CSAM.cpp@ 18927

Last change on this file since 18927 was 18927, checked in by vboxsync, 16 years ago
Big step to separate VMM data structures for guest SMP. (pgm, em)
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 90.8 KB

Line
1	/* $Id: CSAM.cpp 18927 2009-04-16 11:41:38Z vboxsync $ */
2	/** @file
3	* CSAM - Guest OS Code Scanning and Analysis Manager
4	*/
5
6	/*
7	* Copyright (C) 2006-2007 Sun Microsystems, Inc.
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
18	* Clara, CA 95054 USA or visit http://www.sun.com if you need
19	* additional information or have any questions.
20	*/
21
22	/*******************************************************************************
23	* Header Files *
24	*******************************************************************************/
25	#define LOG_GROUP LOG_GROUP_CSAM
26	#include <VBox/cpum.h>
27	#include <VBox/stam.h>
28	#include <VBox/patm.h>
29	#include <VBox/csam.h>
30	#include <VBox/cpumdis.h>
31	#include <VBox/pgm.h>
32	#include <VBox/iom.h>
33	#include <VBox/sup.h>
34	#include <VBox/mm.h>
35	#include <VBox/em.h>
36	#include <VBox/rem.h>
37	#include <VBox/selm.h>
38	#include <VBox/trpm.h>
39	#include <VBox/cfgm.h>
40	#include <VBox/param.h>
41	#include <iprt/avl.h>
42	#include <iprt/asm.h>
43	#include <iprt/thread.h>
44	#include "CSAMInternal.h"
45	#include <VBox/vm.h>
46	#include <VBox/dbg.h>
47	#include <VBox/err.h>
48	#include <VBox/ssm.h>
49	#include <VBox/log.h>
50	#include <iprt/assert.h>
51	#include <iprt/string.h>
52	#include <VBox/dis.h>
53	#include <VBox/disopcode.h>
54	#include <stdlib.h>
55	#include <stdio.h>
56
57
58	/* Enabled by default */
59	#define CSAM_ENABLE
60
61	/* Enable to monitor code pages for self-modifying code. */
62	#define CSAM_MONITOR_CODE_PAGES
63	/* Enable to monitor all scanned pages
64	#define CSAM_MONITOR_CSAM_CODE_PAGES */
65	/* Enable to scan beyond ret instructions.
66	#define CSAM_ANALYSE_BEYOND_RET */
67
68	/*******************************************************************************
69	* Internal Functions *
70	*******************************************************************************/
71	static DECLCALLBACK(int) csamr3Save(PVM pVM, PSSMHANDLE pSSM);
72	static DECLCALLBACK(int) csamr3Load(PVM pVM, PSSMHANDLE pSSM, uint32_t u32Version);
73	static DECLCALLBACK(int) CSAMCodePageWriteHandler(PVM pVM, RTGCPTR GCPtr, void pvPtr, void pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType, void *pvUser);
74	static DECLCALLBACK(int) CSAMCodePageInvalidate(PVM pVM, RTGCPTR GCPtr);
75
76	bool csamIsCodeScanned(PVM pVM, RTRCPTR pInstr, PCSAMPAGE *pPage);
77	int csamR3CheckPageRecord(PVM pVM, RTRCPTR pInstr);
78	static PCSAMPAGE csamCreatePageRecord(PVM pVM, RTRCPTR GCPtr, CSAMTAG enmTag, bool fCode32, bool fMonitorInvalidation = false);
79	static int csamRemovePageRecord(PVM pVM, RTRCPTR GCPtr);
80	static int csamReinit(PVM pVM);
81	static void csamMarkCode(PVM pVM, PCSAMPAGE pPage, RTRCPTR pInstr, uint32_t opsize, bool fScanned);
82	static int csamAnalyseCodeStream(PVM pVM, RCPTRTYPE(uint8_t ) pInstrGC, RCPTRTYPE(uint8_t ) pCurInstrGC, bool fCode32,
83	PFN_CSAMR3ANALYSE pfnCSAMR3Analyse, void *pUserData, PCSAMP2GLOOKUPREC pCacheRec);
84
85	/** @todo Temporary for debugging. */
86	static bool fInCSAMCodePageInvalidate = false;
87
88	/*******************************************************************************
89	* Global Variables *
90	*******************************************************************************/
91	#ifdef VBOX_WITH_DEBUGGER
92	static DECLCALLBACK(int) csamr3CmdOn(PCDBGCCMD pCmd, PDBGCCMDHLP pCmdHlp, PVM pVM, PCDBGCVAR paArgs, unsigned cArgs, PDBGCVAR pResult);
93	static DECLCALLBACK(int) csamr3CmdOff(PCDBGCCMD pCmd, PDBGCCMDHLP pCmdHlp, PVM pVM, PCDBGCVAR paArgs, unsigned cArgs, PDBGCVAR pResult);
94
95	/** Command descriptors. */
96	static const DBGCCMD g_aCmds[] =
97	{
98	/* pszCmd, cArgsMin, cArgsMax, paArgDesc, cArgDescs, pResultDesc, fFlags, pfnHandler pszSyntax, ....pszDescription */
99	{ "csamon", 0, 0, NULL, 0, NULL, 0, csamr3CmdOn, "", "Enable CSAM code scanning." },
100	{ "csamoff", 0, 0, NULL, 0, NULL, 0, csamr3CmdOff, "", "Disable CSAM code scanning." },
101	};
102	#endif
103
104
105	/**
106	* Initializes the CSAM.
107	*
108	* @returns VBox status code.
109	* @param pVM The VM to operate on.
110	*/
111	VMMR3DECL(int) CSAMR3Init(PVM pVM)
112	{
113	int rc;
114
115	LogFlow(("CSAMR3Init\n"));
116
117	/* Allocate bitmap for the page directory. */
118	rc = MMR3HyperAllocOnceNoRel(pVM, CSAM_PGDIRBMP_CHUNKSsizeof(RTHCPTR), 0, MM_TAG_CSAM, (void *)&pVM->csam.s.pPDBitmapHC);
119	AssertRCReturn(rc, rc);
120	rc = MMR3HyperAllocOnceNoRel(pVM, CSAM_PGDIRBMP_CHUNKSsizeof(RTRCPTR), 0, MM_TAG_CSAM, (void *)&pVM->csam.s.pPDGCBitmapHC);
121	AssertRCReturn(rc, rc);
122	pVM->csam.s.pPDBitmapGC = MMHyperR3ToRC(pVM, pVM->csam.s.pPDGCBitmapHC);
123	pVM->csam.s.pPDHCBitmapGC = MMHyperR3ToRC(pVM, pVM->csam.s.pPDBitmapHC);
124
125	rc = csamReinit(pVM);
126	AssertRCReturn(rc, rc);
127
128	/*
129	* Register save and load state notificators.
130	*/
131	rc = SSMR3RegisterInternal(pVM, "CSAM", 0, CSAM_SSM_VERSION, sizeof(pVM->csam.s) + PAGE_SIZE*16,
132	NULL, csamr3Save, NULL,
133	NULL, csamr3Load, NULL);
134	AssertRCReturn(rc, rc);
135
136	STAM_REG(pVM, &pVM->csam.s.StatNrTraps, STAMTYPE_COUNTER, "/CSAM/PageTraps", STAMUNIT_OCCURENCES, "The number of CSAM page traps.");
137	STAM_REG(pVM, &pVM->csam.s.StatDangerousWrite, STAMTYPE_COUNTER, "/CSAM/DangerousWrites", STAMUNIT_OCCURENCES, "The number of dangerous writes that cause a context switch.");
138
139	STAM_REG(pVM, &pVM->csam.s.StatNrPageNPHC, STAMTYPE_COUNTER, "/CSAM/HC/PageNotPresent", STAMUNIT_OCCURENCES, "The number of CSAM pages marked not present.");
140	STAM_REG(pVM, &pVM->csam.s.StatNrPageNPGC, STAMTYPE_COUNTER, "/CSAM/GC/PageNotPresent", STAMUNIT_OCCURENCES, "The number of CSAM pages marked not present.");
141	STAM_REG(pVM, &pVM->csam.s.StatNrPages, STAMTYPE_COUNTER, "/CSAM/PageRec/AddedRW", STAMUNIT_OCCURENCES, "The number of CSAM page records (RW monitoring).");
142	STAM_REG(pVM, &pVM->csam.s.StatNrPagesInv, STAMTYPE_COUNTER, "/CSAM/PageRec/AddedRWI", STAMUNIT_OCCURENCES, "The number of CSAM page records (RW & invalidation monitoring).");
143	STAM_REG(pVM, &pVM->csam.s.StatNrRemovedPages, STAMTYPE_COUNTER, "/CSAM/PageRec/Removed", STAMUNIT_OCCURENCES, "The number of removed CSAM page records.");
144	STAM_REG(pVM, &pVM->csam.s.StatPageRemoveREMFlush,STAMTYPE_COUNTER, "/CSAM/PageRec/Removed/REMFlush", STAMUNIT_OCCURENCES, "The number of removed CSAM page records that caused a REM flush.");
145
146	STAM_REG(pVM, &pVM->csam.s.StatNrPatchPages, STAMTYPE_COUNTER, "/CSAM/PageRec/Patch", STAMUNIT_OCCURENCES, "The number of CSAM patch page records.");
147	STAM_REG(pVM, &pVM->csam.s.StatNrUserPages, STAMTYPE_COUNTER, "/CSAM/PageRec/Ignore/User", STAMUNIT_OCCURENCES, "The number of CSAM user page records (ignored).");
148	STAM_REG(pVM, &pVM->csam.s.StatPagePATM, STAMTYPE_COUNTER, "/CSAM/PageRec/Type/PATM", STAMUNIT_OCCURENCES, "The number of PATM page records.");
149	STAM_REG(pVM, &pVM->csam.s.StatPageCSAM, STAMTYPE_COUNTER, "/CSAM/PageRec/Type/CSAM", STAMUNIT_OCCURENCES, "The number of CSAM page records.");
150	STAM_REG(pVM, &pVM->csam.s.StatPageREM, STAMTYPE_COUNTER, "/CSAM/PageRec/Type/REM", STAMUNIT_OCCURENCES, "The number of REM page records.");
151	STAM_REG(pVM, &pVM->csam.s.StatPageMonitor, STAMTYPE_COUNTER, "/CSAM/PageRec/Monitored", STAMUNIT_OCCURENCES, "The number of monitored pages.");
152
153	STAM_REG(pVM, &pVM->csam.s.StatCodePageModified, STAMTYPE_COUNTER, "/CSAM/Monitor/DirtyPage", STAMUNIT_OCCURENCES, "The number of code page modifications.");
154
155	STAM_REG(pVM, &pVM->csam.s.StatNrFlushes, STAMTYPE_COUNTER, "/CSAM/PageFlushes", STAMUNIT_OCCURENCES, "The number of CSAM page flushes.");
156	STAM_REG(pVM, &pVM->csam.s.StatNrFlushesSkipped, STAMTYPE_COUNTER, "/CSAM/PageFlushesSkipped", STAMUNIT_OCCURENCES, "The number of CSAM page flushes that were skipped.");
157	STAM_REG(pVM, &pVM->csam.s.StatNrKnownPagesHC, STAMTYPE_COUNTER, "/CSAM/HC/KnownPageRecords", STAMUNIT_OCCURENCES, "The number of known CSAM page records.");
158	STAM_REG(pVM, &pVM->csam.s.StatNrKnownPagesGC, STAMTYPE_COUNTER, "/CSAM/GC/KnownPageRecords", STAMUNIT_OCCURENCES, "The number of known CSAM page records.");
159	STAM_REG(pVM, &pVM->csam.s.StatNrInstr, STAMTYPE_COUNTER, "/CSAM/ScannedInstr", STAMUNIT_OCCURENCES, "The number of scanned instructions.");
160	STAM_REG(pVM, &pVM->csam.s.StatNrBytesRead, STAMTYPE_COUNTER, "/CSAM/BytesRead", STAMUNIT_OCCURENCES, "The number of bytes read for scanning.");
161	STAM_REG(pVM, &pVM->csam.s.StatNrOpcodeRead, STAMTYPE_COUNTER, "/CSAM/OpcodeBytesRead", STAMUNIT_OCCURENCES, "The number of opcode bytes read by the recompiler.");
162
163	STAM_REG(pVM, &pVM->csam.s.StatBitmapAlloc, STAMTYPE_COUNTER, "/CSAM/Alloc/PageBitmap", STAMUNIT_OCCURENCES, "The number of page bitmap allocations.");
164
165	STAM_REG(pVM, &pVM->csam.s.StatInstrCacheHit, STAMTYPE_COUNTER, "/CSAM/Cache/Hit", STAMUNIT_OCCURENCES, "The number of dangerous instruction cache hits.");
166	STAM_REG(pVM, &pVM->csam.s.StatInstrCacheMiss, STAMTYPE_COUNTER, "/CSAM/Cache/Miss", STAMUNIT_OCCURENCES, "The number of dangerous instruction cache misses.");
167
168	STAM_REG(pVM, &pVM->csam.s.StatScanNextFunction, STAMTYPE_COUNTER, "/CSAM/Function/Scan/Success", STAMUNIT_OCCURENCES, "The number of found functions beyond the ret border.");
169	STAM_REG(pVM, &pVM->csam.s.StatScanNextFunctionFailed, STAMTYPE_COUNTER, "/CSAM/Function/Scan/Failed", STAMUNIT_OCCURENCES, "The number of refused functions beyond the ret border.");
170
171	STAM_REG(pVM, &pVM->csam.s.StatTime, STAMTYPE_PROFILE, "/PROF/CSAM/Scan", STAMUNIT_TICKS_PER_CALL, "Scanning overhead.");
172	STAM_REG(pVM, &pVM->csam.s.StatTimeCheckAddr, STAMTYPE_PROFILE, "/PROF/CSAM/CheckAddr", STAMUNIT_TICKS_PER_CALL, "Address check overhead.");
173	STAM_REG(pVM, &pVM->csam.s.StatTimeAddrConv, STAMTYPE_PROFILE, "/PROF/CSAM/AddrConv", STAMUNIT_TICKS_PER_CALL, "Address conversion overhead.");
174	STAM_REG(pVM, &pVM->csam.s.StatTimeFlushPage, STAMTYPE_PROFILE, "/PROF/CSAM/FlushPage", STAMUNIT_TICKS_PER_CALL, "Page flushing overhead.");
175	STAM_REG(pVM, &pVM->csam.s.StatTimeDisasm, STAMTYPE_PROFILE, "/PROF/CSAM/Disasm", STAMUNIT_TICKS_PER_CALL, "Disassembly overhead.");
176	STAM_REG(pVM, &pVM->csam.s.StatFlushDirtyPages, STAMTYPE_PROFILE, "/PROF/CSAM/FlushDirtyPage", STAMUNIT_TICKS_PER_CALL, "Dirty page flushing overhead.");
177	STAM_REG(pVM, &pVM->csam.s.StatCheckGates, STAMTYPE_PROFILE, "/PROF/CSAM/CheckGates", STAMUNIT_TICKS_PER_CALL, "CSAMR3CheckGates overhead.");
178
179	/*
180	* Check CFGM option and enable/disable CSAM.
181	*/
182	bool fEnabled;
183	rc = CFGMR3QueryBool(CFGMR3GetRoot(pVM), "CSAMEnabled", &fEnabled);
184	if (RT_FAILURE(rc))
185	#ifdef CSAM_ENABLE
186	fEnabled = true;
187	#else
188	fEnabled = false;
189	#endif
190	if (fEnabled)
191	CSAMEnableScanning(pVM);
192
193	#ifdef VBOX_WITH_DEBUGGER
194	/*
195	* Debugger commands.
196	*/
197	static bool fRegisteredCmds = false;
198	if (!fRegisteredCmds)
199	{
200	int rc = DBGCRegisterCommands(&g_aCmds[0], RT_ELEMENTS(g_aCmds));
201	if (RT_SUCCESS(rc))
202	fRegisteredCmds = true;
203	}
204	#endif
205
206	return VINF_SUCCESS;
207	}
208
209	/**
210	* (Re)initializes CSAM
211	*
212	* @param pVM The VM.
213	*/
214	static int csamReinit(PVM pVM)
215	{
216	/*
217	* Assert alignment and sizes.
218	*/
219	AssertRelease(!(RT_OFFSETOF(VM, csam.s) & 31));
220	AssertRelease(sizeof(pVM->csam.s) <= sizeof(pVM->csam.padding));
221
222	/*
223	* Setup any fixed pointers and offsets.
224	*/
225	pVM->csam.s.offVM = RT_OFFSETOF(VM, patm);
226
227	pVM->csam.s.fGatesChecked = false;
228	pVM->csam.s.fScanningStarted = false;
229
230	VM_FF_CLEAR(pVM, VM_FF_CSAM_PENDING_ACTION);
231	pVM->csam.s.cDirtyPages = 0;
232	/* not necessary */
233	memset(pVM->csam.s.pvDirtyBasePage, 0, sizeof(pVM->csam.s.pvDirtyBasePage));
234	memset(pVM->csam.s.pvDirtyFaultPage, 0, sizeof(pVM->csam.s.pvDirtyFaultPage));
235
236	memset(&pVM->csam.s.aDangerousInstr, 0, sizeof(pVM->csam.s.aDangerousInstr));
237	pVM->csam.s.cDangerousInstr = 0;
238	pVM->csam.s.iDangerousInstr = 0;
239
240	memset(pVM->csam.s.pvCallInstruction, 0, sizeof(pVM->csam.s.pvCallInstruction));
241	pVM->csam.s.iCallInstruction = 0;
242
243	/** @note never mess with the pgdir bitmap here! */
244	return VINF_SUCCESS;
245	}
246
247	/**
248	* Applies relocations to data and code managed by this
249	* component. This function will be called at init and
250	* whenever the VMM need to relocate itself inside the GC.
251	*
252	* The csam will update the addresses used by the switcher.
253	*
254	* @param pVM The VM.
255	* @param offDelta Relocation delta.
256	*/
257	VMMR3DECL(void) CSAMR3Relocate(PVM pVM, RTGCINTPTR offDelta)
258	{
259	if (offDelta)
260	{
261	/* Adjust pgdir and page bitmap pointers. */
262	pVM->csam.s.pPDBitmapGC = MMHyperR3ToRC(pVM, pVM->csam.s.pPDGCBitmapHC);
263	pVM->csam.s.pPDHCBitmapGC = MMHyperR3ToRC(pVM, pVM->csam.s.pPDBitmapHC);
264
265	for(int i=0;i<CSAM_PGDIRBMP_CHUNKS;i++)
266	{
267	if (pVM->csam.s.pPDGCBitmapHC[i])
268	{
269	pVM->csam.s.pPDGCBitmapHC[i] += offDelta;
270	}
271	}
272	}
273	return;
274	}
275
276	/**
277	* Terminates the csam.
278	*
279	* Termination means cleaning up and freeing all resources,
280	* the VM it self is at this point powered off or suspended.
281	*
282	* @returns VBox status code.
283	* @param pVM The VM to operate on.
284	*/
285	VMMR3DECL(int) CSAMR3Term(PVM pVM)
286	{
287	int rc;
288
289	rc = CSAMR3Reset(pVM);
290	AssertRC(rc);
291
292	/* @todo triggers assertion in MMHyperFree */
293	#if 0
294	for(int i=0;i<CSAM_PAGEBMP_CHUNKS;i++)
295	{
296	if (pVM->csam.s.pPDBitmapHC[i])
297	MMHyperFree(pVM, pVM->csam.s.pPDBitmapHC[i]);
298	}
299	#endif
300
301	return VINF_SUCCESS;
302	}
303
304	/**
305	* CSAM reset callback.
306	*
307	* @returns VBox status code.
308	* @param pVM The VM which is reset.
309	*/
310	VMMR3DECL(int) CSAMR3Reset(PVM pVM)
311	{
312	/* Clear page bitmaps. */
313	for(int i=0;i<CSAM_PGDIRBMP_CHUNKS;i++)
314	{
315	if (pVM->csam.s.pPDBitmapHC[i])
316	{
317	Assert((CSAM_PAGE_BITMAP_SIZE& 3) == 0);
318	ASMMemZero32(pVM->csam.s.pPDBitmapHC[i], CSAM_PAGE_BITMAP_SIZE);
319	}
320	}
321
322	/* Remove all CSAM page records. */
323	while(true)
324	{
325	PCSAMPAGEREC pPageRec = (PCSAMPAGEREC)RTAvlPVGetBestFit(&pVM->csam.s.pPageTree, 0, true);
326	if (pPageRec)
327	{
328	csamRemovePageRecord(pVM, pPageRec->page.pPageGC);
329	}
330	else
331	break;
332	}
333	Assert(!pVM->csam.s.pPageTree);
334
335	csamReinit(pVM);
336
337	return VINF_SUCCESS;
338	}
339
340	#define CSAM_SUBTRACT_PTR(a, b) (uintptr_t )&(a) = (uintptr_t)(a) - (uintptr_t)(b)
341	#define CSAM_ADD_PTR(a, b) (uintptr_t )&(a) = (uintptr_t)(a) + (uintptr_t)(b)
342
343
344	/**
345	* Callback function for RTAvlPVDoWithAll
346	*
347	* Counts the number of records in the tree
348	*
349	* @returns VBox status code.
350	* @param pNode Current node
351	* @param pcPatches Pointer to patch counter
352	*/
353	static DECLCALLBACK(int) CountRecord(PAVLPVNODECORE pNode, void *pcPatches)
354	{
355	(uint32_t )pcPatches = (uint32_t )pcPatches + 1;
356	return VINF_SUCCESS;
357	}
358
359	/**
360	* Callback function for RTAvlPVDoWithAll
361	*
362	* Saves the state of the page record
363	*
364	* @returns VBox status code.
365	* @param pNode Current node
366	* @param pVM1 VM Handle
367	*/
368	static DECLCALLBACK(int) SavePageState(PAVLPVNODECORE pNode, void *pVM1)
369	{
370	PVM pVM = (PVM)pVM1;
371	PCSAMPAGEREC pPage = (PCSAMPAGEREC)pNode;
372	CSAMPAGEREC page = *pPage;
373	PSSMHANDLE pSSM = pVM->csam.s.savedstate.pSSM;
374	int rc;
375
376	/* Save the page record itself */
377	rc = SSMR3PutMem(pSSM, &page, sizeof(page));
378	AssertRCReturn(rc, rc);
379
380	if (page.page.pBitmap)
381	{
382	rc = SSMR3PutMem(pSSM, page.page.pBitmap, CSAM_PAGE_BITMAP_SIZE);
383	AssertRCReturn(rc, rc);
384	}
385
386	return VINF_SUCCESS;
387	}
388
389	/**
390	* Execute state save operation.
391	*
392	* @returns VBox status code.
393	* @param pVM VM Handle.
394	* @param pSSM SSM operation handle.
395	*/
396	static DECLCALLBACK(int) csamr3Save(PVM pVM, PSSMHANDLE pSSM)
397	{
398	CSAM csamInfo = pVM->csam.s;
399	int rc;
400
401	/*
402	* Count the number of page records in the tree (feeling lazy)
403	*/
404	csamInfo.savedstate.cPageRecords = 0;
405	RTAvlPVDoWithAll(&pVM->csam.s.pPageTree, true, CountRecord, &csamInfo.savedstate.cPageRecords);
406
407	/*
408	* Save CSAM structure
409	*/
410	pVM->csam.s.savedstate.pSSM = pSSM;
411	rc = SSMR3PutMem(pSSM, &csamInfo, sizeof(csamInfo));
412	AssertRCReturn(rc, rc);
413
414	/* Save pgdir bitmap */
415	rc = SSMR3PutMem(pSSM, csamInfo.pPDBitmapHC, CSAM_PGDIRBMP_CHUNKS*sizeof(RTHCPTR));
416	AssertRCReturn(rc, rc);
417
418	for (unsigned i=0;i<CSAM_PGDIRBMP_CHUNKS;i++)
419	{
420	if(csamInfo.pPDBitmapHC[i])
421	{
422	/* Save the page bitmap. */
423	rc = SSMR3PutMem(pSSM, csamInfo.pPDBitmapHC[i], CSAM_PAGE_BITMAP_SIZE);
424	AssertRCReturn(rc, rc);
425	}
426	}
427
428	/*
429	* Save page records
430	*/
431	rc = RTAvlPVDoWithAll(&pVM->csam.s.pPageTree, true, SavePageState, pVM);
432	AssertRCReturn(rc, rc);
433
434	/** @note we don't restore aDangerousInstr; it will be recreated automatically. */
435	return VINF_SUCCESS;
436	}
437
438	/**
439	* Execute state load operation.
440	*
441	* @returns VBox status code.
442	* @param pVM VM Handle.
443	* @param pSSM SSM operation handle.
444	* @param u32Version Data layout version.
445	*/
446	static DECLCALLBACK(int) csamr3Load(PVM pVM, PSSMHANDLE pSSM, uint32_t u32Version)
447	{
448	int rc;
449	CSAM csamInfo;
450
451	if (u32Version != CSAM_SSM_VERSION)
452	{
453	AssertMsgFailed(("csamR3Load: Invalid version u32Version=%d!\n", u32Version));
454	return VERR_SSM_UNSUPPORTED_DATA_UNIT_VERSION;
455	}
456
457	pVM->csam.s.savedstate.pSSM = pSSM;
458
459	/*
460	* Restore CSAM structure
461	*/
462	rc = SSMR3GetMem(pSSM, &csamInfo, sizeof(csamInfo));
463	AssertRCReturn(rc, rc);
464
465	pVM->csam.s.fGatesChecked = csamInfo.fGatesChecked;
466	pVM->csam.s.fScanningStarted = csamInfo.fScanningStarted;
467
468	/* Restore dirty code page info. */
469	pVM->csam.s.cDirtyPages = csamInfo.cDirtyPages;
470	memcpy(pVM->csam.s.pvDirtyBasePage, csamInfo.pvDirtyBasePage, sizeof(pVM->csam.s.pvDirtyBasePage));
471	memcpy(pVM->csam.s.pvDirtyFaultPage, csamInfo.pvDirtyFaultPage, sizeof(pVM->csam.s.pvDirtyFaultPage));
472
473	/* Restore possible code page */
474	pVM->csam.s.cPossibleCodePages = csamInfo.cPossibleCodePages;
475	memcpy(pVM->csam.s.pvPossibleCodePage, csamInfo.pvPossibleCodePage, sizeof(pVM->csam.s.pvPossibleCodePage));
476
477	/* Restore pgdir bitmap (we'll change the pointers next). */
478	rc = SSMR3GetMem(pSSM, pVM->csam.s.pPDBitmapHC, CSAM_PGDIRBMP_CHUNKS*sizeof(RTHCPTR));
479	AssertRCReturn(rc, rc);
480
481	/*
482	* Restore page bitmaps
483	*/
484	for (unsigned i=0;i<CSAM_PGDIRBMP_CHUNKS;i++)
485	{
486	if(pVM->csam.s.pPDBitmapHC[i])
487	{
488	rc = MMHyperAlloc(pVM, CSAM_PAGE_BITMAP_SIZE, 0, MM_TAG_CSAM, (void **)&pVM->csam.s.pPDBitmapHC[i]);
489	if (RT_FAILURE(rc))
490	{
491	Log(("MMR3HyperAlloc failed with %d\n", rc));
492	return rc;
493	}
494	/* Convert to GC pointer. */
495	pVM->csam.s.pPDGCBitmapHC[i] = MMHyperR3ToRC(pVM, pVM->csam.s.pPDBitmapHC[i]);
496	Assert(pVM->csam.s.pPDGCBitmapHC[i]);
497
498	/* Restore the bitmap. */
499	rc = SSMR3GetMem(pSSM, pVM->csam.s.pPDBitmapHC[i], CSAM_PAGE_BITMAP_SIZE);
500	AssertRCReturn(rc, rc);
501	}
502	else
503	{
504	Assert(!pVM->csam.s.pPDGCBitmapHC[i]);
505	pVM->csam.s.pPDGCBitmapHC[i] = 0;
506	}
507	}
508
509	/*
510	* Restore page records
511	*/
512	for (uint32_t i=0;i<csamInfo.savedstate.cPageRecords + csamInfo.savedstate.cPatchPageRecords;i++)
513	{
514	CSAMPAGEREC page;
515	PCSAMPAGE pPage;
516
517	rc = SSMR3GetMem(pSSM, &page, sizeof(page));
518	AssertRCReturn(rc, rc);
519
520	/*
521	* Recreate the page record
522	*/
523	pPage = csamCreatePageRecord(pVM, page.page.pPageGC, page.page.enmTag, page.page.fCode32, page.page.fMonitorInvalidation);
524	AssertReturn(pPage, VERR_NO_MEMORY);
525
526	pPage->GCPhys = page.page.GCPhys;
527	pPage->fFlags = page.page.fFlags;
528	pPage->u64Hash = page.page.u64Hash;
529
530	if (page.page.pBitmap)
531	{
532	rc = SSMR3GetMem(pSSM, pPage->pBitmap, CSAM_PAGE_BITMAP_SIZE);
533	AssertRCReturn(rc, rc);
534	}
535	else
536	{
537	MMR3HeapFree(pPage->pBitmap);
538	pPage->pBitmap = 0;
539	}
540	}
541
542	/** @note we don't restore aDangerousInstr; it will be recreated automatically. */
543	memset(&pVM->csam.s.aDangerousInstr, 0, sizeof(pVM->csam.s.aDangerousInstr));
544	pVM->csam.s.cDangerousInstr = 0;
545	pVM->csam.s.iDangerousInstr = 0;
546	return VINF_SUCCESS;
547	}
548
549	/**
550	* Convert guest context address to host context pointer
551	*
552	* @returns VBox status code.
553	* @param pVM The VM to operate on.
554	* @param pCacheRec Address conversion cache record
555	* @param pGCPtr Guest context pointer
556	*
557	* @returns Host context pointer or NULL in case of an error
558	*
559	*/
560	static R3PTRTYPE(void ) CSAMGCVirtToHCVirt(PVM pVM, PCSAMP2GLOOKUPREC pCacheRec, RCPTRTYPE(uint8_t ) pGCPtr)
561	{
562	int rc;
563	R3PTRTYPE(void *) pHCPtr;
564	Assert(pVM->cCPUs == 1);
565	PVMCPU pVCpu = VMMGetCpu0(pVM);
566
567	STAM_PROFILE_START(&pVM->csam.s.StatTimeAddrConv, a);
568
569	pHCPtr = PATMR3GCPtrToHCPtr(pVM, pGCPtr);
570	if (pHCPtr) return pHCPtr;
571
572	if (pCacheRec->pPageLocStartHC)
573	{
574	uint32_t offset = pGCPtr & PAGE_OFFSET_MASK;
575	if (pCacheRec->pGuestLoc == (pGCPtr & PAGE_BASE_GC_MASK))
576	{
577	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeAddrConv, a);
578	return pCacheRec->pPageLocStartHC + offset;
579	}
580	}
581
582	rc = PGMPhysGCPtr2R3Ptr(pVCpu, pGCPtr, &pHCPtr);
583	if (rc != VINF_SUCCESS)
584	{
585	//// AssertMsgRC(rc, ("MMR3PhysGCVirt2HCVirtEx failed for %RRv\n", pGCPtr));
586	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeAddrConv, a);
587	return NULL;
588	}
589
590	pCacheRec->pPageLocStartHC = (R3PTRTYPE(uint8_t*))((RTHCUINTPTR)pHCPtr & PAGE_BASE_HC_MASK);
591	pCacheRec->pGuestLoc = pGCPtr & PAGE_BASE_GC_MASK;
592	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeAddrConv, a);
593	return pHCPtr;
594	}
595
596	/**
597	* Read callback for disassembly function; supports reading bytes that cross a page boundary
598	*
599	* @returns VBox status code.
600	* @param pSrc GC source pointer
601	* @param pDest HC destination pointer
602	* @param size Number of bytes to read
603	* @param dwUserdata Callback specific user data (pCpu)
604	*
605	*/
606	static DECLCALLBACK(int) CSAMR3ReadBytes(RTUINTPTR pSrc, uint8_t pDest, unsigned size, void pvUserdata)
607	{
608	DISCPUSTATE pCpu = (DISCPUSTATE )pvUserdata;
609	PVM pVM = (PVM)pCpu->apvUserData[0];
610	RTHCUINTPTR pInstrHC = (RTHCUINTPTR)pCpu->apvUserData[1];
611	RTGCUINTPTR32 pInstrGC = (uintptr_t)pCpu->apvUserData[2];
612	int orgsize = size;
613	Assert(pVM->cCPUs == 1);
614	PVMCPU pVCpu = VMMGetCpu0(pVM);
615
616	/* We are not interested in patched instructions, so read the original opcode bytes. */
617	/** @note single instruction patches (int3) are checked in CSAMR3AnalyseCallback */
618	for (int i=0;i<orgsize;i++)
619	{
620	int rc = PATMR3QueryOpcode(pVM, (RTRCPTR)pSrc, pDest);
621	if (RT_SUCCESS(rc))
622	{
623	pSrc++;
624	pDest++;
625	size--;
626	}
627	else
628	break;
629	}
630	if (size == 0)
631	return VINF_SUCCESS;
632
633	if (PAGE_ADDRESS(pInstrGC) != PAGE_ADDRESS(pSrc + size - 1) && !PATMIsPatchGCAddr(pVM, pSrc))
634	{
635	return PGMPhysSimpleReadGCPtr(pVCpu, pDest, pSrc, size);
636	}
637	else
638	{
639	Assert(pInstrHC);
640
641	/* pInstrHC is the base address; adjust according to the GC pointer. */
642	pInstrHC = pInstrHC + (pSrc - pInstrGC);
643
644	memcpy(pDest, (void *)pInstrHC, size);
645	}
646
647	return VINF_SUCCESS;
648	}
649
650	inline int CSAMR3DISInstr(PVM pVM, DISCPUSTATE pCpu, RTRCPTR InstrGC, uint8_t InstrHC, uint32_t pOpsize, char pszOutput)
651	{
652	(pCpu)->pfnReadBytes = CSAMR3ReadBytes;
653	(pCpu)->apvUserData[0] = pVM;
654	(pCpu)->apvUserData[1] = InstrHC;
655	(pCpu)->apvUserData[2] = (void *)InstrGC; Assert(sizeof(InstrGC) <= sizeof(pCpu->apvUserData[0]));
656	#ifdef DEBUG
657	return DISInstrEx(pCpu, InstrGC, 0, pOpsize, pszOutput, OPTYPE_ALL);
658	#else
659	/* We are interested in everything except harmless stuff */
660	return DISInstrEx(pCpu, InstrGC, 0, pOpsize, pszOutput, ~(OPTYPE_INVALID \| OPTYPE_HARMLESS \| OPTYPE_RRM_MASK));
661	#endif
662	}
663
664	/**
665	* Analyses the instructions following the cli for compliance with our heuristics for cli
666	*
667	* @returns VBox status code.
668	* @param pVM The VM to operate on.
669	* @param pCpu CPU disassembly state
670	* @param pInstrGC Guest context pointer to privileged instruction
671	* @param pCurInstrGC Guest context pointer to the current instruction
672	* @param pCacheRec GC to HC cache record
673	* @param pUserData User pointer (callback specific)
674	*
675	*/
676	static int CSAMR3AnalyseCallback(PVM pVM, DISCPUSTATE pCpu, RCPTRTYPE(uint8_t ) pInstrGC, RCPTRTYPE(uint8_t *) pCurInstrGC,
677	PCSAMP2GLOOKUPREC pCacheRec, void *pUserData)
678	{
679	PCSAMPAGE pPage = (PCSAMPAGE)pUserData;
680	int rc;
681
682	switch(pCpu->pCurInstr->opcode)
683	{
684	case OP_INT:
685	Assert(pCpu->param1.flags & USE_IMMEDIATE8);
686	if (pCpu->param1.parval == 3)
687	{
688	//two byte int 3
689	return VINF_SUCCESS;
690	}
691	break;
692
693	case OP_ILLUD2:
694	/* This appears to be some kind of kernel panic in Linux 2.4; no point to continue. */
695	case OP_RETN:
696	case OP_INT3:
697	case OP_INVALID:
698	#if 1
699	/* removing breaks win2k guests? */
700	case OP_IRET:
701	#endif
702	return VINF_SUCCESS;
703	}
704
705	// Check for exit points
706	switch (pCpu->pCurInstr->opcode)
707	{
708	/* It's not a good idea to patch pushf instructions:
709	* - increases the chance of conflicts (code jumping to the next instruction)
710	* - better to patch the cli
711	* - code that branches before the cli will likely hit an int 3
712	* - in general doesn't offer any benefits as we don't allow nested patch blocks (IF is always 1)
713	*/
714	case OP_PUSHF:
715	case OP_POPF:
716	break;
717
718	case OP_CLI:
719	{
720	uint32_t cbInstr = 0;
721	uint32_t opsize = pCpu->opsize;
722
723	PATMR3AddHint(pVM, pCurInstrGC, (pPage->fCode32) ? PATMFL_CODE32 : 0);
724
725	/* Make sure the instructions that follow the cli have not been encountered before. */
726	while (true)
727	{
728	DISCPUSTATE cpu;
729	uint8_t *pCurInstrHC = 0;
730
731	if (cbInstr + opsize >= SIZEOF_NEARJUMP32)
732	break;
733
734	if (csamIsCodeScanned(pVM, pCurInstrGC + opsize, &pPage) == true)
735	{
736	/* We've scanned the next instruction(s) already. This means we've followed a branch that ended up there before -> dangerous!! */
737	PATMR3DetectConflict(pVM, pCurInstrGC, pCurInstrGC + opsize);
738	break;
739	}
740	pCurInstrGC += opsize;
741	cbInstr += opsize;
742
743	pCurInstrHC = (uint8_t *)CSAMGCVirtToHCVirt(pVM, pCacheRec, pCurInstrGC);
744	if (pCurInstrHC == NULL)
745	{
746	Log(("CSAMGCVirtToHCVirt failed for %RRv\n", pCurInstrGC));
747	break;
748	}
749	Assert(VALID_PTR(pCurInstrHC));
750
751	cpu.mode = (pPage->fCode32) ? CPUMODE_32BIT : CPUMODE_16BIT;
752	rc = CSAMR3DISInstr(pVM, &cpu, pCurInstrGC, pCurInstrHC, &opsize, NULL);
753	Assert(RT_SUCCESS(rc));
754	if (RT_FAILURE(rc))
755	break;
756	}
757	break;
758	}
759
760	case OP_PUSH:
761	if (pCpu->pCurInstr->param1 != OP_PARM_REG_CS)
762	break;
763
764	/* no break */
765	case OP_STR:
766	case OP_LSL:
767	case OP_LAR:
768	case OP_SGDT:
769	case OP_SLDT:
770	case OP_SIDT:
771	case OP_SMSW:
772	case OP_VERW:
773	case OP_VERR:
774	case OP_CPUID:
775	case OP_IRET:
776	#ifdef DEBUG
777	switch(pCpu->pCurInstr->opcode)
778	{
779	case OP_STR:
780	Log(("Privileged instruction at %RRv: str!!\n", pCurInstrGC));
781	break;
782	case OP_LSL:
783	Log(("Privileged instruction at %RRv: lsl!!\n", pCurInstrGC));
784	break;
785	case OP_LAR:
786	Log(("Privileged instruction at %RRv: lar!!\n", pCurInstrGC));
787	break;
788	case OP_SGDT:
789	Log(("Privileged instruction at %RRv: sgdt!!\n", pCurInstrGC));
790	break;
791	case OP_SLDT:
792	Log(("Privileged instruction at %RRv: sldt!!\n", pCurInstrGC));
793	break;
794	case OP_SIDT:
795	Log(("Privileged instruction at %RRv: sidt!!\n", pCurInstrGC));
796	break;
797	case OP_SMSW:
798	Log(("Privileged instruction at %RRv: smsw!!\n", pCurInstrGC));
799	break;
800	case OP_VERW:
801	Log(("Privileged instruction at %RRv: verw!!\n", pCurInstrGC));
802	break;
803	case OP_VERR:
804	Log(("Privileged instruction at %RRv: verr!!\n", pCurInstrGC));
805	break;
806	case OP_CPUID:
807	Log(("Privileged instruction at %RRv: cpuid!!\n", pCurInstrGC));
808	break;
809	case OP_PUSH:
810	Log(("Privileged instruction at %RRv: push cs!!\n", pCurInstrGC));
811	break;
812	case OP_IRET:
813	Log(("Privileged instruction at %RRv: iret!!\n", pCurInstrGC));
814	break;
815	}
816	#endif
817
818	if (PATMR3HasBeenPatched(pVM, pCurInstrGC) == false)
819	{
820	rc = PATMR3InstallPatch(pVM, pCurInstrGC, (pPage->fCode32) ? PATMFL_CODE32 : 0);
821	if (RT_FAILURE(rc))
822	{
823	Log(("PATMR3InstallPatch failed with %d\n", rc));
824	return VWRN_CONTINUE_ANALYSIS;
825	}
826	}
827	if (pCpu->pCurInstr->opcode == OP_IRET)
828	return VINF_SUCCESS; /* Look no further in this branch. */
829
830	return VWRN_CONTINUE_ANALYSIS;
831
832	case OP_JMP:
833	case OP_CALL:
834	{
835	// return or jump/call through a jump table
836	if (OP_PARM_VTYPE(pCpu->pCurInstr->param1) != OP_PARM_J)
837	{
838	#ifdef DEBUG
839	switch(pCpu->pCurInstr->opcode)
840	{
841	case OP_JMP:
842	Log(("Control Flow instruction at %RRv: jmp!!\n", pCurInstrGC));
843	break;
844	case OP_CALL:
845	Log(("Control Flow instruction at %RRv: call!!\n", pCurInstrGC));
846	break;
847	}
848	#endif
849	return VWRN_CONTINUE_ANALYSIS;
850	}
851	return VWRN_CONTINUE_ANALYSIS;
852	}
853
854	}
855
856	return VWRN_CONTINUE_ANALYSIS;
857	}
858
859	#ifdef CSAM_ANALYSE_BEYOND_RET
860	/**
861	* Wrapper for csamAnalyseCodeStream for call instructions.
862	*
863	* @returns VBox status code.
864	* @param pVM The VM to operate on.
865	* @param pInstrGC Guest context pointer to privileged instruction
866	* @param pCurInstrGC Guest context pointer to the current instruction
867	* @param fCode32 16 or 32 bits code
868	* @param pfnCSAMR3Analyse Callback for testing the disassembled instruction
869	* @param pUserData User pointer (callback specific)
870	*
871	*/
872	static int csamAnalyseCallCodeStream(PVM pVM, RCPTRTYPE(uint8_t ) pInstrGC, RCPTRTYPE(uint8_t ) pCurInstrGC, bool fCode32,
873	PFN_CSAMR3ANALYSE pfnCSAMR3Analyse, void *pUserData, PCSAMP2GLOOKUPREC pCacheRec)
874	{
875	int rc;
876	CSAMCALLEXITREC CallExitRec;
877	PCSAMCALLEXITREC pOldCallRec;
878	PCSAMPAGE pPage = 0;
879	uint32_t i;
880
881	CallExitRec.cInstrAfterRet = 0;
882
883	pOldCallRec = pCacheRec->pCallExitRec;
884	pCacheRec->pCallExitRec = &CallExitRec;
885
886	rc = csamAnalyseCodeStream(pVM, pInstrGC, pCurInstrGC, fCode32, pfnCSAMR3Analyse, pUserData, pCacheRec);
887
888	for (i=0;i<CallExitRec.cInstrAfterRet;i++)
889	{
890	PCSAMPAGE pPage = 0;
891
892	pCurInstrGC = CallExitRec.pInstrAfterRetGC[i];
893
894	/* Check if we've previously encountered the instruction after the ret. */
895	if (csamIsCodeScanned(pVM, pCurInstrGC, &pPage) == false)
896	{
897	DISCPUSTATE cpu;
898	uint32_t opsize;
899	uint8_t *pCurInstrHC = 0;
900	int rc2;
901	#ifdef DEBUG
902	char szOutput[256];
903	#endif
904	if (pPage == NULL)
905	{
906	/* New address; let's take a look at it. */
907	pPage = csamCreatePageRecord(pVM, pCurInstrGC, CSAM_TAG_CSAM, fCode32);
908	if (pPage == NULL)
909	{
910	rc = VERR_NO_MEMORY;
911	goto done;
912	}
913	}
914
915	/**
916	* Some generic requirements for recognizing an adjacent function:
917	* - alignment fillers that consist of:
918	* - nop
919	* - lea genregX, [genregX (+ 0)]
920	* - push ebp after the filler (can extend this later); aligned at at least a 4 byte boundary
921	*/
922	for (int j=0;j<16;j++)
923	{
924	pCurInstrHC = (uint8_t *)CSAMGCVirtToHCVirt(pVM, pCacheRec, pCurInstrGC);
925	if (pCurInstrHC == NULL)
926	{
927	Log(("CSAMGCVirtToHCVirt failed for %RRv\n", pCurInstrGC));
928	goto done;
929	}
930	Assert(VALID_PTR(pCurInstrHC));
931
932	cpu.mode = (fCode32) ? CPUMODE_32BIT : CPUMODE_16BIT;
933	STAM_PROFILE_START(&pVM->csam.s.StatTimeDisasm, a);
934	#ifdef DEBUG
935	rc2 = CSAMR3DISInstr(pVM, &cpu, pCurInstrGC, pCurInstrHC, &opsize, szOutput);
936	if (RT_SUCCESS(rc2)) Log(("CSAM Call Analysis: %s", szOutput));
937	#else
938	rc2 = CSAMR3DISInstr(pVM, &cpu, pCurInstrGC, pCurInstrHC, &opsize, NULL);
939	#endif
940	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeDisasm, a);
941	if (RT_FAILURE(rc2))
942	{
943	Log(("Disassembly failed at %RRv with %Rrc (probably page not present) -> return to caller\n", pCurInstrGC, rc2));
944	goto done;
945	}
946
947	STAM_COUNTER_ADD(&pVM->csam.s.StatNrBytesRead, opsize);
948
949	RCPTRTYPE(uint8_t *) addr = 0;
950	PCSAMPAGE pJmpPage = NULL;
951
952	if (PAGE_ADDRESS(pCurInstrGC) != PAGE_ADDRESS(pCurInstrGC + opsize - 1))
953	{
954	if (!PGMGstIsPagePresent(pVM, pCurInstrGC + opsize - 1))
955	{
956	/// @todo fault in the page
957	Log(("Page for current instruction %RRv is not present!!\n", pCurInstrGC));
958	goto done;
959	}
960	//all is fine, let's continue
961	csamR3CheckPageRecord(pVM, pCurInstrGC + opsize - 1);
962	}
963
964	switch (cpu.pCurInstr->opcode)
965	{
966	case OP_NOP:
967	case OP_INT3:
968	break; /* acceptable */
969
970	case OP_LEA:
971	/* Must be similar to:
972	*
973	* lea esi, [esi]
974	* lea esi, [esi+0]
975	* Any register is allowed as long as source and destination are identical.
976	*/
977	if ( cpu.param1.flags != USE_REG_GEN32
978	\|\| ( cpu.param2.flags != USE_REG_GEN32
979	&& ( !(cpu.param2.flags & USE_REG_GEN32)
980	\|\| !(cpu.param2.flags & (USE_DISPLACEMENT8\|USE_DISPLACEMENT16\|USE_DISPLACEMENT32))
981	\|\| cpu.param2.parval != 0
982	)
983	)
984	\|\| cpu.param1.base.reg_gen32 != cpu.param2.base.reg_gen32
985	)
986	{
987	STAM_COUNTER_INC(&pVM->csam.s.StatScanNextFunctionFailed);
988	goto next_function;
989	}
990	break;
991
992	case OP_PUSH:
993	{
994	if ( (pCurInstrGC & 0x3) != 0
995	\|\| cpu.param1.flags != USE_REG_GEN32
996	\|\| cpu.param1.base.reg_gen32 != USE_REG_EBP
997	)
998	{
999	STAM_COUNTER_INC(&pVM->csam.s.StatScanNextFunctionFailed);
1000	goto next_function;
1001	}
1002
1003	if (csamIsCodeScanned(pVM, pCurInstrGC, &pPage) == false)
1004	{
1005	CSAMCALLEXITREC CallExitRec2;
1006	CallExitRec2.cInstrAfterRet = 0;
1007
1008	pCacheRec->pCallExitRec = &CallExitRec2;
1009
1010	/* Analyse the function. */
1011	Log(("Found new function at %RRv\n", pCurInstrGC));
1012	STAM_COUNTER_INC(&pVM->csam.s.StatScanNextFunction);
1013	csamAnalyseCallCodeStream(pVM, pInstrGC, pCurInstrGC, fCode32, pfnCSAMR3Analyse, pUserData, pCacheRec);
1014	}
1015	goto next_function;
1016	}
1017
1018	case OP_SUB:
1019	{
1020	if ( (pCurInstrGC & 0x3) != 0
1021	\|\| cpu.param1.flags != USE_REG_GEN32
1022	\|\| cpu.param1.base.reg_gen32 != USE_REG_ESP
1023	)
1024	{
1025	STAM_COUNTER_INC(&pVM->csam.s.StatScanNextFunctionFailed);
1026	goto next_function;
1027	}
1028
1029	if (csamIsCodeScanned(pVM, pCurInstrGC, &pPage) == false)
1030	{
1031	CSAMCALLEXITREC CallExitRec2;
1032	CallExitRec2.cInstrAfterRet = 0;
1033
1034	pCacheRec->pCallExitRec = &CallExitRec2;
1035
1036	/* Analyse the function. */
1037	Log(("Found new function at %RRv\n", pCurInstrGC));
1038	STAM_COUNTER_INC(&pVM->csam.s.StatScanNextFunction);
1039	csamAnalyseCallCodeStream(pVM, pInstrGC, pCurInstrGC, fCode32, pfnCSAMR3Analyse, pUserData, pCacheRec);
1040	}
1041	goto next_function;
1042	}
1043
1044	default:
1045	STAM_COUNTER_INC(&pVM->csam.s.StatScanNextFunctionFailed);
1046	goto next_function;
1047	}
1048	/* Mark it as scanned. */
1049	csamMarkCode(pVM, pPage, pCurInstrGC, opsize, true);
1050	pCurInstrGC += opsize;
1051	} /* for at most 16 instructions */
1052	next_function:
1053	; /* MSVC complains otherwise */
1054	}
1055	}
1056	done:
1057	pCacheRec->pCallExitRec = pOldCallRec;
1058	return rc;
1059	}
1060	#else
1061	#define csamAnalyseCallCodeStream csamAnalyseCodeStream
1062	#endif
1063
1064	/**
1065	* Disassembles the code stream until the callback function detects a failure or decides everything is acceptable
1066	*
1067	* @returns VBox status code.
1068	* @param pVM The VM to operate on.
1069	* @param pInstrGC Guest context pointer to privileged instruction
1070	* @param pCurInstrGC Guest context pointer to the current instruction
1071	* @param fCode32 16 or 32 bits code
1072	* @param pfnCSAMR3Analyse Callback for testing the disassembled instruction
1073	* @param pUserData User pointer (callback specific)
1074	*
1075	*/
1076	static int csamAnalyseCodeStream(PVM pVM, RCPTRTYPE(uint8_t ) pInstrGC, RCPTRTYPE(uint8_t ) pCurInstrGC, bool fCode32,
1077	PFN_CSAMR3ANALYSE pfnCSAMR3Analyse, void *pUserData, PCSAMP2GLOOKUPREC pCacheRec)
1078	{
1079	DISCPUSTATE cpu;
1080	PCSAMPAGE pPage = (PCSAMPAGE)pUserData;
1081	int rc = VWRN_CONTINUE_ANALYSIS;
1082	uint32_t opsize;
1083	R3PTRTYPE(uint8_t *) pCurInstrHC = 0;
1084	int rc2;
1085	Assert(pVM->cCPUs == 1);
1086	PVMCPU pVCpu = VMMGetCpu0(pVM);
1087
1088	#ifdef DEBUG
1089	char szOutput[256];
1090	#endif
1091
1092	LogFlow(("csamAnalyseCodeStream: code at %RRv depth=%d\n", pCurInstrGC, pCacheRec->depth));
1093
1094	pVM->csam.s.fScanningStarted = true;
1095
1096	pCacheRec->depth++;
1097	/*
1098	* Limit the call depth. (rather arbitrary upper limit; too low and we won't detect certain
1099	* cpuid instructions in Linux kernels; too high and we waste too much time scanning code)
1100	* (512 is necessary to detect cpuid instructions in Red Hat EL4; see defect 1355)
1101	* @note we are using a lot of stack here. couple of 100k when we go to the full depth (!)
1102	*/
1103	if (pCacheRec->depth > 512)
1104	{
1105	LogFlow(("CSAM: maximum calldepth reached for %RRv\n", pCurInstrGC));
1106	pCacheRec->depth--;
1107	return VINF_SUCCESS; //let's not go on forever
1108	}
1109
1110	Assert(!PATMIsPatchGCAddr(pVM, pCurInstrGC));
1111	csamR3CheckPageRecord(pVM, pCurInstrGC);
1112
1113	while(rc == VWRN_CONTINUE_ANALYSIS)
1114	{
1115	if (csamIsCodeScanned(pVM, pCurInstrGC, &pPage) == false)
1116	{
1117	if (pPage == NULL)
1118	{
1119	/* New address; let's take a look at it. */
1120	pPage = csamCreatePageRecord(pVM, pCurInstrGC, CSAM_TAG_CSAM, fCode32);
1121	if (pPage == NULL)
1122	{
1123	rc = VERR_NO_MEMORY;
1124	goto done;
1125	}
1126	}
1127	}
1128	else
1129	{
1130	LogFlow(("Code at %RRv has been scanned before\n", pCurInstrGC));
1131	rc = VINF_SUCCESS;
1132	goto done;
1133	}
1134
1135	pCurInstrHC = (uint8_t *)CSAMGCVirtToHCVirt(pVM, pCacheRec, pCurInstrGC);
1136	if (pCurInstrHC == NULL)
1137	{
1138	Log(("CSAMGCVirtToHCVirt failed for %RRv\n", pCurInstrGC));
1139	rc = VERR_PATCHING_REFUSED;
1140	goto done;
1141	}
1142	Assert(VALID_PTR(pCurInstrHC));
1143
1144	cpu.mode = (fCode32) ? CPUMODE_32BIT : CPUMODE_16BIT;
1145	STAM_PROFILE_START(&pVM->csam.s.StatTimeDisasm, a);
1146	#ifdef DEBUG
1147	rc2 = CSAMR3DISInstr(pVM, &cpu, pCurInstrGC, pCurInstrHC, &opsize, szOutput);
1148	if (RT_SUCCESS(rc2)) Log(("CSAM Analysis: %s", szOutput));
1149	#else
1150	rc2 = CSAMR3DISInstr(pVM, &cpu, pCurInstrGC, pCurInstrHC, &opsize, NULL);
1151	#endif
1152	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeDisasm, a);
1153	if (RT_FAILURE(rc2))
1154	{
1155	Log(("Disassembly failed at %RRv with %Rrc (probably page not present) -> return to caller\n", pCurInstrGC, rc2));
1156	rc = VINF_SUCCESS;
1157	goto done;
1158	}
1159
1160	STAM_COUNTER_ADD(&pVM->csam.s.StatNrBytesRead, opsize);
1161
1162	csamMarkCode(pVM, pPage, pCurInstrGC, opsize, true);
1163
1164	RCPTRTYPE(uint8_t *) addr = 0;
1165	PCSAMPAGE pJmpPage = NULL;
1166
1167	if (PAGE_ADDRESS(pCurInstrGC) != PAGE_ADDRESS(pCurInstrGC + opsize - 1))
1168	{
1169	if (!PGMGstIsPagePresent(pVM, pVCpu, pCurInstrGC + opsize - 1))
1170	{
1171	/// @todo fault in the page
1172	Log(("Page for current instruction %RRv is not present!!\n", pCurInstrGC));
1173	rc = VWRN_CONTINUE_ANALYSIS;
1174	goto next_please;
1175	}
1176	//all is fine, let's continue
1177	csamR3CheckPageRecord(pVM, pCurInstrGC + opsize - 1);
1178	}
1179	/*
1180	* If it's harmless, then don't bother checking it (the disasm tables had better be accurate!)
1181	*/
1182	if ((cpu.pCurInstr->optype & ~OPTYPE_RRM_MASK) == OPTYPE_HARMLESS)
1183	{
1184	AssertMsg(pfnCSAMR3Analyse(pVM, &cpu, pInstrGC, pCurInstrGC, pCacheRec, (void *)pPage) == VWRN_CONTINUE_ANALYSIS, ("Instruction incorrectly marked harmless?!?!?\n"));
1185	rc = VWRN_CONTINUE_ANALYSIS;
1186	goto next_please;
1187	}
1188
1189	#ifdef CSAM_ANALYSE_BEYOND_RET
1190	/* Remember the address of the instruction following the ret in case the parent instruction was a call. */
1191	if ( pCacheRec->pCallExitRec
1192	&& cpu.pCurInstr->opcode == OP_RETN
1193	&& pCacheRec->pCallExitRec->cInstrAfterRet < CSAM_MAX_CALLEXIT_RET)
1194	{
1195	pCacheRec->pCallExitRec->pInstrAfterRetGC[pCacheRec->pCallExitRec->cInstrAfterRet] = pCurInstrGC + opsize;
1196	pCacheRec->pCallExitRec->cInstrAfterRet++;
1197	}
1198	#endif
1199
1200	rc = pfnCSAMR3Analyse(pVM, &cpu, pInstrGC, pCurInstrGC, pCacheRec, (void *)pPage);
1201	if (rc == VINF_SUCCESS)
1202	goto done;
1203
1204	// For our first attempt, we'll handle only simple relative jumps and calls (immediate offset coded in instruction)
1205	if ( ((cpu.pCurInstr->optype & OPTYPE_CONTROLFLOW) && (OP_PARM_VTYPE(cpu.pCurInstr->param1) == OP_PARM_J))
1206	\|\| (cpu.pCurInstr->opcode == OP_CALL && cpu.param1.flags == USE_DISPLACEMENT32)) /* simple indirect call (call dword ptr [address]) */
1207	{
1208	/* We need to parse 'call dword ptr [address]' type of calls to catch cpuid instructions in some recent Linux distributions (e.g. OpenSuse 10.3) */
1209	if ( cpu.pCurInstr->opcode == OP_CALL
1210	&& cpu.param1.flags == USE_DISPLACEMENT32)
1211	{
1212	addr = 0;
1213	PGMPhysSimpleReadGCPtr(pVCpu, &addr, (RTRCUINTPTR)cpu.param1.disp32, sizeof(addr));
1214	}
1215	else
1216	addr = CSAMResolveBranch(&cpu, pCurInstrGC);
1217
1218	if (addr == 0)
1219	{
1220	Log(("We don't support far jumps here!! (%08X)\n", cpu.param1.flags));
1221	rc = VINF_SUCCESS;
1222	break;
1223	}
1224	Assert(!PATMIsPatchGCAddr(pVM, addr));
1225
1226	/* If the target address lies in a patch generated jump, then special action needs to be taken. */
1227	PATMR3DetectConflict(pVM, pCurInstrGC, addr);
1228
1229	/* Same page? */
1230	if (PAGE_ADDRESS(addr) != PAGE_ADDRESS(pCurInstrGC ))
1231	{
1232	if (!PGMGstIsPagePresent(pVM, pVCpu, addr))
1233	{
1234	Log(("Page for current instruction %RRv is not present!!\n", addr));
1235	rc = VWRN_CONTINUE_ANALYSIS;
1236	goto next_please;
1237	}
1238
1239	/* All is fine, let's continue. */
1240	csamR3CheckPageRecord(pVM, addr);
1241	}
1242
1243	pJmpPage = NULL;
1244	if (csamIsCodeScanned(pVM, addr, &pJmpPage) == false)
1245	{
1246	if (pJmpPage == NULL)
1247	{
1248	/* New branch target; let's take a look at it. */
1249	pJmpPage = csamCreatePageRecord(pVM, addr, CSAM_TAG_CSAM, fCode32);
1250	if (pJmpPage == NULL)
1251	{
1252	rc = VERR_NO_MEMORY;
1253	goto done;
1254	}
1255	Assert(pPage);
1256	}
1257	if (cpu.pCurInstr->opcode == OP_CALL)
1258	rc = csamAnalyseCallCodeStream(pVM, pInstrGC, addr, fCode32, pfnCSAMR3Analyse, (void *)pJmpPage, pCacheRec);
1259	else
1260	rc = csamAnalyseCodeStream(pVM, pInstrGC, addr, fCode32, pfnCSAMR3Analyse, (void *)pJmpPage, pCacheRec);
1261
1262	if (rc != VINF_SUCCESS) {
1263	goto done;
1264	}
1265	}
1266	if (cpu.pCurInstr->opcode == OP_JMP)
1267	{//unconditional jump; return to caller
1268	rc = VINF_SUCCESS;
1269	goto done;
1270	}
1271
1272	rc = VWRN_CONTINUE_ANALYSIS;
1273	} //if ((cpu.pCurInstr->optype & OPTYPE_CONTROLFLOW) && (OP_PARM_VTYPE(cpu.pCurInstr->param1) == OP_PARM_J))
1274	#ifdef CSAM_SCAN_JUMP_TABLE
1275	else
1276	if ( cpu.pCurInstr->opcode == OP_JMP
1277	&& (cpu.param1.flags & (USE_DISPLACEMENT32\|USE_INDEX\|USE_SCALE)) == (USE_DISPLACEMENT32\|USE_INDEX\|USE_SCALE)
1278	)
1279	{
1280	RTRCPTR pJumpTableGC = (RTRCPTR)cpu.param1.disp32;
1281	uint8_t *pJumpTableHC;
1282	int rc2;
1283
1284	Log(("Jump through jump table\n"));
1285
1286	rc2 = PGMPhysGCPtr2R3Ptr(pVCpu, pJumpTableGC, (PRTHCPTR)&pJumpTableHC);
1287	if (rc2 == VINF_SUCCESS)
1288	{
1289	for (uint32_t i=0;i<2;i++)
1290	{
1291	uint64_t fFlags;
1292
1293	addr = pJumpTableGC + cpu.param1.scale * i;
1294	/* Same page? */
1295	if (PAGE_ADDRESS(addr) != PAGE_ADDRESS(pJumpTableGC))
1296	break;
1297
1298	addr = (RTRCPTR )(pJumpTableHC + cpu.param1.scale * i);
1299
1300	rc2 = PGMGstGetPage(pVM, pVCpu, addr, &fFlags, NULL);
1301	if ( rc2 != VINF_SUCCESS
1302	\|\| (fFlags & X86_PTE_US)
1303	\|\| !(fFlags & X86_PTE_P)
1304	)
1305	break;
1306
1307	Log(("Jump to %RRv\n", addr));
1308
1309	pJmpPage = NULL;
1310	if (csamIsCodeScanned(pVM, addr, &pJmpPage) == false)
1311	{
1312	if (pJmpPage == NULL)
1313	{
1314	/* New branch target; let's take a look at it. */
1315	pJmpPage = csamCreatePageRecord(pVM, addr, CSAM_TAG_CSAM, fCode32);
1316	if (pJmpPage == NULL)
1317	{
1318	rc = VERR_NO_MEMORY;
1319	goto done;
1320	}
1321	Assert(pPage);
1322	}
1323	rc = csamAnalyseCodeStream(pVM, pInstrGC, addr, fCode32, pfnCSAMR3Analyse, (void *)pJmpPage, pCacheRec);
1324	if (rc != VINF_SUCCESS) {
1325	goto done;
1326	}
1327	}
1328	}
1329	}
1330	}
1331	#endif
1332	if (rc != VWRN_CONTINUE_ANALYSIS) {
1333	break; //done!
1334	}
1335	next_please:
1336	if (cpu.pCurInstr->opcode == OP_JMP)
1337	{
1338	rc = VINF_SUCCESS;
1339	goto done;
1340	}
1341	pCurInstrGC += opsize;
1342	}
1343	done:
1344	pCacheRec->depth--;
1345	return rc;
1346	}
1347
1348
1349	/**
1350	* Calculates the 64 bits hash value for the current page
1351	*
1352	* @returns hash value
1353	* @param pVM The VM to operate on.
1354	* @param pInstr Page address
1355	*/
1356	uint64_t csamR3CalcPageHash(PVM pVM, RTRCPTR pInstr)
1357	{
1358	uint64_t hash = 0;
1359	uint32_t val[5];
1360	int rc;
1361	Assert(pVM->cCPUs == 1);
1362	PVMCPU pVCpu = VMMGetCpu0(pVM);
1363
1364	Assert((pInstr & PAGE_OFFSET_MASK) == 0);
1365
1366	rc = PGMPhysSimpleReadGCPtr(pVCpu, &val[0], pInstr, sizeof(val[0]));
1367	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
1368	if (rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT)
1369	{
1370	Log(("csamR3CalcPageHash: page %RRv not present!!\n", pInstr));
1371	return ~0ULL;
1372	}
1373
1374	rc = PGMPhysSimpleReadGCPtr(pVCpu, &val[1], pInstr+1024, sizeof(val[0]));
1375	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
1376	if (rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT)
1377	{
1378	Log(("csamR3CalcPageHash: page %RRv not present!!\n", pInstr));
1379	return ~0ULL;
1380	}
1381
1382	rc = PGMPhysSimpleReadGCPtr(pVCpu, &val[2], pInstr+2048, sizeof(val[0]));
1383	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
1384	if (rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT)
1385	{
1386	Log(("csamR3CalcPageHash: page %RRv not present!!\n", pInstr));
1387	return ~0ULL;
1388	}
1389
1390	rc = PGMPhysSimpleReadGCPtr(pVCpu, &val[3], pInstr+3072, sizeof(val[0]));
1391	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
1392	if (rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT)
1393	{
1394	Log(("csamR3CalcPageHash: page %RRv not present!!\n", pInstr));
1395	return ~0ULL;
1396	}
1397
1398	rc = PGMPhysSimpleReadGCPtr(pVCpu, &val[4], pInstr+4092, sizeof(val[0]));
1399	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
1400	if (rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT)
1401	{
1402	Log(("csamR3CalcPageHash: page %RRv not present!!\n", pInstr));
1403	return ~0ULL;
1404	}
1405
1406	// don't want to get division by zero traps
1407	val[2] \|= 1;
1408	val[4] \|= 1;
1409
1410	hash = (uint64_t)val[0] * (uint64_t)val[1] / (uint64_t)val[2] + (val[3]%val[4]);
1411	return (hash == ~0ULL) ? hash - 1 : hash;
1412	}
1413
1414
1415	/**
1416	* Notify CSAM of a page flush
1417	*
1418	* @returns VBox status code
1419	* @param pVM The VM to operate on.
1420	* @param addr GC address of the page to flush
1421	* @param fRemovePage Page removal flag
1422	*/
1423	static int csamFlushPage(PVM pVM, RTRCPTR addr, bool fRemovePage)
1424	{
1425	PCSAMPAGEREC pPageRec;
1426	int rc;
1427	RTGCPHYS GCPhys = 0;
1428	uint64_t fFlags = 0;
1429	Assert(pVM->cCPUs == 1);
1430	PVMCPU pVCpu = VMMGetCpu0(pVM);
1431
1432	if (!CSAMIsEnabled(pVM))
1433	return VINF_SUCCESS;
1434
1435	STAM_PROFILE_START(&pVM->csam.s.StatTimeFlushPage, a);
1436
1437	addr = addr & PAGE_BASE_GC_MASK;
1438
1439	/*
1440	* Note: searching for the page in our tree first is more expensive (skipped flushes are two orders of magnitude more common)
1441	*/
1442	if (pVM->csam.s.pPageTree == NULL)
1443	{
1444	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeFlushPage, a);
1445	return VWRN_CSAM_PAGE_NOT_FOUND;
1446	}
1447
1448	rc = PGMGstGetPage(pVM, pVCpu, addr, &fFlags, &GCPhys);
1449	/* Returned at a very early stage (no paging yet presumably). */
1450	if (rc == VERR_NOT_SUPPORTED)
1451	{
1452	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeFlushPage, a);
1453	return rc;
1454	}
1455
1456	if (RT_SUCCESS(rc))
1457	{
1458	if ( (fFlags & X86_PTE_US)
1459	\|\| rc == VERR_PGM_PHYS_PAGE_RESERVED
1460	)
1461	{
1462	/* User page -> not relevant for us. */
1463	STAM_COUNTER_ADD(&pVM->csam.s.StatNrFlushesSkipped, 1);
1464	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeFlushPage, a);
1465	return VINF_SUCCESS;
1466	}
1467	}
1468	else
1469	if (rc != VERR_PAGE_NOT_PRESENT && rc != VERR_PAGE_TABLE_NOT_PRESENT)
1470	AssertMsgFailed(("PGMR3GetPage %RRv failed with %Rrc\n", addr, rc));
1471
1472	pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)addr);
1473	if (pPageRec)
1474	{
1475	if ( GCPhys == pPageRec->page.GCPhys
1476	&& (fFlags & X86_PTE_P))
1477	{
1478	STAM_COUNTER_ADD(&pVM->csam.s.StatNrFlushesSkipped, 1);
1479	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeFlushPage, a);
1480	return VINF_SUCCESS;
1481	}
1482
1483	Log(("CSAMR3FlushPage: page %RRv has changed -> FLUSH (rc=%Rrc) (Phys: %RGp vs %RGp)\n", addr, rc, GCPhys, pPageRec->page.GCPhys));
1484
1485	STAM_COUNTER_ADD(&pVM->csam.s.StatNrFlushes, 1);
1486
1487	if (fRemovePage)
1488	csamRemovePageRecord(pVM, addr);
1489	else
1490	{
1491	CSAMMarkPage(pVM, addr, false);
1492	pPageRec->page.GCPhys = 0;
1493	pPageRec->page.fFlags = 0;
1494	rc = PGMGstGetPage(pVM, pVCpu, addr, &pPageRec->page.fFlags, &pPageRec->page.GCPhys);
1495	if (rc == VINF_SUCCESS)
1496	pPageRec->page.u64Hash = csamR3CalcPageHash(pVM, addr);
1497
1498	if (pPageRec->page.pBitmap == NULL)
1499	{
1500	pPageRec->page.pBitmap = (uint8_t *)MMR3HeapAllocZ(pVM, MM_TAG_CSAM_PATCH, CSAM_PAGE_BITMAP_SIZE);
1501	Assert(pPageRec->page.pBitmap);
1502	if (pPageRec->page.pBitmap == NULL)
1503	return VERR_NO_MEMORY;
1504	}
1505	else
1506	memset(pPageRec->page.pBitmap, 0, CSAM_PAGE_BITMAP_SIZE);
1507	}
1508
1509
1510	/*
1511	* Inform patch manager about the flush; no need to repeat the above check twice.
1512	*/
1513	PATMR3FlushPage(pVM, addr);
1514
1515	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeFlushPage, a);
1516	return VINF_SUCCESS;
1517	}
1518	else
1519	{
1520	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeFlushPage, a);
1521	return VWRN_CSAM_PAGE_NOT_FOUND;
1522	}
1523	}
1524
1525	/**
1526	* Notify CSAM of a page flush
1527	*
1528	* @returns VBox status code
1529	* @param pVM The VM to operate on.
1530	* @param addr GC address of the page to flush
1531	*/
1532	VMMR3DECL(int) CSAMR3FlushPage(PVM pVM, RTRCPTR addr)
1533	{
1534	return csamFlushPage(pVM, addr, true /* remove page record */);
1535	}
1536
1537	/**
1538	* Remove a CSAM monitored page. Use with care!
1539	*
1540	* @returns VBox status code
1541	* @param pVM The VM to operate on.
1542	* @param addr GC address of the page to flush
1543	*/
1544	VMMR3DECL(int) CSAMR3RemovePage(PVM pVM, RTRCPTR addr)
1545	{
1546	PCSAMPAGEREC pPageRec;
1547	int rc;
1548
1549	addr = addr & PAGE_BASE_GC_MASK;
1550
1551	pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)addr);
1552	if (pPageRec)
1553	{
1554	rc = csamRemovePageRecord(pVM, addr);
1555	if (RT_SUCCESS(rc))
1556	PATMR3FlushPage(pVM, addr);
1557	return VINF_SUCCESS;
1558	}
1559	return VWRN_CSAM_PAGE_NOT_FOUND;
1560	}
1561
1562	/**
1563	* Check a page record in case a page has been changed
1564	*
1565	* @returns VBox status code. (trap handled or not)
1566	* @param pVM The VM to operate on.
1567	* @param pInstrGC GC instruction pointer
1568	*/
1569	int csamR3CheckPageRecord(PVM pVM, RTRCPTR pInstrGC)
1570	{
1571	PCSAMPAGEREC pPageRec;
1572	uint64_t u64hash;
1573
1574	pInstrGC = pInstrGC & PAGE_BASE_GC_MASK;
1575
1576	pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)pInstrGC);
1577	if (pPageRec)
1578	{
1579	u64hash = csamR3CalcPageHash(pVM, pInstrGC);
1580	if (u64hash != pPageRec->page.u64Hash)
1581	csamFlushPage(pVM, pInstrGC, false /* don't remove page record */);
1582	}
1583	else
1584	return VWRN_CSAM_PAGE_NOT_FOUND;
1585
1586	return VINF_SUCCESS;
1587	}
1588
1589	/**
1590	* Returns monitor description based on CSAM tag
1591	*
1592	* @return description string
1593	* @param enmTag Owner tag
1594	*/
1595	const char *csamGetMonitorDescription(CSAMTAG enmTag)
1596	{
1597	if (enmTag == CSAM_TAG_PATM)
1598	return "CSAM-PATM self-modifying code monitor handler";
1599	else
1600	if (enmTag == CSAM_TAG_REM)
1601	return "CSAM-REM self-modifying code monitor handler";
1602	Assert(enmTag == CSAM_TAG_CSAM);
1603	return "CSAM self-modifying code monitor handler";
1604	}
1605
1606	/**
1607	* Adds page record to our lookup tree
1608	*
1609	* @returns CSAMPAGE ptr or NULL if failure
1610	* @param pVM The VM to operate on.
1611	* @param GCPtr Page address
1612	* @param enmTag Owner tag
1613	* @param fCode32 16 or 32 bits code
1614	* @param fMonitorInvalidation Monitor page invalidation flag
1615	*/
1616	static PCSAMPAGE csamCreatePageRecord(PVM pVM, RTRCPTR GCPtr, CSAMTAG enmTag, bool fCode32, bool fMonitorInvalidation)
1617	{
1618	PCSAMPAGEREC pPage;
1619	int rc;
1620	bool ret;
1621	Assert(pVM->cCPUs == 1);
1622	PVMCPU pVCpu = VMMGetCpu0(pVM);
1623
1624	Log(("New page record for %RRv\n", GCPtr & PAGE_BASE_GC_MASK));
1625
1626	pPage = (PCSAMPAGEREC)MMR3HeapAllocZ(pVM, MM_TAG_CSAM_PATCH, sizeof(CSAMPAGEREC));
1627	if (pPage == NULL)
1628	{
1629	AssertMsgFailed(("csamCreatePageRecord: Out of memory!!!!\n"));
1630	return NULL;
1631	}
1632	/* Round down to page boundary. */
1633	GCPtr = (GCPtr & PAGE_BASE_GC_MASK);
1634	pPage->Core.Key = (AVLPVKEY)GCPtr;
1635	pPage->page.pPageGC = GCPtr;
1636	pPage->page.fCode32 = fCode32;
1637	pPage->page.fMonitorInvalidation = fMonitorInvalidation;
1638	pPage->page.enmTag = enmTag;
1639	pPage->page.fMonitorActive = false;
1640	pPage->page.pBitmap = (uint8_t *)MMR3HeapAllocZ(pVM, MM_TAG_CSAM_PATCH, PAGE_SIZE/sizeof(uint8_t));
1641	rc = PGMGstGetPage(pVM, pVCpu, GCPtr, &pPage->page.fFlags, &pPage->page.GCPhys);
1642	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
1643
1644	pPage->page.u64Hash = csamR3CalcPageHash(pVM, GCPtr);
1645	ret = RTAvlPVInsert(&pVM->csam.s.pPageTree, &pPage->Core);
1646	Assert(ret);
1647
1648	#ifdef CSAM_MONITOR_CODE_PAGES
1649	AssertRelease(!fInCSAMCodePageInvalidate);
1650
1651	switch (enmTag)
1652	{
1653	case CSAM_TAG_PATM:
1654	case CSAM_TAG_REM:
1655	#ifdef CSAM_MONITOR_CSAM_CODE_PAGES
1656	case CSAM_TAG_CSAM:
1657	#endif
1658	{
1659	int rc = PGMR3HandlerVirtualRegister(pVM, PGMVIRTHANDLERTYPE_WRITE, GCPtr, GCPtr + (PAGE_SIZE - 1) /* inclusive! */,
1660	(fMonitorInvalidation) ? CSAMCodePageInvalidate : 0, CSAMCodePageWriteHandler, "CSAMGCCodePageWriteHandler", 0,
1661	csamGetMonitorDescription(enmTag));
1662	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PGM_HANDLER_VIRTUAL_CONFLICT, ("PGMR3HandlerVirtualRegisterEx %RRv failed with %Rrc\n", GCPtr, rc));
1663	if (RT_FAILURE(rc))
1664	Log(("PGMR3HandlerVirtualRegisterEx for %RRv failed with %Rrc\n", GCPtr, rc));
1665
1666	/* Could fail, because it's already monitored. Don't treat that condition as fatal. */
1667
1668	/* Prefetch it in case it's not there yet. */
1669	rc = PGMPrefetchPage(pVM, pVCpu, GCPtr);
1670	AssertRC(rc);
1671
1672	rc = PGMShwModifyPage(pVM, pVCpu, GCPtr, 1, 0, ~(uint64_t)X86_PTE_RW);
1673	Assert(rc == VINF_SUCCESS \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT);
1674
1675	pPage->page.fMonitorActive = true;
1676	STAM_COUNTER_INC(&pVM->csam.s.StatPageMonitor);
1677	break;
1678	}
1679	default:
1680	break; /* to shut up GCC */
1681	}
1682
1683	Log(("csamCreatePageRecord %RRv GCPhys=%RGp\n", GCPtr, pPage->page.GCPhys));
1684
1685	#ifdef VBOX_WITH_STATISTICS
1686	switch (enmTag)
1687	{
1688	case CSAM_TAG_CSAM:
1689	STAM_COUNTER_INC(&pVM->csam.s.StatPageCSAM);
1690	break;
1691	case CSAM_TAG_PATM:
1692	STAM_COUNTER_INC(&pVM->csam.s.StatPagePATM);
1693	break;
1694	case CSAM_TAG_REM:
1695	STAM_COUNTER_INC(&pVM->csam.s.StatPageREM);
1696	break;
1697	default:
1698	break; /* to shut up GCC */
1699	}
1700	#endif
1701
1702	#endif
1703
1704	STAM_COUNTER_INC(&pVM->csam.s.StatNrPages);
1705	if (fMonitorInvalidation)
1706	STAM_COUNTER_INC(&pVM->csam.s.StatNrPagesInv);
1707
1708	return &pPage->page;
1709	}
1710
1711	/**
1712	* Monitors a code page (if not already monitored)
1713	*
1714	* @returns VBox status code
1715	* @param pVM The VM to operate on.
1716	* @param pPageAddrGC The page to monitor
1717	* @param enmTag Monitor tag
1718	*/
1719	VMMR3DECL(int) CSAMR3MonitorPage(PVM pVM, RTRCPTR pPageAddrGC, CSAMTAG enmTag)
1720	{
1721	PCSAMPAGEREC pPageRec = NULL;
1722	int rc;
1723	bool fMonitorInvalidation;
1724	Assert(pVM->cCPUs == 1);
1725	PVMCPU pVCpu = VMMGetCpu0(pVM);
1726
1727	/* Dirty pages must be handled before calling this function!. */
1728	Assert(!pVM->csam.s.cDirtyPages);
1729
1730	if (pVM->csam.s.fScanningStarted == false)
1731	return VINF_SUCCESS; /* too early */
1732
1733	pPageAddrGC &= PAGE_BASE_GC_MASK;
1734
1735	Log(("CSAMR3MonitorPage %RRv %d\n", pPageAddrGC, enmTag));
1736
1737	/** @todo implicit assumption */
1738	fMonitorInvalidation = (enmTag == CSAM_TAG_PATM);
1739
1740	pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)pPageAddrGC);
1741	if (pPageRec == NULL)
1742	{
1743	uint64_t fFlags;
1744
1745	rc = PGMGstGetPage(pVM, pVCpu, pPageAddrGC, &fFlags, NULL);
1746	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
1747	if ( rc == VINF_SUCCESS
1748	&& (fFlags & X86_PTE_US))
1749	{
1750	/* We don't care about user pages. */
1751	STAM_COUNTER_INC(&pVM->csam.s.StatNrUserPages);
1752	return VINF_SUCCESS;
1753	}
1754
1755	csamCreatePageRecord(pVM, pPageAddrGC, enmTag, true /* 32 bits code */, fMonitorInvalidation);
1756
1757	pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)pPageAddrGC);
1758	Assert(pPageRec);
1759	}
1760	/** @todo reference count */
1761
1762	#ifdef CSAM_MONITOR_CSAM_CODE_PAGES
1763	Assert(pPageRec->page.fMonitorActive);
1764	#endif
1765
1766	#ifdef CSAM_MONITOR_CODE_PAGES
1767	if (!pPageRec->page.fMonitorActive)
1768	{
1769	Log(("CSAMR3MonitorPage: activate monitoring for %RRv\n", pPageAddrGC));
1770
1771	rc = PGMR3HandlerVirtualRegister(pVM, PGMVIRTHANDLERTYPE_WRITE, pPageAddrGC, pPageAddrGC + (PAGE_SIZE - 1) /* inclusive! */,
1772	(fMonitorInvalidation) ? CSAMCodePageInvalidate : 0, CSAMCodePageWriteHandler, "CSAMGCCodePageWriteHandler", 0,
1773	csamGetMonitorDescription(enmTag));
1774	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PGM_HANDLER_VIRTUAL_CONFLICT, ("PGMR3HandlerVirtualRegisterEx %RRv failed with %Rrc\n", pPageAddrGC, rc));
1775	if (RT_FAILURE(rc))
1776	Log(("PGMR3HandlerVirtualRegisterEx for %RRv failed with %Rrc\n", pPageAddrGC, rc));
1777
1778	/* Could fail, because it's already monitored. Don't treat that condition as fatal. */
1779
1780	/* Prefetch it in case it's not there yet. */
1781	rc = PGMPrefetchPage(pVM, pVCpu, pPageAddrGC);
1782	AssertRC(rc);
1783
1784	rc = PGMShwModifyPage(pVM, pVCpu, pPageAddrGC, 1, 0, ~(uint64_t)X86_PTE_RW);
1785	Assert(rc == VINF_SUCCESS \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT);
1786
1787	STAM_COUNTER_INC(&pVM->csam.s.StatPageMonitor);
1788
1789	pPageRec->page.fMonitorActive = true;
1790	pPageRec->page.fMonitorInvalidation = fMonitorInvalidation;
1791	}
1792	else
1793	if ( !pPageRec->page.fMonitorInvalidation
1794	&& fMonitorInvalidation)
1795	{
1796	Assert(pPageRec->page.fMonitorActive);
1797	PGMHandlerVirtualChangeInvalidateCallback(pVM, pPageRec->page.pPageGC, CSAMCodePageInvalidate);
1798	pPageRec->page.fMonitorInvalidation = true;
1799	STAM_COUNTER_INC(&pVM->csam.s.StatNrPagesInv);
1800
1801	/* Prefetch it in case it's not there yet. */
1802	rc = PGMPrefetchPage(pVM, pVCpu, pPageAddrGC);
1803	AssertRC(rc);
1804
1805	/* Make sure it's readonly. Page invalidation may have modified the attributes. */
1806	rc = PGMShwModifyPage(pVM, pVCpu, pPageAddrGC, 1, 0, ~(uint64_t)X86_PTE_RW);
1807	Assert(rc == VINF_SUCCESS \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT);
1808	}
1809
1810	#if 0 /* def VBOX_STRICT -> very annoying) */
1811	if (pPageRec->page.fMonitorActive)
1812	{
1813	uint64_t fPageShw;
1814	RTHCPHYS GCPhys;
1815	rc = PGMShwGetPage(pVM, pVCpu, pPageAddrGC, &fPageShw, &GCPhys);
1816	// AssertMsg( (rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT)
1817	// \|\| !(fPageShw & X86_PTE_RW)
1818	// \|\| (pPageRec->page.GCPhys == 0), ("Shadow page flags for %RRv (%RHp) aren't readonly (%RX64)!!\n", pPageAddrGC, GCPhys, fPageShw));
1819	}
1820	#endif
1821
1822	if (pPageRec->page.GCPhys == 0)
1823	{
1824	/* Prefetch it in case it's not there yet. */
1825	rc = PGMPrefetchPage(pVM, pVCpu, pPageAddrGC);
1826	AssertRC(rc);
1827	/* The page was changed behind our back. It won't be made read-only until the next SyncCR3, so force it here. */
1828	rc = PGMShwModifyPage(pVM, pVCpu, pPageAddrGC, 1, 0, ~(uint64_t)X86_PTE_RW);
1829	Assert(rc == VINF_SUCCESS \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT);
1830	}
1831	#endif /* CSAM_MONITOR_CODE_PAGES */
1832	return VINF_SUCCESS;
1833	}
1834
1835	/**
1836	* Unmonitors a code page
1837	*
1838	* @returns VBox status code
1839	* @param pVM The VM to operate on.
1840	* @param pPageAddrGC The page to monitor
1841	* @param enmTag Monitor tag
1842	*/
1843	VMMR3DECL(int) CSAMR3UnmonitorPage(PVM pVM, RTRCPTR pPageAddrGC, CSAMTAG enmTag)
1844	{
1845	pPageAddrGC &= PAGE_BASE_GC_MASK;
1846
1847	Log(("CSAMR3UnmonitorPage %RRv %d\n", pPageAddrGC, enmTag));
1848
1849	Assert(enmTag == CSAM_TAG_REM);
1850
1851	#ifdef VBOX_STRICT
1852	PCSAMPAGEREC pPageRec;
1853
1854	pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)pPageAddrGC);
1855	Assert(pPageRec && pPageRec->page.enmTag == enmTag);
1856	#endif
1857	return CSAMR3RemovePage(pVM, pPageAddrGC);
1858	}
1859
1860	/**
1861	* Removes a page record from our lookup tree
1862	*
1863	* @returns VBox status code
1864	* @param pVM The VM to operate on.
1865	* @param GCPtr Page address
1866	*/
1867	static int csamRemovePageRecord(PVM pVM, RTRCPTR GCPtr)
1868	{
1869	PCSAMPAGEREC pPageRec;
1870	Assert(pVM->cCPUs == 1);
1871	PVMCPU pVCpu = VMMGetCpu0(pVM);
1872
1873	Log(("csamRemovePageRecord %RRv\n", GCPtr));
1874	pPageRec = (PCSAMPAGEREC)RTAvlPVRemove(&pVM->csam.s.pPageTree, (AVLPVKEY)GCPtr);
1875
1876	if (pPageRec)
1877	{
1878	STAM_COUNTER_INC(&pVM->csam.s.StatNrRemovedPages);
1879
1880	#ifdef CSAM_MONITOR_CODE_PAGES
1881	if (pPageRec->page.fMonitorActive)
1882	{
1883	/* @todo -> this is expensive (cr3 reload)!!!
1884	* if this happens often, then reuse it instead!!!
1885	*/
1886	Assert(!fInCSAMCodePageInvalidate);
1887	STAM_COUNTER_DEC(&pVM->csam.s.StatPageMonitor);
1888	PGMHandlerVirtualDeregister(pVM, GCPtr);
1889	}
1890	if (pPageRec->page.enmTag == CSAM_TAG_PATM)
1891	{
1892	/* Make sure the recompiler flushes its cache as this page is no longer monitored. */
1893	STAM_COUNTER_INC(&pVM->csam.s.StatPageRemoveREMFlush);
1894	CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_GLOBAL_TLB_FLUSH);
1895	}
1896	#endif
1897
1898	#ifdef VBOX_WITH_STATISTICS
1899	switch (pPageRec->page.enmTag)
1900	{
1901	case CSAM_TAG_CSAM:
1902	STAM_COUNTER_DEC(&pVM->csam.s.StatPageCSAM);
1903	break;
1904	case CSAM_TAG_PATM:
1905	STAM_COUNTER_DEC(&pVM->csam.s.StatPagePATM);
1906	break;
1907	case CSAM_TAG_REM:
1908	STAM_COUNTER_DEC(&pVM->csam.s.StatPageREM);
1909	break;
1910	default:
1911	break; /* to shut up GCC */
1912	}
1913	#endif
1914
1915	if (pPageRec->page.pBitmap) MMR3HeapFree(pPageRec->page.pBitmap);
1916	MMR3HeapFree(pPageRec);
1917	}
1918	else
1919	AssertFailed();
1920
1921	return VINF_SUCCESS;
1922	}
1923
1924	/**
1925	* Callback for delayed writes from non-EMT threads
1926	*
1927	* @param pVM VM Handle.
1928	* @param GCPtr The virtual address the guest is writing to. (not correct if it's an alias!)
1929	* @param cbBuf How much it's reading/writing.
1930	*/
1931	static DECLCALLBACK(void) CSAMDelayedWriteHandler(PVM pVM, RTRCPTR GCPtr, size_t cbBuf)
1932	{
1933	int rc = PATMR3PatchWrite(pVM, GCPtr, (uint32_t)cbBuf);
1934	AssertRC(rc);
1935	}
1936
1937	/**
1938	* #PF Handler callback for virtual access handler ranges.
1939	*
1940	* Important to realize that a physical page in a range can have aliases, and
1941	* for ALL and WRITE handlers these will also trigger.
1942	*
1943	* @returns VINF_SUCCESS if the handler have carried out the operation.
1944	* @returns VINF_PGM_HANDLER_DO_DEFAULT if the caller should carry out the access operation.
1945	* @param pVM VM Handle.
1946	* @param GCPtr The virtual address the guest is writing to. (not correct if it's an alias!)
1947	* @param pvPtr The HC mapping of that address.
1948	* @param pvBuf What the guest is reading/writing.
1949	* @param cbBuf How much it's reading/writing.
1950	* @param enmAccessType The access type.
1951	* @param pvUser User argument.
1952	*/
1953	static DECLCALLBACK(int) CSAMCodePageWriteHandler(PVM pVM, RTGCPTR GCPtr, void pvPtr, void pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType, void *pvUser)
1954	{
1955	int rc;
1956
1957	Assert(enmAccessType == PGMACCESSTYPE_WRITE);
1958	Log(("CSAMCodePageWriteHandler: write to %RGv size=%zu\n", GCPtr, cbBuf));
1959
1960	if ( PAGE_ADDRESS(pvPtr) == PAGE_ADDRESS((uintptr_t)pvPtr + cbBuf - 1)
1961	&& !memcmp(pvPtr, pvBuf, cbBuf))
1962	{
1963	Log(("CSAMCodePageWriteHandler: dummy write -> ignore\n"));
1964	return VINF_PGM_HANDLER_DO_DEFAULT;
1965	}
1966
1967	if (VM_IS_EMT(pVM))
1968	{
1969	rc = PATMR3PatchWrite(pVM, GCPtr, (uint32_t)cbBuf);
1970	}
1971	else
1972	{
1973	/* Queue the write instead otherwise we'll get concurrency issues. */
1974	/** @note in theory not correct to let it write the data first before disabling a patch!
1975	* (if it writes the same data as the patch jump and we replace it with obsolete opcodes)
1976	*/
1977	Log(("CSAMCodePageWriteHandler: delayed write!\n"));
1978	AssertCompileSize(RTRCPTR, 4);
1979	rc = VMR3ReqCallEx(pVM, VMREQDEST_ANY, NULL, 0, VMREQFLAGS_NO_WAIT \| VMREQFLAGS_VOID,
1980	(PFNRT)CSAMDelayedWriteHandler, 3, pVM, (RTRCPTR)GCPtr, cbBuf);
1981	}
1982	AssertRC(rc);
1983
1984	return VINF_PGM_HANDLER_DO_DEFAULT;
1985	}
1986
1987	/**
1988	* #PF Handler callback for invalidation of virtual access handler ranges.
1989	*
1990	* @param pVM VM Handle.
1991	* @param GCPtr The virtual address the guest has changed.
1992	*/
1993	static DECLCALLBACK(int) CSAMCodePageInvalidate(PVM pVM, RTGCPTR GCPtr)
1994	{
1995	fInCSAMCodePageInvalidate = true;
1996	LogFlow(("CSAMCodePageInvalidate %RGv\n", GCPtr));
1997	/** @todo We can't remove the page (which unregisters the virtual handler) as we are called from a DoWithAll on the virtual handler tree. Argh. */
1998	csamFlushPage(pVM, GCPtr, false /* don't remove page! */);
1999	fInCSAMCodePageInvalidate = false;
2000	return VINF_SUCCESS;
2001	}
2002
2003	/**
2004	* Check if the current instruction has already been checked before
2005	*
2006	* @returns VBox status code. (trap handled or not)
2007	* @param pVM The VM to operate on.
2008	* @param pInstr Instruction pointer
2009	* @param pPage CSAM patch structure pointer
2010	*/
2011	bool csamIsCodeScanned(PVM pVM, RTRCPTR pInstr, PCSAMPAGE *pPage)
2012	{
2013	PCSAMPAGEREC pPageRec;
2014	uint32_t offset;
2015
2016	STAM_PROFILE_START(&pVM->csam.s.StatTimeCheckAddr, a);
2017
2018	offset = pInstr & PAGE_OFFSET_MASK;
2019	pInstr = pInstr & PAGE_BASE_GC_MASK;
2020
2021	Assert(pPage);
2022
2023	if (pPage && (pPage)->pPageGC == pInstr)
2024	{
2025	if ((pPage)->pBitmap == NULL \|\| ASMBitTest((pPage)->pBitmap, offset))
2026	{
2027	STAM_COUNTER_ADD(&pVM->csam.s.StatNrKnownPagesHC, 1);
2028	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeCheckAddr, a);
2029	return true;
2030	}
2031	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeCheckAddr, a);
2032	return false;
2033	}
2034
2035	pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)pInstr);
2036	if (pPageRec)
2037	{
2038	if (pPage) *pPage= &pPageRec->page;
2039	if (pPageRec->page.pBitmap == NULL \|\| ASMBitTest(pPageRec->page.pBitmap, offset))
2040	{
2041	STAM_COUNTER_ADD(&pVM->csam.s.StatNrKnownPagesHC, 1);
2042	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeCheckAddr, a);
2043	return true;
2044	}
2045	}
2046	else
2047	{
2048	if (pPage) *pPage = NULL;
2049	}
2050	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeCheckAddr, a);
2051	return false;
2052	}
2053
2054	/**
2055	* Mark an instruction in a page as scanned/not scanned
2056	*
2057	* @param pVM The VM to operate on.
2058	* @param pPage Patch structure pointer
2059	* @param pInstr Instruction pointer
2060	* @param opsize Instruction size
2061	* @param fScanned Mark as scanned or not
2062	*/
2063	static void csamMarkCode(PVM pVM, PCSAMPAGE pPage, RTRCPTR pInstr, uint32_t opsize, bool fScanned)
2064	{
2065	LogFlow(("csamMarkCodeAsScanned %RRv opsize=%d\n", pInstr, opsize));
2066	CSAMMarkPage(pVM, pInstr, fScanned);
2067
2068	/** @todo should recreate empty bitmap if !fScanned */
2069	if (pPage->pBitmap == NULL)
2070	return;
2071
2072	if (fScanned)
2073	{
2074	// retn instructions can be scanned more than once
2075	if (ASMBitTest(pPage->pBitmap, pInstr & PAGE_OFFSET_MASK) == 0)
2076	{
2077	pPage->uSize += opsize;
2078	STAM_COUNTER_ADD(&pVM->csam.s.StatNrInstr, 1);
2079	}
2080	if (pPage->uSize >= PAGE_SIZE)
2081	{
2082	Log(("Scanned full page (%RRv) -> free bitmap\n", pInstr & PAGE_BASE_GC_MASK));
2083	MMR3HeapFree(pPage->pBitmap);
2084	pPage->pBitmap = NULL;
2085	}
2086	else
2087	ASMBitSet(pPage->pBitmap, pInstr & PAGE_OFFSET_MASK);
2088	}
2089	else
2090	ASMBitClear(pPage->pBitmap, pInstr & PAGE_OFFSET_MASK);
2091	}
2092
2093	/**
2094	* Mark an instruction in a page as scanned/not scanned
2095	*
2096	* @returns VBox status code.
2097	* @param pVM The VM to operate on.
2098	* @param pInstr Instruction pointer
2099	* @param opsize Instruction size
2100	* @param fScanned Mark as scanned or not
2101	*/
2102	VMMR3DECL(int) CSAMR3MarkCode(PVM pVM, RTRCPTR pInstr, uint32_t opsize, bool fScanned)
2103	{
2104	PCSAMPAGE pPage = 0;
2105
2106	Assert(!fScanned); /* other case not implemented. */
2107	Assert(!PATMIsPatchGCAddr(pVM, pInstr));
2108
2109	if (csamIsCodeScanned(pVM, pInstr, &pPage) == false)
2110	{
2111	Assert(fScanned == true); /* other case should not be possible */
2112	return VINF_SUCCESS;
2113	}
2114
2115	Log(("CSAMR3MarkCode: %RRv size=%d fScanned=%d\n", pInstr, opsize, fScanned));
2116	csamMarkCode(pVM, pPage, pInstr, opsize, fScanned);
2117	return VINF_SUCCESS;
2118	}
2119
2120
2121	/**
2122	* Scan and analyse code
2123	*
2124	* @returns VBox status code.
2125	* @param pVM The VM to operate on.
2126	* @param pCtxCore CPU context
2127	* @param pInstrGC Instruction pointer
2128	*/
2129	VMMR3DECL(int) CSAMR3CheckCodeEx(PVM pVM, PCPUMCTXCORE pCtxCore, RTRCPTR pInstrGC)
2130	{
2131	if (EMIsRawRing0Enabled(pVM) == false \|\| PATMIsPatchGCAddr(pVM, pInstrGC) == true)
2132	{
2133	// No use
2134	return VINF_SUCCESS;
2135	}
2136
2137	if (CSAMIsEnabled(pVM))
2138	{
2139	/* Assuming 32 bits code for now. */
2140	Assert(SELMGetCpuModeFromSelector(pVM, pCtxCore->eflags, pCtxCore->cs, &pCtxCore->csHid) == CPUMODE_32BIT);
2141
2142	pInstrGC = SELMToFlat(pVM, DIS_SELREG_CS, pCtxCore, pInstrGC);
2143	return CSAMR3CheckCode(pVM, pInstrGC);
2144	}
2145	return VINF_SUCCESS;
2146	}
2147
2148	/**
2149	* Scan and analyse code
2150	*
2151	* @returns VBox status code.
2152	* @param pVM The VM to operate on.
2153	* @param pInstrGC Instruction pointer (0:32 virtual address)
2154	*/
2155	VMMR3DECL(int) CSAMR3CheckCode(PVM pVM, RTRCPTR pInstrGC)
2156	{
2157	int rc;
2158	PCSAMPAGE pPage = NULL;
2159
2160	if (EMIsRawRing0Enabled(pVM) == false \|\| PATMIsPatchGCAddr(pVM, pInstrGC) == true)
2161	{
2162	// No use
2163	return VINF_SUCCESS;
2164	}
2165
2166	if (CSAMIsEnabled(pVM))
2167	{
2168	// Cache record for PATMGCVirtToHCVirt
2169	CSAMP2GLOOKUPREC cacheRec = {0};
2170
2171	STAM_PROFILE_START(&pVM->csam.s.StatTime, a);
2172	rc = csamAnalyseCallCodeStream(pVM, pInstrGC, pInstrGC, true /* 32 bits code */, CSAMR3AnalyseCallback, pPage, &cacheRec);
2173	STAM_PROFILE_STOP(&pVM->csam.s.StatTime, a);
2174	if (rc != VINF_SUCCESS)
2175	{
2176	Log(("csamAnalyseCodeStream failed with %d\n", rc));
2177	return rc;
2178	}
2179	}
2180	return VINF_SUCCESS;
2181	}
2182
2183	/**
2184	* Flush dirty code pages
2185	*
2186	* @returns VBox status code.
2187	* @param pVM The VM to operate on.
2188	*/
2189	static int csamR3FlushDirtyPages(PVM pVM)
2190	{
2191	Assert(pVM->cCPUs == 1);
2192	PVMCPU pVCpu = VMMGetCpu0(pVM);
2193
2194	STAM_PROFILE_START(&pVM->csam.s.StatFlushDirtyPages, a);
2195
2196	for (uint32_t i=0;i<pVM->csam.s.cDirtyPages;i++)
2197	{
2198	int rc;
2199	PCSAMPAGEREC pPageRec;
2200	RTRCPTR GCPtr = pVM->csam.s.pvDirtyBasePage[i];
2201
2202	GCPtr = GCPtr & PAGE_BASE_GC_MASK;
2203
2204	/* Notify the recompiler that this page has been changed. */
2205	REMR3NotifyCodePageChanged(pVM, pVCpu, GCPtr);
2206
2207	/* Enable write protection again. (use the fault address as it might be an alias) */
2208	rc = PGMShwModifyPage(pVM, pVCpu, pVM->csam.s.pvDirtyFaultPage[i], 1, 0, ~(uint64_t)X86_PTE_RW);
2209	Assert(rc == VINF_SUCCESS \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT);
2210
2211	Log(("CSAMR3FlushDirtyPages: flush %RRv (modifypage rc=%Rrc)\n", pVM->csam.s.pvDirtyBasePage[i], rc));
2212
2213	pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)GCPtr);
2214	if (pPageRec && pPageRec->page.enmTag == CSAM_TAG_REM)
2215	{
2216	uint64_t fFlags;
2217
2218	rc = PGMGstGetPage(pVM, pVCpu, GCPtr, &fFlags, NULL);
2219	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
2220	if ( rc == VINF_SUCCESS
2221	&& (fFlags & X86_PTE_US))
2222	{
2223	/* We don't care about user pages. */
2224	csamRemovePageRecord(pVM, GCPtr);
2225	STAM_COUNTER_INC(&pVM->csam.s.StatNrUserPages);
2226	}
2227	}
2228	}
2229	pVM->csam.s.cDirtyPages = 0;
2230	STAM_PROFILE_STOP(&pVM->csam.s.StatFlushDirtyPages, a);
2231	return VINF_SUCCESS;
2232	}
2233
2234	/**
2235	* Flush potential new code pages
2236	*
2237	* @returns VBox status code.
2238	* @param pVM The VM to operate on.
2239	*/
2240	static int csamR3FlushCodePages(PVM pVM)
2241	{
2242	Assert(pVM->cCPUs == 1);
2243	PVMCPU pVCpu = VMMGetCpu0(pVM);
2244
2245	for (uint32_t i=0;i<pVM->csam.s.cPossibleCodePages;i++)
2246	{
2247	RTRCPTR GCPtr = pVM->csam.s.pvPossibleCodePage[i];
2248
2249	GCPtr = GCPtr & PAGE_BASE_GC_MASK;
2250
2251	Log(("csamR3FlushCodePages: %RRv\n", GCPtr));
2252	PGMShwSetPage(pVM, pVCpu, GCPtr, 1, 0);
2253	/* Resync the page to make sure instruction fetch will fault */
2254	CSAMMarkPage(pVM, GCPtr, false);
2255	}
2256	pVM->csam.s.cPossibleCodePages = 0;
2257	return VINF_SUCCESS;
2258	}
2259
2260	/**
2261	* Perform any pending actions
2262	*
2263	* @returns VBox status code.
2264	* @param pVM The VM to operate on.
2265	*/
2266	VMMR3DECL(int) CSAMR3DoPendingAction(PVM pVM)
2267	{
2268	csamR3FlushDirtyPages(pVM);
2269	csamR3FlushCodePages(pVM);
2270
2271	VM_FF_CLEAR(pVM, VM_FF_CSAM_PENDING_ACTION);
2272	return VINF_SUCCESS;
2273	}
2274
2275	/**
2276	* Analyse interrupt and trap gates
2277	*
2278	* @returns VBox status code.
2279	* @param pVM The VM to operate on.
2280	* @param iGate Start gate
2281	* @param cGates Number of gates to check
2282	*/
2283	VMMR3DECL(int) CSAMR3CheckGates(PVM pVM, uint32_t iGate, uint32_t cGates)
2284	{
2285	Assert(pVM->cCPUs == 1);
2286	PVMCPU pVCpu = VMMGetCpu0(pVM);
2287	uint16_t cbIDT;
2288	RTRCPTR GCPtrIDT = CPUMGetGuestIDTR(pVCpu, &cbIDT);
2289	uint32_t iGateEnd;
2290	uint32_t maxGates;
2291	VBOXIDTE aIDT[256];
2292	PVBOXIDTE pGuestIdte;
2293	int rc;
2294
2295	if (EMIsRawRing0Enabled(pVM) == false)
2296	{
2297	/* Enabling interrupt gates only works when raw ring 0 is enabled. */
2298	//AssertFailed();
2299	return VINF_SUCCESS;
2300	}
2301
2302	/* We only check all gates once during a session */
2303	if ( !pVM->csam.s.fGatesChecked
2304	&& cGates != 256)
2305	return VINF_SUCCESS; /* too early */
2306
2307	/* We only check all gates once during a session */
2308	if ( pVM->csam.s.fGatesChecked
2309	&& cGates != 1)
2310	return VINF_SUCCESS; /* ignored */
2311
2312	Assert(cGates <= 256);
2313	if (!GCPtrIDT \|\| cGates > 256)
2314	return VERR_INVALID_PARAMETER;
2315
2316	if (cGates != 1)
2317	{
2318	pVM->csam.s.fGatesChecked = true;
2319	for (unsigned i=0;i<RT_ELEMENTS(pVM->csam.s.pvCallInstruction);i++)
2320	{
2321	RTRCPTR pHandler = pVM->csam.s.pvCallInstruction[i];
2322
2323	if (pHandler)
2324	{
2325	CSAMP2GLOOKUPREC cacheRec = {0}; /* Cache record for PATMGCVirtToHCVirt. */
2326	PCSAMPAGE pPage = NULL;
2327
2328	Log(("CSAMCheckGates: checking previous call instruction %RRv\n", pHandler));
2329	STAM_PROFILE_START(&pVM->csam.s.StatTime, a);
2330	rc = csamAnalyseCodeStream(pVM, pHandler, pHandler, true, CSAMR3AnalyseCallback, pPage, &cacheRec);
2331	STAM_PROFILE_STOP(&pVM->csam.s.StatTime, a);
2332	if (rc != VINF_SUCCESS)
2333	{
2334	Log(("CSAMCheckGates: csamAnalyseCodeStream failed with %d\n", rc));
2335	continue;
2336	}
2337	}
2338	}
2339	}
2340
2341	/* Determine valid upper boundary. */
2342	maxGates = (cbIDT+1) / sizeof(VBOXIDTE);
2343	Assert(iGate < maxGates);
2344	if (iGate > maxGates)
2345	return VERR_INVALID_PARAMETER;
2346
2347	if (iGate + cGates > maxGates)
2348	cGates = maxGates - iGate;
2349
2350	GCPtrIDT = GCPtrIDT + iGate * sizeof(VBOXIDTE);
2351	iGateEnd = iGate + cGates;
2352
2353	STAM_PROFILE_START(&pVM->csam.s.StatCheckGates, a);
2354
2355	/*
2356	* Get IDT entries.
2357	*/
2358	if (PAGE_ADDRESS(GCPtrIDT) == PAGE_ADDRESS(GCPtrIDT+cGates*sizeof(VBOXIDTE)))
2359	{
2360	/* Just convert the IDT address to a R3 pointer. The whole IDT fits in one page. */
2361	rc = PGMPhysGCPtr2R3Ptr(pVCpu, GCPtrIDT, (PRTR3PTR)&pGuestIdte);
2362	if (RT_FAILURE(rc))
2363	{
2364	AssertMsgRC(rc, ("Failed to read IDTE! rc=%Rrc\n", rc));
2365	STAM_PROFILE_STOP(&pVM->csam.s.StatCheckGates, a);
2366	return rc;
2367	}
2368	}
2369	else
2370	{
2371	/* Slow method when it crosses a page boundary. */
2372	rc = PGMPhysSimpleReadGCPtr(pVCpu, aIDT, GCPtrIDT, cGates*sizeof(VBOXIDTE));
2373	if (RT_FAILURE(rc))
2374	{
2375	AssertMsgRC(rc, ("Failed to read IDTE! rc=%Rrc\n", rc));
2376	STAM_PROFILE_STOP(&pVM->csam.s.StatCheckGates, a);
2377	return rc;
2378	}
2379	pGuestIdte = &aIDT[0];
2380	}
2381
2382	for (/iGate/; iGate<iGateEnd; iGate++, pGuestIdte++)
2383	{
2384	Assert(TRPMR3GetGuestTrapHandler(pVM, iGate) == TRPM_INVALID_HANDLER);
2385
2386	if ( pGuestIdte->Gen.u1Present
2387	&& (pGuestIdte->Gen.u5Type2 == VBOX_IDTE_TYPE2_TRAP_32 \|\| pGuestIdte->Gen.u5Type2 == VBOX_IDTE_TYPE2_INT_32)
2388	&& (pGuestIdte->Gen.u2DPL == 3 \|\| pGuestIdte->Gen.u2DPL == 0)
2389	)
2390	{
2391	RTRCPTR pHandler;
2392	CSAMP2GLOOKUPREC cacheRec = {0}; /* Cache record for PATMGCVirtToHCVirt. */
2393	PCSAMPAGE pPage = NULL;
2394	SELMSELINFO selInfo;
2395
2396	pHandler = VBOXIDTE_OFFSET(*pGuestIdte);
2397	pHandler = SELMToFlatBySel(pVM, pGuestIdte->Gen.u16SegSel, pHandler);
2398
2399	rc = SELMR3GetSelectorInfo(pVM, pVCpu, pGuestIdte->Gen.u16SegSel, &selInfo);
2400	if ( RT_FAILURE(rc)
2401	\|\| selInfo.GCPtrBase != 0
2402	\|\| selInfo.cbLimit != ~0U
2403	)
2404	{
2405	/* Refuse to patch a handler whose idt cs selector isn't wide open. */
2406	Log(("CSAMCheckGates: check gate %d failed due to rc %Rrc GCPtrBase=%RRv limit=%x\n", iGate, rc, selInfo.GCPtrBase, selInfo.cbLimit));
2407	continue;
2408	}
2409
2410
2411	if (pGuestIdte->Gen.u5Type2 == VBOX_IDTE_TYPE2_TRAP_32)
2412	{
2413	Log(("CSAMCheckGates: check trap gate %d at %04X:%08X (flat %RRv)\n", iGate, pGuestIdte->Gen.u16SegSel, VBOXIDTE_OFFSET(*pGuestIdte), pHandler));
2414	}
2415	else
2416	{
2417	Log(("CSAMCheckGates: check interrupt gate %d at %04X:%08X (flat %RRv)\n", iGate, pGuestIdte->Gen.u16SegSel, VBOXIDTE_OFFSET(*pGuestIdte), pHandler));
2418	}
2419
2420	STAM_PROFILE_START(&pVM->csam.s.StatTime, a);
2421	rc = csamAnalyseCodeStream(pVM, pHandler, pHandler, true, CSAMR3AnalyseCallback, pPage, &cacheRec);
2422	STAM_PROFILE_STOP(&pVM->csam.s.StatTime, a);
2423	if (rc != VINF_SUCCESS)
2424	{
2425	Log(("CSAMCheckGates: csamAnalyseCodeStream failed with %d\n", rc));
2426	continue;
2427	}
2428	/* OpenBSD guest specific patch test. */
2429	if (iGate >= 0x20)
2430	{
2431	PCPUMCTX pCtx;
2432	DISCPUSTATE cpu;
2433	RTGCUINTPTR32 aOpenBsdPushCSOffset[3] = {0x03, /* OpenBSD 3.7 & 3.8 */
2434	0x2B, /* OpenBSD 4.0 installation ISO */
2435	0x2F}; /* OpenBSD 4.0 after install */
2436
2437	pCtx = CPUMQueryGuestCtxPtr(pVCpu);
2438
2439	for (unsigned i=0;i<RT_ELEMENTS(aOpenBsdPushCSOffset);i++)
2440	{
2441	rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pHandler - aOpenBsdPushCSOffset[i], &cpu, NULL);
2442	if ( rc == VINF_SUCCESS
2443	&& cpu.pCurInstr->opcode == OP_PUSH
2444	&& cpu.pCurInstr->param1 == OP_PARM_REG_CS)
2445	{
2446	rc = PATMR3InstallPatch(pVM, pHandler - aOpenBsdPushCSOffset[i], PATMFL_CODE32 \| PATMFL_GUEST_SPECIFIC);
2447	if (RT_SUCCESS(rc))
2448	Log(("Installed OpenBSD interrupt handler prefix instruction (push cs) patch\n"));
2449	}
2450	}
2451	}
2452
2453	/* Trap gates and certain interrupt gates. */
2454	uint32_t fPatchFlags = PATMFL_CODE32 \| PATMFL_IDTHANDLER;
2455
2456	if (pGuestIdte->Gen.u5Type2 == VBOX_IDTE_TYPE2_TRAP_32)
2457	fPatchFlags \|= PATMFL_TRAPHANDLER;
2458	else
2459	fPatchFlags \|= PATMFL_INTHANDLER;
2460
2461	switch (iGate) {
2462	case 8:
2463	case 10:
2464	case 11:
2465	case 12:
2466	case 13:
2467	case 14:
2468	case 17:
2469	fPatchFlags \|= PATMFL_TRAPHANDLER_WITH_ERRORCODE;
2470	break;
2471	default:
2472	/* No error code. */
2473	break;
2474	}
2475
2476	Log(("Installing %s gate handler for 0x%X at %RRv\n", (pGuestIdte->Gen.u5Type2 == VBOX_IDTE_TYPE2_TRAP_32) ? "trap" : "intr", iGate, pHandler));
2477
2478	rc = PATMR3InstallPatch(pVM, pHandler, fPatchFlags);
2479	if (RT_SUCCESS(rc) \|\| rc == VERR_PATM_ALREADY_PATCHED)
2480	{
2481	Log(("Gate handler 0x%X is SAFE!\n", iGate));
2482
2483	RTRCPTR pNewHandlerGC = PATMR3QueryPatchGCPtr(pVM, pHandler);
2484	if (pNewHandlerGC)
2485	{
2486	rc = TRPMR3SetGuestTrapHandler(pVM, iGate, pNewHandlerGC);
2487	if (RT_FAILURE(rc))
2488	Log(("TRPMR3SetGuestTrapHandler %d failed with %Rrc\n", iGate, rc));
2489	}
2490	}
2491	}
2492	} /* for */
2493	STAM_PROFILE_STOP(&pVM->csam.s.StatCheckGates, a);
2494	return VINF_SUCCESS;
2495	}
2496
2497	/**
2498	* Record previous call instruction addresses
2499	*
2500	* @returns VBox status code.
2501	* @param pVM The VM to operate on.
2502	* @param GCPtrCall Call address
2503	*/
2504	VMMR3DECL(int) CSAMR3RecordCallAddress(PVM pVM, RTRCPTR GCPtrCall)
2505	{
2506	for (unsigned i=0;i<RT_ELEMENTS(pVM->csam.s.pvCallInstruction);i++)
2507	{
2508	if (pVM->csam.s.pvCallInstruction[i] == GCPtrCall)
2509	return VINF_SUCCESS;
2510	}
2511
2512	Log(("CSAMR3RecordCallAddress %RRv\n", GCPtrCall));
2513
2514	pVM->csam.s.pvCallInstruction[pVM->csam.s.iCallInstruction++] = GCPtrCall;
2515	if (pVM->csam.s.iCallInstruction >= RT_ELEMENTS(pVM->csam.s.pvCallInstruction))
2516	pVM->csam.s.iCallInstruction = 0;
2517
2518	return VINF_SUCCESS;
2519	}
2520
2521
2522	/**
2523	* Query CSAM state (enabled/disabled)
2524	*
2525	* @returns 0 - disabled, 1 - enabled
2526	* @param pVM The VM to operate on.
2527	*/
2528	VMMR3DECL(int) CSAMR3IsEnabled(PVM pVM)
2529	{
2530	return pVM->fCSAMEnabled;
2531	}
2532
2533	#ifdef VBOX_WITH_DEBUGGER
2534	/**
2535	* The '.csamoff' command.
2536	*
2537	* @returns VBox status.
2538	* @param pCmd Pointer to the command descriptor (as registered).
2539	* @param pCmdHlp Pointer to command helper functions.
2540	* @param pVM Pointer to the current VM (if any).
2541	* @param paArgs Pointer to (readonly) array of arguments.
2542	* @param cArgs Number of arguments in the array.
2543	*/
2544	static DECLCALLBACK(int) csamr3CmdOff(PCDBGCCMD pCmd, PDBGCCMDHLP pCmdHlp, PVM pVM, PCDBGCVAR paArgs, unsigned cArgs, PDBGCVAR pResult)
2545	{
2546	/*
2547	* Validate input.
2548	*/
2549	if (!pVM)
2550	return pCmdHlp->pfnPrintf(pCmdHlp, NULL, "error: The command requires VM to be selected.\n");
2551
2552	CSAMDisableScanning(pVM);
2553	return pCmdHlp->pfnPrintf(pCmdHlp, NULL, "CSAM Scanning disabled\n");
2554	}
2555
2556	/**
2557	* The '.csamon' command.
2558	*
2559	* @returns VBox status.
2560	* @param pCmd Pointer to the command descriptor (as registered).
2561	* @param pCmdHlp Pointer to command helper functions.
2562	* @param pVM Pointer to the current VM (if any).
2563	* @param paArgs Pointer to (readonly) array of arguments.
2564	* @param cArgs Number of arguments in the array.
2565	*/
2566	static DECLCALLBACK(int) csamr3CmdOn(PCDBGCCMD pCmd, PDBGCCMDHLP pCmdHlp, PVM pVM, PCDBGCVAR paArgs, unsigned cArgs, PDBGCVAR pResult)
2567	{
2568	/*
2569	* Validate input.
2570	*/
2571	if (!pVM)
2572	return pCmdHlp->pfnPrintf(pCmdHlp, NULL, "error: The command requires VM to be selected.\n");
2573
2574	CSAMEnableScanning(pVM);
2575	return pCmdHlp->pfnPrintf(pCmdHlp, NULL, "CSAM Scanning enabled\n");
2576	}
2577	#endif

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/PATM/CSAM.cpp@ 18927

Download in other formats: