CSAM.cpp@ 49836

Last change on this file since 49836 was 49247, checked in by vboxsync, 11 years ago
PATM,CSAM,SSM: Fix PATM restore issue in 4.3.0. SSMSTRUCT_FLAGS_MEM_BAND_AID policy update.
Property svn:eol-style set to `native` Property svn:keywords set to `Id Revision`
File size: 100.5 KB

Line
1	/* $Id: CSAM.cpp 49247 2013-10-22 20:36:41Z vboxsync $ */
2	/** @file
3	* CSAM - Guest OS Code Scanning and Analysis Manager
4	*/
5
6	/*
7	* Copyright (C) 2006-2013 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18	/*******************************************************************************
19	* Header Files *
20	*******************************************************************************/
21	#define LOG_GROUP LOG_GROUP_CSAM
22	#include <VBox/vmm/cpum.h>
23	#include <VBox/vmm/stam.h>
24	#include <VBox/vmm/patm.h>
25	#include <VBox/vmm/csam.h>
26	#include <VBox/vmm/cpumdis.h>
27	#include <VBox/vmm/pgm.h>
28	#include <VBox/vmm/iom.h>
29	#include <VBox/vmm/mm.h>
30	#include <VBox/vmm/em.h>
31	#include <VBox/vmm/hm.h>
32	#ifdef VBOX_WITH_REM
33	# include <VBox/vmm/rem.h>
34	#endif
35	#include <VBox/vmm/selm.h>
36	#include <VBox/vmm/trpm.h>
37	#include <VBox/vmm/cfgm.h>
38	#include <VBox/vmm/ssm.h>
39	#include <VBox/param.h>
40	#include <iprt/avl.h>
41	#include <iprt/asm.h>
42	#include <iprt/thread.h>
43	#include "CSAMInternal.h"
44	#include <VBox/vmm/vm.h>
45	#include <VBox/vmm/uvm.h>
46
47	#include <VBox/dbg.h>
48	#include <VBox/sup.h>
49	#include <VBox/err.h>
50	#include <VBox/log.h>
51
52	#include <VBox/dis.h>
53	#include <VBox/disopcode.h>
54	#include <iprt/assert.h>
55	#include <iprt/string.h>
56	#include "internal/pgm.h"
57
58
59	/* Enabled by default */
60	#define CSAM_ENABLE
61
62	/* Enable to monitor code pages for self-modifying code. */
63	#define CSAM_MONITOR_CODE_PAGES
64	/* Enable to monitor all scanned pages
65	#define CSAM_MONITOR_CSAM_CODE_PAGES */
66	/* Enable to scan beyond ret instructions.
67	#define CSAM_ANALYSE_BEYOND_RET */
68
69	/*******************************************************************************
70	* Internal Functions *
71	*******************************************************************************/
72	static DECLCALLBACK(int) csamr3Save(PVM pVM, PSSMHANDLE pSSM);
73	static DECLCALLBACK(int) csamr3Load(PVM pVM, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass);
74	static DECLCALLBACK(int) csamR3LoadDummy(PVM pVM, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass);
75	static DECLCALLBACK(int) CSAMCodePageWriteHandler(PVM pVM, RTGCPTR GCPtr, void pvPtr, void pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType, void *pvUser);
76	static DECLCALLBACK(int) CSAMCodePageInvalidate(PVM pVM, RTGCPTR GCPtr);
77
78	bool csamIsCodeScanned(PVM pVM, RTRCPTR pInstr, PCSAMPAGE *pPage);
79	int csamR3CheckPageRecord(PVM pVM, RTRCPTR pInstr);
80	static PCSAMPAGE csamCreatePageRecord(PVM pVM, RTRCPTR GCPtr, CSAMTAG enmTag, bool fCode32, bool fMonitorInvalidation = false);
81	static int csamRemovePageRecord(PVM pVM, RTRCPTR GCPtr);
82	static int csamReinit(PVM pVM);
83	static void csamMarkCode(PVM pVM, PCSAMPAGE pPage, RTRCPTR pInstr, uint32_t opsize, bool fScanned);
84	static int csamAnalyseCodeStream(PVM pVM, RCPTRTYPE(uint8_t ) pInstrGC, RCPTRTYPE(uint8_t ) pCurInstrGC, bool fCode32,
85	PFN_CSAMR3ANALYSE pfnCSAMR3Analyse, void *pUserData, PCSAMP2GLOOKUPREC pCacheRec);
86
87	/** @todo Temporary for debugging. */
88	static bool fInCSAMCodePageInvalidate = false;
89
90	#ifdef VBOX_WITH_DEBUGGER
91	static FNDBGCCMD csamr3CmdOn;
92	static FNDBGCCMD csamr3CmdOff;
93	#endif
94
95
96	/*******************************************************************************
97	* Global Variables *
98	*******************************************************************************/
99	#ifdef VBOX_WITH_DEBUGGER
100	/** Command descriptors. */
101	static const DBGCCMD g_aCmds[] =
102	{
103	/* pszCmd, cArgsMin, cArgsMax, paArgDesc, cArgDescs, fFlags, pfnHandler pszSyntax, ....pszDescription */
104	{ "csamon", 0, 0, NULL, 0, 0, csamr3CmdOn, "", "Enable CSAM code scanning." },
105	{ "csamoff", 0, 0, NULL, 0, 0, csamr3CmdOff, "", "Disable CSAM code scanning." },
106	};
107	#endif
108
109	/**
110	* SSM descriptor table for the CSAM structure.
111	*/
112	static const SSMFIELD g_aCsamFields[] =
113	{
114	/** @todo there are more fields that can be ignored here. */
115	SSMFIELD_ENTRY_IGNORE( CSAM, offVM),
116	SSMFIELD_ENTRY_PAD_HC64( CSAM, Alignment0, sizeof(uint32_t)),
117	SSMFIELD_ENTRY_IGN_HCPTR( CSAM, pPageTree),
118	SSMFIELD_ENTRY( CSAM, aDangerousInstr),
119	SSMFIELD_ENTRY( CSAM, cDangerousInstr),
120	SSMFIELD_ENTRY( CSAM, iDangerousInstr),
121	SSMFIELD_ENTRY_RCPTR( CSAM, pPDBitmapGC), /// @todo ignore this?
122	SSMFIELD_ENTRY_RCPTR( CSAM, pPDHCBitmapGC), /// @todo ignore this?
123	SSMFIELD_ENTRY_IGN_HCPTR( CSAM, pPDBitmapHC),
124	SSMFIELD_ENTRY_IGN_HCPTR( CSAM, pPDGCBitmapHC),
125	SSMFIELD_ENTRY_IGN_HCPTR( CSAM, savedstate.pSSM),
126	SSMFIELD_ENTRY( CSAM, savedstate.cPageRecords),
127	SSMFIELD_ENTRY( CSAM, savedstate.cPatchPageRecords),
128	SSMFIELD_ENTRY( CSAM, cDirtyPages),
129	SSMFIELD_ENTRY_RCPTR_ARRAY( CSAM, pvDirtyBasePage),
130	SSMFIELD_ENTRY_RCPTR_ARRAY( CSAM, pvDirtyFaultPage),
131	SSMFIELD_ENTRY( CSAM, cPossibleCodePages),
132	SSMFIELD_ENTRY_RCPTR_ARRAY( CSAM, pvPossibleCodePage),
133	SSMFIELD_ENTRY_RCPTR_ARRAY( CSAM, pvCallInstruction),
134	SSMFIELD_ENTRY( CSAM, iCallInstruction),
135	SSMFIELD_ENTRY( CSAM, fScanningStarted),
136	SSMFIELD_ENTRY( CSAM, fGatesChecked),
137	SSMFIELD_ENTRY_PAD_HC( CSAM, Alignment1, 6, 2),
138	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrTraps),
139	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrPages),
140	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrPagesInv),
141	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrRemovedPages),
142	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrPatchPages),
143	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrPageNPHC),
144	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrPageNPGC),
145	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrFlushes),
146	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrFlushesSkipped),
147	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrKnownPagesHC),
148	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrKnownPagesGC),
149	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrInstr),
150	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrBytesRead),
151	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrOpcodeRead),
152	SSMFIELD_ENTRY_IGNORE( CSAM, StatTime),
153	SSMFIELD_ENTRY_IGNORE( CSAM, StatTimeCheckAddr),
154	SSMFIELD_ENTRY_IGNORE( CSAM, StatTimeAddrConv),
155	SSMFIELD_ENTRY_IGNORE( CSAM, StatTimeFlushPage),
156	SSMFIELD_ENTRY_IGNORE( CSAM, StatTimeDisasm),
157	SSMFIELD_ENTRY_IGNORE( CSAM, StatFlushDirtyPages),
158	SSMFIELD_ENTRY_IGNORE( CSAM, StatCheckGates),
159	SSMFIELD_ENTRY_IGNORE( CSAM, StatCodePageModified),
160	SSMFIELD_ENTRY_IGNORE( CSAM, StatDangerousWrite),
161	SSMFIELD_ENTRY_IGNORE( CSAM, StatInstrCacheHit),
162	SSMFIELD_ENTRY_IGNORE( CSAM, StatInstrCacheMiss),
163	SSMFIELD_ENTRY_IGNORE( CSAM, StatPagePATM),
164	SSMFIELD_ENTRY_IGNORE( CSAM, StatPageCSAM),
165	SSMFIELD_ENTRY_IGNORE( CSAM, StatPageREM),
166	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrUserPages),
167	SSMFIELD_ENTRY_IGNORE( CSAM, StatPageMonitor),
168	SSMFIELD_ENTRY_IGNORE( CSAM, StatPageRemoveREMFlush),
169	SSMFIELD_ENTRY_IGNORE( CSAM, StatBitmapAlloc),
170	SSMFIELD_ENTRY_IGNORE( CSAM, StatScanNextFunction),
171	SSMFIELD_ENTRY_IGNORE( CSAM, StatScanNextFunctionFailed),
172	SSMFIELD_ENTRY_TERM()
173	};
174
175	/** Fake type to simplify g_aCsamPDBitmapArray construction. */
176	typedef struct
177	{
178	uint8_t *a[CSAM_PGDIRBMP_CHUNKS];
179	} CSAMPDBITMAPARRAY;
180
181	/**
182	* SSM descriptor table for the CSAM::pPDBitmapHC array.
183	*/
184	static SSMFIELD const g_aCsamPDBitmapArray[] =
185	{
186	SSMFIELD_ENTRY_HCPTR_NI_ARRAY(CSAMPDBITMAPARRAY, a),
187	SSMFIELD_ENTRY_TERM()
188	};
189
190	/**
191	* SSM descriptor table for the CSAMPAGEREC structure.
192	*/
193	static const SSMFIELD g_aCsamPageRecFields[] =
194	{
195	SSMFIELD_ENTRY_IGN_HCPTR( CSAMPAGEREC, Core.Key),
196	SSMFIELD_ENTRY_IGN_HCPTR( CSAMPAGEREC, Core.pLeft),
197	SSMFIELD_ENTRY_IGN_HCPTR( CSAMPAGEREC, Core.pRight),
198	SSMFIELD_ENTRY_IGNORE( CSAMPAGEREC, Core.uchHeight),
199	SSMFIELD_ENTRY_PAD_HC_AUTO( 3, 7),
200	SSMFIELD_ENTRY_RCPTR( CSAMPAGEREC, page.pPageGC),
201	SSMFIELD_ENTRY_PAD_HC_AUTO( 0, 4),
202	SSMFIELD_ENTRY_PAD_MSC32_AUTO( 4),
203	SSMFIELD_ENTRY_GCPHYS( CSAMPAGEREC, page.GCPhys),
204	SSMFIELD_ENTRY( CSAMPAGEREC, page.fFlags),
205	SSMFIELD_ENTRY( CSAMPAGEREC, page.uSize),
206	SSMFIELD_ENTRY_PAD_HC_AUTO( 0, 4),
207	SSMFIELD_ENTRY_HCPTR_NI( CSAMPAGEREC, page.pBitmap),
208	SSMFIELD_ENTRY( CSAMPAGEREC, page.fCode32),
209	SSMFIELD_ENTRY( CSAMPAGEREC, page.fMonitorActive),
210	SSMFIELD_ENTRY( CSAMPAGEREC, page.fMonitorInvalidation),
211	SSMFIELD_ENTRY_PAD_HC_AUTO( 1, 1),
212	SSMFIELD_ENTRY( CSAMPAGEREC, page.enmTag),
213	SSMFIELD_ENTRY( CSAMPAGEREC, page.u64Hash),
214	SSMFIELD_ENTRY_TERM()
215	};
216
217
218	/**
219	* Initializes the CSAM.
220	*
221	* @returns VBox status code.
222	* @param pVM Pointer to the VM.
223	*/
224	VMMR3_INT_DECL(int) CSAMR3Init(PVM pVM)
225	{
226	int rc;
227
228	/*
229	* We only need a saved state dummy loader if HM is enabled.
230	*/
231	if (HMIsEnabled(pVM))
232	{
233	pVM->fCSAMEnabled = false;
234	return SSMR3RegisterInternal(pVM, "CSAM", 0, CSAM_SSM_VERSION, 0,
235	NULL, NULL, NULL,
236	NULL, NULL, NULL,
237	NULL, csamR3LoadDummy, NULL);
238	}
239
240	/*
241	* Raw-mode.
242	*/
243	LogFlow(("CSAMR3Init\n"));
244
245	/* Allocate bitmap for the page directory. */
246	rc = MMR3HyperAllocOnceNoRel(pVM, CSAM_PGDIRBMP_CHUNKSsizeof(RTHCPTR), 0, MM_TAG_CSAM, (void *)&pVM->csam.s.pPDBitmapHC);
247	AssertRCReturn(rc, rc);
248	rc = MMR3HyperAllocOnceNoRel(pVM, CSAM_PGDIRBMP_CHUNKSsizeof(RTRCPTR), 0, MM_TAG_CSAM, (void *)&pVM->csam.s.pPDGCBitmapHC);
249	AssertRCReturn(rc, rc);
250	pVM->csam.s.pPDBitmapGC = MMHyperR3ToRC(pVM, pVM->csam.s.pPDGCBitmapHC);
251	pVM->csam.s.pPDHCBitmapGC = MMHyperR3ToRC(pVM, pVM->csam.s.pPDBitmapHC);
252
253	rc = csamReinit(pVM);
254	AssertRCReturn(rc, rc);
255
256	/*
257	* Register save and load state notifiers.
258	*/
259	rc = SSMR3RegisterInternal(pVM, "CSAM", 0, CSAM_SSM_VERSION, sizeof(pVM->csam.s) + PAGE_SIZE*16,
260	NULL, NULL, NULL,
261	NULL, csamr3Save, NULL,
262	NULL, csamr3Load, NULL);
263	AssertRCReturn(rc, rc);
264
265	STAM_REG(pVM, &pVM->csam.s.StatNrTraps, STAMTYPE_COUNTER, "/CSAM/PageTraps", STAMUNIT_OCCURENCES, "The number of CSAM page traps.");
266	STAM_REG(pVM, &pVM->csam.s.StatDangerousWrite, STAMTYPE_COUNTER, "/CSAM/DangerousWrites", STAMUNIT_OCCURENCES, "The number of dangerous writes that cause a context switch.");
267
268	STAM_REG(pVM, &pVM->csam.s.StatNrPageNPHC, STAMTYPE_COUNTER, "/CSAM/HC/PageNotPresent", STAMUNIT_OCCURENCES, "The number of CSAM pages marked not present.");
269	STAM_REG(pVM, &pVM->csam.s.StatNrPageNPGC, STAMTYPE_COUNTER, "/CSAM/GC/PageNotPresent", STAMUNIT_OCCURENCES, "The number of CSAM pages marked not present.");
270	STAM_REG(pVM, &pVM->csam.s.StatNrPages, STAMTYPE_COUNTER, "/CSAM/PageRec/AddedRW", STAMUNIT_OCCURENCES, "The number of CSAM page records (RW monitoring).");
271	STAM_REG(pVM, &pVM->csam.s.StatNrPagesInv, STAMTYPE_COUNTER, "/CSAM/PageRec/AddedRWI", STAMUNIT_OCCURENCES, "The number of CSAM page records (RW & invalidation monitoring).");
272	STAM_REG(pVM, &pVM->csam.s.StatNrRemovedPages, STAMTYPE_COUNTER, "/CSAM/PageRec/Removed", STAMUNIT_OCCURENCES, "The number of removed CSAM page records.");
273	STAM_REG(pVM, &pVM->csam.s.StatPageRemoveREMFlush,STAMTYPE_COUNTER, "/CSAM/PageRec/Removed/REMFlush", STAMUNIT_OCCURENCES, "The number of removed CSAM page records that caused a REM flush.");
274
275	STAM_REG(pVM, &pVM->csam.s.StatNrPatchPages, STAMTYPE_COUNTER, "/CSAM/PageRec/Patch", STAMUNIT_OCCURENCES, "The number of CSAM patch page records.");
276	STAM_REG(pVM, &pVM->csam.s.StatNrUserPages, STAMTYPE_COUNTER, "/CSAM/PageRec/Ignore/User", STAMUNIT_OCCURENCES, "The number of CSAM user page records (ignored).");
277	STAM_REG(pVM, &pVM->csam.s.StatPagePATM, STAMTYPE_COUNTER, "/CSAM/PageRec/Type/PATM", STAMUNIT_OCCURENCES, "The number of PATM page records.");
278	STAM_REG(pVM, &pVM->csam.s.StatPageCSAM, STAMTYPE_COUNTER, "/CSAM/PageRec/Type/CSAM", STAMUNIT_OCCURENCES, "The number of CSAM page records.");
279	STAM_REG(pVM, &pVM->csam.s.StatPageREM, STAMTYPE_COUNTER, "/CSAM/PageRec/Type/REM", STAMUNIT_OCCURENCES, "The number of REM page records.");
280	STAM_REG(pVM, &pVM->csam.s.StatPageMonitor, STAMTYPE_COUNTER, "/CSAM/PageRec/Monitored", STAMUNIT_OCCURENCES, "The number of monitored pages.");
281
282	STAM_REG(pVM, &pVM->csam.s.StatCodePageModified, STAMTYPE_COUNTER, "/CSAM/Monitor/DirtyPage", STAMUNIT_OCCURENCES, "The number of code page modifications.");
283
284	STAM_REG(pVM, &pVM->csam.s.StatNrFlushes, STAMTYPE_COUNTER, "/CSAM/PageFlushes", STAMUNIT_OCCURENCES, "The number of CSAM page flushes.");
285	STAM_REG(pVM, &pVM->csam.s.StatNrFlushesSkipped, STAMTYPE_COUNTER, "/CSAM/PageFlushesSkipped", STAMUNIT_OCCURENCES, "The number of CSAM page flushes that were skipped.");
286	STAM_REG(pVM, &pVM->csam.s.StatNrKnownPagesHC, STAMTYPE_COUNTER, "/CSAM/HC/KnownPageRecords", STAMUNIT_OCCURENCES, "The number of known CSAM page records.");
287	STAM_REG(pVM, &pVM->csam.s.StatNrKnownPagesGC, STAMTYPE_COUNTER, "/CSAM/GC/KnownPageRecords", STAMUNIT_OCCURENCES, "The number of known CSAM page records.");
288	STAM_REG(pVM, &pVM->csam.s.StatNrInstr, STAMTYPE_COUNTER, "/CSAM/ScannedInstr", STAMUNIT_OCCURENCES, "The number of scanned instructions.");
289	STAM_REG(pVM, &pVM->csam.s.StatNrBytesRead, STAMTYPE_COUNTER, "/CSAM/BytesRead", STAMUNIT_OCCURENCES, "The number of bytes read for scanning.");
290	STAM_REG(pVM, &pVM->csam.s.StatNrOpcodeRead, STAMTYPE_COUNTER, "/CSAM/OpcodeBytesRead", STAMUNIT_OCCURENCES, "The number of opcode bytes read by the recompiler.");
291
292	STAM_REG(pVM, &pVM->csam.s.StatBitmapAlloc, STAMTYPE_COUNTER, "/CSAM/Alloc/PageBitmap", STAMUNIT_OCCURENCES, "The number of page bitmap allocations.");
293
294	STAM_REG(pVM, &pVM->csam.s.StatInstrCacheHit, STAMTYPE_COUNTER, "/CSAM/Cache/Hit", STAMUNIT_OCCURENCES, "The number of dangerous instruction cache hits.");
295	STAM_REG(pVM, &pVM->csam.s.StatInstrCacheMiss, STAMTYPE_COUNTER, "/CSAM/Cache/Miss", STAMUNIT_OCCURENCES, "The number of dangerous instruction cache misses.");
296
297	STAM_REG(pVM, &pVM->csam.s.StatScanNextFunction, STAMTYPE_COUNTER, "/CSAM/Function/Scan/Success", STAMUNIT_OCCURENCES, "The number of found functions beyond the ret border.");
298	STAM_REG(pVM, &pVM->csam.s.StatScanNextFunctionFailed, STAMTYPE_COUNTER, "/CSAM/Function/Scan/Failed", STAMUNIT_OCCURENCES, "The number of refused functions beyond the ret border.");
299
300	STAM_REG(pVM, &pVM->csam.s.StatTime, STAMTYPE_PROFILE, "/PROF/CSAM/Scan", STAMUNIT_TICKS_PER_CALL, "Scanning overhead.");
301	STAM_REG(pVM, &pVM->csam.s.StatTimeCheckAddr, STAMTYPE_PROFILE, "/PROF/CSAM/CheckAddr", STAMUNIT_TICKS_PER_CALL, "Address check overhead.");
302	STAM_REG(pVM, &pVM->csam.s.StatTimeAddrConv, STAMTYPE_PROFILE, "/PROF/CSAM/AddrConv", STAMUNIT_TICKS_PER_CALL, "Address conversion overhead.");
303	STAM_REG(pVM, &pVM->csam.s.StatTimeFlushPage, STAMTYPE_PROFILE, "/PROF/CSAM/FlushPage", STAMUNIT_TICKS_PER_CALL, "Page flushing overhead.");
304	STAM_REG(pVM, &pVM->csam.s.StatTimeDisasm, STAMTYPE_PROFILE, "/PROF/CSAM/Disasm", STAMUNIT_TICKS_PER_CALL, "Disassembly overhead.");
305	STAM_REG(pVM, &pVM->csam.s.StatFlushDirtyPages, STAMTYPE_PROFILE, "/PROF/CSAM/FlushDirtyPage", STAMUNIT_TICKS_PER_CALL, "Dirty page flushing overhead.");
306	STAM_REG(pVM, &pVM->csam.s.StatCheckGates, STAMTYPE_PROFILE, "/PROF/CSAM/CheckGates", STAMUNIT_TICKS_PER_CALL, "CSAMR3CheckGates overhead.");
307
308	/*
309	* Check CFGM option and enable/disable CSAM.
310	*/
311	bool fEnabled;
312	rc = CFGMR3QueryBool(CFGMR3GetRoot(pVM), "CSAMEnabled", &fEnabled);
313	if (RT_FAILURE(rc))
314	#ifdef CSAM_ENABLE
315	fEnabled = true;
316	#else
317	fEnabled = false;
318	#endif
319	if (fEnabled)
320	CSAMEnableScanning(pVM);
321
322	#ifdef VBOX_WITH_DEBUGGER
323	/*
324	* Debugger commands.
325	*/
326	static bool fRegisteredCmds = false;
327	if (!fRegisteredCmds)
328	{
329	rc = DBGCRegisterCommands(&g_aCmds[0], RT_ELEMENTS(g_aCmds));
330	if (RT_SUCCESS(rc))
331	fRegisteredCmds = true;
332	}
333	#endif
334
335	return VINF_SUCCESS;
336	}
337
338	/**
339	* (Re)initializes CSAM
340	*
341	* @param pVM The VM.
342	*/
343	static int csamReinit(PVM pVM)
344	{
345	/*
346	* Assert alignment and sizes.
347	*/
348	AssertRelease(!(RT_OFFSETOF(VM, csam.s) & 31));
349	AssertRelease(sizeof(pVM->csam.s) <= sizeof(pVM->csam.padding));
350	AssertRelease(!HMIsEnabled(pVM));
351
352	/*
353	* Setup any fixed pointers and offsets.
354	*/
355	pVM->csam.s.offVM = RT_OFFSETOF(VM, patm);
356
357	pVM->csam.s.fGatesChecked = false;
358	pVM->csam.s.fScanningStarted = false;
359
360	PVMCPU pVCpu = &pVM->aCpus[0]; /* raw mode implies 1 VPCU */
361	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_CSAM_PENDING_ACTION);
362	pVM->csam.s.cDirtyPages = 0;
363	/* not necessary */
364	memset(pVM->csam.s.pvDirtyBasePage, 0, sizeof(pVM->csam.s.pvDirtyBasePage));
365	memset(pVM->csam.s.pvDirtyFaultPage, 0, sizeof(pVM->csam.s.pvDirtyFaultPage));
366
367	memset(&pVM->csam.s.aDangerousInstr, 0, sizeof(pVM->csam.s.aDangerousInstr));
368	pVM->csam.s.cDangerousInstr = 0;
369	pVM->csam.s.iDangerousInstr = 0;
370
371	memset(pVM->csam.s.pvCallInstruction, 0, sizeof(pVM->csam.s.pvCallInstruction));
372	pVM->csam.s.iCallInstruction = 0;
373
374	/** @note never mess with the pgdir bitmap here! */
375	return VINF_SUCCESS;
376	}
377
378	/**
379	* Applies relocations to data and code managed by this
380	* component. This function will be called at init and
381	* whenever the VMM need to relocate itself inside the GC.
382	*
383	* The csam will update the addresses used by the switcher.
384	*
385	* @param pVM The VM.
386	* @param offDelta Relocation delta.
387	*/
388	VMMR3_INT_DECL(void) CSAMR3Relocate(PVM pVM, RTGCINTPTR offDelta)
389	{
390	if (offDelta && !HMIsEnabled(pVM))
391	{
392	/* Adjust pgdir and page bitmap pointers. */
393	pVM->csam.s.pPDBitmapGC = MMHyperR3ToRC(pVM, pVM->csam.s.pPDGCBitmapHC);
394	pVM->csam.s.pPDHCBitmapGC = MMHyperR3ToRC(pVM, pVM->csam.s.pPDBitmapHC);
395
396	for(int i=0;i<CSAM_PGDIRBMP_CHUNKS;i++)
397	{
398	if (pVM->csam.s.pPDGCBitmapHC[i])
399	{
400	pVM->csam.s.pPDGCBitmapHC[i] += offDelta;
401	}
402	}
403	}
404	return;
405	}
406
407	/**
408	* Terminates the csam.
409	*
410	* Termination means cleaning up and freeing all resources,
411	* the VM it self is at this point powered off or suspended.
412	*
413	* @returns VBox status code.
414	* @param pVM Pointer to the VM.
415	*/
416	VMMR3_INT_DECL(int) CSAMR3Term(PVM pVM)
417	{
418	if (HMIsEnabled(pVM))
419	return VINF_SUCCESS;
420
421	int rc;
422
423	rc = CSAMR3Reset(pVM);
424	AssertRC(rc);
425
426	/* @todo triggers assertion in MMHyperFree */
427	#if 0
428	for(int i=0;i<CSAM_PAGEBMP_CHUNKS;i++)
429	{
430	if (pVM->csam.s.pPDBitmapHC[i])
431	MMHyperFree(pVM, pVM->csam.s.pPDBitmapHC[i]);
432	}
433	#endif
434
435	return VINF_SUCCESS;
436	}
437
438	/**
439	* CSAM reset callback.
440	*
441	* @returns VBox status code.
442	* @param pVM The VM which is reset.
443	*/
444	VMMR3_INT_DECL(int) CSAMR3Reset(PVM pVM)
445	{
446	if (HMIsEnabled(pVM))
447	return VINF_SUCCESS;
448
449	/* Clear page bitmaps. */
450	for (int i = 0; i < CSAM_PGDIRBMP_CHUNKS; i++)
451	{
452	if (pVM->csam.s.pPDBitmapHC[i])
453	{
454	Assert((CSAM_PAGE_BITMAP_SIZE& 3) == 0);
455	ASMMemZero32(pVM->csam.s.pPDBitmapHC[i], CSAM_PAGE_BITMAP_SIZE);
456	}
457	}
458
459	/* Remove all CSAM page records. */
460	for (;;)
461	{
462	PCSAMPAGEREC pPageRec = (PCSAMPAGEREC)RTAvlPVGetBestFit(&pVM->csam.s.pPageTree, 0, true);
463	if (!pPageRec)
464	break;
465	csamRemovePageRecord(pVM, pPageRec->page.pPageGC);
466	}
467	Assert(!pVM->csam.s.pPageTree);
468
469	csamReinit(pVM);
470
471	return VINF_SUCCESS;
472	}
473
474
475	/**
476	* Callback function for RTAvlPVDoWithAll
477	*
478	* Counts the number of records in the tree
479	*
480	* @returns VBox status code.
481	* @param pNode Current node
482	* @param pcPatches Pointer to patch counter
483	*/
484	static DECLCALLBACK(int) CountRecord(PAVLPVNODECORE pNode, void *pcPatches)
485	{
486	NOREF(pNode);
487	(uint32_t )pcPatches = (uint32_t )pcPatches + 1;
488	return VINF_SUCCESS;
489	}
490
491	/**
492	* Callback function for RTAvlPVDoWithAll
493	*
494	* Saves the state of the page record
495	*
496	* @returns VBox status code.
497	* @param pNode Current node
498	* @param pVM1 Pointer to the VM
499	*/
500	static DECLCALLBACK(int) SavePageState(PAVLPVNODECORE pNode, void *pVM1)
501	{
502	PVM pVM = (PVM)pVM1;
503	PCSAMPAGEREC pPage = (PCSAMPAGEREC)pNode;
504	CSAMPAGEREC page = *pPage;
505	PSSMHANDLE pSSM = pVM->csam.s.savedstate.pSSM;
506	int rc;
507
508	/* Save the page record itself */
509	rc = SSMR3PutMem(pSSM, &page, sizeof(page));
510	AssertRCReturn(rc, rc);
511
512	if (page.page.pBitmap)
513	{
514	rc = SSMR3PutMem(pSSM, page.page.pBitmap, CSAM_PAGE_BITMAP_SIZE);
515	AssertRCReturn(rc, rc);
516	}
517
518	return VINF_SUCCESS;
519	}
520
521	/**
522	* Execute state save operation.
523	*
524	* @returns VBox status code.
525	* @param pVM Pointer to the VM.
526	* @param pSSM SSM operation handle.
527	*/
528	static DECLCALLBACK(int) csamr3Save(PVM pVM, PSSMHANDLE pSSM)
529	{
530	CSAM csamInfo = pVM->csam.s;
531	int rc;
532
533	/*
534	* Count the number of page records in the tree (feeling lazy)
535	*/
536	csamInfo.savedstate.cPageRecords = 0;
537	RTAvlPVDoWithAll(&pVM->csam.s.pPageTree, true, CountRecord, &csamInfo.savedstate.cPageRecords);
538
539	/*
540	* Save CSAM structure
541	*/
542	pVM->csam.s.savedstate.pSSM = pSSM;
543	rc = SSMR3PutMem(pSSM, &csamInfo, sizeof(csamInfo));
544	AssertRCReturn(rc, rc);
545
546	/* Save pgdir bitmap */
547	rc = SSMR3PutMem(pSSM, csamInfo.pPDBitmapHC, CSAM_PGDIRBMP_CHUNKS*sizeof(RTHCPTR));
548	AssertRCReturn(rc, rc);
549
550	for (unsigned i=0;i<CSAM_PGDIRBMP_CHUNKS;i++)
551	{
552	if(csamInfo.pPDBitmapHC[i])
553	{
554	/* Save the page bitmap. */
555	rc = SSMR3PutMem(pSSM, csamInfo.pPDBitmapHC[i], CSAM_PAGE_BITMAP_SIZE);
556	AssertRCReturn(rc, rc);
557	}
558	}
559
560	/*
561	* Save page records
562	*/
563	rc = RTAvlPVDoWithAll(&pVM->csam.s.pPageTree, true, SavePageState, pVM);
564	AssertRCReturn(rc, rc);
565
566	/** @note we don't restore aDangerousInstr; it will be recreated automatically. */
567	return VINF_SUCCESS;
568	}
569
570
571	/**
572	* @callback_method_impl{FNSSMINTLOADEXEC, Dummy load function for HM mode.}
573	*/
574	DECLCALLBACK(int) csamR3LoadDummy(PVM pVM, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass)
575	{
576	return SSMR3SkipToEndOfUnit(pSSM);
577	}
578
579
580	/**
581	* Execute state load operation.
582	*
583	* @returns VBox status code.
584	* @param pVM Pointer to the VM.
585	* @param pSSM SSM operation handle.
586	* @param uVersion Data layout version.
587	* @param uPass The data pass.
588	*/
589	static DECLCALLBACK(int) csamr3Load(PVM pVM, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass)
590	{
591	int rc;
592	CSAM csamInfo;
593
594	Assert(uPass == SSM_PASS_FINAL); NOREF(uPass);
595	if (uVersion != CSAM_SSM_VERSION)
596	{
597	AssertMsgFailed(("csamR3Load: Invalid version uVersion=%d!\n", uVersion));
598	return VERR_SSM_UNSUPPORTED_DATA_UNIT_VERSION;
599	}
600
601	pVM->csam.s.savedstate.pSSM = pSSM;
602
603	/*
604	* Restore CSAM structure
605	*/
606	RT_ZERO(csamInfo);
607	rc = SSMR3GetStructEx(pSSM, &csamInfo, sizeof(csamInfo), SSMSTRUCT_FLAGS_MEM_BAND_AID_RELAXED, &g_aCsamFields[0], NULL);
608	AssertRCReturn(rc, rc);
609
610	pVM->csam.s.fGatesChecked = csamInfo.fGatesChecked;
611	pVM->csam.s.fScanningStarted = csamInfo.fScanningStarted;
612
613	/* Restore dirty code page info. */
614	pVM->csam.s.cDirtyPages = csamInfo.cDirtyPages;
615	memcpy(pVM->csam.s.pvDirtyBasePage, csamInfo.pvDirtyBasePage, sizeof(pVM->csam.s.pvDirtyBasePage));
616	memcpy(pVM->csam.s.pvDirtyFaultPage, csamInfo.pvDirtyFaultPage, sizeof(pVM->csam.s.pvDirtyFaultPage));
617
618	/* Restore possible code page */
619	pVM->csam.s.cPossibleCodePages = csamInfo.cPossibleCodePages;
620	memcpy(pVM->csam.s.pvPossibleCodePage, csamInfo.pvPossibleCodePage, sizeof(pVM->csam.s.pvPossibleCodePage));
621
622	/* Restore pgdir bitmap (we'll change the pointers next). */
623	rc = SSMR3GetStructEx(pSSM, pVM->csam.s.pPDBitmapHC, sizeof(uint8_t ) CSAM_PGDIRBMP_CHUNKS,
624	SSMSTRUCT_FLAGS_MEM_BAND_AID_RELAXED, &g_aCsamPDBitmapArray[0], NULL);
625	AssertRCReturn(rc, rc);
626
627	/*
628	* Restore page bitmaps
629	*/
630	for (unsigned i=0;i<CSAM_PGDIRBMP_CHUNKS;i++)
631	{
632	if(pVM->csam.s.pPDBitmapHC[i])
633	{
634	rc = MMHyperAlloc(pVM, CSAM_PAGE_BITMAP_SIZE, 0, MM_TAG_CSAM, (void **)&pVM->csam.s.pPDBitmapHC[i]);
635	if (RT_FAILURE(rc))
636	{
637	Log(("MMHyperAlloc failed with %Rrc\n", rc));
638	return rc;
639	}
640	/* Convert to GC pointer. */
641	pVM->csam.s.pPDGCBitmapHC[i] = MMHyperR3ToRC(pVM, pVM->csam.s.pPDBitmapHC[i]);
642	Assert(pVM->csam.s.pPDGCBitmapHC[i]);
643
644	/* Restore the bitmap. */
645	rc = SSMR3GetMem(pSSM, pVM->csam.s.pPDBitmapHC[i], CSAM_PAGE_BITMAP_SIZE);
646	AssertRCReturn(rc, rc);
647	}
648	else
649	{
650	Assert(!pVM->csam.s.pPDGCBitmapHC[i]);
651	pVM->csam.s.pPDGCBitmapHC[i] = 0;
652	}
653	}
654
655	/*
656	* Restore page records
657	*/
658	for (uint32_t i=0;i<csamInfo.savedstate.cPageRecords + csamInfo.savedstate.cPatchPageRecords;i++)
659	{
660	CSAMPAGEREC page;
661	PCSAMPAGE pPage;
662
663	RT_ZERO(page);
664	rc = SSMR3GetStructEx(pSSM, &page, sizeof(page), SSMSTRUCT_FLAGS_MEM_BAND_AID_RELAXED, &g_aCsamPageRecFields[0], NULL);
665	AssertRCReturn(rc, rc);
666
667	/*
668	* Recreate the page record
669	*/
670	pPage = csamCreatePageRecord(pVM, page.page.pPageGC, page.page.enmTag, page.page.fCode32, page.page.fMonitorInvalidation);
671	AssertReturn(pPage, VERR_NO_MEMORY);
672
673	pPage->GCPhys = page.page.GCPhys;
674	pPage->fFlags = page.page.fFlags;
675	pPage->u64Hash = page.page.u64Hash;
676
677	if (page.page.pBitmap)
678	{
679	rc = SSMR3GetMem(pSSM, pPage->pBitmap, CSAM_PAGE_BITMAP_SIZE);
680	AssertRCReturn(rc, rc);
681	}
682	else
683	{
684	MMR3HeapFree(pPage->pBitmap);
685	pPage->pBitmap = 0;
686	}
687	}
688
689	/* Note: we don't restore aDangerousInstr; it will be recreated automatically. */
690	memset(&pVM->csam.s.aDangerousInstr, 0, sizeof(pVM->csam.s.aDangerousInstr));
691	pVM->csam.s.cDangerousInstr = 0;
692	pVM->csam.s.iDangerousInstr = 0;
693	return VINF_SUCCESS;
694	}
695
696	/**
697	* Convert guest context address to host context pointer
698	*
699	* @returns Byte pointer (ring-3 context) corresponding to pGCPtr on success,
700	* NULL on failure.
701	* @param pVM Pointer to the VM.
702	* @param pCacheRec Address conversion cache record
703	* @param pGCPtr Guest context pointer
704	* @returns Host context pointer or NULL in case of an error
705	*
706	*/
707	static uint8_t csamR3GCVirtToHCVirt(PVM pVM, PCSAMP2GLOOKUPREC pCacheRec, RCPTRTYPE(uint8_t ) pGCPtr)
708	{
709	int rc;
710	void *pHCPtr;
711	Assert(pVM->cCpus == 1);
712	PVMCPU pVCpu = VMMGetCpu0(pVM);
713
714	STAM_PROFILE_START(&pVM->csam.s.StatTimeAddrConv, a);
715
716	pHCPtr = PATMR3GCPtrToHCPtr(pVM, pGCPtr);
717	if (pHCPtr)
718	return (uint8_t *)pHCPtr;
719
720	if (pCacheRec->pPageLocStartHC)
721	{
722	uint32_t offset = pGCPtr & PAGE_OFFSET_MASK;
723	if (pCacheRec->pGuestLoc == (pGCPtr & PAGE_BASE_GC_MASK))
724	{
725	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeAddrConv, a);
726	return pCacheRec->pPageLocStartHC + offset;
727	}
728	}
729
730	/* Release previous lock if any. */
731	if (pCacheRec->Lock.pvMap)
732	{
733	PGMPhysReleasePageMappingLock(pVM, &pCacheRec->Lock);
734	pCacheRec->Lock.pvMap = NULL;
735	}
736
737	rc = PGMPhysGCPtr2CCPtrReadOnly(pVCpu, pGCPtr, (const void **)&pHCPtr, &pCacheRec->Lock);
738	if (rc != VINF_SUCCESS)
739	{
740	//// AssertMsgRC(rc, ("MMR3PhysGCVirt2HCVirtEx failed for %RRv\n", pGCPtr));
741	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeAddrConv, a);
742	return NULL;
743	}
744
745	pCacheRec->pPageLocStartHC = (uint8_t*)((uintptr_t)pHCPtr & PAGE_BASE_HC_MASK);
746	pCacheRec->pGuestLoc = pGCPtr & PAGE_BASE_GC_MASK;
747	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeAddrConv, a);
748	return (uint8_t *)pHCPtr;
749	}
750
751
752	/** For csamR3ReadBytes. */
753	typedef struct CSAMDISINFO
754	{
755	PVM pVM;
756	uint8_t const pbSrcInstr; / aka pInstHC */
757	} CSAMDISINFO, *PCSAMDISINFO;
758
759
760	/**
761	* @callback_method_impl{FNDISREADBYTES}
762	*/
763	static DECLCALLBACK(int) csamR3ReadBytes(PDISCPUSTATE pDis, uint8_t offInstr, uint8_t cbMinRead, uint8_t cbMaxRead)
764	{
765	PCSAMDISINFO pDisInfo = (PCSAMDISINFO)pDis->pvUser;
766
767	/*
768	* We are not interested in patched instructions, so read the original opcode bytes.
769	*
770	* Note! single instruction patches (int3) are checked in CSAMR3AnalyseCallback
771	*
772	* Since we're decoding one instruction at the time, we don't need to be
773	* concerned about any patched instructions following the first one. We
774	* could in fact probably skip this PATM call for offInstr != 0.
775	*/
776	size_t cbRead = cbMaxRead;
777	RTUINTPTR uSrcAddr = pDis->uInstrAddr + offInstr;
778	int rc = PATMR3ReadOrgInstr(pDisInfo->pVM, pDis->uInstrAddr + offInstr, &pDis->abInstr[offInstr], cbRead, &cbRead);
779	if (RT_SUCCESS(rc))
780	{
781	if (cbRead >= cbMinRead)
782	{
783	pDis->cbCachedInstr = offInstr + (uint8_t)cbRead;
784	return rc;
785	}
786
787	cbMinRead -= (uint8_t)cbRead;
788	cbMaxRead -= (uint8_t)cbRead;
789	offInstr += (uint8_t)cbRead;
790	uSrcAddr += cbRead;
791	}
792
793	/*
794	* The current byte isn't a patch instruction byte.
795	*/
796	AssertPtr(pDisInfo->pbSrcInstr);
797	if ((pDis->uInstrAddr >> PAGE_SHIFT) == ((uSrcAddr + cbMaxRead - 1) >> PAGE_SHIFT))
798	{
799	memcpy(&pDis->abInstr[offInstr], &pDisInfo->pbSrcInstr[offInstr], cbMaxRead);
800	offInstr += cbMaxRead;
801	rc = VINF_SUCCESS;
802	}
803	else if ( (pDis->uInstrAddr >> PAGE_SHIFT) == ((uSrcAddr + cbMinRead - 1) >> PAGE_SHIFT)
804	\|\| PATMIsPatchGCAddr(pDisInfo->pVM, uSrcAddr) /** @todo does CSAM actually analyze patch code, or is this just a copy&past check? */
805	)
806	{
807	memcpy(&pDis->abInstr[offInstr], &pDisInfo->pbSrcInstr[offInstr], cbMinRead);
808	offInstr += cbMinRead;
809	rc = VINF_SUCCESS;
810	}
811	else
812	{
813	/* Crossed page boundrary, pbSrcInstr is no good... */
814	rc = PGMPhysSimpleReadGCPtr(VMMGetCpu0(pDisInfo->pVM), &pDis->abInstr[offInstr], uSrcAddr, cbMinRead);
815	offInstr += cbMinRead;
816	}
817
818	pDis->cbCachedInstr = offInstr;
819	return rc;
820	}
821
822	DECLINLINE(int) csamR3DISInstr(PVM pVM, RTRCPTR InstrGC, uint8_t *InstrHC, DISCPUMODE enmCpuMode,
823	PDISCPUSTATE pCpu, uint32_t pcbInstr, char pszOutput, size_t cbOutput)
824	{
825	CSAMDISINFO DisInfo = { pVM, InstrHC };
826	#ifdef DEBUG
827	return DISInstrToStrEx(InstrGC, enmCpuMode, csamR3ReadBytes, &DisInfo, DISOPTYPE_ALL,
828	pCpu, pcbInstr, pszOutput, cbOutput);
829	#else
830	/* We are interested in everything except harmless stuff */
831	if (pszOutput)
832	return DISInstrToStrEx(InstrGC, enmCpuMode, csamR3ReadBytes, &DisInfo,
833	~(DISOPTYPE_INVALID \| DISOPTYPE_HARMLESS \| DISOPTYPE_RRM_MASK),
834	pCpu, pcbInstr, pszOutput, cbOutput);
835	return DISInstrEx(InstrGC, enmCpuMode, ~(DISOPTYPE_INVALID \| DISOPTYPE_HARMLESS \| DISOPTYPE_RRM_MASK),
836	csamR3ReadBytes, &DisInfo, pCpu, pcbInstr);
837	#endif
838	}
839
840	/**
841	* Analyses the instructions following the cli for compliance with our heuristics for cli
842	*
843	* @returns VBox status code.
844	* @param pVM Pointer to the VM.
845	* @param pCpu CPU disassembly state
846	* @param pInstrGC Guest context pointer to privileged instruction
847	* @param pCurInstrGC Guest context pointer to the current instruction
848	* @param pCacheRec GC to HC cache record
849	* @param pUserData User pointer (callback specific)
850	*
851	*/
852	static int CSAMR3AnalyseCallback(PVM pVM, DISCPUSTATE pCpu, RCPTRTYPE(uint8_t ) pInstrGC, RCPTRTYPE(uint8_t *) pCurInstrGC,
853	PCSAMP2GLOOKUPREC pCacheRec, void *pUserData)
854	{
855	PCSAMPAGE pPage = (PCSAMPAGE)pUserData;
856	int rc;
857	NOREF(pInstrGC);
858
859	switch (pCpu->pCurInstr->uOpcode)
860	{
861	case OP_INT:
862	Assert(pCpu->Param1.fUse & DISUSE_IMMEDIATE8);
863	if (pCpu->Param1.uValue == 3)
864	{
865	//two byte int 3
866	return VINF_SUCCESS;
867	}
868	break;
869
870	/* removing breaks win2k guests? */
871	case OP_IRET:
872	if (EMIsRawRing1Enabled(pVM))
873	break;
874	/* no break */
875
876	case OP_ILLUD2:
877	/* This appears to be some kind of kernel panic in Linux 2.4; no point to continue. */
878	case OP_RETN:
879	case OP_INT3:
880	case OP_INVALID:
881	return VINF_SUCCESS;
882	}
883
884	// Check for exit points
885	switch (pCpu->pCurInstr->uOpcode)
886	{
887	/* It's not a good idea to patch pushf instructions:
888	* - increases the chance of conflicts (code jumping to the next instruction)
889	* - better to patch the cli
890	* - code that branches before the cli will likely hit an int 3
891	* - in general doesn't offer any benefits as we don't allow nested patch blocks (IF is always 1)
892	*/
893	case OP_PUSHF:
894	case OP_POPF:
895	break;
896
897	case OP_CLI:
898	{
899	uint32_t cbInstrs = 0;
900	uint32_t cbCurInstr = pCpu->cbInstr;
901	bool fCode32 = pPage->fCode32;
902
903	Assert(fCode32);
904
905	PATMR3AddHint(pVM, pCurInstrGC, (fCode32) ? PATMFL_CODE32 : 0);
906
907	/* Make sure the instructions that follow the cli have not been encountered before. */
908	while (true)
909	{
910	DISCPUSTATE cpu;
911
912	if (cbInstrs + cbCurInstr >= SIZEOF_NEARJUMP32)
913	break;
914
915	if (csamIsCodeScanned(pVM, pCurInstrGC + cbCurInstr, &pPage) == true)
916	{
917	/* We've scanned the next instruction(s) already. This means we've
918	followed a branch that ended up there before -> dangerous!! */
919	PATMR3DetectConflict(pVM, pCurInstrGC, pCurInstrGC + cbCurInstr);
920	break;
921	}
922	pCurInstrGC += cbCurInstr;
923	cbInstrs += cbCurInstr;
924
925	{ /* Force pCurInstrHC out of scope after we stop using it (page lock!) */
926	uint8_t *pCurInstrHC = csamR3GCVirtToHCVirt(pVM, pCacheRec, pCurInstrGC);
927	if (pCurInstrHC == NULL)
928	{
929	Log(("csamR3GCVirtToHCVirt failed for %RRv\n", pCurInstrGC));
930	break;
931	}
932	Assert(VALID_PTR(pCurInstrHC));
933
934	rc = csamR3DISInstr(pVM, pCurInstrGC, pCurInstrHC, (fCode32) ? DISCPUMODE_32BIT : DISCPUMODE_16BIT,
935	&cpu, &cbCurInstr, NULL, 0);
936	}
937	AssertRC(rc);
938	if (RT_FAILURE(rc))
939	break;
940	}
941	break;
942	}
943
944	#ifdef VBOX_WITH_RAW_RING1
945	case OP_MOV:
946	/* mov xx, CS is a dangerous instruction as our raw ring usage leaks through. */
947	if ( EMIsRawRing1Enabled(pVM)
948	&& (pCpu->Param2.fUse & DISUSE_REG_SEG)
949	&& (pCpu->Param2.Base.idxSegReg == DISSELREG_CS))
950	{
951	Log(("CSAM: Patching dangerous 'mov xx, cs' instruction at %RGv with an int3\n", pCurInstrGC));
952	if (PATMR3HasBeenPatched(pVM, pCurInstrGC) == false)
953	{
954	rc = PATMR3InstallPatch(pVM, pCurInstrGC, (pPage->fCode32) ? PATMFL_CODE32 : 0);
955	if (RT_FAILURE(rc))
956	{
957	Log(("PATMR3InstallPatch failed with %d\n", rc));
958	return VWRN_CONTINUE_ANALYSIS;
959	}
960	}
961	return VWRN_CONTINUE_ANALYSIS;
962	}
963	break;
964	#endif
965
966	case OP_PUSH:
967	/** @todo broken comparison!! should be if ((pCpu->Param1.fUse & DISUSE_REG_SEG) && (pCpu->Param1.Base.idxSegReg == DISSELREG_SS)) */
968	if (pCpu->pCurInstr->fParam1 != OP_PARM_REG_CS)
969	break;
970
971	/* no break */
972	#ifndef VBOX_WITH_SAFE_STR
973	case OP_STR:
974	#endif
975	case OP_LSL:
976	case OP_LAR:
977	case OP_SGDT:
978	case OP_SLDT:
979	case OP_SIDT:
980	case OP_SMSW:
981	case OP_VERW:
982	case OP_VERR:
983	case OP_CPUID:
984	case OP_IRET:
985	#ifdef DEBUG
986	switch(pCpu->pCurInstr->uOpcode)
987	{
988	case OP_STR:
989	Log(("Privileged instruction at %RRv: str!!\n", pCurInstrGC));
990	break;
991	case OP_LSL:
992	Log(("Privileged instruction at %RRv: lsl!!\n", pCurInstrGC));
993	break;
994	case OP_LAR:
995	Log(("Privileged instruction at %RRv: lar!!\n", pCurInstrGC));
996	break;
997	case OP_SGDT:
998	Log(("Privileged instruction at %RRv: sgdt!!\n", pCurInstrGC));
999	break;
1000	case OP_SLDT:
1001	Log(("Privileged instruction at %RRv: sldt!!\n", pCurInstrGC));
1002	break;
1003	case OP_SIDT:
1004	Log(("Privileged instruction at %RRv: sidt!!\n", pCurInstrGC));
1005	break;
1006	case OP_SMSW:
1007	Log(("Privileged instruction at %RRv: smsw!!\n", pCurInstrGC));
1008	break;
1009	case OP_VERW:
1010	Log(("Privileged instruction at %RRv: verw!!\n", pCurInstrGC));
1011	break;
1012	case OP_VERR:
1013	Log(("Privileged instruction at %RRv: verr!!\n", pCurInstrGC));
1014	break;
1015	case OP_CPUID:
1016	Log(("Privileged instruction at %RRv: cpuid!!\n", pCurInstrGC));
1017	break;
1018	case OP_PUSH:
1019	Log(("Privileged instruction at %RRv: push cs!!\n", pCurInstrGC));
1020	break;
1021	case OP_IRET:
1022	Log(("Privileged instruction at %RRv: iret!!\n", pCurInstrGC));
1023	break;
1024	}
1025	#endif
1026
1027	if (PATMR3HasBeenPatched(pVM, pCurInstrGC) == false)
1028	{
1029	rc = PATMR3InstallPatch(pVM, pCurInstrGC, (pPage->fCode32) ? PATMFL_CODE32 : 0);
1030	if (RT_FAILURE(rc))
1031	{
1032	Log(("PATMR3InstallPatch failed with %d\n", rc));
1033	return VWRN_CONTINUE_ANALYSIS;
1034	}
1035	}
1036	if (pCpu->pCurInstr->uOpcode == OP_IRET)
1037	return VINF_SUCCESS; /* Look no further in this branch. */
1038
1039	return VWRN_CONTINUE_ANALYSIS;
1040
1041	case OP_JMP:
1042	case OP_CALL:
1043	{
1044	// return or jump/call through a jump table
1045	if (OP_PARM_VTYPE(pCpu->pCurInstr->fParam1) != OP_PARM_J)
1046	{
1047	#ifdef DEBUG
1048	switch(pCpu->pCurInstr->uOpcode)
1049	{
1050	case OP_JMP:
1051	Log(("Control Flow instruction at %RRv: jmp!!\n", pCurInstrGC));
1052	break;
1053	case OP_CALL:
1054	Log(("Control Flow instruction at %RRv: call!!\n", pCurInstrGC));
1055	break;
1056	}
1057	#endif
1058	return VWRN_CONTINUE_ANALYSIS;
1059	}
1060	return VWRN_CONTINUE_ANALYSIS;
1061	}
1062
1063	}
1064
1065	return VWRN_CONTINUE_ANALYSIS;
1066	}
1067
1068	#ifdef CSAM_ANALYSE_BEYOND_RET
1069	/**
1070	* Wrapper for csamAnalyseCodeStream for call instructions.
1071	*
1072	* @returns VBox status code.
1073	* @param pVM Pointer to the VM.
1074	* @param pInstrGC Guest context pointer to privileged instruction
1075	* @param pCurInstrGC Guest context pointer to the current instruction
1076	* @param fCode32 16 or 32 bits code
1077	* @param pfnCSAMR3Analyse Callback for testing the disassembled instruction
1078	* @param pUserData User pointer (callback specific)
1079	*
1080	*/
1081	static int csamAnalyseCallCodeStream(PVM pVM, RCPTRTYPE(uint8_t ) pInstrGC, RCPTRTYPE(uint8_t ) pCurInstrGC, bool fCode32,
1082	PFN_CSAMR3ANALYSE pfnCSAMR3Analyse, void *pUserData, PCSAMP2GLOOKUPREC pCacheRec)
1083	{
1084	int rc;
1085	CSAMCALLEXITREC CallExitRec;
1086	PCSAMCALLEXITREC pOldCallRec;
1087	PCSAMPAGE pPage = 0;
1088	uint32_t i;
1089
1090	CallExitRec.cInstrAfterRet = 0;
1091
1092	pOldCallRec = pCacheRec->pCallExitRec;
1093	pCacheRec->pCallExitRec = &CallExitRec;
1094
1095	rc = csamAnalyseCodeStream(pVM, pInstrGC, pCurInstrGC, fCode32, pfnCSAMR3Analyse, pUserData, pCacheRec);
1096
1097	for (i=0;i<CallExitRec.cInstrAfterRet;i++)
1098	{
1099	PCSAMPAGE pPage = 0;
1100
1101	pCurInstrGC = CallExitRec.pInstrAfterRetGC[i];
1102
1103	/* Check if we've previously encountered the instruction after the ret. */
1104	if (csamIsCodeScanned(pVM, pCurInstrGC, &pPage) == false)
1105	{
1106	DISCPUSTATE cpu;
1107	uint32_t cbInstr;
1108	int rc2;
1109	#ifdef DEBUG
1110	char szOutput[256];
1111	#endif
1112	if (pPage == NULL)
1113	{
1114	/* New address; let's take a look at it. */
1115	pPage = csamCreatePageRecord(pVM, pCurInstrGC, CSAM_TAG_CSAM, fCode32);
1116	if (pPage == NULL)
1117	{
1118	rc = VERR_NO_MEMORY;
1119	goto done;
1120	}
1121	}
1122
1123	/**
1124	* Some generic requirements for recognizing an adjacent function:
1125	* - alignment fillers that consist of:
1126	* - nop
1127	* - lea genregX, [genregX (+ 0)]
1128	* - push ebp after the filler (can extend this later); aligned at at least a 4 byte boundary
1129	*/
1130	for (int j = 0; j < 16; j++)
1131	{
1132	uint8_t *pCurInstrHC = csamR3GCVirtToHCVirt(pVM, pCacheRec, pCurInstrGC);
1133	if (pCurInstrHC == NULL)
1134	{
1135	Log(("csamR3GCVirtToHCVirt failed for %RRv\n", pCurInstrGC));
1136	goto done;
1137	}
1138	Assert(VALID_PTR(pCurInstrHC));
1139
1140	STAM_PROFILE_START(&pVM->csam.s.StatTimeDisasm, a);
1141	#ifdef DEBUG
1142	rc2 = csamR3DISInstr(pVM, pCurInstrGC, pCurInstrHC, (fCode32) ? DISCPUMODE_32BIT : DISCPUMODE_16BIT,
1143	&cpu, &cbInstr, szOutput, sizeof(szOutput));
1144	if (RT_SUCCESS(rc2)) Log(("CSAM Call Analysis: %s", szOutput));
1145	#else
1146	rc2 = csamR3DISInstr(pVM, pCurInstrGC, pCurInstrHC, (fCode32) ? DISCPUMODE_32BIT : DISCPUMODE_16BIT,
1147	&cpu, &cbInstr, NULL, 0);
1148	#endif
1149	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeDisasm, a);
1150	if (RT_FAILURE(rc2))
1151	{
1152	Log(("Disassembly failed at %RRv with %Rrc (probably page not present) -> return to caller\n", pCurInstrGC, rc2));
1153	goto done;
1154	}
1155
1156	STAM_COUNTER_ADD(&pVM->csam.s.StatNrBytesRead, cbInstr);
1157
1158	RCPTRTYPE(uint8_t *) addr = 0;
1159	PCSAMPAGE pJmpPage = NULL;
1160
1161	if (PAGE_ADDRESS(pCurInstrGC) != PAGE_ADDRESS(pCurInstrGC + cbInstr - 1))
1162	{
1163	if (!PGMGstIsPagePresent(pVM, pCurInstrGC + cbInstr - 1))
1164	{
1165	/// @todo fault in the page
1166	Log(("Page for current instruction %RRv is not present!!\n", pCurInstrGC));
1167	goto done;
1168	}
1169	//all is fine, let's continue
1170	csamR3CheckPageRecord(pVM, pCurInstrGC + cbInstr - 1);
1171	}
1172
1173	switch (cpu.pCurInstr->uOpcode)
1174	{
1175	case OP_NOP:
1176	case OP_INT3:
1177	break; /* acceptable */
1178
1179	case OP_LEA:
1180	/* Must be similar to:
1181	*
1182	* lea esi, [esi]
1183	* lea esi, [esi+0]
1184	* Any register is allowed as long as source and destination are identical.
1185	*/
1186	if ( cpu.Param1.fUse != DISUSE_REG_GEN32
1187	\|\| ( cpu.Param2.flags != DISUSE_REG_GEN32
1188	&& ( !(cpu.Param2.flags & DISUSE_REG_GEN32)
1189	\|\| !(cpu.Param2.flags & (DISUSE_DISPLACEMENT8\|DISUSE_DISPLACEMENT16\|DISUSE_DISPLACEMENT32))
1190	\|\| cpu.Param2.uValue != 0
1191	)
1192	)
1193	\|\| cpu.Param1.base.reg_gen32 != cpu.Param2.base.reg_gen32
1194	)
1195	{
1196	STAM_COUNTER_INC(&pVM->csam.s.StatScanNextFunctionFailed);
1197	goto next_function;
1198	}
1199	break;
1200
1201	case OP_PUSH:
1202	{
1203	if ( (pCurInstrGC & 0x3) != 0
1204	\|\| cpu.Param1.fUse != DISUSE_REG_GEN32
1205	\|\| cpu.Param1.base.reg_gen32 != USE_REG_EBP
1206	)
1207	{
1208	STAM_COUNTER_INC(&pVM->csam.s.StatScanNextFunctionFailed);
1209	goto next_function;
1210	}
1211
1212	if (csamIsCodeScanned(pVM, pCurInstrGC, &pPage) == false)
1213	{
1214	CSAMCALLEXITREC CallExitRec2;
1215	CallExitRec2.cInstrAfterRet = 0;
1216
1217	pCacheRec->pCallExitRec = &CallExitRec2;
1218
1219	/* Analyse the function. */
1220	Log(("Found new function at %RRv\n", pCurInstrGC));
1221	STAM_COUNTER_INC(&pVM->csam.s.StatScanNextFunction);
1222	csamAnalyseCallCodeStream(pVM, pInstrGC, pCurInstrGC, fCode32, pfnCSAMR3Analyse, pUserData, pCacheRec);
1223	}
1224	goto next_function;
1225	}
1226
1227	case OP_SUB:
1228	{
1229	if ( (pCurInstrGC & 0x3) != 0
1230	\|\| cpu.Param1.fUse != DISUSE_REG_GEN32
1231	\|\| cpu.Param1.base.reg_gen32 != USE_REG_ESP
1232	)
1233	{
1234	STAM_COUNTER_INC(&pVM->csam.s.StatScanNextFunctionFailed);
1235	goto next_function;
1236	}
1237
1238	if (csamIsCodeScanned(pVM, pCurInstrGC, &pPage) == false)
1239	{
1240	CSAMCALLEXITREC CallExitRec2;
1241	CallExitRec2.cInstrAfterRet = 0;
1242
1243	pCacheRec->pCallExitRec = &CallExitRec2;
1244
1245	/* Analyse the function. */
1246	Log(("Found new function at %RRv\n", pCurInstrGC));
1247	STAM_COUNTER_INC(&pVM->csam.s.StatScanNextFunction);
1248	csamAnalyseCallCodeStream(pVM, pInstrGC, pCurInstrGC, fCode32, pfnCSAMR3Analyse, pUserData, pCacheRec);
1249	}
1250	goto next_function;
1251	}
1252
1253	default:
1254	STAM_COUNTER_INC(&pVM->csam.s.StatScanNextFunctionFailed);
1255	goto next_function;
1256	}
1257	/* Mark it as scanned. */
1258	csamMarkCode(pVM, pPage, pCurInstrGC, cbInstr, true);
1259	pCurInstrGC += cbInstr;
1260	} /* for at most 16 instructions */
1261	next_function:
1262	; /* MSVC complains otherwise */
1263	}
1264	}
1265	done:
1266	pCacheRec->pCallExitRec = pOldCallRec;
1267	return rc;
1268	}
1269	#else
1270	#define csamAnalyseCallCodeStream csamAnalyseCodeStream
1271	#endif
1272
1273	/**
1274	* Disassembles the code stream until the callback function detects a failure or decides everything is acceptable
1275	*
1276	* @returns VBox status code.
1277	* @param pVM Pointer to the VM.
1278	* @param pInstrGC Guest context pointer to privileged instruction
1279	* @param pCurInstrGC Guest context pointer to the current instruction
1280	* @param fCode32 16 or 32 bits code
1281	* @param pfnCSAMR3Analyse Callback for testing the disassembled instruction
1282	* @param pUserData User pointer (callback specific)
1283	*
1284	*/
1285	static int csamAnalyseCodeStream(PVM pVM, RCPTRTYPE(uint8_t ) pInstrGC, RCPTRTYPE(uint8_t ) pCurInstrGC, bool fCode32,
1286	PFN_CSAMR3ANALYSE pfnCSAMR3Analyse, void *pUserData, PCSAMP2GLOOKUPREC pCacheRec)
1287	{
1288	DISCPUSTATE cpu;
1289	PCSAMPAGE pPage = (PCSAMPAGE)pUserData;
1290	int rc = VWRN_CONTINUE_ANALYSIS;
1291	uint32_t cbInstr;
1292	int rc2;
1293	Assert(pVM->cCpus == 1);
1294	PVMCPU pVCpu = VMMGetCpu0(pVM);
1295
1296	#ifdef DEBUG
1297	char szOutput[256];
1298	#endif
1299
1300	LogFlow(("csamAnalyseCodeStream: code at %RRv depth=%d\n", pCurInstrGC, pCacheRec->depth));
1301
1302	pVM->csam.s.fScanningStarted = true;
1303
1304	pCacheRec->depth++;
1305	/*
1306	* Limit the call depth. (rather arbitrary upper limit; too low and we won't detect certain
1307	* cpuid instructions in Linux kernels; too high and we waste too much time scanning code)
1308	* (512 is necessary to detect cpuid instructions in Red Hat EL4; see defect 1355)
1309	* @note we are using a lot of stack here. couple of 100k when we go to the full depth (!)
1310	*/
1311	if (pCacheRec->depth > 512)
1312	{
1313	LogFlow(("CSAM: maximum calldepth reached for %RRv\n", pCurInstrGC));
1314	pCacheRec->depth--;
1315	return VINF_SUCCESS; //let's not go on forever
1316	}
1317
1318	Assert(!PATMIsPatchGCAddr(pVM, pCurInstrGC));
1319	csamR3CheckPageRecord(pVM, pCurInstrGC);
1320
1321	while(rc == VWRN_CONTINUE_ANALYSIS)
1322	{
1323	if (csamIsCodeScanned(pVM, pCurInstrGC, &pPage) == false)
1324	{
1325	if (pPage == NULL)
1326	{
1327	/* New address; let's take a look at it. */
1328	pPage = csamCreatePageRecord(pVM, pCurInstrGC, CSAM_TAG_CSAM, fCode32);
1329	if (pPage == NULL)
1330	{
1331	rc = VERR_NO_MEMORY;
1332	goto done;
1333	}
1334	}
1335	}
1336	else
1337	{
1338	LogFlow(("Code at %RRv has been scanned before\n", pCurInstrGC));
1339	rc = VINF_SUCCESS;
1340	goto done;
1341	}
1342
1343	{ /* Force pCurInstrHC out of scope after we stop using it (page lock!) */
1344	uint8_t *pCurInstrHC = csamR3GCVirtToHCVirt(pVM, pCacheRec, pCurInstrGC);
1345	if (pCurInstrHC == NULL)
1346	{
1347	Log(("csamR3GCVirtToHCVirt failed for %RRv\n", pCurInstrGC));
1348	rc = VERR_PATCHING_REFUSED;
1349	goto done;
1350	}
1351	Assert(VALID_PTR(pCurInstrHC));
1352
1353	STAM_PROFILE_START(&pVM->csam.s.StatTimeDisasm, a);
1354	#ifdef DEBUG
1355	rc2 = csamR3DISInstr(pVM, pCurInstrGC, pCurInstrHC, fCode32 ? DISCPUMODE_32BIT : DISCPUMODE_16BIT,
1356	&cpu, &cbInstr, szOutput, sizeof(szOutput));
1357	if (RT_SUCCESS(rc2)) Log(("CSAM Analysis: %s", szOutput));
1358	#else
1359	rc2 = csamR3DISInstr(pVM, pCurInstrGC, pCurInstrHC, fCode32 ? DISCPUMODE_32BIT : DISCPUMODE_16BIT,
1360	&cpu, &cbInstr, NULL, 0);
1361	#endif
1362	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeDisasm, a);
1363	}
1364	if (RT_FAILURE(rc2))
1365	{
1366	Log(("Disassembly failed at %RRv with %Rrc (probably page not present) -> return to caller\n", pCurInstrGC, rc2));
1367	rc = VINF_SUCCESS;
1368	goto done;
1369	}
1370
1371	STAM_COUNTER_ADD(&pVM->csam.s.StatNrBytesRead, cbInstr);
1372
1373	csamMarkCode(pVM, pPage, pCurInstrGC, cbInstr, true);
1374
1375	RCPTRTYPE(uint8_t *) addr = 0;
1376	PCSAMPAGE pJmpPage = NULL;
1377
1378	if (PAGE_ADDRESS(pCurInstrGC) != PAGE_ADDRESS(pCurInstrGC + cbInstr - 1))
1379	{
1380	if (!PGMGstIsPagePresent(pVCpu, pCurInstrGC + cbInstr - 1))
1381	{
1382	/// @todo fault in the page
1383	Log(("Page for current instruction %RRv is not present!!\n", pCurInstrGC));
1384	rc = VWRN_CONTINUE_ANALYSIS;
1385	goto next_please;
1386	}
1387	//all is fine, let's continue
1388	csamR3CheckPageRecord(pVM, pCurInstrGC + cbInstr - 1);
1389	}
1390	/*
1391	* If it's harmless, then don't bother checking it (the disasm tables had better be accurate!)
1392	*/
1393	if ((cpu.pCurInstr->fOpType & ~DISOPTYPE_RRM_MASK) == DISOPTYPE_HARMLESS)
1394	{
1395	AssertMsg(pfnCSAMR3Analyse(pVM, &cpu, pInstrGC, pCurInstrGC, pCacheRec, (void *)pPage) == VWRN_CONTINUE_ANALYSIS, ("Instruction incorrectly marked harmless?!?!?\n"));
1396	rc = VWRN_CONTINUE_ANALYSIS;
1397	goto next_please;
1398	}
1399
1400	#ifdef CSAM_ANALYSE_BEYOND_RET
1401	/* Remember the address of the instruction following the ret in case the parent instruction was a call. */
1402	if ( pCacheRec->pCallExitRec
1403	&& cpu.pCurInstr->uOpcode == OP_RETN
1404	&& pCacheRec->pCallExitRec->cInstrAfterRet < CSAM_MAX_CALLEXIT_RET)
1405	{
1406	pCacheRec->pCallExitRec->pInstrAfterRetGC[pCacheRec->pCallExitRec->cInstrAfterRet] = pCurInstrGC + cbInstr;
1407	pCacheRec->pCallExitRec->cInstrAfterRet++;
1408	}
1409	#endif
1410
1411	rc = pfnCSAMR3Analyse(pVM, &cpu, pInstrGC, pCurInstrGC, pCacheRec, (void *)pPage);
1412	if (rc == VINF_SUCCESS)
1413	goto done;
1414
1415	// For our first attempt, we'll handle only simple relative jumps and calls (immediate offset coded in instruction)
1416	if ( ((cpu.pCurInstr->fOpType & DISOPTYPE_CONTROLFLOW) && (OP_PARM_VTYPE(cpu.pCurInstr->fParam1) == OP_PARM_J))
1417	\|\| (cpu.pCurInstr->uOpcode == OP_CALL && cpu.Param1.fUse == DISUSE_DISPLACEMENT32)) /* simple indirect call (call dword ptr [address]) */
1418	{
1419	/* We need to parse 'call dword ptr [address]' type of calls to catch cpuid instructions in some recent Linux distributions (e.g. OpenSuse 10.3) */
1420	if ( cpu.pCurInstr->uOpcode == OP_CALL
1421	&& cpu.Param1.fUse == DISUSE_DISPLACEMENT32)
1422	{
1423	addr = 0;
1424	PGMPhysSimpleReadGCPtr(pVCpu, &addr, (RTRCUINTPTR)cpu.Param1.uDisp.i32, sizeof(addr));
1425	}
1426	else
1427	addr = CSAMResolveBranch(&cpu, pCurInstrGC);
1428
1429	if (addr == 0)
1430	{
1431	Log(("We don't support far jumps here!! (%08X)\n", cpu.Param1.fUse));
1432	rc = VINF_SUCCESS;
1433	break;
1434	}
1435	Assert(!PATMIsPatchGCAddr(pVM, addr));
1436
1437	/* If the target address lies in a patch generated jump, then special action needs to be taken. */
1438	PATMR3DetectConflict(pVM, pCurInstrGC, addr);
1439
1440	/* Same page? */
1441	if (PAGE_ADDRESS(addr) != PAGE_ADDRESS(pCurInstrGC ))
1442	{
1443	if (!PGMGstIsPagePresent(pVCpu, addr))
1444	{
1445	Log(("Page for current instruction %RRv is not present!!\n", addr));
1446	rc = VWRN_CONTINUE_ANALYSIS;
1447	goto next_please;
1448	}
1449
1450	/* All is fine, let's continue. */
1451	csamR3CheckPageRecord(pVM, addr);
1452	}
1453
1454	pJmpPage = NULL;
1455	if (csamIsCodeScanned(pVM, addr, &pJmpPage) == false)
1456	{
1457	if (pJmpPage == NULL)
1458	{
1459	/* New branch target; let's take a look at it. */
1460	pJmpPage = csamCreatePageRecord(pVM, addr, CSAM_TAG_CSAM, fCode32);
1461	if (pJmpPage == NULL)
1462	{
1463	rc = VERR_NO_MEMORY;
1464	goto done;
1465	}
1466	Assert(pPage);
1467	}
1468	if (cpu.pCurInstr->uOpcode == OP_CALL)
1469	rc = csamAnalyseCallCodeStream(pVM, pInstrGC, addr, fCode32, pfnCSAMR3Analyse, (void *)pJmpPage, pCacheRec);
1470	else
1471	rc = csamAnalyseCodeStream(pVM, pInstrGC, addr, fCode32, pfnCSAMR3Analyse, (void *)pJmpPage, pCacheRec);
1472
1473	if (rc != VINF_SUCCESS) {
1474	goto done;
1475	}
1476	}
1477	if (cpu.pCurInstr->uOpcode == OP_JMP)
1478	{//unconditional jump; return to caller
1479	rc = VINF_SUCCESS;
1480	goto done;
1481	}
1482
1483	rc = VWRN_CONTINUE_ANALYSIS;
1484	} //if ((cpu.pCurInstr->fOpType & DISOPTYPE_CONTROLFLOW) && (OP_PARM_VTYPE(cpu.pCurInstr->fParam1) == OP_PARM_J))
1485	#ifdef CSAM_SCAN_JUMP_TABLE
1486	else
1487	if ( cpu.pCurInstr->uOpcode == OP_JMP
1488	&& (cpu.Param1.fUse & (DISUSE_DISPLACEMENT32\|DISUSE_INDEX\|DISUSE_SCALE)) == (DISUSE_DISPLACEMENT32\|DISUSE_INDEX\|DISUSE_SCALE)
1489	)
1490	{
1491	RTRCPTR pJumpTableGC = (RTRCPTR)cpu.Param1.disp32;
1492	uint8_t *pJumpTableHC;
1493	int rc2;
1494
1495	Log(("Jump through jump table\n"));
1496
1497	rc2 = PGMPhysGCPtr2CCPtrReadOnly(pVCpu, pJumpTableGC, (PRTHCPTR)&pJumpTableHC, missing page lock);
1498	if (rc2 == VINF_SUCCESS)
1499	{
1500	for (uint32_t i=0;i<2;i++)
1501	{
1502	uint64_t fFlags;
1503
1504	addr = pJumpTableGC + cpu.Param1.scale * i;
1505	/* Same page? */
1506	if (PAGE_ADDRESS(addr) != PAGE_ADDRESS(pJumpTableGC))
1507	break;
1508
1509	addr = (RTRCPTR )(pJumpTableHC + cpu.Param1.scale * i);
1510
1511	rc2 = PGMGstGetPage(pVCpu, addr, &fFlags, NULL);
1512	if ( rc2 != VINF_SUCCESS
1513	\|\| (fFlags & X86_PTE_US)
1514	\|\| !(fFlags & X86_PTE_P)
1515	)
1516	break;
1517
1518	Log(("Jump to %RRv\n", addr));
1519
1520	pJmpPage = NULL;
1521	if (csamIsCodeScanned(pVM, addr, &pJmpPage) == false)
1522	{
1523	if (pJmpPage == NULL)
1524	{
1525	/* New branch target; let's take a look at it. */
1526	pJmpPage = csamCreatePageRecord(pVM, addr, CSAM_TAG_CSAM, fCode32);
1527	if (pJmpPage == NULL)
1528	{
1529	rc = VERR_NO_MEMORY;
1530	goto done;
1531	}
1532	Assert(pPage);
1533	}
1534	rc = csamAnalyseCodeStream(pVM, pInstrGC, addr, fCode32, pfnCSAMR3Analyse, (void *)pJmpPage, pCacheRec);
1535	if (rc != VINF_SUCCESS) {
1536	goto done;
1537	}
1538	}
1539	}
1540	}
1541	}
1542	#endif
1543	if (rc != VWRN_CONTINUE_ANALYSIS) {
1544	break; //done!
1545	}
1546	next_please:
1547	if (cpu.pCurInstr->uOpcode == OP_JMP)
1548	{
1549	rc = VINF_SUCCESS;
1550	goto done;
1551	}
1552	pCurInstrGC += cbInstr;
1553	}
1554	done:
1555	pCacheRec->depth--;
1556	return rc;
1557	}
1558
1559
1560	/**
1561	* Calculates the 64 bits hash value for the current page
1562	*
1563	* @returns hash value
1564	* @param pVM Pointer to the VM.
1565	* @param pInstr Page address
1566	*/
1567	uint64_t csamR3CalcPageHash(PVM pVM, RTRCPTR pInstr)
1568	{
1569	uint64_t hash = 0;
1570	uint32_t val[5];
1571	int rc;
1572	Assert(pVM->cCpus == 1);
1573	PVMCPU pVCpu = VMMGetCpu0(pVM);
1574
1575	Assert((pInstr & PAGE_OFFSET_MASK) == 0);
1576
1577	rc = PGMPhysSimpleReadGCPtr(pVCpu, &val[0], pInstr, sizeof(val[0]));
1578	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
1579	if (rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT)
1580	{
1581	Log(("csamR3CalcPageHash: page %RRv not present!!\n", pInstr));
1582	return ~0ULL;
1583	}
1584
1585	rc = PGMPhysSimpleReadGCPtr(pVCpu, &val[1], pInstr+1024, sizeof(val[0]));
1586	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
1587	if (rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT)
1588	{
1589	Log(("csamR3CalcPageHash: page %RRv not present!!\n", pInstr));
1590	return ~0ULL;
1591	}
1592
1593	rc = PGMPhysSimpleReadGCPtr(pVCpu, &val[2], pInstr+2048, sizeof(val[0]));
1594	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
1595	if (rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT)
1596	{
1597	Log(("csamR3CalcPageHash: page %RRv not present!!\n", pInstr));
1598	return ~0ULL;
1599	}
1600
1601	rc = PGMPhysSimpleReadGCPtr(pVCpu, &val[3], pInstr+3072, sizeof(val[0]));
1602	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
1603	if (rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT)
1604	{
1605	Log(("csamR3CalcPageHash: page %RRv not present!!\n", pInstr));
1606	return ~0ULL;
1607	}
1608
1609	rc = PGMPhysSimpleReadGCPtr(pVCpu, &val[4], pInstr+4092, sizeof(val[0]));
1610	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
1611	if (rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT)
1612	{
1613	Log(("csamR3CalcPageHash: page %RRv not present!!\n", pInstr));
1614	return ~0ULL;
1615	}
1616
1617	// don't want to get division by zero traps
1618	val[2] \|= 1;
1619	val[4] \|= 1;
1620
1621	hash = (uint64_t)val[0] * (uint64_t)val[1] / (uint64_t)val[2] + (val[3]%val[4]);
1622	return (hash == ~0ULL) ? hash - 1 : hash;
1623	}
1624
1625
1626	/**
1627	* Notify CSAM of a page flush
1628	*
1629	* @returns VBox status code
1630	* @param pVM Pointer to the VM.
1631	* @param addr GC address of the page to flush
1632	* @param fRemovePage Page removal flag
1633	*/
1634	static int csamFlushPage(PVM pVM, RTRCPTR addr, bool fRemovePage)
1635	{
1636	PCSAMPAGEREC pPageRec;
1637	int rc;
1638	RTGCPHYS GCPhys = 0;
1639	uint64_t fFlags = 0;
1640	Assert(pVM->cCpus == 1 \|\| !CSAMIsEnabled(pVM));
1641
1642	if (!CSAMIsEnabled(pVM))
1643	return VINF_SUCCESS;
1644	Assert(!HMIsEnabled(pVM));
1645
1646	PVMCPU pVCpu = VMMGetCpu0(pVM);
1647
1648	STAM_PROFILE_START(&pVM->csam.s.StatTimeFlushPage, a);
1649
1650	addr = addr & PAGE_BASE_GC_MASK;
1651
1652	/*
1653	* Note: searching for the page in our tree first is more expensive (skipped flushes are two orders of magnitude more common)
1654	*/
1655	if (pVM->csam.s.pPageTree == NULL)
1656	{
1657	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeFlushPage, a);
1658	return VWRN_CSAM_PAGE_NOT_FOUND;
1659	}
1660
1661	rc = PGMGstGetPage(pVCpu, addr, &fFlags, &GCPhys);
1662	/* Returned at a very early stage (no paging yet presumably). */
1663	if (rc == VERR_NOT_SUPPORTED)
1664	{
1665	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeFlushPage, a);
1666	return rc;
1667	}
1668
1669	if (RT_SUCCESS(rc))
1670	{
1671	if ( (fFlags & X86_PTE_US)
1672	\|\| rc == VERR_PGM_PHYS_PAGE_RESERVED
1673	)
1674	{
1675	/* User page -> not relevant for us. */
1676	STAM_COUNTER_ADD(&pVM->csam.s.StatNrFlushesSkipped, 1);
1677	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeFlushPage, a);
1678	return VINF_SUCCESS;
1679	}
1680	}
1681	else
1682	if (rc != VERR_PAGE_NOT_PRESENT && rc != VERR_PAGE_TABLE_NOT_PRESENT)
1683	AssertMsgFailed(("PGMR3GetPage %RRv failed with %Rrc\n", addr, rc));
1684
1685	pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)(uintptr_t)addr);
1686	if (pPageRec)
1687	{
1688	if ( GCPhys == pPageRec->page.GCPhys
1689	&& (fFlags & X86_PTE_P))
1690	{
1691	STAM_COUNTER_ADD(&pVM->csam.s.StatNrFlushesSkipped, 1);
1692	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeFlushPage, a);
1693	return VINF_SUCCESS;
1694	}
1695
1696	Log(("CSAMR3FlushPage: page %RRv has changed -> FLUSH (rc=%Rrc) (Phys: %RGp vs %RGp)\n", addr, rc, GCPhys, pPageRec->page.GCPhys));
1697
1698	STAM_COUNTER_ADD(&pVM->csam.s.StatNrFlushes, 1);
1699
1700	if (fRemovePage)
1701	csamRemovePageRecord(pVM, addr);
1702	else
1703	{
1704	CSAMMarkPage(pVM, addr, false);
1705	pPageRec->page.GCPhys = 0;
1706	pPageRec->page.fFlags = 0;
1707	rc = PGMGstGetPage(pVCpu, addr, &pPageRec->page.fFlags, &pPageRec->page.GCPhys);
1708	if (rc == VINF_SUCCESS)
1709	pPageRec->page.u64Hash = csamR3CalcPageHash(pVM, addr);
1710
1711	if (pPageRec->page.pBitmap == NULL)
1712	{
1713	pPageRec->page.pBitmap = (uint8_t *)MMR3HeapAllocZ(pVM, MM_TAG_CSAM_PATCH, CSAM_PAGE_BITMAP_SIZE);
1714	Assert(pPageRec->page.pBitmap);
1715	if (pPageRec->page.pBitmap == NULL)
1716	return VERR_NO_MEMORY;
1717	}
1718	else
1719	memset(pPageRec->page.pBitmap, 0, CSAM_PAGE_BITMAP_SIZE);
1720	}
1721
1722
1723	/*
1724	* Inform patch manager about the flush; no need to repeat the above check twice.
1725	*/
1726	PATMR3FlushPage(pVM, addr);
1727
1728	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeFlushPage, a);
1729	return VINF_SUCCESS;
1730	}
1731	else
1732	{
1733	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeFlushPage, a);
1734	return VWRN_CSAM_PAGE_NOT_FOUND;
1735	}
1736	}
1737
1738	/**
1739	* Notify CSAM of a page flush
1740	*
1741	* @returns VBox status code
1742	* @param pVM Pointer to the VM.
1743	* @param addr GC address of the page to flush
1744	*/
1745	VMMR3_INT_DECL(int) CSAMR3FlushPage(PVM pVM, RTRCPTR addr)
1746	{
1747	return csamFlushPage(pVM, addr, true /* remove page record */);
1748	}
1749
1750	/**
1751	* Remove a CSAM monitored page. Use with care!
1752	*
1753	* @returns VBox status code
1754	* @param pVM Pointer to the VM.
1755	* @param addr GC address of the page to flush
1756	*/
1757	VMMR3_INT_DECL(int) CSAMR3RemovePage(PVM pVM, RTRCPTR addr)
1758	{
1759	PCSAMPAGEREC pPageRec;
1760	int rc;
1761
1762	AssertReturn(!HMIsEnabled(pVM), VERR_CSAM_HM_IPE);
1763
1764	addr = addr & PAGE_BASE_GC_MASK;
1765
1766	pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)(uintptr_t)addr);
1767	if (pPageRec)
1768	{
1769	rc = csamRemovePageRecord(pVM, addr);
1770	if (RT_SUCCESS(rc))
1771	PATMR3FlushPage(pVM, addr);
1772	return VINF_SUCCESS;
1773	}
1774	return VWRN_CSAM_PAGE_NOT_FOUND;
1775	}
1776
1777	/**
1778	* Check a page record in case a page has been changed
1779	*
1780	* @returns VBox status code. (trap handled or not)
1781	* @param pVM Pointer to the VM.
1782	* @param pInstrGC GC instruction pointer
1783	*/
1784	int csamR3CheckPageRecord(PVM pVM, RTRCPTR pInstrGC)
1785	{
1786	PCSAMPAGEREC pPageRec;
1787	uint64_t u64hash;
1788
1789	pInstrGC = pInstrGC & PAGE_BASE_GC_MASK;
1790
1791	pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)(uintptr_t)pInstrGC);
1792	if (pPageRec)
1793	{
1794	u64hash = csamR3CalcPageHash(pVM, pInstrGC);
1795	if (u64hash != pPageRec->page.u64Hash)
1796	csamFlushPage(pVM, pInstrGC, false /* don't remove page record */);
1797	}
1798	else
1799	return VWRN_CSAM_PAGE_NOT_FOUND;
1800
1801	return VINF_SUCCESS;
1802	}
1803
1804	/**
1805	* Returns monitor description based on CSAM tag
1806	*
1807	* @return description string
1808	* @param enmTag Owner tag
1809	*/
1810	const char *csamGetMonitorDescription(CSAMTAG enmTag)
1811	{
1812	if (enmTag == CSAM_TAG_PATM)
1813	return "CSAM-PATM self-modifying code monitor handler";
1814	else
1815	if (enmTag == CSAM_TAG_REM)
1816	return "CSAM-REM self-modifying code monitor handler";
1817	Assert(enmTag == CSAM_TAG_CSAM);
1818	return "CSAM self-modifying code monitor handler";
1819	}
1820
1821	/**
1822	* Adds page record to our lookup tree
1823	*
1824	* @returns CSAMPAGE ptr or NULL if failure
1825	* @param pVM Pointer to the VM.
1826	* @param GCPtr Page address
1827	* @param enmTag Owner tag
1828	* @param fCode32 16 or 32 bits code
1829	* @param fMonitorInvalidation Monitor page invalidation flag
1830	*/
1831	static PCSAMPAGE csamCreatePageRecord(PVM pVM, RTRCPTR GCPtr, CSAMTAG enmTag, bool fCode32, bool fMonitorInvalidation)
1832	{
1833	PCSAMPAGEREC pPage;
1834	int rc;
1835	bool ret;
1836	Assert(pVM->cCpus == 1);
1837	PVMCPU pVCpu = VMMGetCpu0(pVM);
1838
1839	Log(("New page record for %RRv\n", GCPtr & PAGE_BASE_GC_MASK));
1840
1841	pPage = (PCSAMPAGEREC)MMR3HeapAllocZ(pVM, MM_TAG_CSAM_PATCH, sizeof(CSAMPAGEREC));
1842	if (pPage == NULL)
1843	{
1844	AssertMsgFailed(("csamCreatePageRecord: Out of memory!!!!\n"));
1845	return NULL;
1846	}
1847	/* Round down to page boundary. */
1848	GCPtr = (GCPtr & PAGE_BASE_GC_MASK);
1849	pPage->Core.Key = (AVLPVKEY)(uintptr_t)GCPtr;
1850	pPage->page.pPageGC = GCPtr;
1851	pPage->page.fCode32 = fCode32;
1852	pPage->page.fMonitorInvalidation = fMonitorInvalidation;
1853	pPage->page.enmTag = enmTag;
1854	pPage->page.fMonitorActive = false;
1855	pPage->page.pBitmap = (uint8_t *)MMR3HeapAllocZ(pVM, MM_TAG_CSAM_PATCH, PAGE_SIZE/sizeof(uint8_t));
1856	rc = PGMGstGetPage(pVCpu, GCPtr, &pPage->page.fFlags, &pPage->page.GCPhys);
1857	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
1858
1859	pPage->page.u64Hash = csamR3CalcPageHash(pVM, GCPtr);
1860	ret = RTAvlPVInsert(&pVM->csam.s.pPageTree, &pPage->Core);
1861	Assert(ret);
1862
1863	#ifdef CSAM_MONITOR_CODE_PAGES
1864	AssertRelease(!fInCSAMCodePageInvalidate);
1865
1866	switch (enmTag)
1867	{
1868	case CSAM_TAG_PATM:
1869	case CSAM_TAG_REM:
1870	#ifdef CSAM_MONITOR_CSAM_CODE_PAGES
1871	case CSAM_TAG_CSAM:
1872	#endif
1873	{
1874	rc = PGMR3HandlerVirtualRegister(pVM, PGMVIRTHANDLERTYPE_WRITE, GCPtr, GCPtr + (PAGE_SIZE - 1) /* inclusive! */,
1875	(fMonitorInvalidation) ? CSAMCodePageInvalidate : 0, CSAMCodePageWriteHandler, "CSAMGCCodePageWriteHandler", 0,
1876	csamGetMonitorDescription(enmTag));
1877	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PGM_HANDLER_VIRTUAL_CONFLICT, ("PGMR3HandlerVirtualRegisterEx %RRv failed with %Rrc\n", GCPtr, rc));
1878	if (RT_FAILURE(rc))
1879	Log(("PGMR3HandlerVirtualRegisterEx for %RRv failed with %Rrc\n", GCPtr, rc));
1880
1881	/* Could fail, because it's already monitored. Don't treat that condition as fatal. */
1882
1883	/* Prefetch it in case it's not there yet. */
1884	rc = PGMPrefetchPage(pVCpu, GCPtr);
1885	AssertRC(rc);
1886
1887	rc = PGMShwMakePageReadonly(pVCpu, GCPtr, 0 /fFlags/);
1888	Assert(rc == VINF_SUCCESS \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT);
1889
1890	pPage->page.fMonitorActive = true;
1891	STAM_COUNTER_INC(&pVM->csam.s.StatPageMonitor);
1892	break;
1893	}
1894	default:
1895	break; /* to shut up GCC */
1896	}
1897
1898	Log(("csamCreatePageRecord %RRv GCPhys=%RGp\n", GCPtr, pPage->page.GCPhys));
1899
1900	#ifdef VBOX_WITH_STATISTICS
1901	switch (enmTag)
1902	{
1903	case CSAM_TAG_CSAM:
1904	STAM_COUNTER_INC(&pVM->csam.s.StatPageCSAM);
1905	break;
1906	case CSAM_TAG_PATM:
1907	STAM_COUNTER_INC(&pVM->csam.s.StatPagePATM);
1908	break;
1909	case CSAM_TAG_REM:
1910	STAM_COUNTER_INC(&pVM->csam.s.StatPageREM);
1911	break;
1912	default:
1913	break; /* to shut up GCC */
1914	}
1915	#endif
1916
1917	#endif
1918
1919	STAM_COUNTER_INC(&pVM->csam.s.StatNrPages);
1920	if (fMonitorInvalidation)
1921	STAM_COUNTER_INC(&pVM->csam.s.StatNrPagesInv);
1922
1923	return &pPage->page;
1924	}
1925
1926	/**
1927	* Monitors a code page (if not already monitored)
1928	*
1929	* @returns VBox status code
1930	* @param pVM Pointer to the VM.
1931	* @param pPageAddrGC The page to monitor
1932	* @param enmTag Monitor tag
1933	*/
1934	VMMR3DECL(int) CSAMR3MonitorPage(PVM pVM, RTRCPTR pPageAddrGC, CSAMTAG enmTag)
1935	{
1936	PCSAMPAGEREC pPageRec = NULL;
1937	int rc;
1938	bool fMonitorInvalidation;
1939	Assert(pVM->cCpus == 1);
1940	PVMCPU pVCpu = VMMGetCpu0(pVM);
1941	Assert(!HMIsEnabled(pVM));
1942
1943	/* Dirty pages must be handled before calling this function!. */
1944	Assert(!pVM->csam.s.cDirtyPages);
1945
1946	if (pVM->csam.s.fScanningStarted == false)
1947	return VINF_SUCCESS; /* too early */
1948
1949	pPageAddrGC &= PAGE_BASE_GC_MASK;
1950
1951	Log(("CSAMR3MonitorPage %RRv %d\n", pPageAddrGC, enmTag));
1952
1953	/** @todo implicit assumption */
1954	fMonitorInvalidation = (enmTag == CSAM_TAG_PATM);
1955
1956	pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)(uintptr_t)pPageAddrGC);
1957	if (pPageRec == NULL)
1958	{
1959	uint64_t fFlags;
1960
1961	rc = PGMGstGetPage(pVCpu, pPageAddrGC, &fFlags, NULL);
1962	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
1963	if ( rc == VINF_SUCCESS
1964	&& (fFlags & X86_PTE_US))
1965	{
1966	/* We don't care about user pages. */
1967	STAM_COUNTER_INC(&pVM->csam.s.StatNrUserPages);
1968	return VINF_SUCCESS;
1969	}
1970
1971	csamCreatePageRecord(pVM, pPageAddrGC, enmTag, true /* 32 bits code */, fMonitorInvalidation);
1972
1973	pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)(uintptr_t)pPageAddrGC);
1974	Assert(pPageRec);
1975	}
1976	/** @todo reference count */
1977
1978	#ifdef CSAM_MONITOR_CSAM_CODE_PAGES
1979	Assert(pPageRec->page.fMonitorActive);
1980	#endif
1981
1982	#ifdef CSAM_MONITOR_CODE_PAGES
1983	if (!pPageRec->page.fMonitorActive)
1984	{
1985	Log(("CSAMR3MonitorPage: activate monitoring for %RRv\n", pPageAddrGC));
1986
1987	rc = PGMR3HandlerVirtualRegister(pVM, PGMVIRTHANDLERTYPE_WRITE, pPageAddrGC, pPageAddrGC + (PAGE_SIZE - 1) /* inclusive! */,
1988	(fMonitorInvalidation) ? CSAMCodePageInvalidate : 0, CSAMCodePageWriteHandler, "CSAMGCCodePageWriteHandler", 0,
1989	csamGetMonitorDescription(enmTag));
1990	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PGM_HANDLER_VIRTUAL_CONFLICT, ("PGMR3HandlerVirtualRegisterEx %RRv failed with %Rrc\n", pPageAddrGC, rc));
1991	if (RT_FAILURE(rc))
1992	Log(("PGMR3HandlerVirtualRegisterEx for %RRv failed with %Rrc\n", pPageAddrGC, rc));
1993
1994	/* Could fail, because it's already monitored. Don't treat that condition as fatal. */
1995
1996	/* Prefetch it in case it's not there yet. */
1997	rc = PGMPrefetchPage(pVCpu, pPageAddrGC);
1998	AssertRC(rc);
1999
2000	rc = PGMShwMakePageReadonly(pVCpu, pPageAddrGC, 0 /fFlags/);
2001	Assert(rc == VINF_SUCCESS \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT);
2002
2003	STAM_COUNTER_INC(&pVM->csam.s.StatPageMonitor);
2004
2005	pPageRec->page.fMonitorActive = true;
2006	pPageRec->page.fMonitorInvalidation = fMonitorInvalidation;
2007	}
2008	else
2009	if ( !pPageRec->page.fMonitorInvalidation
2010	&& fMonitorInvalidation)
2011	{
2012	Assert(pPageRec->page.fMonitorActive);
2013	PGMHandlerVirtualChangeInvalidateCallback(pVM, pPageRec->page.pPageGC, CSAMCodePageInvalidate);
2014	pPageRec->page.fMonitorInvalidation = true;
2015	STAM_COUNTER_INC(&pVM->csam.s.StatNrPagesInv);
2016
2017	/* Prefetch it in case it's not there yet. */
2018	rc = PGMPrefetchPage(pVCpu, pPageAddrGC);
2019	AssertRC(rc);
2020
2021	/* Make sure it's readonly. Page invalidation may have modified the attributes. */
2022	rc = PGMShwMakePageReadonly(pVCpu, pPageAddrGC, 0 /fFlags/);
2023	Assert(rc == VINF_SUCCESS \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT);
2024	}
2025
2026	#if 0 /* def VBOX_STRICT -> very annoying) */
2027	if (pPageRec->page.fMonitorActive)
2028	{
2029	uint64_t fPageShw;
2030	RTHCPHYS GCPhys;
2031	rc = PGMShwGetPage(pVCpu, pPageAddrGC, &fPageShw, &GCPhys);
2032	// AssertMsg( (rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT)
2033	// \|\| !(fPageShw & X86_PTE_RW)
2034	// \|\| (pPageRec->page.GCPhys == 0), ("Shadow page flags for %RRv (%RHp) aren't readonly (%RX64)!!\n", pPageAddrGC, GCPhys, fPageShw));
2035	}
2036	#endif
2037
2038	if (pPageRec->page.GCPhys == 0)
2039	{
2040	/* Prefetch it in case it's not there yet. */
2041	rc = PGMPrefetchPage(pVCpu, pPageAddrGC);
2042	AssertRC(rc);
2043	/* The page was changed behind our back. It won't be made read-only until the next SyncCR3, so force it here. */
2044	rc = PGMShwMakePageReadonly(pVCpu, pPageAddrGC, 0 /fFlags/);
2045	Assert(rc == VINF_SUCCESS \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT);
2046	}
2047	#endif /* CSAM_MONITOR_CODE_PAGES */
2048	return VINF_SUCCESS;
2049	}
2050
2051	/**
2052	* Unmonitors a code page
2053	*
2054	* @returns VBox status code
2055	* @param pVM Pointer to the VM.
2056	* @param pPageAddrGC The page to monitor
2057	* @param enmTag Monitor tag
2058	*/
2059	VMMR3DECL(int) CSAMR3UnmonitorPage(PVM pVM, RTRCPTR pPageAddrGC, CSAMTAG enmTag)
2060	{
2061	Assert(!HMIsEnabled(pVM));
2062
2063	pPageAddrGC &= PAGE_BASE_GC_MASK;
2064
2065	Log(("CSAMR3UnmonitorPage %RRv %d\n", pPageAddrGC, enmTag));
2066
2067	Assert(enmTag == CSAM_TAG_REM);
2068
2069	#ifdef VBOX_STRICT
2070	PCSAMPAGEREC pPageRec;
2071
2072	pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)(uintptr_t)pPageAddrGC);
2073	Assert(pPageRec && pPageRec->page.enmTag == enmTag);
2074	#endif
2075	return CSAMR3RemovePage(pVM, pPageAddrGC);
2076	}
2077
2078	/**
2079	* Removes a page record from our lookup tree
2080	*
2081	* @returns VBox status code
2082	* @param pVM Pointer to the VM.
2083	* @param GCPtr Page address
2084	*/
2085	static int csamRemovePageRecord(PVM pVM, RTRCPTR GCPtr)
2086	{
2087	PCSAMPAGEREC pPageRec;
2088	Assert(pVM->cCpus == 1);
2089	PVMCPU pVCpu = VMMGetCpu0(pVM);
2090
2091	Log(("csamRemovePageRecord %RRv\n", GCPtr));
2092	pPageRec = (PCSAMPAGEREC)RTAvlPVRemove(&pVM->csam.s.pPageTree, (AVLPVKEY)(uintptr_t)GCPtr);
2093
2094	if (pPageRec)
2095	{
2096	STAM_COUNTER_INC(&pVM->csam.s.StatNrRemovedPages);
2097
2098	#ifdef CSAM_MONITOR_CODE_PAGES
2099	if (pPageRec->page.fMonitorActive)
2100	{
2101	/* @todo -> this is expensive (cr3 reload)!!!
2102	* if this happens often, then reuse it instead!!!
2103	*/
2104	Assert(!fInCSAMCodePageInvalidate);
2105	STAM_COUNTER_DEC(&pVM->csam.s.StatPageMonitor);
2106	PGMHandlerVirtualDeregister(pVM, GCPtr);
2107	}
2108	if (pPageRec->page.enmTag == CSAM_TAG_PATM)
2109	{
2110	/* Make sure the recompiler flushes its cache as this page is no longer monitored. */
2111	STAM_COUNTER_INC(&pVM->csam.s.StatPageRemoveREMFlush);
2112	CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_GLOBAL_TLB_FLUSH);
2113	}
2114	#endif
2115
2116	#ifdef VBOX_WITH_STATISTICS
2117	switch (pPageRec->page.enmTag)
2118	{
2119	case CSAM_TAG_CSAM:
2120	STAM_COUNTER_DEC(&pVM->csam.s.StatPageCSAM);
2121	break;
2122	case CSAM_TAG_PATM:
2123	STAM_COUNTER_DEC(&pVM->csam.s.StatPagePATM);
2124	break;
2125	case CSAM_TAG_REM:
2126	STAM_COUNTER_DEC(&pVM->csam.s.StatPageREM);
2127	break;
2128	default:
2129	break; /* to shut up GCC */
2130	}
2131	#endif
2132
2133	if (pPageRec->page.pBitmap) MMR3HeapFree(pPageRec->page.pBitmap);
2134	MMR3HeapFree(pPageRec);
2135	}
2136	else
2137	AssertFailed();
2138
2139	return VINF_SUCCESS;
2140	}
2141
2142	/**
2143	* Callback for delayed writes from non-EMT threads
2144	*
2145	* @param pVM Pointer to the VM.
2146	* @param GCPtr The virtual address the guest is writing to. (not correct if it's an alias!)
2147	* @param cbBuf How much it's reading/writing.
2148	*/
2149	static DECLCALLBACK(void) CSAMDelayedWriteHandler(PVM pVM, RTRCPTR GCPtr, size_t cbBuf)
2150	{
2151	int rc = PATMR3PatchWrite(pVM, GCPtr, (uint32_t)cbBuf);
2152	AssertRC(rc);
2153	}
2154
2155	/**
2156	* \#PF Handler callback for virtual access handler ranges.
2157	*
2158	* Important to realize that a physical page in a range can have aliases, and
2159	* for ALL and WRITE handlers these will also trigger.
2160	*
2161	* @returns VINF_SUCCESS if the handler have carried out the operation.
2162	* @returns VINF_PGM_HANDLER_DO_DEFAULT if the caller should carry out the access operation.
2163	* @param pVM Pointer to the VM.
2164	* @param GCPtr The virtual address the guest is writing to. (not correct if it's an alias!)
2165	* @param pvPtr The HC mapping of that address.
2166	* @param pvBuf What the guest is reading/writing.
2167	* @param cbBuf How much it's reading/writing.
2168	* @param enmAccessType The access type.
2169	* @param pvUser User argument.
2170	*/
2171	static DECLCALLBACK(int) CSAMCodePageWriteHandler(PVM pVM, RTGCPTR GCPtr, void pvPtr, void pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType, void *pvUser)
2172	{
2173	int rc;
2174
2175	Assert(enmAccessType == PGMACCESSTYPE_WRITE); NOREF(enmAccessType);
2176	Log(("CSAMCodePageWriteHandler: write to %RGv size=%zu\n", GCPtr, cbBuf));
2177	NOREF(pvUser);
2178
2179	if ( PAGE_ADDRESS(pvPtr) == PAGE_ADDRESS((uintptr_t)pvPtr + cbBuf - 1)
2180	&& !memcmp(pvPtr, pvBuf, cbBuf))
2181	{
2182	Log(("CSAMCodePageWriteHandler: dummy write -> ignore\n"));
2183	return VINF_PGM_HANDLER_DO_DEFAULT;
2184	}
2185
2186	if (VM_IS_EMT(pVM))
2187	rc = PATMR3PatchWrite(pVM, GCPtr, (uint32_t)cbBuf);
2188	else
2189	{
2190	/* Queue the write instead otherwise we'll get concurrency issues. */
2191	/** @note in theory not correct to let it write the data first before disabling a patch!
2192	* (if it writes the same data as the patch jump and we replace it with obsolete opcodes)
2193	*/
2194	Log(("CSAMCodePageWriteHandler: delayed write!\n"));
2195	AssertCompileSize(RTRCPTR, 4);
2196	rc = VMR3ReqCallVoidNoWait(pVM, VMCPUID_ANY, (PFNRT)CSAMDelayedWriteHandler, 3, pVM, (RTRCPTR)GCPtr, cbBuf);
2197	}
2198	AssertRC(rc);
2199
2200	return VINF_PGM_HANDLER_DO_DEFAULT;
2201	}
2202
2203	/**
2204	* \#PF Handler callback for invalidation of virtual access handler ranges.
2205	*
2206	* @param pVM Pointer to the VM.
2207	* @param GCPtr The virtual address the guest has changed.
2208	*/
2209	static DECLCALLBACK(int) CSAMCodePageInvalidate(PVM pVM, RTGCPTR GCPtr)
2210	{
2211	fInCSAMCodePageInvalidate = true;
2212	LogFlow(("CSAMCodePageInvalidate %RGv\n", GCPtr));
2213	/** @todo We can't remove the page (which unregisters the virtual handler) as we are called from a DoWithAll on the virtual handler tree. Argh. */
2214	csamFlushPage(pVM, GCPtr, false /* don't remove page! */);
2215	fInCSAMCodePageInvalidate = false;
2216	return VINF_SUCCESS;
2217	}
2218
2219	/**
2220	* Check if the current instruction has already been checked before
2221	*
2222	* @returns VBox status code. (trap handled or not)
2223	* @param pVM Pointer to the VM.
2224	* @param pInstr Instruction pointer
2225	* @param pPage CSAM patch structure pointer
2226	*/
2227	bool csamIsCodeScanned(PVM pVM, RTRCPTR pInstr, PCSAMPAGE *pPage)
2228	{
2229	PCSAMPAGEREC pPageRec;
2230	uint32_t offset;
2231
2232	STAM_PROFILE_START(&pVM->csam.s.StatTimeCheckAddr, a);
2233
2234	offset = pInstr & PAGE_OFFSET_MASK;
2235	pInstr = pInstr & PAGE_BASE_GC_MASK;
2236
2237	Assert(pPage);
2238
2239	if (pPage && (pPage)->pPageGC == pInstr)
2240	{
2241	if ((pPage)->pBitmap == NULL \|\| ASMBitTest((pPage)->pBitmap, offset))
2242	{
2243	STAM_COUNTER_ADD(&pVM->csam.s.StatNrKnownPagesHC, 1);
2244	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeCheckAddr, a);
2245	return true;
2246	}
2247	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeCheckAddr, a);
2248	return false;
2249	}
2250
2251	pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)(uintptr_t)pInstr);
2252	if (pPageRec)
2253	{
2254	if (pPage) *pPage= &pPageRec->page;
2255	if (pPageRec->page.pBitmap == NULL \|\| ASMBitTest(pPageRec->page.pBitmap, offset))
2256	{
2257	STAM_COUNTER_ADD(&pVM->csam.s.StatNrKnownPagesHC, 1);
2258	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeCheckAddr, a);
2259	return true;
2260	}
2261	}
2262	else
2263	{
2264	if (pPage) *pPage = NULL;
2265	}
2266	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeCheckAddr, a);
2267	return false;
2268	}
2269
2270	/**
2271	* Mark an instruction in a page as scanned/not scanned
2272	*
2273	* @param pVM Pointer to the VM.
2274	* @param pPage Patch structure pointer
2275	* @param pInstr Instruction pointer
2276	* @param cbInstr Instruction size
2277	* @param fScanned Mark as scanned or not
2278	*/
2279	static void csamMarkCode(PVM pVM, PCSAMPAGE pPage, RTRCPTR pInstr, uint32_t cbInstr, bool fScanned)
2280	{
2281	LogFlow(("csamMarkCodeAsScanned %RRv cbInstr=%d\n", pInstr, cbInstr));
2282	CSAMMarkPage(pVM, pInstr, fScanned);
2283
2284	/** @todo should recreate empty bitmap if !fScanned */
2285	if (pPage->pBitmap == NULL)
2286	return;
2287
2288	if (fScanned)
2289	{
2290	// retn instructions can be scanned more than once
2291	if (ASMBitTest(pPage->pBitmap, pInstr & PAGE_OFFSET_MASK) == 0)
2292	{
2293	pPage->uSize += cbInstr;
2294	STAM_COUNTER_ADD(&pVM->csam.s.StatNrInstr, 1);
2295	}
2296	if (pPage->uSize >= PAGE_SIZE)
2297	{
2298	Log(("Scanned full page (%RRv) -> free bitmap\n", pInstr & PAGE_BASE_GC_MASK));
2299	MMR3HeapFree(pPage->pBitmap);
2300	pPage->pBitmap = NULL;
2301	}
2302	else
2303	ASMBitSet(pPage->pBitmap, pInstr & PAGE_OFFSET_MASK);
2304	}
2305	else
2306	ASMBitClear(pPage->pBitmap, pInstr & PAGE_OFFSET_MASK);
2307	}
2308
2309	/**
2310	* Mark an instruction in a page as scanned/not scanned
2311	*
2312	* @returns VBox status code.
2313	* @param pVM Pointer to the VM.
2314	* @param pInstr Instruction pointer
2315	* @param cbInstr Instruction size
2316	* @param fScanned Mark as scanned or not
2317	*/
2318	VMMR3_INT_DECL(int) CSAMR3MarkCode(PVM pVM, RTRCPTR pInstr, uint32_t cbInstr, bool fScanned)
2319	{
2320	PCSAMPAGE pPage = 0;
2321
2322	Assert(!fScanned); /* other case not implemented. */
2323	Assert(!PATMIsPatchGCAddr(pVM, pInstr));
2324	Assert(!HMIsEnabled(pVM));
2325
2326	if (csamIsCodeScanned(pVM, pInstr, &pPage) == false)
2327	{
2328	Assert(fScanned == true); /* other case should not be possible */
2329	return VINF_SUCCESS;
2330	}
2331
2332	Log(("CSAMR3MarkCode: %RRv size=%d fScanned=%d\n", pInstr, cbInstr, fScanned));
2333	csamMarkCode(pVM, pPage, pInstr, cbInstr, fScanned);
2334	return VINF_SUCCESS;
2335	}
2336
2337
2338	/**
2339	* Scan and analyse code
2340	*
2341	* @returns VBox status code.
2342	* @param pVM Pointer to the VM.
2343	* @param pCtxCore CPU context
2344	* @param pInstrGC Instruction pointer
2345	*/
2346	VMMR3_INT_DECL(int) CSAMR3CheckCodeEx(PVM pVM, PCPUMCTXCORE pCtxCore, RTRCPTR pInstrGC)
2347	{
2348	Assert(!HMIsEnabled(pVM));
2349	if (EMIsRawRing0Enabled(pVM) == false \|\| PATMIsPatchGCAddr(pVM, pInstrGC) == true)
2350	{
2351	// No use
2352	return VINF_SUCCESS;
2353	}
2354
2355	if (CSAMIsEnabled(pVM))
2356	{
2357	/* Assuming 32 bits code for now. */
2358	Assert(CPUMGetGuestCodeBits(VMMGetCpu0(pVM)) == 32);
2359
2360	pInstrGC = SELMToFlat(pVM, DISSELREG_CS, pCtxCore, pInstrGC);
2361	return CSAMR3CheckCode(pVM, pInstrGC);
2362	}
2363	return VINF_SUCCESS;
2364	}
2365
2366	/**
2367	* Scan and analyse code
2368	*
2369	* @returns VBox status code.
2370	* @param pVM Pointer to the VM.
2371	* @param pInstrGC Instruction pointer (0:32 virtual address)
2372	*/
2373	VMMR3_INT_DECL(int) CSAMR3CheckCode(PVM pVM, RTRCPTR pInstrGC)
2374	{
2375	int rc;
2376	PCSAMPAGE pPage = NULL;
2377	Assert(!HMIsEnabled(pVM));
2378
2379	if ( EMIsRawRing0Enabled(pVM) == false
2380	\|\| PATMIsPatchGCAddr(pVM, pInstrGC) == true)
2381	{
2382	/* Not active. */
2383	return VINF_SUCCESS;
2384	}
2385
2386	if (CSAMIsEnabled(pVM))
2387	{
2388	/* Cache record for csamR3GCVirtToHCVirt */
2389	CSAMP2GLOOKUPREC cacheRec;
2390	RT_ZERO(cacheRec);
2391
2392	STAM_PROFILE_START(&pVM->csam.s.StatTime, a);
2393	rc = csamAnalyseCallCodeStream(pVM, pInstrGC, pInstrGC, true /* 32 bits code */, CSAMR3AnalyseCallback, pPage, &cacheRec);
2394	STAM_PROFILE_STOP(&pVM->csam.s.StatTime, a);
2395	if (cacheRec.Lock.pvMap)
2396	PGMPhysReleasePageMappingLock(pVM, &cacheRec.Lock);
2397
2398	if (rc != VINF_SUCCESS)
2399	{
2400	Log(("csamAnalyseCodeStream failed with %d\n", rc));
2401	return rc;
2402	}
2403	}
2404	return VINF_SUCCESS;
2405	}
2406
2407	/**
2408	* Flush dirty code pages
2409	*
2410	* @returns VBox status code.
2411	* @param pVM Pointer to the VM.
2412	*/
2413	static int csamR3FlushDirtyPages(PVM pVM)
2414	{
2415	Assert(pVM->cCpus == 1);
2416	PVMCPU pVCpu = VMMGetCpu0(pVM);
2417
2418	STAM_PROFILE_START(&pVM->csam.s.StatFlushDirtyPages, a);
2419
2420	for (uint32_t i=0;i<pVM->csam.s.cDirtyPages;i++)
2421	{
2422	int rc;
2423	PCSAMPAGEREC pPageRec;
2424	RTRCPTR GCPtr = pVM->csam.s.pvDirtyBasePage[i];
2425
2426	GCPtr = GCPtr & PAGE_BASE_GC_MASK;
2427
2428	#ifdef VBOX_WITH_REM
2429	/* Notify the recompiler that this page has been changed. */
2430	REMR3NotifyCodePageChanged(pVM, pVCpu, GCPtr);
2431	#endif
2432
2433	/* Enable write protection again. (use the fault address as it might be an alias) */
2434	rc = PGMShwMakePageReadonly(pVCpu, pVM->csam.s.pvDirtyFaultPage[i], 0 /fFlags/);
2435	Assert(rc == VINF_SUCCESS \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT);
2436
2437	Log(("CSAMR3FlushDirtyPages: flush %RRv (modifypage rc=%Rrc)\n", pVM->csam.s.pvDirtyBasePage[i], rc));
2438
2439	pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)(uintptr_t)GCPtr);
2440	if (pPageRec && pPageRec->page.enmTag == CSAM_TAG_REM)
2441	{
2442	uint64_t fFlags;
2443
2444	rc = PGMGstGetPage(pVCpu, GCPtr, &fFlags, NULL);
2445	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
2446	if ( rc == VINF_SUCCESS
2447	&& (fFlags & X86_PTE_US))
2448	{
2449	/* We don't care about user pages. */
2450	csamRemovePageRecord(pVM, GCPtr);
2451	STAM_COUNTER_INC(&pVM->csam.s.StatNrUserPages);
2452	}
2453	}
2454	}
2455	pVM->csam.s.cDirtyPages = 0;
2456	STAM_PROFILE_STOP(&pVM->csam.s.StatFlushDirtyPages, a);
2457	return VINF_SUCCESS;
2458	}
2459
2460	/**
2461	* Flush potential new code pages
2462	*
2463	* @returns VBox status code.
2464	* @param pVM Pointer to the VM.
2465	*/
2466	static int csamR3FlushCodePages(PVM pVM)
2467	{
2468	Assert(pVM->cCpus == 1);
2469	PVMCPU pVCpu = VMMGetCpu0(pVM);
2470
2471	for (uint32_t i=0;i<pVM->csam.s.cPossibleCodePages;i++)
2472	{
2473	RTRCPTR GCPtr = pVM->csam.s.pvPossibleCodePage[i];
2474
2475	GCPtr = GCPtr & PAGE_BASE_GC_MASK;
2476
2477	Log(("csamR3FlushCodePages: %RRv\n", GCPtr));
2478	PGMShwMakePageNotPresent(pVCpu, GCPtr, 0 /fFlags/);
2479	/* Resync the page to make sure instruction fetch will fault */
2480	CSAMMarkPage(pVM, GCPtr, false);
2481	}
2482	pVM->csam.s.cPossibleCodePages = 0;
2483	return VINF_SUCCESS;
2484	}
2485
2486	/**
2487	* Perform any pending actions
2488	*
2489	* @returns VBox status code.
2490	* @param pVM Pointer to the VM.
2491	* @param pVCpu Pointer to the VMCPU.
2492	*/
2493	VMMR3_INT_DECL(int) CSAMR3DoPendingAction(PVM pVM, PVMCPU pVCpu)
2494	{
2495	AssertReturn(!HMIsEnabled(pVM), VERR_CSAM_HM_IPE);
2496
2497	csamR3FlushDirtyPages(pVM);
2498	csamR3FlushCodePages(pVM);
2499
2500	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_CSAM_PENDING_ACTION);
2501	return VINF_SUCCESS;
2502	}
2503
2504	/**
2505	* Analyse interrupt and trap gates
2506	*
2507	* @returns VBox status code.
2508	* @param pVM Pointer to the VM.
2509	* @param iGate Start gate
2510	* @param cGates Number of gates to check
2511	*/
2512	VMMR3_INT_DECL(int) CSAMR3CheckGates(PVM pVM, uint32_t iGate, uint32_t cGates)
2513	{
2514	#ifdef VBOX_WITH_RAW_MODE
2515	Assert(pVM->cCpus == 1);
2516	PVMCPU pVCpu = VMMGetCpu0(pVM);
2517	uint16_t cbIDT;
2518	RTRCPTR GCPtrIDT = CPUMGetGuestIDTR(pVCpu, &cbIDT);
2519	uint32_t iGateEnd;
2520	uint32_t maxGates;
2521	VBOXIDTE aIDT[256];
2522	PVBOXIDTE pGuestIdte;
2523	int rc;
2524
2525	AssertReturn(!HMIsEnabled(pVM), VERR_CSAM_HM_IPE);
2526	if (EMIsRawRing0Enabled(pVM) == false)
2527	{
2528	/* Enabling interrupt gates only works when raw ring 0 is enabled. */
2529	//AssertFailed();
2530	return VINF_SUCCESS;
2531	}
2532
2533	/* We only check all gates once during a session */
2534	if ( !pVM->csam.s.fGatesChecked
2535	&& cGates != 256)
2536	return VINF_SUCCESS; /* too early */
2537
2538	/* We only check all gates once during a session */
2539	if ( pVM->csam.s.fGatesChecked
2540	&& cGates != 1)
2541	return VINF_SUCCESS; /* ignored */
2542
2543	Assert(cGates <= 256);
2544	if (!GCPtrIDT \|\| cGates > 256)
2545	return VERR_INVALID_PARAMETER;
2546
2547	if (cGates != 1)
2548	{
2549	pVM->csam.s.fGatesChecked = true;
2550	for (unsigned i=0;i<RT_ELEMENTS(pVM->csam.s.pvCallInstruction);i++)
2551	{
2552	RTRCPTR pHandler = pVM->csam.s.pvCallInstruction[i];
2553
2554	if (pHandler)
2555	{
2556	PCSAMPAGE pPage = NULL;
2557	CSAMP2GLOOKUPREC cacheRec; /* Cache record for csamR3GCVirtToHCVirt. */
2558	RT_ZERO(cacheRec);
2559
2560	Log(("CSAMCheckGates: checking previous call instruction %RRv\n", pHandler));
2561	STAM_PROFILE_START(&pVM->csam.s.StatTime, a);
2562	rc = csamAnalyseCodeStream(pVM, pHandler, pHandler, true, CSAMR3AnalyseCallback, pPage, &cacheRec);
2563	STAM_PROFILE_STOP(&pVM->csam.s.StatTime, a);
2564	if (cacheRec.Lock.pvMap)
2565	PGMPhysReleasePageMappingLock(pVM, &cacheRec.Lock);
2566
2567	if (rc != VINF_SUCCESS)
2568	{
2569	Log(("CSAMCheckGates: csamAnalyseCodeStream failed with %d\n", rc));
2570	continue;
2571	}
2572	}
2573	}
2574	}
2575
2576	/* Determine valid upper boundary. */
2577	maxGates = (cbIDT+1) / sizeof(VBOXIDTE);
2578	Assert(iGate < maxGates);
2579	if (iGate > maxGates)
2580	return VERR_INVALID_PARAMETER;
2581
2582	if (iGate + cGates > maxGates)
2583	cGates = maxGates - iGate;
2584
2585	GCPtrIDT = GCPtrIDT + iGate * sizeof(VBOXIDTE);
2586	iGateEnd = iGate + cGates;
2587
2588	STAM_PROFILE_START(&pVM->csam.s.StatCheckGates, a);
2589
2590	/*
2591	* Get IDT entries.
2592	*/
2593	rc = PGMPhysSimpleReadGCPtr(pVCpu, aIDT, GCPtrIDT, cGates*sizeof(VBOXIDTE));
2594	if (RT_FAILURE(rc))
2595	{
2596	AssertMsgRC(rc, ("Failed to read IDTE! rc=%Rrc\n", rc));
2597	STAM_PROFILE_STOP(&pVM->csam.s.StatCheckGates, a);
2598	return rc;
2599	}
2600	pGuestIdte = &aIDT[0];
2601
2602	for (/iGate/; iGate<iGateEnd; iGate++, pGuestIdte++)
2603	{
2604	Assert(TRPMR3GetGuestTrapHandler(pVM, iGate) == TRPM_INVALID_HANDLER);
2605
2606	if ( pGuestIdte->Gen.u1Present
2607	&& (pGuestIdte->Gen.u5Type2 == VBOX_IDTE_TYPE2_TRAP_32 \|\| pGuestIdte->Gen.u5Type2 == VBOX_IDTE_TYPE2_INT_32)
2608	&& (pGuestIdte->Gen.u2DPL == 3 \|\| pGuestIdte->Gen.u2DPL == 0)
2609	)
2610	{
2611	RTRCPTR pHandler;
2612	PCSAMPAGE pPage = NULL;
2613	DBGFSELINFO selInfo;
2614	CSAMP2GLOOKUPREC cacheRec; /* Cache record for csamR3GCVirtToHCVirt. */
2615	RT_ZERO(cacheRec);
2616
2617	pHandler = VBOXIDTE_OFFSET(*pGuestIdte);
2618	pHandler = SELMToFlatBySel(pVM, pGuestIdte->Gen.u16SegSel, pHandler);
2619
2620	rc = SELMR3GetSelectorInfo(pVM, pVCpu, pGuestIdte->Gen.u16SegSel, &selInfo);
2621	if ( RT_FAILURE(rc)
2622	\|\| (selInfo.fFlags & (DBGFSELINFO_FLAGS_NOT_PRESENT \| DBGFSELINFO_FLAGS_INVALID))
2623	\|\| selInfo.GCPtrBase != 0
2624	\|\| selInfo.cbLimit != ~0U
2625	)
2626	{
2627	/* Refuse to patch a handler whose idt cs selector isn't wide open. */
2628	Log(("CSAMCheckGates: check gate %d failed due to rc %Rrc GCPtrBase=%RRv limit=%x\n", iGate, rc, selInfo.GCPtrBase, selInfo.cbLimit));
2629	continue;
2630	}
2631
2632
2633	if (pGuestIdte->Gen.u5Type2 == VBOX_IDTE_TYPE2_TRAP_32)
2634	{
2635	Log(("CSAMCheckGates: check trap gate %d at %04X:%08X (flat %RRv)\n", iGate, pGuestIdte->Gen.u16SegSel, VBOXIDTE_OFFSET(*pGuestIdte), pHandler));
2636	}
2637	else
2638	{
2639	Log(("CSAMCheckGates: check interrupt gate %d at %04X:%08X (flat %RRv)\n", iGate, pGuestIdte->Gen.u16SegSel, VBOXIDTE_OFFSET(*pGuestIdte), pHandler));
2640	}
2641
2642	STAM_PROFILE_START(&pVM->csam.s.StatTime, b);
2643	rc = csamAnalyseCodeStream(pVM, pHandler, pHandler, true, CSAMR3AnalyseCallback, pPage, &cacheRec);
2644	STAM_PROFILE_STOP(&pVM->csam.s.StatTime, b);
2645	if (cacheRec.Lock.pvMap)
2646	PGMPhysReleasePageMappingLock(pVM, &cacheRec.Lock);
2647
2648	if (rc != VINF_SUCCESS)
2649	{
2650	Log(("CSAMCheckGates: csamAnalyseCodeStream failed with %d\n", rc));
2651	continue;
2652	}
2653	/* OpenBSD guest specific patch test. */
2654	if (iGate >= 0x20)
2655	{
2656	PCPUMCTX pCtx;
2657	DISCPUSTATE cpu;
2658	RTGCUINTPTR32 aOpenBsdPushCSOffset[3] = {0x03, /* OpenBSD 3.7 & 3.8 */
2659	0x2B, /* OpenBSD 4.0 installation ISO */
2660	0x2F}; /* OpenBSD 4.0 after install */
2661
2662	pCtx = CPUMQueryGuestCtxPtr(pVCpu);
2663
2664	for (unsigned i=0;i<RT_ELEMENTS(aOpenBsdPushCSOffset);i++)
2665	{
2666	rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pHandler - aOpenBsdPushCSOffset[i], &cpu, NULL);
2667	if ( rc == VINF_SUCCESS
2668	&& cpu.pCurInstr->uOpcode == OP_PUSH
2669	&& cpu.pCurInstr->fParam1 == OP_PARM_REG_CS)
2670	{
2671	rc = PATMR3InstallPatch(pVM, pHandler - aOpenBsdPushCSOffset[i], PATMFL_CODE32 \| PATMFL_GUEST_SPECIFIC);
2672	if (RT_SUCCESS(rc))
2673	Log(("Installed OpenBSD interrupt handler prefix instruction (push cs) patch\n"));
2674	}
2675	}
2676	}
2677
2678	/* Trap gates and certain interrupt gates. */
2679	uint32_t fPatchFlags = PATMFL_CODE32 \| PATMFL_IDTHANDLER;
2680
2681	if (pGuestIdte->Gen.u5Type2 == VBOX_IDTE_TYPE2_TRAP_32)
2682	fPatchFlags \|= PATMFL_TRAPHANDLER;
2683	else
2684	fPatchFlags \|= PATMFL_INTHANDLER;
2685
2686	switch (iGate) {
2687	case 8:
2688	case 10:
2689	case 11:
2690	case 12:
2691	case 13:
2692	case 14:
2693	case 17:
2694	fPatchFlags \|= PATMFL_TRAPHANDLER_WITH_ERRORCODE;
2695	break;
2696	default:
2697	/* No error code. */
2698	break;
2699	}
2700
2701	Log(("Installing %s gate handler for 0x%X at %RRv\n", (pGuestIdte->Gen.u5Type2 == VBOX_IDTE_TYPE2_TRAP_32) ? "trap" : "intr", iGate, pHandler));
2702
2703	rc = PATMR3InstallPatch(pVM, pHandler, fPatchFlags);
2704	if ( RT_SUCCESS(rc)
2705	\|\| rc == VERR_PATM_ALREADY_PATCHED)
2706	{
2707	Log(("Gate handler 0x%X is SAFE!\n", iGate));
2708
2709	RTRCPTR pNewHandlerGC = PATMR3QueryPatchGCPtr(pVM, pHandler);
2710	if (pNewHandlerGC)
2711	{
2712	rc = TRPMR3SetGuestTrapHandler(pVM, iGate, pNewHandlerGC);
2713	if (RT_FAILURE(rc))
2714	Log(("TRPMR3SetGuestTrapHandler %d failed with %Rrc\n", iGate, rc));
2715	}
2716	}
2717	}
2718	} /* for */
2719	STAM_PROFILE_STOP(&pVM->csam.s.StatCheckGates, a);
2720	#endif /* VBOX_WITH_RAW_MODE */
2721	return VINF_SUCCESS;
2722	}
2723
2724	/**
2725	* Record previous call instruction addresses
2726	*
2727	* @returns VBox status code.
2728	* @param pVM Pointer to the VM.
2729	* @param GCPtrCall Call address
2730	*/
2731	VMMR3DECL(int) CSAMR3RecordCallAddress(PVM pVM, RTRCPTR GCPtrCall)
2732	{
2733	Assert(!HMIsEnabled(pVM));
2734	for (unsigned i=0;i<RT_ELEMENTS(pVM->csam.s.pvCallInstruction);i++)
2735	{
2736	if (pVM->csam.s.pvCallInstruction[i] == GCPtrCall)
2737	return VINF_SUCCESS;
2738	}
2739
2740	Log(("CSAMR3RecordCallAddress %RRv\n", GCPtrCall));
2741
2742	pVM->csam.s.pvCallInstruction[pVM->csam.s.iCallInstruction++] = GCPtrCall;
2743	if (pVM->csam.s.iCallInstruction >= RT_ELEMENTS(pVM->csam.s.pvCallInstruction))
2744	pVM->csam.s.iCallInstruction = 0;
2745
2746	return VINF_SUCCESS;
2747	}
2748
2749
2750	/**
2751	* Query CSAM state (enabled/disabled)
2752	*
2753	* @returns true if enabled, false otherwise.
2754	* @param pUVM The user mode VM handle.
2755	*/
2756	VMMR3DECL(bool) CSAMR3IsEnabled(PUVM pUVM)
2757	{
2758	UVM_ASSERT_VALID_EXT_RETURN(pUVM, false);
2759	PVM pVM = pUVM->pVM;
2760	VM_ASSERT_VALID_EXT_RETURN(pVM, false);
2761	return CSAMIsEnabled(pVM);
2762	}
2763
2764
2765	/**
2766	* Enables or disables code scanning.
2767	*
2768	* @returns VBox status code.
2769	* @param pUVM The user mode VM handle.
2770	* @param fEnabled Whether to enable or disable scanning.
2771	*/
2772	VMMR3DECL(int) CSAMR3SetScanningEnabled(PUVM pUVM, bool fEnabled)
2773	{
2774	UVM_ASSERT_VALID_EXT_RETURN(pUVM, VERR_INVALID_VM_HANDLE);
2775	PVM pVM = pUVM->pVM;
2776	VM_ASSERT_VALID_EXT_RETURN(pVM, VERR_INVALID_VM_HANDLE);
2777
2778	if (HMIsEnabled(pVM))
2779	{
2780	Assert(!pVM->fCSAMEnabled);
2781	return VINF_SUCCESS;
2782	}
2783
2784	int rc;
2785	if (fEnabled)
2786	rc = CSAMEnableScanning(pVM);
2787	else
2788	rc = CSAMDisableScanning(pVM);
2789	return rc;
2790	}
2791
2792
2793	#ifdef VBOX_WITH_DEBUGGER
2794
2795	/**
2796	* @callback_method_impl{FNDBGCCMD, The '.csamoff' command.}
2797	*/
2798	static DECLCALLBACK(int) csamr3CmdOff(PCDBGCCMD pCmd, PDBGCCMDHLP pCmdHlp, PUVM pUVM, PCDBGCVAR paArgs, unsigned cArgs)
2799	{
2800	DBGC_CMDHLP_REQ_UVM_RET(pCmdHlp, pCmd, pUVM);
2801	NOREF(cArgs); NOREF(paArgs);
2802
2803	if (HMR3IsEnabled(pUVM))
2804	return DBGCCmdHlpPrintf(pCmdHlp, "CSAM is permanently disabled by HM.\n");
2805
2806	int rc = CSAMR3SetScanningEnabled(pUVM, false);
2807	if (RT_FAILURE(rc))
2808	return DBGCCmdHlpFailRc(pCmdHlp, pCmd, rc, "CSAMR3SetScanningEnabled");
2809	return DBGCCmdHlpPrintf(pCmdHlp, "CSAM Scanning disabled\n");
2810	}
2811
2812	/**
2813	* @callback_method_impl{FNDBGCCMD, The '.csamon' command.}
2814	*/
2815	static DECLCALLBACK(int) csamr3CmdOn(PCDBGCCMD pCmd, PDBGCCMDHLP pCmdHlp, PUVM pUVM, PCDBGCVAR paArgs, unsigned cArgs)
2816	{
2817	DBGC_CMDHLP_REQ_UVM_RET(pCmdHlp, pCmd, pUVM);
2818	NOREF(cArgs); NOREF(paArgs);
2819
2820	if (HMR3IsEnabled(pUVM))
2821	return DBGCCmdHlpPrintf(pCmdHlp, "CSAM is permanently disabled by HM.\n");
2822
2823	int rc = CSAMR3SetScanningEnabled(pUVM, true);
2824	if (RT_FAILURE(rc))
2825	return DBGCCmdHlpFailRc(pCmdHlp, pCmd, rc, "CSAMR3SetScanningEnabled");
2826	return DBGCCmdHlpPrintf(pCmdHlp, "CSAM Scanning enabled\n");
2827	}
2828
2829	#endif /* VBOX_WITH_DEBUGGER */

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMR3/CSAM.cpp@ 49836

Download in other formats: