pPage));
2765	PGM_PAGE_SET_STATE(pVM, pPage, PGM_PAGE_STATE_BALLOONED);
2766	break;
2767	}
2768
2769	case PGM_STATE_REC_RAM_RAW:
2770	{
2771	PGMPAGEMAPLOCK PgMpLck;
2772	void *pvDstPage;
2773	rc = pgmPhysGCPhys2CCPtrInternal(pVM, pPage, GCPhys, &pvDstPage, &PgMpLck);
2774	AssertLogRelMsgRCReturn(rc, ("GCPhys=%RGp %R[pgmpage] rc=%Rrc\n", GCPhys, pPage, rc), rc);
2775	rc = SSMR3GetMem(pSSM, pvDstPage, PAGE_SIZE);
2776	pgmPhysReleaseInternalPageMappingLock(pVM, &PgMpLck);
2777	if (RT_FAILURE(rc))
2778	return rc;
2779	break;
2780	}
2781
2782	default:
2783	AssertMsgFailedReturn(("%#x\n", u8), VERR_PGM_SAVED_REC_TYPE);
2784	}
2785	id = UINT8_MAX;
2786	break;
2787	}
2788
2789	/*
2790	* MMIO2 page.
2791	*/
2792	case PGM_STATE_REC_MMIO2_RAW:
2793	case PGM_STATE_REC_MMIO2_ZERO:
2794	{
2795	/*
2796	* Get the ID + page number and resolved that into a MMIO2 page.
2797	*/
2798	if (!(u8 & PGM_STATE_REC_FLAG_ADDR))
2799	iPage++;
2800	else
2801	{
2802	SSMR3GetU8(pSSM, &id);
2803	rc = SSMR3GetU32(pSSM, &iPage);
2804	if (RT_FAILURE(rc))
2805	return rc;
2806	}
2807	if ( !pRegMmio
2808	\|\| pRegMmio->idSavedState != id)
2809	{
2810	for (pRegMmio = pVM->pgm.s.pRegMmioRangesR3; pRegMmio; pRegMmio = pRegMmio->pNextR3)
2811	if ( pRegMmio->idSavedState == id
2812	&& pRegMmio->fMmio2)
2813	break;
2814	AssertLogRelMsgReturn(pRegMmio, ("id=%#u iPage=%#x\n", id, iPage), VERR_PGM_SAVED_MMIO2_RANGE_NOT_FOUND);
2815	}
2816	AssertLogRelMsgReturn(iPage < (pRegMmio->RamRange.cb >> PAGE_SHIFT), ("iPage=%#x cb=%RGp %s\n", iPage, pRegMmio->RamRange.cb, pRegMmio->RamRange.pszDesc), VERR_PGM_SAVED_MMIO2_PAGE_NOT_FOUND);
2817	void pvDstPage = (uint8_t )pRegMmio->RamRange.pvR3 + ((size_t)iPage << PAGE_SHIFT);
2818
2819	/*
2820	* Load the page bits.
2821	*/
2822	if ((u8 & ~PGM_STATE_REC_FLAG_ADDR) == PGM_STATE_REC_MMIO2_ZERO)
2823	ASMMemZeroPage(pvDstPage);
2824	else
2825	{
2826	rc = SSMR3GetMem(pSSM, pvDstPage, PAGE_SIZE);
2827	if (RT_FAILURE(rc))
2828	return rc;
2829	}
2830	GCPhys = NIL_RTGCPHYS;
2831	break;
2832	}
2833
2834	/*
2835	* ROM pages.
2836	*/
2837	case PGM_STATE_REC_ROM_VIRGIN:
2838	case PGM_STATE_REC_ROM_SHW_RAW:
2839	case PGM_STATE_REC_ROM_SHW_ZERO:
2840	case PGM_STATE_REC_ROM_PROT:
2841	{
2842	/*
2843	* Get the ID + page number and resolved that into a ROM page descriptor.
2844	*/
2845	if (!(u8 & PGM_STATE_REC_FLAG_ADDR))
2846	iPage++;
2847	else
2848	{
2849	SSMR3GetU8(pSSM, &id);
2850	rc = SSMR3GetU32(pSSM, &iPage);
2851	if (RT_FAILURE(rc))
2852	return rc;
2853	}
2854	if ( !pRom
2855	\|\| pRom->idSavedState != id)
2856	{
2857	for (pRom = pVM->pgm.s.pRomRangesR3; pRom; pRom = pRom->pNextR3)
2858	if (pRom->idSavedState == id)
2859	break;
2860	AssertLogRelMsgReturn(pRom, ("id=%#u iPage=%#x\n", id, iPage), VERR_PGM_SAVED_ROM_RANGE_NOT_FOUND);
2861	}
2862	AssertLogRelMsgReturn(iPage < (pRom->cb >> PAGE_SHIFT), ("iPage=%#x cb=%RGp %s\n", iPage, pRom->cb, pRom->pszDesc), VERR_PGM_SAVED_ROM_PAGE_NOT_FOUND);
2863	PPGMROMPAGE pRomPage = &pRom->aPages[iPage];
2864	GCPhys = pRom->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT);
2865
2866	/*
2867	* Get and set the protection.
2868	*/
2869	uint8_t u8Prot;
2870	rc = SSMR3GetU8(pSSM, &u8Prot);
2871	if (RT_FAILURE(rc))
2872	return rc;
2873	PGMROMPROT enmProt = (PGMROMPROT)u8Prot;
2874	AssertLogRelMsgReturn(enmProt > PGMROMPROT_INVALID && enmProt < PGMROMPROT_END, ("GCPhys=%RGp enmProt=%d\n", GCPhys, enmProt), VERR_PGM_SAVED_ROM_PAGE_PROT);
2875
2876	if (enmProt != pRomPage->enmProt)
2877	{
2878	if (RT_UNLIKELY(!(pRom->fFlags & PGMPHYS_ROM_FLAGS_SHADOWED)))
2879	return SSMR3SetCfgError(pSSM, RT_SRC_POS,
2880	N_("Protection change of unshadowed ROM page: GCPhys=%RGp enmProt=%d %s"),
2881	GCPhys, enmProt, pRom->pszDesc);
2882	rc = PGMR3PhysRomProtect(pVM, GCPhys, PAGE_SIZE, enmProt);
2883	AssertLogRelMsgRCReturn(rc, ("GCPhys=%RGp rc=%Rrc\n", GCPhys, rc), rc);
2884	AssertLogRelReturn(pRomPage->enmProt == enmProt, VERR_PGM_SAVED_ROM_PAGE_PROT);
2885	}
2886	if ((u8 & ~PGM_STATE_REC_FLAG_ADDR) == PGM_STATE_REC_ROM_PROT)
2887	break; /* done */
2888
2889	/*
2890	* Get the right page descriptor.
2891	*/
2892	PPGMPAGE pRealPage;
2893	switch (u8 & ~PGM_STATE_REC_FLAG_ADDR)
2894	{
2895	case PGM_STATE_REC_ROM_VIRGIN:
2896	if (!PGMROMPROT_IS_ROM(enmProt))
2897	pRealPage = &pRomPage->Virgin;
2898	else
2899	pRealPage = NULL;
2900	break;
2901
2902	case PGM_STATE_REC_ROM_SHW_RAW:
2903	case PGM_STATE_REC_ROM_SHW_ZERO:
2904	if (RT_UNLIKELY(!(pRom->fFlags & PGMPHYS_ROM_FLAGS_SHADOWED)))
2905	return SSMR3SetCfgError(pSSM, RT_SRC_POS,
2906	N_("Shadowed / non-shadowed page type mismatch: GCPhys=%RGp enmProt=%d %s"),
2907	GCPhys, enmProt, pRom->pszDesc);
2908	if (PGMROMPROT_IS_ROM(enmProt))
2909	pRealPage = &pRomPage->Shadow;
2910	else
2911	pRealPage = NULL;
2912	break;
2913
2914	default: AssertLogRelFailedReturn(VERR_IPE_NOT_REACHED_DEFAULT_CASE); /* shut up gcc */
2915	}
2916	if (!pRealPage)
2917	{
2918	rc = pgmPhysGetPageWithHintEx(pVM, GCPhys, &pRealPage, &pRamHint);
2919	AssertLogRelMsgRCReturn(rc, ("rc=%Rrc %RGp\n", rc, GCPhys), rc);
2920	}
2921
2922	/*
2923	* Make it writable and map it (if necessary).
2924	*/
2925	void *pvDstPage = NULL;
2926	switch (u8 & ~PGM_STATE_REC_FLAG_ADDR)
2927	{
2928	case PGM_STATE_REC_ROM_SHW_ZERO:
2929	if ( PGM_PAGE_IS_ZERO(pRealPage)
2930	\|\| PGM_PAGE_IS_BALLOONED(pRealPage))
2931	break;
2932	/** @todo implement zero page replacing. */
2933	/* fall thru */
2934	case PGM_STATE_REC_ROM_VIRGIN:
2935	case PGM_STATE_REC_ROM_SHW_RAW:
2936	{
2937	rc = pgmPhysPageMakeWritableAndMap(pVM, pRealPage, GCPhys, &pvDstPage);
2938	AssertLogRelMsgRCReturn(rc, ("GCPhys=%RGp rc=%Rrc\n", GCPhys, rc), rc);
2939	break;
2940	}
2941	}
2942
2943	/*
2944	* Load the bits.
2945	*/
2946	switch (u8 & ~PGM_STATE_REC_FLAG_ADDR)
2947	{
2948	case PGM_STATE_REC_ROM_SHW_ZERO:
2949	if (pvDstPage)
2950	ASMMemZeroPage(pvDstPage);
2951	break;
2952
2953	case PGM_STATE_REC_ROM_VIRGIN:
2954	case PGM_STATE_REC_ROM_SHW_RAW:
2955	rc = SSMR3GetMem(pSSM, pvDstPage, PAGE_SIZE);
2956	if (RT_FAILURE(rc))
2957	return rc;
2958	break;
2959	}
2960	GCPhys = NIL_RTGCPHYS;
2961	break;
2962	}
2963
2964	/*
2965	* Unknown type.
2966	*/
2967	default:
2968	AssertLogRelMsgFailedReturn(("%#x\n", u8), VERR_PGM_SAVED_REC_TYPE);
2969	}
2970	} /* forever */
2971	}
2972
2973
2974	/**
2975	* Worker for pgmR3Load.
2976	*
2977	* @returns VBox status code.
2978	*
2979	* @param pVM The cross context VM structure.
2980	* @param pSSM The SSM handle.
2981	* @param uVersion The saved state version.
2982	*/
2983	static int pgmR3LoadFinalLocked(PVM pVM, PSSMHANDLE pSSM, uint32_t uVersion)
2984	{
2985	PPGM pPGM = &pVM->pgm.s;
2986	int rc;
2987	uint32_t u32Sep;
2988
2989	/*
2990	* Load basic data (required / unaffected by relocation).
2991	*/
2992	if (uVersion >= PGM_SAVED_STATE_VERSION_3_0_0)
2993	{
2994	if (uVersion > PGM_SAVED_STATE_VERSION_PRE_BALLOON)
2995	rc = SSMR3GetStruct(pSSM, pPGM, &s_aPGMFields[0]);
2996	else
2997	rc = SSMR3GetStruct(pSSM, pPGM, &s_aPGMFieldsPreBalloon[0]);
2998
2999	AssertLogRelRCReturn(rc, rc);
3000
3001	for (VMCPUID i = 0; i < pVM->cCpus; i++)
3002	{
3003	if (uVersion <= PGM_SAVED_STATE_VERSION_PRE_PAE)
3004	rc = SSMR3GetStruct(pSSM, &pVM->aCpus[i].pgm.s, &s_aPGMCpuFieldsPrePae[0]);
3005	else
3006	rc = SSMR3GetStruct(pSSM, &pVM->aCpus[i].pgm.s, &s_aPGMCpuFields[0]);
3007	AssertLogRelRCReturn(rc, rc);
3008	}
3009	}
3010	else if (uVersion >= PGM_SAVED_STATE_VERSION_RR_DESC)
3011	{
3012	AssertRelease(pVM->cCpus == 1);
3013
3014	PGMOLD pgmOld;
3015	rc = SSMR3GetStruct(pSSM, &pgmOld, &s_aPGMFields_Old[0]);
3016	AssertLogRelRCReturn(rc, rc);
3017
3018	pPGM->fMappingsFixed = pgmOld.fMappingsFixed;
3019	pPGM->GCPtrMappingFixed = pgmOld.GCPtrMappingFixed;
3020	pPGM->cbMappingFixed = pgmOld.cbMappingFixed;
3021
3022	pVM->aCpus[0].pgm.s.fA20Enabled = pgmOld.fA20Enabled;
3023	pVM->aCpus[0].pgm.s.GCPhysA20Mask = pgmOld.GCPhysA20Mask;
3024	pVM->aCpus[0].pgm.s.enmGuestMode = pgmOld.enmGuestMode;
3025	}
3026	else
3027	{
3028	AssertRelease(pVM->cCpus == 1);
3029
3030	SSMR3GetBool(pSSM, &pPGM->fMappingsFixed);
3031	SSMR3GetGCPtr(pSSM, &pPGM->GCPtrMappingFixed);
3032	SSMR3GetU32(pSSM, &pPGM->cbMappingFixed);
3033
3034	uint32_t cbRamSizeIgnored;
3035	rc = SSMR3GetU32(pSSM, &cbRamSizeIgnored);
3036	if (RT_FAILURE(rc))
3037	return rc;
3038	SSMR3GetGCPhys(pSSM, &pVM->aCpus[0].pgm.s.GCPhysA20Mask);
3039
3040	uint32_t u32 = 0;
3041	SSMR3GetUInt(pSSM, &u32);
3042	pVM->aCpus[0].pgm.s.fA20Enabled = !!u32;
3043	SSMR3GetUInt(pSSM, &pVM->aCpus[0].pgm.s.fSyncFlags);
3044	RTUINT uGuestMode;
3045	SSMR3GetUInt(pSSM, &uGuestMode);
3046	pVM->aCpus[0].pgm.s.enmGuestMode = (PGMMODE)uGuestMode;
3047
3048	/* check separator. */
3049	SSMR3GetU32(pSSM, &u32Sep);
3050	if (RT_FAILURE(rc))
3051	return rc;
3052	if (u32Sep != (uint32_t)~0)
3053	{
3054	AssertMsgFailed(("u32Sep=%#x (first)\n", u32Sep));
3055	return VERR_SSM_DATA_UNIT_FORMAT_CHANGED;
3056	}
3057	}
3058
3059	/*
3060	* Fix the A20 mask.
3061	*/
3062	for (VMCPUID i = 0; i < pVM->cCpus; i++)
3063	{
3064	PVMCPU pVCpu = &pVM->aCpus[i];
3065	pVCpu->pgm.s.GCPhysA20Mask = ~((RTGCPHYS)!pVCpu->pgm.s.fA20Enabled << 20);
3066	pgmR3RefreshShadowModeAfterA20Change(pVCpu);
3067	}
3068
3069	/*
3070	* The guest mappings - skipped now, see re-fixation in the caller.
3071	*/
3072	if (uVersion <= PGM_SAVED_STATE_VERSION_PRE_PAE)
3073	{
3074	for (uint32_t i = 0; ; i++)
3075	{
3076	rc = SSMR3GetU32(pSSM, &u32Sep); /* sequence number */
3077	if (RT_FAILURE(rc))
3078	return rc;
3079	if (u32Sep == ~0U)
3080	break;
3081	AssertMsgReturn(u32Sep == i, ("u32Sep=%#x i=%#x\n", u32Sep, i), VERR_SSM_DATA_UNIT_FORMAT_CHANGED);
3082
3083	char szDesc[256];
3084	rc = SSMR3GetStrZ(pSSM, szDesc, sizeof(szDesc));
3085	if (RT_FAILURE(rc))
3086	return rc;
3087	RTGCPTR GCPtrIgnore;
3088	SSMR3GetGCPtr(pSSM, &GCPtrIgnore); /* GCPtr */
3089	rc = SSMR3GetGCPtr(pSSM, &GCPtrIgnore); /* cPTs */
3090	if (RT_FAILURE(rc))
3091	return rc;
3092	}
3093	}
3094
3095	/*
3096	* Load the RAM contents.
3097	*/
3098	if (uVersion > PGM_SAVED_STATE_VERSION_3_0_0)
3099	{
3100	if (!pVM->pgm.s.LiveSave.fActive)
3101	{
3102	if (uVersion > PGM_SAVED_STATE_VERSION_NO_RAM_CFG)
3103	{
3104	rc = pgmR3LoadRamConfig(pVM, pSSM);
3105	if (RT_FAILURE(rc))
3106	return rc;
3107	}
3108	rc = pgmR3LoadRomRanges(pVM, pSSM);
3109	if (RT_FAILURE(rc))
3110	return rc;
3111	rc = pgmR3LoadMmio2Ranges(pVM, pSSM);
3112	if (RT_FAILURE(rc))
3113	return rc;
3114	}
3115
3116	rc = pgmR3LoadMemory(pVM, pSSM, uVersion, SSM_PASS_FINAL);
3117	}
3118	else
3119	rc = pgmR3LoadMemoryOld(pVM, pSSM, uVersion);
3120
3121	/* Refresh balloon accounting. */
3122	if (pVM->pgm.s.cBalloonedPages)
3123	{
3124	Log(("pgmR3LoadFinalLocked: pVM=%p cBalloonedPages=%#x\n", pVM, pVM->pgm.s.cBalloonedPages));
3125	rc = GMMR3BalloonedPages(pVM, GMMBALLOONACTION_INFLATE, pVM->pgm.s.cBalloonedPages);
3126	AssertRCReturn(rc, rc);
3127	}
3128	return rc;
3129	}
3130
3131
3132	/**
3133	* @callback_method_impl{FNSSMINTLOADEXEC}
3134	*/
3135	static DECLCALLBACK(int) pgmR3Load(PVM pVM, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass)
3136	{
3137	int rc;
3138
3139	/*
3140	* Validate version.
3141	*/
3142	if ( ( uPass != SSM_PASS_FINAL
3143	&& uVersion != PGM_SAVED_STATE_VERSION
3144	&& uVersion != PGM_SAVED_STATE_VERSION_PRE_PAE
3145	&& uVersion != PGM_SAVED_STATE_VERSION_BALLOON_BROKEN
3146	&& uVersion != PGM_SAVED_STATE_VERSION_PRE_BALLOON
3147	&& uVersion != PGM_SAVED_STATE_VERSION_NO_RAM_CFG)
3148	\|\| ( uVersion != PGM_SAVED_STATE_VERSION
3149	&& uVersion != PGM_SAVED_STATE_VERSION_PRE_PAE
3150	&& uVersion != PGM_SAVED_STATE_VERSION_BALLOON_BROKEN
3151	&& uVersion != PGM_SAVED_STATE_VERSION_PRE_BALLOON
3152	&& uVersion != PGM_SAVED_STATE_VERSION_NO_RAM_CFG
3153	&& uVersion != PGM_SAVED_STATE_VERSION_3_0_0
3154	&& uVersion != PGM_SAVED_STATE_VERSION_2_2_2
3155	&& uVersion != PGM_SAVED_STATE_VERSION_RR_DESC
3156	&& uVersion != PGM_SAVED_STATE_VERSION_OLD_PHYS_CODE)
3157	)
3158	{
3159	AssertMsgFailed(("pgmR3Load: Invalid version uVersion=%d (current %d)!\n", uVersion, PGM_SAVED_STATE_VERSION));
3160	return VERR_SSM_UNSUPPORTED_DATA_UNIT_VERSION;
3161	}
3162
3163	/*
3164	* Do the loading while owning the lock because a bunch of the functions
3165	* we're using requires this.
3166	*/
3167	if (uPass != SSM_PASS_FINAL)
3168	{
3169	pgmLock(pVM);
3170	if (uPass != 0)
3171	rc = pgmR3LoadMemory(pVM, pSSM, uVersion, uPass);
3172	else
3173	{
3174	pVM->pgm.s.LiveSave.fActive = true;
3175	if (uVersion > PGM_SAVED_STATE_VERSION_NO_RAM_CFG)
3176	rc = pgmR3LoadRamConfig(pVM, pSSM);
3177	else
3178	rc = VINF_SUCCESS;
3179	if (RT_SUCCESS(rc))
3180	rc = pgmR3LoadRomRanges(pVM, pSSM);
3181	if (RT_SUCCESS(rc))
3182	rc = pgmR3LoadMmio2Ranges(pVM, pSSM);
3183	if (RT_SUCCESS(rc))
3184	rc = pgmR3LoadMemory(pVM, pSSM, uVersion, uPass);
3185	}
3186	pgmUnlock(pVM);
3187	}
3188	else
3189	{
3190	pgmLock(pVM);
3191	rc = pgmR3LoadFinalLocked(pVM, pSSM, uVersion);
3192	pVM->pgm.s.LiveSave.fActive = false;
3193	pgmUnlock(pVM);
3194	if (RT_SUCCESS(rc))
3195	{
3196	/*
3197	* We require a full resync now.
3198	*/
3199	for (VMCPUID i = 0; i < pVM->cCpus; i++)
3200	{
3201	PVMCPU pVCpu = &pVM->aCpus[i];
3202	VMCPU_FF_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL);
3203	VMCPU_FF_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3);
3204	pVCpu->pgm.s.fSyncFlags \|= PGM_SYNC_UPDATE_PAGE_BIT_VIRTUAL;
3205	/** @todo For guest PAE, we might get the wrong
3206	* aGCPhysGstPaePDs values now. We should used the
3207	* saved ones... Postponing this since it nothing new
3208	* and PAE/PDPTR needs some general readjusting, see
3209	* @bugref{5880}. */
3210	}
3211
3212	pgmR3HandlerPhysicalUpdateAll(pVM);
3213
3214	/*
3215	* Change the paging mode and restore PGMCPU::GCPhysCR3.
3216	* (The latter requires the CPUM state to be restored already.)
3217	*/
3218	if (CPUMR3IsStateRestorePending(pVM))
3219	return SSMR3SetLoadError(pSSM, VERR_WRONG_ORDER, RT_SRC_POS,
3220	N_("PGM was unexpectedly restored before CPUM"));
3221
3222	for (VMCPUID i = 0; i < pVM->cCpus; i++)
3223	{
3224	PVMCPU pVCpu = &pVM->aCpus[i];
3225
3226	rc = PGMR3ChangeMode(pVM, pVCpu, pVCpu->pgm.s.enmGuestMode);
3227	AssertLogRelRCReturn(rc, rc);
3228
3229	/* Update pVM->pgm.s.GCPhysCR3. */
3230	Assert(pVCpu->pgm.s.GCPhysCR3 == NIL_RTGCPHYS \|\| FTMIsDeltaLoadSaveActive(pVM));
3231	RTGCPHYS GCPhysCR3 = CPUMGetGuestCR3(pVCpu);
3232	if ( pVCpu->pgm.s.enmGuestMode == PGMMODE_PAE
3233	\|\| pVCpu->pgm.s.enmGuestMode == PGMMODE_PAE_NX
3234	\|\| pVCpu->pgm.s.enmGuestMode == PGMMODE_AMD64
3235	\|\| pVCpu->pgm.s.enmGuestMode == PGMMODE_AMD64_NX)
3236	GCPhysCR3 = (GCPhysCR3 & X86_CR3_PAE_PAGE_MASK);
3237	else
3238	GCPhysCR3 = (GCPhysCR3 & X86_CR3_PAGE_MASK);
3239	pVCpu->pgm.s.GCPhysCR3 = GCPhysCR3;
3240
3241	/* Update the PSE, NX flags and validity masks. */
3242	pVCpu->pgm.s.fGst32BitPageSizeExtension = CPUMIsGuestPageSizeExtEnabled(pVCpu);
3243	PGMNotifyNxeChanged(pVCpu, CPUMIsGuestNXEnabled(pVCpu));
3244	}
3245
3246	/*
3247	* Try re-fixate the guest mappings.
3248	*/
3249	pVM->pgm.s.fMappingsFixedRestored = false;
3250	if ( pVM->pgm.s.fMappingsFixed
3251	&& pgmMapAreMappingsEnabled(pVM))
3252	{
3253	#ifndef PGM_WITHOUT_MAPPINGS
3254	RTGCPTR GCPtrFixed = pVM->pgm.s.GCPtrMappingFixed;
3255	uint32_t cbFixed = pVM->pgm.s.cbMappingFixed;
3256	pVM->pgm.s.fMappingsFixed = false;
3257
3258	uint32_t cbRequired;
3259	int rc2 = PGMR3MappingsSize(pVM, &cbRequired); AssertRC(rc2);
3260	if ( RT_SUCCESS(rc2)
3261	&& cbRequired > cbFixed)
3262	rc2 = VERR_OUT_OF_RANGE;
3263	if (RT_SUCCESS(rc2))
3264	rc2 = pgmR3MappingsFixInternal(pVM, GCPtrFixed, cbFixed);
3265	if (RT_FAILURE(rc2))
3266	{
3267	LogRel(("PGM: Unable to re-fixate the guest mappings at %RGv-%RGv: rc=%Rrc (cbRequired=%#x)\n",
3268	GCPtrFixed, GCPtrFixed + cbFixed, rc2, cbRequired));
3269	pVM->pgm.s.fMappingsFixed = false;
3270	pVM->pgm.s.fMappingsFixedRestored = true;
3271	pVM->pgm.s.GCPtrMappingFixed = GCPtrFixed;
3272	pVM->pgm.s.cbMappingFixed = cbFixed;
3273	}
3274	#else
3275	AssertFailed();
3276	#endif
3277	}
3278	else
3279	{
3280	/* We used to set fixed + disabled while we only use disabled now,
3281	so wipe the state to avoid any confusion. */
3282	pVM->pgm.s.fMappingsFixed = false;
3283	pVM->pgm.s.GCPtrMappingFixed = NIL_RTGCPTR;
3284	pVM->pgm.s.cbMappingFixed = 0;
3285	}
3286
3287	/*
3288	* If we have floating mappings, do a CR3 sync now to make sure the HMA
3289	* doesn't conflict with guest code / data and thereby cause trouble
3290	* when restoring other components like PATM.
3291	*/
3292	if (pgmMapAreMappingsFloating(pVM))
3293	{
3294	PVMCPU pVCpu = &pVM->aCpus[0];
3295	rc = PGMSyncCR3(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR3(pVCpu), CPUMGetGuestCR4(pVCpu), true);
3296	if (RT_FAILURE(rc))
3297	return SSMR3SetLoadError(pSSM, VERR_WRONG_ORDER, RT_SRC_POS,
3298	N_("PGMSyncCR3 failed unexpectedly with rc=%Rrc"), rc);
3299
3300	/* Make sure to re-sync before executing code. */
3301	VMCPU_FF_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL);
3302	VMCPU_FF_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3);
3303	pVCpu->pgm.s.fSyncFlags \|= PGM_SYNC_UPDATE_PAGE_BIT_VIRTUAL;
3304	}
3305	}
3306	}
3307
3308	return rc;
3309	}
3310
3311
3312	/**
3313	* @callback_method_impl{FNSSMINTLOADDONE}
3314	*/
3315	static DECLCALLBACK(int) pgmR3LoadDone(PVM pVM, PSSMHANDLE pSSM)
3316	{
3317	pVM->pgm.s.fRestoreRomPagesOnReset = true;
3318	NOREF(pSSM);
3319	return VINF_SUCCESS;
3320	}
3321
3322
3323	/**
3324	* Registers the saved state callbacks with SSM.
3325	*
3326	* @returns VBox status code.
3327	* @param pVM The cross context VM structure.
3328	* @param cbRam The RAM size.
3329	*/
3330	int pgmR3InitSavedState(PVM pVM, uint64_t cbRam)
3331	{
3332	return SSMR3RegisterInternal(pVM, "pgm", 1, PGM_SAVED_STATE_VERSION, (size_t)cbRam + sizeof(PGM),
3333	pgmR3LivePrep, pgmR3LiveExec, pgmR3LiveVote,
3334	NULL, pgmR3SaveExec, pgmR3SaveDone,
3335	pgmR3LoadPrep, pgmR3Load, pgmR3LoadDone);
3336	}
3337

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMR3/PGMSavedState.cpp@ 64115

Download in other formats: