CSAM.cpp@ 48568

Last change on this file since 48568 was 45620, checked in by vboxsync, 12 years ago
CSAM,PATM: Don't bother initializing anything if HMIsEnabled(). Also, don't allow the components to be enabled.
Property svn:eol-style set to `native` Property svn:keywords set to `Id Revision`
File size: 100.7 KB

Line
1	/* $Id: CSAM.cpp 45620 2013-04-18 20:07:14Z vboxsync $ */
2	/** @file
3	* CSAM - Guest OS Code Scanning and Analysis Manager
4	*/
5
6	/*
7	* Copyright (C) 2006-2013 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18	/*******************************************************************************
19	* Header Files *
20	*******************************************************************************/
21	#define LOG_GROUP LOG_GROUP_CSAM
22	#include <VBox/vmm/cpum.h>
23	#include <VBox/vmm/stam.h>
24	#include <VBox/vmm/patm.h>
25	#include <VBox/vmm/csam.h>
26	#include <VBox/vmm/cpumdis.h>
27	#include <VBox/vmm/pgm.h>
28	#include <VBox/vmm/iom.h>
29	#include <VBox/vmm/mm.h>
30	#include <VBox/vmm/em.h>
31	#include <VBox/vmm/hm.h>
32	#ifdef VBOX_WITH_REM
33	# include <VBox/vmm/rem.h>
34	#endif
35	#include <VBox/vmm/selm.h>
36	#include <VBox/vmm/trpm.h>
37	#include <VBox/vmm/cfgm.h>
38	#include <VBox/vmm/ssm.h>
39	#include <VBox/param.h>
40	#include <iprt/avl.h>
41	#include <iprt/asm.h>
42	#include <iprt/thread.h>
43	#include "CSAMInternal.h"
44	#include <VBox/vmm/vm.h>
45	#include <VBox/vmm/uvm.h>
46
47	#include <VBox/dbg.h>
48	#include <VBox/sup.h>
49	#include <VBox/err.h>
50	#include <VBox/log.h>
51
52	#include <VBox/dis.h>
53	#include <VBox/disopcode.h>
54	#include <iprt/assert.h>
55	#include <iprt/string.h>
56	#include "internal/pgm.h"
57
58
59	/* Enabled by default */
60	#define CSAM_ENABLE
61
62	/* Enable to monitor code pages for self-modifying code. */
63	#define CSAM_MONITOR_CODE_PAGES
64	/* Enable to monitor all scanned pages
65	#define CSAM_MONITOR_CSAM_CODE_PAGES */
66	/* Enable to scan beyond ret instructions.
67	#define CSAM_ANALYSE_BEYOND_RET */
68
69	/*******************************************************************************
70	* Internal Functions *
71	*******************************************************************************/
72	static DECLCALLBACK(int) csamr3Save(PVM pVM, PSSMHANDLE pSSM);
73	static DECLCALLBACK(int) csamr3Load(PVM pVM, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass);
74	static DECLCALLBACK(int) csamR3LoadDummy(PVM pVM, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass);
75	static DECLCALLBACK(int) CSAMCodePageWriteHandler(PVM pVM, RTGCPTR GCPtr, void pvPtr, void pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType, void *pvUser);
76	static DECLCALLBACK(int) CSAMCodePageInvalidate(PVM pVM, RTGCPTR GCPtr);
77
78	bool csamIsCodeScanned(PVM pVM, RTRCPTR pInstr, PCSAMPAGE *pPage);
79	int csamR3CheckPageRecord(PVM pVM, RTRCPTR pInstr);
80	static PCSAMPAGE csamCreatePageRecord(PVM pVM, RTRCPTR GCPtr, CSAMTAG enmTag, bool fCode32, bool fMonitorInvalidation = false);
81	static int csamRemovePageRecord(PVM pVM, RTRCPTR GCPtr);
82	static int csamReinit(PVM pVM);
83	static void csamMarkCode(PVM pVM, PCSAMPAGE pPage, RTRCPTR pInstr, uint32_t opsize, bool fScanned);
84	static int csamAnalyseCodeStream(PVM pVM, RCPTRTYPE(uint8_t ) pInstrGC, RCPTRTYPE(uint8_t ) pCurInstrGC, bool fCode32,
85	PFN_CSAMR3ANALYSE pfnCSAMR3Analyse, void *pUserData, PCSAMP2GLOOKUPREC pCacheRec);
86
87	/** @todo Temporary for debugging. */
88	static bool fInCSAMCodePageInvalidate = false;
89
90	#ifdef VBOX_WITH_DEBUGGER
91	static FNDBGCCMD csamr3CmdOn;
92	static FNDBGCCMD csamr3CmdOff;
93	#endif
94
95
96	/*******************************************************************************
97	* Global Variables *
98	*******************************************************************************/
99	#ifdef VBOX_WITH_DEBUGGER
100	/** Command descriptors. */
101	static const DBGCCMD g_aCmds[] =
102	{
103	/* pszCmd, cArgsMin, cArgsMax, paArgDesc, cArgDescs, fFlags, pfnHandler pszSyntax, ....pszDescription */
104	{ "csamon", 0, 0, NULL, 0, 0, csamr3CmdOn, "", "Enable CSAM code scanning." },
105	{ "csamoff", 0, 0, NULL, 0, 0, csamr3CmdOff, "", "Disable CSAM code scanning." },
106	};
107	#endif
108
109	/**
110	* SSM descriptor table for the CSAM structure.
111	*/
112	static const SSMFIELD g_aCsamFields[] =
113	{
114	/** @todo there are more fields that can be ignored here. */
115	SSMFIELD_ENTRY_IGNORE( CSAM, offVM),
116	SSMFIELD_ENTRY_PAD_HC64( CSAM, Alignment0, sizeof(uint32_t)),
117	SSMFIELD_ENTRY_IGN_HCPTR( CSAM, pPageTree),
118	SSMFIELD_ENTRY( CSAM, aDangerousInstr),
119	SSMFIELD_ENTRY( CSAM, cDangerousInstr),
120	SSMFIELD_ENTRY( CSAM, iDangerousInstr),
121	SSMFIELD_ENTRY_RCPTR( CSAM, pPDBitmapGC), /// @todo ignore this?
122	SSMFIELD_ENTRY_RCPTR( CSAM, pPDHCBitmapGC), /// @todo ignore this?
123	SSMFIELD_ENTRY_IGN_HCPTR( CSAM, pPDBitmapHC),
124	SSMFIELD_ENTRY_IGN_HCPTR( CSAM, pPDGCBitmapHC),
125	SSMFIELD_ENTRY_IGN_HCPTR( CSAM, savedstate.pSSM),
126	SSMFIELD_ENTRY( CSAM, savedstate.cPageRecords),
127	SSMFIELD_ENTRY( CSAM, savedstate.cPatchPageRecords),
128	SSMFIELD_ENTRY( CSAM, cDirtyPages),
129	SSMFIELD_ENTRY_RCPTR_ARRAY( CSAM, pvDirtyBasePage),
130	SSMFIELD_ENTRY_RCPTR_ARRAY( CSAM, pvDirtyFaultPage),
131	SSMFIELD_ENTRY( CSAM, cPossibleCodePages),
132	SSMFIELD_ENTRY_RCPTR_ARRAY( CSAM, pvPossibleCodePage),
133	SSMFIELD_ENTRY_RCPTR_ARRAY( CSAM, pvCallInstruction),
134	SSMFIELD_ENTRY( CSAM, iCallInstruction),
135	SSMFIELD_ENTRY( CSAM, fScanningStarted),
136	SSMFIELD_ENTRY( CSAM, fGatesChecked),
137	SSMFIELD_ENTRY_PAD_HC( CSAM, Alignment1, 6, 2),
138	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrTraps),
139	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrPages),
140	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrPagesInv),
141	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrRemovedPages),
142	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrPatchPages),
143	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrPageNPHC),
144	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrPageNPGC),
145	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrFlushes),
146	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrFlushesSkipped),
147	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrKnownPagesHC),
148	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrKnownPagesGC),
149	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrInstr),
150	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrBytesRead),
151	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrOpcodeRead),
152	SSMFIELD_ENTRY_IGNORE( CSAM, StatTime),
153	SSMFIELD_ENTRY_IGNORE( CSAM, StatTimeCheckAddr),
154	SSMFIELD_ENTRY_IGNORE( CSAM, StatTimeAddrConv),
155	SSMFIELD_ENTRY_IGNORE( CSAM, StatTimeFlushPage),
156	SSMFIELD_ENTRY_IGNORE( CSAM, StatTimeDisasm),
157	SSMFIELD_ENTRY_IGNORE( CSAM, StatFlushDirtyPages),
158	SSMFIELD_ENTRY_IGNORE( CSAM, StatCheckGates),
159	SSMFIELD_ENTRY_IGNORE( CSAM, StatCodePageModified),
160	SSMFIELD_ENTRY_IGNORE( CSAM, StatDangerousWrite),
161	SSMFIELD_ENTRY_IGNORE( CSAM, StatInstrCacheHit),
162	SSMFIELD_ENTRY_IGNORE( CSAM, StatInstrCacheMiss),
163	SSMFIELD_ENTRY_IGNORE( CSAM, StatPagePATM),
164	SSMFIELD_ENTRY_IGNORE( CSAM, StatPageCSAM),
165	SSMFIELD_ENTRY_IGNORE( CSAM, StatPageREM),
166	SSMFIELD_ENTRY_IGNORE( CSAM, StatNrUserPages),
167	SSMFIELD_ENTRY_IGNORE( CSAM, StatPageMonitor),
168	SSMFIELD_ENTRY_IGNORE( CSAM, StatPageRemoveREMFlush),
169	SSMFIELD_ENTRY_IGNORE( CSAM, StatBitmapAlloc),
170	SSMFIELD_ENTRY_IGNORE( CSAM, StatScanNextFunction),
171	SSMFIELD_ENTRY_IGNORE( CSAM, StatScanNextFunctionFailed),
172	SSMFIELD_ENTRY_TERM()
173	};
174
175	/** Fake type to simplify g_aCsamPDBitmapArray construction. */
176	typedef struct
177	{
178	uint8_t *a[CSAM_PGDIRBMP_CHUNKS];
179	} CSAMPDBITMAPARRAY;
180
181	/**
182	* SSM descriptor table for the CSAM::pPDBitmapHC array.
183	*/
184	static SSMFIELD const g_aCsamPDBitmapArray[] =
185	{
186	SSMFIELD_ENTRY_HCPTR_NI_ARRAY(CSAMPDBITMAPARRAY, a),
187	SSMFIELD_ENTRY_TERM()
188	};
189
190	/**
191	* SSM descriptor table for the CSAMPAGEREC structure.
192	*/
193	static const SSMFIELD g_aCsamPageRecFields[] =
194	{
195	SSMFIELD_ENTRY_IGN_HCPTR( CSAMPAGEREC, Core.Key),
196	SSMFIELD_ENTRY_IGN_HCPTR( CSAMPAGEREC, Core.pLeft),
197	SSMFIELD_ENTRY_IGN_HCPTR( CSAMPAGEREC, Core.pRight),
198	SSMFIELD_ENTRY_IGNORE( CSAMPAGEREC, Core.uchHeight),
199	SSMFIELD_ENTRY_PAD_HC_AUTO( 3, 7),
200	SSMFIELD_ENTRY_RCPTR( CSAMPAGEREC, page.pPageGC),
201	SSMFIELD_ENTRY_PAD_HC_AUTO( 0, 4),
202	SSMFIELD_ENTRY_PAD_MSC32_AUTO( 4),
203	SSMFIELD_ENTRY_GCPHYS( CSAMPAGEREC, page.GCPhys),
204	SSMFIELD_ENTRY( CSAMPAGEREC, page.fFlags),
205	SSMFIELD_ENTRY( CSAMPAGEREC, page.uSize),
206	SSMFIELD_ENTRY_PAD_HC_AUTO( 0, 4),
207	SSMFIELD_ENTRY_HCPTR_NI( CSAMPAGEREC, page.pBitmap),
208	SSMFIELD_ENTRY( CSAMPAGEREC, page.fCode32),
209	SSMFIELD_ENTRY( CSAMPAGEREC, page.fMonitorActive),
210	SSMFIELD_ENTRY( CSAMPAGEREC, page.fMonitorInvalidation),
211	SSMFIELD_ENTRY_PAD_HC_AUTO( 1, 1),
212	SSMFIELD_ENTRY( CSAMPAGEREC, page.enmTag),
213	SSMFIELD_ENTRY( CSAMPAGEREC, page.u64Hash),
214	SSMFIELD_ENTRY_TERM()
215	};
216
217
218	/**
219	* Initializes the CSAM.
220	*
221	* @returns VBox status code.
222	* @param pVM Pointer to the VM.
223	*/
224	VMMR3_INT_DECL(int) CSAMR3Init(PVM pVM)
225	{
226	int rc;
227
228	/*
229	* We only need a saved state dummy loader if HM is enabled.
230	*/
231	if (HMIsEnabled(pVM))
232	{
233	pVM->fCSAMEnabled = false;
234	return SSMR3RegisterInternal(pVM, "CSAM", 0, CSAM_SSM_VERSION, 0,
235	NULL, NULL, NULL,
236	NULL, NULL, NULL,
237	NULL, csamR3LoadDummy, NULL);
238	}
239
240	/*
241	* Raw-mode.
242	*/
243	LogFlow(("CSAMR3Init\n"));
244
245	/* Allocate bitmap for the page directory. */
246	rc = MMR3HyperAllocOnceNoRel(pVM, CSAM_PGDIRBMP_CHUNKSsizeof(RTHCPTR), 0, MM_TAG_CSAM, (void *)&pVM->csam.s.pPDBitmapHC);
247	AssertRCReturn(rc, rc);
248	rc = MMR3HyperAllocOnceNoRel(pVM, CSAM_PGDIRBMP_CHUNKSsizeof(RTRCPTR), 0, MM_TAG_CSAM, (void *)&pVM->csam.s.pPDGCBitmapHC);
249	AssertRCReturn(rc, rc);
250	pVM->csam.s.pPDBitmapGC = MMHyperR3ToRC(pVM, pVM->csam.s.pPDGCBitmapHC);
251	pVM->csam.s.pPDHCBitmapGC = MMHyperR3ToRC(pVM, pVM->csam.s.pPDBitmapHC);
252
253	rc = csamReinit(pVM);
254	AssertRCReturn(rc, rc);
255
256	/*
257	* Register save and load state notifiers.
258	*/
259	rc = SSMR3RegisterInternal(pVM, "CSAM", 0, CSAM_SSM_VERSION, sizeof(pVM->csam.s) + PAGE_SIZE*16,
260	NULL, NULL, NULL,
261	NULL, csamr3Save, NULL,
262	NULL, csamr3Load, NULL);
263	AssertRCReturn(rc, rc);
264
265	STAM_REG(pVM, &pVM->csam.s.StatNrTraps, STAMTYPE_COUNTER, "/CSAM/PageTraps", STAMUNIT_OCCURENCES, "The number of CSAM page traps.");
266	STAM_REG(pVM, &pVM->csam.s.StatDangerousWrite, STAMTYPE_COUNTER, "/CSAM/DangerousWrites", STAMUNIT_OCCURENCES, "The number of dangerous writes that cause a context switch.");
267
268	STAM_REG(pVM, &pVM->csam.s.StatNrPageNPHC, STAMTYPE_COUNTER, "/CSAM/HC/PageNotPresent", STAMUNIT_OCCURENCES, "The number of CSAM pages marked not present.");
269	STAM_REG(pVM, &pVM->csam.s.StatNrPageNPGC, STAMTYPE_COUNTER, "/CSAM/GC/PageNotPresent", STAMUNIT_OCCURENCES, "The number of CSAM pages marked not present.");
270	STAM_REG(pVM, &pVM->csam.s.StatNrPages, STAMTYPE_COUNTER, "/CSAM/PageRec/AddedRW", STAMUNIT_OCCURENCES, "The number of CSAM page records (RW monitoring).");
271	STAM_REG(pVM, &pVM->csam.s.StatNrPagesInv, STAMTYPE_COUNTER, "/CSAM/PageRec/AddedRWI", STAMUNIT_OCCURENCES, "The number of CSAM page records (RW & invalidation monitoring).");
272	STAM_REG(pVM, &pVM->csam.s.StatNrRemovedPages, STAMTYPE_COUNTER, "/CSAM/PageRec/Removed", STAMUNIT_OCCURENCES, "The number of removed CSAM page records.");
273	STAM_REG(pVM, &pVM->csam.s.StatPageRemoveREMFlush,STAMTYPE_COUNTER, "/CSAM/PageRec/Removed/REMFlush", STAMUNIT_OCCURENCES, "The number of removed CSAM page records that caused a REM flush.");
274
275	STAM_REG(pVM, &pVM->csam.s.StatNrPatchPages, STAMTYPE_COUNTER, "/CSAM/PageRec/Patch", STAMUNIT_OCCURENCES, "The number of CSAM patch page records.");
276	STAM_REG(pVM, &pVM->csam.s.StatNrUserPages, STAMTYPE_COUNTER, "/CSAM/PageRec/Ignore/User", STAMUNIT_OCCURENCES, "The number of CSAM user page records (ignored).");
277	STAM_REG(pVM, &pVM->csam.s.StatPagePATM, STAMTYPE_COUNTER, "/CSAM/PageRec/Type/PATM", STAMUNIT_OCCURENCES, "The number of PATM page records.");
278	STAM_REG(pVM, &pVM->csam.s.StatPageCSAM, STAMTYPE_COUNTER, "/CSAM/PageRec/Type/CSAM", STAMUNIT_OCCURENCES, "The number of CSAM page records.");
279	STAM_REG(pVM, &pVM->csam.s.StatPageREM, STAMTYPE_COUNTER, "/CSAM/PageRec/Type/REM", STAMUNIT_OCCURENCES, "The number of REM page records.");
280	STAM_REG(pVM, &pVM->csam.s.StatPageMonitor, STAMTYPE_COUNTER, "/CSAM/PageRec/Monitored", STAMUNIT_OCCURENCES, "The number of monitored pages.");
281
282	STAM_REG(pVM, &pVM->csam.s.StatCodePageModified, STAMTYPE_COUNTER, "/CSAM/Monitor/DirtyPage", STAMUNIT_OCCURENCES, "The number of code page modifications.");
283
284	STAM_REG(pVM, &pVM->csam.s.StatNrFlushes, STAMTYPE_COUNTER, "/CSAM/PageFlushes", STAMUNIT_OCCURENCES, "The number of CSAM page flushes.");
285	STAM_REG(pVM, &pVM->csam.s.StatNrFlushesSkipped, STAMTYPE_COUNTER, "/CSAM/PageFlushesSkipped", STAMUNIT_OCCURENCES, "The number of CSAM page flushes that were skipped.");
286	STAM_REG(pVM, &pVM->csam.s.StatNrKnownPagesHC, STAMTYPE_COUNTER, "/CSAM/HC/KnownPageRecords", STAMUNIT_OCCURENCES, "The number of known CSAM page records.");
287	STAM_REG(pVM, &pVM->csam.s.StatNrKnownPagesGC, STAMTYPE_COUNTER, "/CSAM/GC/KnownPageRecords", STAMUNIT_OCCURENCES, "The number of known CSAM page records.");
288	STAM_REG(pVM, &pVM->csam.s.StatNrInstr, STAMTYPE_COUNTER, "/CSAM/ScannedInstr", STAMUNIT_OCCURENCES, "The number of scanned instructions.");
289	STAM_REG(pVM, &pVM->csam.s.StatNrBytesRead, STAMTYPE_COUNTER, "/CSAM/BytesRead", STAMUNIT_OCCURENCES, "The number of bytes read for scanning.");
290	STAM_REG(pVM, &pVM->csam.s.StatNrOpcodeRead, STAMTYPE_COUNTER, "/CSAM/OpcodeBytesRead", STAMUNIT_OCCURENCES, "The number of opcode bytes read by the recompiler.");
291
292	STAM_REG(pVM, &pVM->csam.s.StatBitmapAlloc, STAMTYPE_COUNTER, "/CSAM/Alloc/PageBitmap", STAMUNIT_OCCURENCES, "The number of page bitmap allocations.");
293
294	STAM_REG(pVM, &pVM->csam.s.StatInstrCacheHit, STAMTYPE_COUNTER, "/CSAM/Cache/Hit", STAMUNIT_OCCURENCES, "The number of dangerous instruction cache hits.");
295	STAM_REG(pVM, &pVM->csam.s.StatInstrCacheMiss, STAMTYPE_COUNTER, "/CSAM/Cache/Miss", STAMUNIT_OCCURENCES, "The number of dangerous instruction cache misses.");
296
297	STAM_REG(pVM, &pVM->csam.s.StatScanNextFunction, STAMTYPE_COUNTER, "/CSAM/Function/Scan/Success", STAMUNIT_OCCURENCES, "The number of found functions beyond the ret border.");
298	STAM_REG(pVM, &pVM->csam.s.StatScanNextFunctionFailed, STAMTYPE_COUNTER, "/CSAM/Function/Scan/Failed", STAMUNIT_OCCURENCES, "The number of refused functions beyond the ret border.");
299
300	STAM_REG(pVM, &pVM->csam.s.StatTime, STAMTYPE_PROFILE, "/PROF/CSAM/Scan", STAMUNIT_TICKS_PER_CALL, "Scanning overhead.");
301	STAM_REG(pVM, &pVM->csam.s.StatTimeCheckAddr, STAMTYPE_PROFILE, "/PROF/CSAM/CheckAddr", STAMUNIT_TICKS_PER_CALL, "Address check overhead.");
302	STAM_REG(pVM, &pVM->csam.s.StatTimeAddrConv, STAMTYPE_PROFILE, "/PROF/CSAM/AddrConv", STAMUNIT_TICKS_PER_CALL, "Address conversion overhead.");
303	STAM_REG(pVM, &pVM->csam.s.StatTimeFlushPage, STAMTYPE_PROFILE, "/PROF/CSAM/FlushPage", STAMUNIT_TICKS_PER_CALL, "Page flushing overhead.");
304	STAM_REG(pVM, &pVM->csam.s.StatTimeDisasm, STAMTYPE_PROFILE, "/PROF/CSAM/Disasm", STAMUNIT_TICKS_PER_CALL, "Disassembly overhead.");
305	STAM_REG(pVM, &pVM->csam.s.StatFlushDirtyPages, STAMTYPE_PROFILE, "/PROF/CSAM/FlushDirtyPage", STAMUNIT_TICKS_PER_CALL, "Dirty page flushing overhead.");
306	STAM_REG(pVM, &pVM->csam.s.StatCheckGates, STAMTYPE_PROFILE, "/PROF/CSAM/CheckGates", STAMUNIT_TICKS_PER_CALL, "CSAMR3CheckGates overhead.");
307
308	/*
309	* Check CFGM option and enable/disable CSAM.
310	*/
311	bool fEnabled;
312	rc = CFGMR3QueryBool(CFGMR3GetRoot(pVM), "CSAMEnabled", &fEnabled);
313	if (RT_FAILURE(rc))
314	#ifdef CSAM_ENABLE
315	fEnabled = true;
316	#else
317	fEnabled = false;
318	#endif
319	if (fEnabled)
320	CSAMEnableScanning(pVM);
321
322	#ifdef VBOX_WITH_DEBUGGER
323	/*
324	* Debugger commands.
325	*/
326	static bool fRegisteredCmds = false;
327	if (!fRegisteredCmds)
328	{
329	rc = DBGCRegisterCommands(&g_aCmds[0], RT_ELEMENTS(g_aCmds));
330	if (RT_SUCCESS(rc))
331	fRegisteredCmds = true;
332	}
333	#endif
334
335	return VINF_SUCCESS;
336	}
337
338	/**
339	* (Re)initializes CSAM
340	*
341	* @param pVM The VM.
342	*/
343	static int csamReinit(PVM pVM)
344	{
345	/*
346	* Assert alignment and sizes.
347	*/
348	AssertRelease(!(RT_OFFSETOF(VM, csam.s) & 31));
349	AssertRelease(sizeof(pVM->csam.s) <= sizeof(pVM->csam.padding));
350	AssertRelease(!HMIsEnabled(pVM));
351
352	/*
353	* Setup any fixed pointers and offsets.
354	*/
355	pVM->csam.s.offVM = RT_OFFSETOF(VM, patm);
356
357	pVM->csam.s.fGatesChecked = false;
358	pVM->csam.s.fScanningStarted = false;
359
360	PVMCPU pVCpu = &pVM->aCpus[0]; /* raw mode implies 1 VPCU */
361	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_CSAM_PENDING_ACTION);
362	pVM->csam.s.cDirtyPages = 0;
363	/* not necessary */
364	memset(pVM->csam.s.pvDirtyBasePage, 0, sizeof(pVM->csam.s.pvDirtyBasePage));
365	memset(pVM->csam.s.pvDirtyFaultPage, 0, sizeof(pVM->csam.s.pvDirtyFaultPage));
366
367	memset(&pVM->csam.s.aDangerousInstr, 0, sizeof(pVM->csam.s.aDangerousInstr));
368	pVM->csam.s.cDangerousInstr = 0;
369	pVM->csam.s.iDangerousInstr = 0;
370
371	memset(pVM->csam.s.pvCallInstruction, 0, sizeof(pVM->csam.s.pvCallInstruction));
372	pVM->csam.s.iCallInstruction = 0;
373
374	/** @note never mess with the pgdir bitmap here! */
375	return VINF_SUCCESS;
376	}
377
378	/**
379	* Applies relocations to data and code managed by this
380	* component. This function will be called at init and
381	* whenever the VMM need to relocate itself inside the GC.
382	*
383	* The csam will update the addresses used by the switcher.
384	*
385	* @param pVM The VM.
386	* @param offDelta Relocation delta.
387	*/
388	VMMR3_INT_DECL(void) CSAMR3Relocate(PVM pVM, RTGCINTPTR offDelta)
389	{
390	if (offDelta && !HMIsEnabled(pVM))
391	{
392	/* Adjust pgdir and page bitmap pointers. */
393	pVM->csam.s.pPDBitmapGC = MMHyperR3ToRC(pVM, pVM->csam.s.pPDGCBitmapHC);
394	pVM->csam.s.pPDHCBitmapGC = MMHyperR3ToRC(pVM, pVM->csam.s.pPDBitmapHC);
395
396	for(int i=0;i<CSAM_PGDIRBMP_CHUNKS;i++)
397	{
398	if (pVM->csam.s.pPDGCBitmapHC[i])
399	{
400	pVM->csam.s.pPDGCBitmapHC[i] += offDelta;
401	}
402	}
403	}
404	return;
405	}
406
407	/**
408	* Terminates the csam.
409	*
410	* Termination means cleaning up and freeing all resources,
411	* the VM it self is at this point powered off or suspended.
412	*
413	* @returns VBox status code.
414	* @param pVM Pointer to the VM.
415	*/
416	VMMR3_INT_DECL(int) CSAMR3Term(PVM pVM)
417	{
418	if (HMIsEnabled(pVM))
419	return VINF_SUCCESS;
420
421	int rc;
422
423	rc = CSAMR3Reset(pVM);
424	AssertRC(rc);
425
426	/* @todo triggers assertion in MMHyperFree */
427	#if 0
428	for(int i=0;i<CSAM_PAGEBMP_CHUNKS;i++)
429	{
430	if (pVM->csam.s.pPDBitmapHC[i])
431	MMHyperFree(pVM, pVM->csam.s.pPDBitmapHC[i]);
432	}
433	#endif
434
435	return VINF_SUCCESS;
436	}
437
438	/**
439	* CSAM reset callback.
440	*
441	* @returns VBox status code.
442	* @param pVM The VM which is reset.
443	*/
444	VMMR3_INT_DECL(int) CSAMR3Reset(PVM pVM)
445	{
446	if (HMIsEnabled(pVM))
447	return VINF_SUCCESS;
448
449	/* Clear page bitmaps. */
450	for (int i = 0; i < CSAM_PGDIRBMP_CHUNKS; i++)
451	{
452	if (pVM->csam.s.pPDBitmapHC[i])
453	{
454	Assert((CSAM_PAGE_BITMAP_SIZE& 3) == 0);
455	ASMMemZero32(pVM->csam.s.pPDBitmapHC[i], CSAM_PAGE_BITMAP_SIZE);
456	}
457	}
458
459	/* Remove all CSAM page records. */
460	for (;;)
461	{
462	PCSAMPAGEREC pPageRec = (PCSAMPAGEREC)RTAvlPVGetBestFit(&pVM->csam.s.pPageTree, 0, true);
463	if (!pPageRec)
464	break;
465	csamRemovePageRecord(pVM, pPageRec->page.pPageGC);
466	}
467	Assert(!pVM->csam.s.pPageTree);
468
469	csamReinit(pVM);
470
471	return VINF_SUCCESS;
472	}
473
474
475	/**
476	* Callback function for RTAvlPVDoWithAll
477	*
478	* Counts the number of records in the tree
479	*
480	* @returns VBox status code.
481	* @param pNode Current node
482	* @param pcPatches Pointer to patch counter
483	*/
484	static DECLCALLBACK(int) CountRecord(PAVLPVNODECORE pNode, void *pcPatches)
485	{
486	NOREF(pNode);
487	(uint32_t )pcPatches = (uint32_t )pcPatches + 1;
488	return VINF_SUCCESS;
489	}
490
491	/**
492	* Callback function for RTAvlPVDoWithAll
493	*
494	* Saves the state of the page record
495	*
496	* @returns VBox status code.
497	* @param pNode Current node
498	* @param pVM1 Pointer to the VM
499	*/
500	static DECLCALLBACK(int) SavePageState(PAVLPVNODECORE pNode, void *pVM1)
501	{
502	PVM pVM = (PVM)pVM1;
503	PCSAMPAGEREC pPage = (PCSAMPAGEREC)pNode;
504	CSAMPAGEREC page = *pPage;
505	PSSMHANDLE pSSM = pVM->csam.s.savedstate.pSSM;
506	int rc;
507
508	/* Save the page record itself */
509	rc = SSMR3PutMem(pSSM, &page, sizeof(page));
510	AssertRCReturn(rc, rc);
511
512	if (page.page.pBitmap)
513	{
514	rc = SSMR3PutMem(pSSM, page.page.pBitmap, CSAM_PAGE_BITMAP_SIZE);
515	AssertRCReturn(rc, rc);
516	}
517
518	return VINF_SUCCESS;
519	}
520
521	/**
522	* Execute state save operation.
523	*
524	* @returns VBox status code.
525	* @param pVM Pointer to the VM.
526	* @param pSSM SSM operation handle.
527	*/
528	static DECLCALLBACK(int) csamr3Save(PVM pVM, PSSMHANDLE pSSM)
529	{
530	CSAM csamInfo = pVM->csam.s;
531	int rc;
532
533	/*
534	* Count the number of page records in the tree (feeling lazy)
535	*/
536	csamInfo.savedstate.cPageRecords = 0;
537	RTAvlPVDoWithAll(&pVM->csam.s.pPageTree, true, CountRecord, &csamInfo.savedstate.cPageRecords);
538
539	/*
540	* Save CSAM structure
541	*/
542	pVM->csam.s.savedstate.pSSM = pSSM;
543	rc = SSMR3PutMem(pSSM, &csamInfo, sizeof(csamInfo));
544	AssertRCReturn(rc, rc);
545
546	/* Save pgdir bitmap */
547	rc = SSMR3PutMem(pSSM, csamInfo.pPDBitmapHC, CSAM_PGDIRBMP_CHUNKS*sizeof(RTHCPTR));
548	AssertRCReturn(rc, rc);
549
550	for (unsigned i=0;i<CSAM_PGDIRBMP_CHUNKS;i++)
551	{
552	if(csamInfo.pPDBitmapHC[i])
553	{
554	/* Save the page bitmap. */
555	rc = SSMR3PutMem(pSSM, csamInfo.pPDBitmapHC[i], CSAM_PAGE_BITMAP_SIZE);
556	AssertRCReturn(rc, rc);
557	}
558	}
559
560	/*
561	* Save page records
562	*/
563	rc = RTAvlPVDoWithAll(&pVM->csam.s.pPageTree, true, SavePageState, pVM);
564	AssertRCReturn(rc, rc);
565
566	/** @note we don't restore aDangerousInstr; it will be recreated automatically. */
567	return VINF_SUCCESS;
568	}
569
570
571	/**
572	* @callback_method_impl{FNSSMINTLOADEXEC, Dummy load function for HM mode.}
573	*/
574	DECLCALLBACK(int) csamR3LoadDummy(PVM pVM, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass)
575	{
576	return SSMR3SkipToEndOfUnit(pSSM);
577	}
578
579
580	/**
581	* Execute state load operation.
582	*
583	* @returns VBox status code.
584	* @param pVM Pointer to the VM.
585	* @param pSSM SSM operation handle.
586	* @param uVersion Data layout version.
587	* @param uPass The data pass.
588	*/
589	static DECLCALLBACK(int) csamr3Load(PVM pVM, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass)
590	{
591	int rc;
592	CSAM csamInfo;
593
594	Assert(uPass == SSM_PASS_FINAL); NOREF(uPass);
595	if (uVersion != CSAM_SSM_VERSION)
596	{
597	AssertMsgFailed(("csamR3Load: Invalid version uVersion=%d!\n", uVersion));
598	return VERR_SSM_UNSUPPORTED_DATA_UNIT_VERSION;
599	}
600
601	pVM->csam.s.savedstate.pSSM = pSSM;
602
603	/*
604	* Restore CSAM structure
605	*/
606	#if 0
607	rc = SSMR3GetMem(pSSM, &csamInfo, sizeof(csamInfo));
608	#else
609	RT_ZERO(csamInfo);
610	rc = SSMR3GetStructEx(pSSM, &csamInfo, sizeof(csamInfo), SSMSTRUCT_FLAGS_MEM_BAND_AID, &g_aCsamFields[0], NULL);
611	#endif
612	AssertRCReturn(rc, rc);
613
614	pVM->csam.s.fGatesChecked = csamInfo.fGatesChecked;
615	pVM->csam.s.fScanningStarted = csamInfo.fScanningStarted;
616
617	/* Restore dirty code page info. */
618	pVM->csam.s.cDirtyPages = csamInfo.cDirtyPages;
619	memcpy(pVM->csam.s.pvDirtyBasePage, csamInfo.pvDirtyBasePage, sizeof(pVM->csam.s.pvDirtyBasePage));
620	memcpy(pVM->csam.s.pvDirtyFaultPage, csamInfo.pvDirtyFaultPage, sizeof(pVM->csam.s.pvDirtyFaultPage));
621
622	/* Restore possible code page */
623	pVM->csam.s.cPossibleCodePages = csamInfo.cPossibleCodePages;
624	memcpy(pVM->csam.s.pvPossibleCodePage, csamInfo.pvPossibleCodePage, sizeof(pVM->csam.s.pvPossibleCodePage));
625
626	/* Restore pgdir bitmap (we'll change the pointers next). */
627	#if 0
628	rc = SSMR3GetMem(pSSM, pVM->csam.s.pPDBitmapHC, CSAM_PGDIRBMP_CHUNKS*sizeof(RTHCPTR));
629	#else
630	rc = SSMR3GetStructEx(pSSM, pVM->csam.s.pPDBitmapHC, sizeof(uint8_t ) CSAM_PGDIRBMP_CHUNKS,
631	SSMSTRUCT_FLAGS_MEM_BAND_AID, &g_aCsamPDBitmapArray[0], NULL);
632	#endif
633	AssertRCReturn(rc, rc);
634
635	/*
636	* Restore page bitmaps
637	*/
638	for (unsigned i=0;i<CSAM_PGDIRBMP_CHUNKS;i++)
639	{
640	if(pVM->csam.s.pPDBitmapHC[i])
641	{
642	rc = MMHyperAlloc(pVM, CSAM_PAGE_BITMAP_SIZE, 0, MM_TAG_CSAM, (void **)&pVM->csam.s.pPDBitmapHC[i]);
643	if (RT_FAILURE(rc))
644	{
645	Log(("MMHyperAlloc failed with %Rrc\n", rc));
646	return rc;
647	}
648	/* Convert to GC pointer. */
649	pVM->csam.s.pPDGCBitmapHC[i] = MMHyperR3ToRC(pVM, pVM->csam.s.pPDBitmapHC[i]);
650	Assert(pVM->csam.s.pPDGCBitmapHC[i]);
651
652	/* Restore the bitmap. */
653	rc = SSMR3GetMem(pSSM, pVM->csam.s.pPDBitmapHC[i], CSAM_PAGE_BITMAP_SIZE);
654	AssertRCReturn(rc, rc);
655	}
656	else
657	{
658	Assert(!pVM->csam.s.pPDGCBitmapHC[i]);
659	pVM->csam.s.pPDGCBitmapHC[i] = 0;
660	}
661	}
662
663	/*
664	* Restore page records
665	*/
666	for (uint32_t i=0;i<csamInfo.savedstate.cPageRecords + csamInfo.savedstate.cPatchPageRecords;i++)
667	{
668	CSAMPAGEREC page;
669	PCSAMPAGE pPage;
670
671	#if 0
672	rc = SSMR3GetMem(pSSM, &page, sizeof(page));
673	#else
674	RT_ZERO(page);
675	rc = SSMR3GetStructEx(pSSM, &page, sizeof(page), SSMSTRUCT_FLAGS_MEM_BAND_AID, &g_aCsamPageRecFields[0], NULL);
676	#endif
677	AssertRCReturn(rc, rc);
678
679	/*
680	* Recreate the page record
681	*/
682	pPage = csamCreatePageRecord(pVM, page.page.pPageGC, page.page.enmTag, page.page.fCode32, page.page.fMonitorInvalidation);
683	AssertReturn(pPage, VERR_NO_MEMORY);
684
685	pPage->GCPhys = page.page.GCPhys;
686	pPage->fFlags = page.page.fFlags;
687	pPage->u64Hash = page.page.u64Hash;
688
689	if (page.page.pBitmap)
690	{
691	rc = SSMR3GetMem(pSSM, pPage->pBitmap, CSAM_PAGE_BITMAP_SIZE);
692	AssertRCReturn(rc, rc);
693	}
694	else
695	{
696	MMR3HeapFree(pPage->pBitmap);
697	pPage->pBitmap = 0;
698	}
699	}
700
701	/* Note: we don't restore aDangerousInstr; it will be recreated automatically. */
702	memset(&pVM->csam.s.aDangerousInstr, 0, sizeof(pVM->csam.s.aDangerousInstr));
703	pVM->csam.s.cDangerousInstr = 0;
704	pVM->csam.s.iDangerousInstr = 0;
705	return VINF_SUCCESS;
706	}
707
708	/**
709	* Convert guest context address to host context pointer
710	*
711	* @returns Byte pointer (ring-3 context) corresponding to pGCPtr on success,
712	* NULL on failure.
713	* @param pVM Pointer to the VM.
714	* @param pCacheRec Address conversion cache record
715	* @param pGCPtr Guest context pointer
716	* @returns Host context pointer or NULL in case of an error
717	*
718	*/
719	static uint8_t csamR3GCVirtToHCVirt(PVM pVM, PCSAMP2GLOOKUPREC pCacheRec, RCPTRTYPE(uint8_t ) pGCPtr)
720	{
721	int rc;
722	void *pHCPtr;
723	Assert(pVM->cCpus == 1);
724	PVMCPU pVCpu = VMMGetCpu0(pVM);
725
726	STAM_PROFILE_START(&pVM->csam.s.StatTimeAddrConv, a);
727
728	pHCPtr = PATMR3GCPtrToHCPtr(pVM, pGCPtr);
729	if (pHCPtr)
730	return (uint8_t *)pHCPtr;
731
732	if (pCacheRec->pPageLocStartHC)
733	{
734	uint32_t offset = pGCPtr & PAGE_OFFSET_MASK;
735	if (pCacheRec->pGuestLoc == (pGCPtr & PAGE_BASE_GC_MASK))
736	{
737	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeAddrConv, a);
738	return pCacheRec->pPageLocStartHC + offset;
739	}
740	}
741
742	/* Release previous lock if any. */
743	if (pCacheRec->Lock.pvMap)
744	{
745	PGMPhysReleasePageMappingLock(pVM, &pCacheRec->Lock);
746	pCacheRec->Lock.pvMap = NULL;
747	}
748
749	rc = PGMPhysGCPtr2CCPtrReadOnly(pVCpu, pGCPtr, (const void **)&pHCPtr, &pCacheRec->Lock);
750	if (rc != VINF_SUCCESS)
751	{
752	//// AssertMsgRC(rc, ("MMR3PhysGCVirt2HCVirtEx failed for %RRv\n", pGCPtr));
753	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeAddrConv, a);
754	return NULL;
755	}
756
757	pCacheRec->pPageLocStartHC = (uint8_t*)((uintptr_t)pHCPtr & PAGE_BASE_HC_MASK);
758	pCacheRec->pGuestLoc = pGCPtr & PAGE_BASE_GC_MASK;
759	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeAddrConv, a);
760	return (uint8_t *)pHCPtr;
761	}
762
763
764	/** For csamR3ReadBytes. */
765	typedef struct CSAMDISINFO
766	{
767	PVM pVM;
768	uint8_t const pbSrcInstr; / aka pInstHC */
769	} CSAMDISINFO, *PCSAMDISINFO;
770
771
772	/**
773	* @callback_method_impl{FNDISREADBYTES}
774	*/
775	static DECLCALLBACK(int) csamR3ReadBytes(PDISCPUSTATE pDis, uint8_t offInstr, uint8_t cbMinRead, uint8_t cbMaxRead)
776	{
777	PCSAMDISINFO pDisInfo = (PCSAMDISINFO)pDis->pvUser;
778
779	/*
780	* We are not interested in patched instructions, so read the original opcode bytes.
781	*
782	* Note! single instruction patches (int3) are checked in CSAMR3AnalyseCallback
783	*
784	* Since we're decoding one instruction at the time, we don't need to be
785	* concerned about any patched instructions following the first one. We
786	* could in fact probably skip this PATM call for offInstr != 0.
787	*/
788	size_t cbRead = cbMaxRead;
789	RTUINTPTR uSrcAddr = pDis->uInstrAddr + offInstr;
790	int rc = PATMR3ReadOrgInstr(pDisInfo->pVM, pDis->uInstrAddr + offInstr, &pDis->abInstr[offInstr], cbRead, &cbRead);
791	if (RT_SUCCESS(rc))
792	{
793	if (cbRead >= cbMinRead)
794	{
795	pDis->cbCachedInstr = offInstr + (uint8_t)cbRead;
796	return rc;
797	}
798
799	cbMinRead -= (uint8_t)cbRead;
800	cbMaxRead -= (uint8_t)cbRead;
801	offInstr += (uint8_t)cbRead;
802	uSrcAddr += cbRead;
803	}
804
805	/*
806	* The current byte isn't a patch instruction byte.
807	*/
808	AssertPtr(pDisInfo->pbSrcInstr);
809	if ((pDis->uInstrAddr >> PAGE_SHIFT) == ((uSrcAddr + cbMaxRead - 1) >> PAGE_SHIFT))
810	{
811	memcpy(&pDis->abInstr[offInstr], &pDisInfo->pbSrcInstr[offInstr], cbMaxRead);
812	offInstr += cbMaxRead;
813	rc = VINF_SUCCESS;
814	}
815	else if ( (pDis->uInstrAddr >> PAGE_SHIFT) == ((uSrcAddr + cbMinRead - 1) >> PAGE_SHIFT)
816	\|\| PATMIsPatchGCAddr(pDisInfo->pVM, uSrcAddr) /** @todo does CSAM actually analyze patch code, or is this just a copy&past check? */
817	)
818	{
819	memcpy(&pDis->abInstr[offInstr], &pDisInfo->pbSrcInstr[offInstr], cbMinRead);
820	offInstr += cbMinRead;
821	rc = VINF_SUCCESS;
822	}
823	else
824	{
825	/* Crossed page boundrary, pbSrcInstr is no good... */
826	rc = PGMPhysSimpleReadGCPtr(VMMGetCpu0(pDisInfo->pVM), &pDis->abInstr[offInstr], uSrcAddr, cbMinRead);
827	offInstr += cbMinRead;
828	}
829
830	pDis->cbCachedInstr = offInstr;
831	return rc;
832	}
833
834	DECLINLINE(int) csamR3DISInstr(PVM pVM, RTRCPTR InstrGC, uint8_t *InstrHC, DISCPUMODE enmCpuMode,
835	PDISCPUSTATE pCpu, uint32_t pcbInstr, char pszOutput, size_t cbOutput)
836	{
837	CSAMDISINFO DisInfo = { pVM, InstrHC };
838	#ifdef DEBUG
839	return DISInstrToStrEx(InstrGC, enmCpuMode, csamR3ReadBytes, &DisInfo, DISOPTYPE_ALL,
840	pCpu, pcbInstr, pszOutput, cbOutput);
841	#else
842	/* We are interested in everything except harmless stuff */
843	if (pszOutput)
844	return DISInstrToStrEx(InstrGC, enmCpuMode, csamR3ReadBytes, &DisInfo,
845	~(DISOPTYPE_INVALID \| DISOPTYPE_HARMLESS \| DISOPTYPE_RRM_MASK),
846	pCpu, pcbInstr, pszOutput, cbOutput);
847	return DISInstrEx(InstrGC, enmCpuMode, ~(DISOPTYPE_INVALID \| DISOPTYPE_HARMLESS \| DISOPTYPE_RRM_MASK),
848	csamR3ReadBytes, &DisInfo, pCpu, pcbInstr);
849	#endif
850	}
851
852	/**
853	* Analyses the instructions following the cli for compliance with our heuristics for cli
854	*
855	* @returns VBox status code.
856	* @param pVM Pointer to the VM.
857	* @param pCpu CPU disassembly state
858	* @param pInstrGC Guest context pointer to privileged instruction
859	* @param pCurInstrGC Guest context pointer to the current instruction
860	* @param pCacheRec GC to HC cache record
861	* @param pUserData User pointer (callback specific)
862	*
863	*/
864	static int CSAMR3AnalyseCallback(PVM pVM, DISCPUSTATE pCpu, RCPTRTYPE(uint8_t ) pInstrGC, RCPTRTYPE(uint8_t *) pCurInstrGC,
865	PCSAMP2GLOOKUPREC pCacheRec, void *pUserData)
866	{
867	PCSAMPAGE pPage = (PCSAMPAGE)pUserData;
868	int rc;
869	NOREF(pInstrGC);
870
871	switch (pCpu->pCurInstr->uOpcode)
872	{
873	case OP_INT:
874	Assert(pCpu->Param1.fUse & DISUSE_IMMEDIATE8);
875	if (pCpu->Param1.uValue == 3)
876	{
877	//two byte int 3
878	return VINF_SUCCESS;
879	}
880	break;
881
882	/* removing breaks win2k guests? */
883	case OP_IRET:
884	if (EMIsRawRing1Enabled(pVM))
885	break;
886	/* no break */
887
888	case OP_ILLUD2:
889	/* This appears to be some kind of kernel panic in Linux 2.4; no point to continue. */
890	case OP_RETN:
891	case OP_INT3:
892	case OP_INVALID:
893	return VINF_SUCCESS;
894	}
895
896	// Check for exit points
897	switch (pCpu->pCurInstr->uOpcode)
898	{
899	/* It's not a good idea to patch pushf instructions:
900	* - increases the chance of conflicts (code jumping to the next instruction)
901	* - better to patch the cli
902	* - code that branches before the cli will likely hit an int 3
903	* - in general doesn't offer any benefits as we don't allow nested patch blocks (IF is always 1)
904	*/
905	case OP_PUSHF:
906	case OP_POPF:
907	break;
908
909	case OP_CLI:
910	{
911	uint32_t cbInstrs = 0;
912	uint32_t cbCurInstr = pCpu->cbInstr;
913	bool fCode32 = pPage->fCode32;
914
915	Assert(fCode32);
916
917	PATMR3AddHint(pVM, pCurInstrGC, (fCode32) ? PATMFL_CODE32 : 0);
918
919	/* Make sure the instructions that follow the cli have not been encountered before. */
920	while (true)
921	{
922	DISCPUSTATE cpu;
923
924	if (cbInstrs + cbCurInstr >= SIZEOF_NEARJUMP32)
925	break;
926
927	if (csamIsCodeScanned(pVM, pCurInstrGC + cbCurInstr, &pPage) == true)
928	{
929	/* We've scanned the next instruction(s) already. This means we've
930	followed a branch that ended up there before -> dangerous!! */
931	PATMR3DetectConflict(pVM, pCurInstrGC, pCurInstrGC + cbCurInstr);
932	break;
933	}
934	pCurInstrGC += cbCurInstr;
935	cbInstrs += cbCurInstr;
936
937	{ /* Force pCurInstrHC out of scope after we stop using it (page lock!) */
938	uint8_t *pCurInstrHC = csamR3GCVirtToHCVirt(pVM, pCacheRec, pCurInstrGC);
939	if (pCurInstrHC == NULL)
940	{
941	Log(("csamR3GCVirtToHCVirt failed for %RRv\n", pCurInstrGC));
942	break;
943	}
944	Assert(VALID_PTR(pCurInstrHC));
945
946	rc = csamR3DISInstr(pVM, pCurInstrGC, pCurInstrHC, (fCode32) ? DISCPUMODE_32BIT : DISCPUMODE_16BIT,
947	&cpu, &cbCurInstr, NULL, 0);
948	}
949	AssertRC(rc);
950	if (RT_FAILURE(rc))
951	break;
952	}
953	break;
954	}
955
956	#ifdef VBOX_WITH_RAW_RING1
957	case OP_MOV:
958	/* mov xx, CS is a dangerous instruction as our raw ring usage leaks through. */
959	if ( EMIsRawRing1Enabled(pVM)
960	&& (pCpu->Param2.fUse & DISUSE_REG_SEG)
961	&& (pCpu->Param2.Base.idxSegReg == DISSELREG_CS))
962	{
963	Log(("CSAM: Patching dangerous 'mov xx, cs' instruction at %RGv with an int3\n", pCurInstrGC));
964	if (PATMR3HasBeenPatched(pVM, pCurInstrGC) == false)
965	{
966	rc = PATMR3InstallPatch(pVM, pCurInstrGC, (pPage->fCode32) ? PATMFL_CODE32 : 0);
967	if (RT_FAILURE(rc))
968	{
969	Log(("PATMR3InstallPatch failed with %d\n", rc));
970	return VWRN_CONTINUE_ANALYSIS;
971	}
972	}
973	return VWRN_CONTINUE_ANALYSIS;
974	}
975	break;
976	#endif
977
978	case OP_PUSH:
979	/** @todo broken comparison!! should be if ((pCpu->Param1.fUse & DISUSE_REG_SEG) && (pCpu->Param1.Base.idxSegReg == DISSELREG_SS)) */
980	if (pCpu->pCurInstr->fParam1 != OP_PARM_REG_CS)
981	break;
982
983	/* no break */
984	#ifndef VBOX_WITH_SAFE_STR
985	case OP_STR:
986	#endif
987	case OP_LSL:
988	case OP_LAR:
989	case OP_SGDT:
990	case OP_SLDT:
991	case OP_SIDT:
992	case OP_SMSW:
993	case OP_VERW:
994	case OP_VERR:
995	case OP_CPUID:
996	case OP_IRET:
997	#ifdef DEBUG
998	switch(pCpu->pCurInstr->uOpcode)
999	{
1000	case OP_STR:
1001	Log(("Privileged instruction at %RRv: str!!\n", pCurInstrGC));
1002	break;
1003	case OP_LSL:
1004	Log(("Privileged instruction at %RRv: lsl!!\n", pCurInstrGC));
1005	break;
1006	case OP_LAR:
1007	Log(("Privileged instruction at %RRv: lar!!\n", pCurInstrGC));
1008	break;
1009	case OP_SGDT:
1010	Log(("Privileged instruction at %RRv: sgdt!!\n", pCurInstrGC));
1011	break;
1012	case OP_SLDT:
1013	Log(("Privileged instruction at %RRv: sldt!!\n", pCurInstrGC));
1014	break;
1015	case OP_SIDT:
1016	Log(("Privileged instruction at %RRv: sidt!!\n", pCurInstrGC));
1017	break;
1018	case OP_SMSW:
1019	Log(("Privileged instruction at %RRv: smsw!!\n", pCurInstrGC));
1020	break;
1021	case OP_VERW:
1022	Log(("Privileged instruction at %RRv: verw!!\n", pCurInstrGC));
1023	break;
1024	case OP_VERR:
1025	Log(("Privileged instruction at %RRv: verr!!\n", pCurInstrGC));
1026	break;
1027	case OP_CPUID:
1028	Log(("Privileged instruction at %RRv: cpuid!!\n", pCurInstrGC));
1029	break;
1030	case OP_PUSH:
1031	Log(("Privileged instruction at %RRv: push cs!!\n", pCurInstrGC));
1032	break;
1033	case OP_IRET:
1034	Log(("Privileged instruction at %RRv: iret!!\n", pCurInstrGC));
1035	break;
1036	}
1037	#endif
1038
1039	if (PATMR3HasBeenPatched(pVM, pCurInstrGC) == false)
1040	{
1041	rc = PATMR3InstallPatch(pVM, pCurInstrGC, (pPage->fCode32) ? PATMFL_CODE32 : 0);
1042	if (RT_FAILURE(rc))
1043	{
1044	Log(("PATMR3InstallPatch failed with %d\n", rc));
1045	return VWRN_CONTINUE_ANALYSIS;
1046	}
1047	}
1048	if (pCpu->pCurInstr->uOpcode == OP_IRET)
1049	return VINF_SUCCESS; /* Look no further in this branch. */
1050
1051	return VWRN_CONTINUE_ANALYSIS;
1052
1053	case OP_JMP:
1054	case OP_CALL:
1055	{
1056	// return or jump/call through a jump table
1057	if (OP_PARM_VTYPE(pCpu->pCurInstr->fParam1) != OP_PARM_J)
1058	{
1059	#ifdef DEBUG
1060	switch(pCpu->pCurInstr->uOpcode)
1061	{
1062	case OP_JMP:
1063	Log(("Control Flow instruction at %RRv: jmp!!\n", pCurInstrGC));
1064	break;
1065	case OP_CALL:
1066	Log(("Control Flow instruction at %RRv: call!!\n", pCurInstrGC));
1067	break;
1068	}
1069	#endif
1070	return VWRN_CONTINUE_ANALYSIS;
1071	}
1072	return VWRN_CONTINUE_ANALYSIS;
1073	}
1074
1075	}
1076
1077	return VWRN_CONTINUE_ANALYSIS;
1078	}
1079
1080	#ifdef CSAM_ANALYSE_BEYOND_RET
1081	/**
1082	* Wrapper for csamAnalyseCodeStream for call instructions.
1083	*
1084	* @returns VBox status code.
1085	* @param pVM Pointer to the VM.
1086	* @param pInstrGC Guest context pointer to privileged instruction
1087	* @param pCurInstrGC Guest context pointer to the current instruction
1088	* @param fCode32 16 or 32 bits code
1089	* @param pfnCSAMR3Analyse Callback for testing the disassembled instruction
1090	* @param pUserData User pointer (callback specific)
1091	*
1092	*/
1093	static int csamAnalyseCallCodeStream(PVM pVM, RCPTRTYPE(uint8_t ) pInstrGC, RCPTRTYPE(uint8_t ) pCurInstrGC, bool fCode32,
1094	PFN_CSAMR3ANALYSE pfnCSAMR3Analyse, void *pUserData, PCSAMP2GLOOKUPREC pCacheRec)
1095	{
1096	int rc;
1097	CSAMCALLEXITREC CallExitRec;
1098	PCSAMCALLEXITREC pOldCallRec;
1099	PCSAMPAGE pPage = 0;
1100	uint32_t i;
1101
1102	CallExitRec.cInstrAfterRet = 0;
1103
1104	pOldCallRec = pCacheRec->pCallExitRec;
1105	pCacheRec->pCallExitRec = &CallExitRec;
1106
1107	rc = csamAnalyseCodeStream(pVM, pInstrGC, pCurInstrGC, fCode32, pfnCSAMR3Analyse, pUserData, pCacheRec);
1108
1109	for (i=0;i<CallExitRec.cInstrAfterRet;i++)
1110	{
1111	PCSAMPAGE pPage = 0;
1112
1113	pCurInstrGC = CallExitRec.pInstrAfterRetGC[i];
1114
1115	/* Check if we've previously encountered the instruction after the ret. */
1116	if (csamIsCodeScanned(pVM, pCurInstrGC, &pPage) == false)
1117	{
1118	DISCPUSTATE cpu;
1119	uint32_t cbInstr;
1120	int rc2;
1121	#ifdef DEBUG
1122	char szOutput[256];
1123	#endif
1124	if (pPage == NULL)
1125	{
1126	/* New address; let's take a look at it. */
1127	pPage = csamCreatePageRecord(pVM, pCurInstrGC, CSAM_TAG_CSAM, fCode32);
1128	if (pPage == NULL)
1129	{
1130	rc = VERR_NO_MEMORY;
1131	goto done;
1132	}
1133	}
1134
1135	/**
1136	* Some generic requirements for recognizing an adjacent function:
1137	* - alignment fillers that consist of:
1138	* - nop
1139	* - lea genregX, [genregX (+ 0)]
1140	* - push ebp after the filler (can extend this later); aligned at at least a 4 byte boundary
1141	*/
1142	for (int j = 0; j < 16; j++)
1143	{
1144	uint8_t *pCurInstrHC = csamR3GCVirtToHCVirt(pVM, pCacheRec, pCurInstrGC);
1145	if (pCurInstrHC == NULL)
1146	{
1147	Log(("csamR3GCVirtToHCVirt failed for %RRv\n", pCurInstrGC));
1148	goto done;
1149	}
1150	Assert(VALID_PTR(pCurInstrHC));
1151
1152	STAM_PROFILE_START(&pVM->csam.s.StatTimeDisasm, a);
1153	#ifdef DEBUG
1154	rc2 = csamR3DISInstr(pVM, pCurInstrGC, pCurInstrHC, (fCode32) ? DISCPUMODE_32BIT : DISCPUMODE_16BIT,
1155	&cpu, &cbInstr, szOutput, sizeof(szOutput));
1156	if (RT_SUCCESS(rc2)) Log(("CSAM Call Analysis: %s", szOutput));
1157	#else
1158	rc2 = csamR3DISInstr(pVM, pCurInstrGC, pCurInstrHC, (fCode32) ? DISCPUMODE_32BIT : DISCPUMODE_16BIT,
1159	&cpu, &cbInstr, NULL, 0);
1160	#endif
1161	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeDisasm, a);
1162	if (RT_FAILURE(rc2))
1163	{
1164	Log(("Disassembly failed at %RRv with %Rrc (probably page not present) -> return to caller\n", pCurInstrGC, rc2));
1165	goto done;
1166	}
1167
1168	STAM_COUNTER_ADD(&pVM->csam.s.StatNrBytesRead, cbInstr);
1169
1170	RCPTRTYPE(uint8_t *) addr = 0;
1171	PCSAMPAGE pJmpPage = NULL;
1172
1173	if (PAGE_ADDRESS(pCurInstrGC) != PAGE_ADDRESS(pCurInstrGC + cbInstr - 1))
1174	{
1175	if (!PGMGstIsPagePresent(pVM, pCurInstrGC + cbInstr - 1))
1176	{
1177	/// @todo fault in the page
1178	Log(("Page for current instruction %RRv is not present!!\n", pCurInstrGC));
1179	goto done;
1180	}
1181	//all is fine, let's continue
1182	csamR3CheckPageRecord(pVM, pCurInstrGC + cbInstr - 1);
1183	}
1184
1185	switch (cpu.pCurInstr->uOpcode)
1186	{
1187	case OP_NOP:
1188	case OP_INT3:
1189	break; /* acceptable */
1190
1191	case OP_LEA:
1192	/* Must be similar to:
1193	*
1194	* lea esi, [esi]
1195	* lea esi, [esi+0]
1196	* Any register is allowed as long as source and destination are identical.
1197	*/
1198	if ( cpu.Param1.fUse != DISUSE_REG_GEN32
1199	\|\| ( cpu.Param2.flags != DISUSE_REG_GEN32
1200	&& ( !(cpu.Param2.flags & DISUSE_REG_GEN32)
1201	\|\| !(cpu.Param2.flags & (DISUSE_DISPLACEMENT8\|DISUSE_DISPLACEMENT16\|DISUSE_DISPLACEMENT32))
1202	\|\| cpu.Param2.uValue != 0
1203	)
1204	)
1205	\|\| cpu.Param1.base.reg_gen32 != cpu.Param2.base.reg_gen32
1206	)
1207	{
1208	STAM_COUNTER_INC(&pVM->csam.s.StatScanNextFunctionFailed);
1209	goto next_function;
1210	}
1211	break;
1212
1213	case OP_PUSH:
1214	{
1215	if ( (pCurInstrGC & 0x3) != 0
1216	\|\| cpu.Param1.fUse != DISUSE_REG_GEN32
1217	\|\| cpu.Param1.base.reg_gen32 != USE_REG_EBP
1218	)
1219	{
1220	STAM_COUNTER_INC(&pVM->csam.s.StatScanNextFunctionFailed);
1221	goto next_function;
1222	}
1223
1224	if (csamIsCodeScanned(pVM, pCurInstrGC, &pPage) == false)
1225	{
1226	CSAMCALLEXITREC CallExitRec2;
1227	CallExitRec2.cInstrAfterRet = 0;
1228
1229	pCacheRec->pCallExitRec = &CallExitRec2;
1230
1231	/* Analyse the function. */
1232	Log(("Found new function at %RRv\n", pCurInstrGC));
1233	STAM_COUNTER_INC(&pVM->csam.s.StatScanNextFunction);
1234	csamAnalyseCallCodeStream(pVM, pInstrGC, pCurInstrGC, fCode32, pfnCSAMR3Analyse, pUserData, pCacheRec);
1235	}
1236	goto next_function;
1237	}
1238
1239	case OP_SUB:
1240	{
1241	if ( (pCurInstrGC & 0x3) != 0
1242	\|\| cpu.Param1.fUse != DISUSE_REG_GEN32
1243	\|\| cpu.Param1.base.reg_gen32 != USE_REG_ESP
1244	)
1245	{
1246	STAM_COUNTER_INC(&pVM->csam.s.StatScanNextFunctionFailed);
1247	goto next_function;
1248	}
1249
1250	if (csamIsCodeScanned(pVM, pCurInstrGC, &pPage) == false)
1251	{
1252	CSAMCALLEXITREC CallExitRec2;
1253	CallExitRec2.cInstrAfterRet = 0;
1254
1255	pCacheRec->pCallExitRec = &CallExitRec2;
1256
1257	/* Analyse the function. */
1258	Log(("Found new function at %RRv\n", pCurInstrGC));
1259	STAM_COUNTER_INC(&pVM->csam.s.StatScanNextFunction);
1260	csamAnalyseCallCodeStream(pVM, pInstrGC, pCurInstrGC, fCode32, pfnCSAMR3Analyse, pUserData, pCacheRec);
1261	}
1262	goto next_function;
1263	}
1264
1265	default:
1266	STAM_COUNTER_INC(&pVM->csam.s.StatScanNextFunctionFailed);
1267	goto next_function;
1268	}
1269	/* Mark it as scanned. */
1270	csamMarkCode(pVM, pPage, pCurInstrGC, cbInstr, true);
1271	pCurInstrGC += cbInstr;
1272	} /* for at most 16 instructions */
1273	next_function:
1274	; /* MSVC complains otherwise */
1275	}
1276	}
1277	done:
1278	pCacheRec->pCallExitRec = pOldCallRec;
1279	return rc;
1280	}
1281	#else
1282	#define csamAnalyseCallCodeStream csamAnalyseCodeStream
1283	#endif
1284
1285	/**
1286	* Disassembles the code stream until the callback function detects a failure or decides everything is acceptable
1287	*
1288	* @returns VBox status code.
1289	* @param pVM Pointer to the VM.
1290	* @param pInstrGC Guest context pointer to privileged instruction
1291	* @param pCurInstrGC Guest context pointer to the current instruction
1292	* @param fCode32 16 or 32 bits code
1293	* @param pfnCSAMR3Analyse Callback for testing the disassembled instruction
1294	* @param pUserData User pointer (callback specific)
1295	*
1296	*/
1297	static int csamAnalyseCodeStream(PVM pVM, RCPTRTYPE(uint8_t ) pInstrGC, RCPTRTYPE(uint8_t ) pCurInstrGC, bool fCode32,
1298	PFN_CSAMR3ANALYSE pfnCSAMR3Analyse, void *pUserData, PCSAMP2GLOOKUPREC pCacheRec)
1299	{
1300	DISCPUSTATE cpu;
1301	PCSAMPAGE pPage = (PCSAMPAGE)pUserData;
1302	int rc = VWRN_CONTINUE_ANALYSIS;
1303	uint32_t cbInstr;
1304	int rc2;
1305	Assert(pVM->cCpus == 1);
1306	PVMCPU pVCpu = VMMGetCpu0(pVM);
1307
1308	#ifdef DEBUG
1309	char szOutput[256];
1310	#endif
1311
1312	LogFlow(("csamAnalyseCodeStream: code at %RRv depth=%d\n", pCurInstrGC, pCacheRec->depth));
1313
1314	pVM->csam.s.fScanningStarted = true;
1315
1316	pCacheRec->depth++;
1317	/*
1318	* Limit the call depth. (rather arbitrary upper limit; too low and we won't detect certain
1319	* cpuid instructions in Linux kernels; too high and we waste too much time scanning code)
1320	* (512 is necessary to detect cpuid instructions in Red Hat EL4; see defect 1355)
1321	* @note we are using a lot of stack here. couple of 100k when we go to the full depth (!)
1322	*/
1323	if (pCacheRec->depth > 512)
1324	{
1325	LogFlow(("CSAM: maximum calldepth reached for %RRv\n", pCurInstrGC));
1326	pCacheRec->depth--;
1327	return VINF_SUCCESS; //let's not go on forever
1328	}
1329
1330	Assert(!PATMIsPatchGCAddr(pVM, pCurInstrGC));
1331	csamR3CheckPageRecord(pVM, pCurInstrGC);
1332
1333	while(rc == VWRN_CONTINUE_ANALYSIS)
1334	{
1335	if (csamIsCodeScanned(pVM, pCurInstrGC, &pPage) == false)
1336	{
1337	if (pPage == NULL)
1338	{
1339	/* New address; let's take a look at it. */
1340	pPage = csamCreatePageRecord(pVM, pCurInstrGC, CSAM_TAG_CSAM, fCode32);
1341	if (pPage == NULL)
1342	{
1343	rc = VERR_NO_MEMORY;
1344	goto done;
1345	}
1346	}
1347	}
1348	else
1349	{
1350	LogFlow(("Code at %RRv has been scanned before\n", pCurInstrGC));
1351	rc = VINF_SUCCESS;
1352	goto done;
1353	}
1354
1355	{ /* Force pCurInstrHC out of scope after we stop using it (page lock!) */
1356	uint8_t *pCurInstrHC = csamR3GCVirtToHCVirt(pVM, pCacheRec, pCurInstrGC);
1357	if (pCurInstrHC == NULL)
1358	{
1359	Log(("csamR3GCVirtToHCVirt failed for %RRv\n", pCurInstrGC));
1360	rc = VERR_PATCHING_REFUSED;
1361	goto done;
1362	}
1363	Assert(VALID_PTR(pCurInstrHC));
1364
1365	STAM_PROFILE_START(&pVM->csam.s.StatTimeDisasm, a);
1366	#ifdef DEBUG
1367	rc2 = csamR3DISInstr(pVM, pCurInstrGC, pCurInstrHC, fCode32 ? DISCPUMODE_32BIT : DISCPUMODE_16BIT,
1368	&cpu, &cbInstr, szOutput, sizeof(szOutput));
1369	if (RT_SUCCESS(rc2)) Log(("CSAM Analysis: %s", szOutput));
1370	#else
1371	rc2 = csamR3DISInstr(pVM, pCurInstrGC, pCurInstrHC, fCode32 ? DISCPUMODE_32BIT : DISCPUMODE_16BIT,
1372	&cpu, &cbInstr, NULL, 0);
1373	#endif
1374	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeDisasm, a);
1375	}
1376	if (RT_FAILURE(rc2))
1377	{
1378	Log(("Disassembly failed at %RRv with %Rrc (probably page not present) -> return to caller\n", pCurInstrGC, rc2));
1379	rc = VINF_SUCCESS;
1380	goto done;
1381	}
1382
1383	STAM_COUNTER_ADD(&pVM->csam.s.StatNrBytesRead, cbInstr);
1384
1385	csamMarkCode(pVM, pPage, pCurInstrGC, cbInstr, true);
1386
1387	RCPTRTYPE(uint8_t *) addr = 0;
1388	PCSAMPAGE pJmpPage = NULL;
1389
1390	if (PAGE_ADDRESS(pCurInstrGC) != PAGE_ADDRESS(pCurInstrGC + cbInstr - 1))
1391	{
1392	if (!PGMGstIsPagePresent(pVCpu, pCurInstrGC + cbInstr - 1))
1393	{
1394	/// @todo fault in the page
1395	Log(("Page for current instruction %RRv is not present!!\n", pCurInstrGC));
1396	rc = VWRN_CONTINUE_ANALYSIS;
1397	goto next_please;
1398	}
1399	//all is fine, let's continue
1400	csamR3CheckPageRecord(pVM, pCurInstrGC + cbInstr - 1);
1401	}
1402	/*
1403	* If it's harmless, then don't bother checking it (the disasm tables had better be accurate!)
1404	*/
1405	if ((cpu.pCurInstr->fOpType & ~DISOPTYPE_RRM_MASK) == DISOPTYPE_HARMLESS)
1406	{
1407	AssertMsg(pfnCSAMR3Analyse(pVM, &cpu, pInstrGC, pCurInstrGC, pCacheRec, (void *)pPage) == VWRN_CONTINUE_ANALYSIS, ("Instruction incorrectly marked harmless?!?!?\n"));
1408	rc = VWRN_CONTINUE_ANALYSIS;
1409	goto next_please;
1410	}
1411
1412	#ifdef CSAM_ANALYSE_BEYOND_RET
1413	/* Remember the address of the instruction following the ret in case the parent instruction was a call. */
1414	if ( pCacheRec->pCallExitRec
1415	&& cpu.pCurInstr->uOpcode == OP_RETN
1416	&& pCacheRec->pCallExitRec->cInstrAfterRet < CSAM_MAX_CALLEXIT_RET)
1417	{
1418	pCacheRec->pCallExitRec->pInstrAfterRetGC[pCacheRec->pCallExitRec->cInstrAfterRet] = pCurInstrGC + cbInstr;
1419	pCacheRec->pCallExitRec->cInstrAfterRet++;
1420	}
1421	#endif
1422
1423	rc = pfnCSAMR3Analyse(pVM, &cpu, pInstrGC, pCurInstrGC, pCacheRec, (void *)pPage);
1424	if (rc == VINF_SUCCESS)
1425	goto done;
1426
1427	// For our first attempt, we'll handle only simple relative jumps and calls (immediate offset coded in instruction)
1428	if ( ((cpu.pCurInstr->fOpType & DISOPTYPE_CONTROLFLOW) && (OP_PARM_VTYPE(cpu.pCurInstr->fParam1) == OP_PARM_J))
1429	\|\| (cpu.pCurInstr->uOpcode == OP_CALL && cpu.Param1.fUse == DISUSE_DISPLACEMENT32)) /* simple indirect call (call dword ptr [address]) */
1430	{
1431	/* We need to parse 'call dword ptr [address]' type of calls to catch cpuid instructions in some recent Linux distributions (e.g. OpenSuse 10.3) */
1432	if ( cpu.pCurInstr->uOpcode == OP_CALL
1433	&& cpu.Param1.fUse == DISUSE_DISPLACEMENT32)
1434	{
1435	addr = 0;
1436	PGMPhysSimpleReadGCPtr(pVCpu, &addr, (RTRCUINTPTR)cpu.Param1.uDisp.i32, sizeof(addr));
1437	}
1438	else
1439	addr = CSAMResolveBranch(&cpu, pCurInstrGC);
1440
1441	if (addr == 0)
1442	{
1443	Log(("We don't support far jumps here!! (%08X)\n", cpu.Param1.fUse));
1444	rc = VINF_SUCCESS;
1445	break;
1446	}
1447	Assert(!PATMIsPatchGCAddr(pVM, addr));
1448
1449	/* If the target address lies in a patch generated jump, then special action needs to be taken. */
1450	PATMR3DetectConflict(pVM, pCurInstrGC, addr);
1451
1452	/* Same page? */
1453	if (PAGE_ADDRESS(addr) != PAGE_ADDRESS(pCurInstrGC ))
1454	{
1455	if (!PGMGstIsPagePresent(pVCpu, addr))
1456	{
1457	Log(("Page for current instruction %RRv is not present!!\n", addr));
1458	rc = VWRN_CONTINUE_ANALYSIS;
1459	goto next_please;
1460	}
1461
1462	/* All is fine, let's continue. */
1463	csamR3CheckPageRecord(pVM, addr);
1464	}
1465
1466	pJmpPage = NULL;
1467	if (csamIsCodeScanned(pVM, addr, &pJmpPage) == false)
1468	{
1469	if (pJmpPage == NULL)
1470	{
1471	/* New branch target; let's take a look at it. */
1472	pJmpPage = csamCreatePageRecord(pVM, addr, CSAM_TAG_CSAM, fCode32);
1473	if (pJmpPage == NULL)
1474	{
1475	rc = VERR_NO_MEMORY;
1476	goto done;
1477	}
1478	Assert(pPage);
1479	}
1480	if (cpu.pCurInstr->uOpcode == OP_CALL)
1481	rc = csamAnalyseCallCodeStream(pVM, pInstrGC, addr, fCode32, pfnCSAMR3Analyse, (void *)pJmpPage, pCacheRec);
1482	else
1483	rc = csamAnalyseCodeStream(pVM, pInstrGC, addr, fCode32, pfnCSAMR3Analyse, (void *)pJmpPage, pCacheRec);
1484
1485	if (rc != VINF_SUCCESS) {
1486	goto done;
1487	}
1488	}
1489	if (cpu.pCurInstr->uOpcode == OP_JMP)
1490	{//unconditional jump; return to caller
1491	rc = VINF_SUCCESS;
1492	goto done;
1493	}
1494
1495	rc = VWRN_CONTINUE_ANALYSIS;
1496	} //if ((cpu.pCurInstr->fOpType & DISOPTYPE_CONTROLFLOW) && (OP_PARM_VTYPE(cpu.pCurInstr->fParam1) == OP_PARM_J))
1497	#ifdef CSAM_SCAN_JUMP_TABLE
1498	else
1499	if ( cpu.pCurInstr->uOpcode == OP_JMP
1500	&& (cpu.Param1.fUse & (DISUSE_DISPLACEMENT32\|DISUSE_INDEX\|DISUSE_SCALE)) == (DISUSE_DISPLACEMENT32\|DISUSE_INDEX\|DISUSE_SCALE)
1501	)
1502	{
1503	RTRCPTR pJumpTableGC = (RTRCPTR)cpu.Param1.disp32;
1504	uint8_t *pJumpTableHC;
1505	int rc2;
1506
1507	Log(("Jump through jump table\n"));
1508
1509	rc2 = PGMPhysGCPtr2CCPtrReadOnly(pVCpu, pJumpTableGC, (PRTHCPTR)&pJumpTableHC, missing page lock);
1510	if (rc2 == VINF_SUCCESS)
1511	{
1512	for (uint32_t i=0;i<2;i++)
1513	{
1514	uint64_t fFlags;
1515
1516	addr = pJumpTableGC + cpu.Param1.scale * i;
1517	/* Same page? */
1518	if (PAGE_ADDRESS(addr) != PAGE_ADDRESS(pJumpTableGC))
1519	break;
1520
1521	addr = (RTRCPTR )(pJumpTableHC + cpu.Param1.scale * i);
1522
1523	rc2 = PGMGstGetPage(pVCpu, addr, &fFlags, NULL);
1524	if ( rc2 != VINF_SUCCESS
1525	\|\| (fFlags & X86_PTE_US)
1526	\|\| !(fFlags & X86_PTE_P)
1527	)
1528	break;
1529
1530	Log(("Jump to %RRv\n", addr));
1531
1532	pJmpPage = NULL;
1533	if (csamIsCodeScanned(pVM, addr, &pJmpPage) == false)
1534	{
1535	if (pJmpPage == NULL)
1536	{
1537	/* New branch target; let's take a look at it. */
1538	pJmpPage = csamCreatePageRecord(pVM, addr, CSAM_TAG_CSAM, fCode32);
1539	if (pJmpPage == NULL)
1540	{
1541	rc = VERR_NO_MEMORY;
1542	goto done;
1543	}
1544	Assert(pPage);
1545	}
1546	rc = csamAnalyseCodeStream(pVM, pInstrGC, addr, fCode32, pfnCSAMR3Analyse, (void *)pJmpPage, pCacheRec);
1547	if (rc != VINF_SUCCESS) {
1548	goto done;
1549	}
1550	}
1551	}
1552	}
1553	}
1554	#endif
1555	if (rc != VWRN_CONTINUE_ANALYSIS) {
1556	break; //done!
1557	}
1558	next_please:
1559	if (cpu.pCurInstr->uOpcode == OP_JMP)
1560	{
1561	rc = VINF_SUCCESS;
1562	goto done;
1563	}
1564	pCurInstrGC += cbInstr;
1565	}
1566	done:
1567	pCacheRec->depth--;
1568	return rc;
1569	}
1570
1571
1572	/**
1573	* Calculates the 64 bits hash value for the current page
1574	*
1575	* @returns hash value
1576	* @param pVM Pointer to the VM.
1577	* @param pInstr Page address
1578	*/
1579	uint64_t csamR3CalcPageHash(PVM pVM, RTRCPTR pInstr)
1580	{
1581	uint64_t hash = 0;
1582	uint32_t val[5];
1583	int rc;
1584	Assert(pVM->cCpus == 1);
1585	PVMCPU pVCpu = VMMGetCpu0(pVM);
1586
1587	Assert((pInstr & PAGE_OFFSET_MASK) == 0);
1588
1589	rc = PGMPhysSimpleReadGCPtr(pVCpu, &val[0], pInstr, sizeof(val[0]));
1590	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
1591	if (rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT)
1592	{
1593	Log(("csamR3CalcPageHash: page %RRv not present!!\n", pInstr));
1594	return ~0ULL;
1595	}
1596
1597	rc = PGMPhysSimpleReadGCPtr(pVCpu, &val[1], pInstr+1024, sizeof(val[0]));
1598	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
1599	if (rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT)
1600	{
1601	Log(("csamR3CalcPageHash: page %RRv not present!!\n", pInstr));
1602	return ~0ULL;
1603	}
1604
1605	rc = PGMPhysSimpleReadGCPtr(pVCpu, &val[2], pInstr+2048, sizeof(val[0]));
1606	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
1607	if (rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT)
1608	{
1609	Log(("csamR3CalcPageHash: page %RRv not present!!\n", pInstr));
1610	return ~0ULL;
1611	}
1612
1613	rc = PGMPhysSimpleReadGCPtr(pVCpu, &val[3], pInstr+3072, sizeof(val[0]));
1614	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
1615	if (rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT)
1616	{
1617	Log(("csamR3CalcPageHash: page %RRv not present!!\n", pInstr));
1618	return ~0ULL;
1619	}
1620
1621	rc = PGMPhysSimpleReadGCPtr(pVCpu, &val[4], pInstr+4092, sizeof(val[0]));
1622	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
1623	if (rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT)
1624	{
1625	Log(("csamR3CalcPageHash: page %RRv not present!!\n", pInstr));
1626	return ~0ULL;
1627	}
1628
1629	// don't want to get division by zero traps
1630	val[2] \|= 1;
1631	val[4] \|= 1;
1632
1633	hash = (uint64_t)val[0] * (uint64_t)val[1] / (uint64_t)val[2] + (val[3]%val[4]);
1634	return (hash == ~0ULL) ? hash - 1 : hash;
1635	}
1636
1637
1638	/**
1639	* Notify CSAM of a page flush
1640	*
1641	* @returns VBox status code
1642	* @param pVM Pointer to the VM.
1643	* @param addr GC address of the page to flush
1644	* @param fRemovePage Page removal flag
1645	*/
1646	static int csamFlushPage(PVM pVM, RTRCPTR addr, bool fRemovePage)
1647	{
1648	PCSAMPAGEREC pPageRec;
1649	int rc;
1650	RTGCPHYS GCPhys = 0;
1651	uint64_t fFlags = 0;
1652	Assert(pVM->cCpus == 1 \|\| !CSAMIsEnabled(pVM));
1653
1654	if (!CSAMIsEnabled(pVM))
1655	return VINF_SUCCESS;
1656	Assert(!HMIsEnabled(pVM));
1657
1658	PVMCPU pVCpu = VMMGetCpu0(pVM);
1659
1660	STAM_PROFILE_START(&pVM->csam.s.StatTimeFlushPage, a);
1661
1662	addr = addr & PAGE_BASE_GC_MASK;
1663
1664	/*
1665	* Note: searching for the page in our tree first is more expensive (skipped flushes are two orders of magnitude more common)
1666	*/
1667	if (pVM->csam.s.pPageTree == NULL)
1668	{
1669	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeFlushPage, a);
1670	return VWRN_CSAM_PAGE_NOT_FOUND;
1671	}
1672
1673	rc = PGMGstGetPage(pVCpu, addr, &fFlags, &GCPhys);
1674	/* Returned at a very early stage (no paging yet presumably). */
1675	if (rc == VERR_NOT_SUPPORTED)
1676	{
1677	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeFlushPage, a);
1678	return rc;
1679	}
1680
1681	if (RT_SUCCESS(rc))
1682	{
1683	if ( (fFlags & X86_PTE_US)
1684	\|\| rc == VERR_PGM_PHYS_PAGE_RESERVED
1685	)
1686	{
1687	/* User page -> not relevant for us. */
1688	STAM_COUNTER_ADD(&pVM->csam.s.StatNrFlushesSkipped, 1);
1689	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeFlushPage, a);
1690	return VINF_SUCCESS;
1691	}
1692	}
1693	else
1694	if (rc != VERR_PAGE_NOT_PRESENT && rc != VERR_PAGE_TABLE_NOT_PRESENT)
1695	AssertMsgFailed(("PGMR3GetPage %RRv failed with %Rrc\n", addr, rc));
1696
1697	pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)(uintptr_t)addr);
1698	if (pPageRec)
1699	{
1700	if ( GCPhys == pPageRec->page.GCPhys
1701	&& (fFlags & X86_PTE_P))
1702	{
1703	STAM_COUNTER_ADD(&pVM->csam.s.StatNrFlushesSkipped, 1);
1704	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeFlushPage, a);
1705	return VINF_SUCCESS;
1706	}
1707
1708	Log(("CSAMR3FlushPage: page %RRv has changed -> FLUSH (rc=%Rrc) (Phys: %RGp vs %RGp)\n", addr, rc, GCPhys, pPageRec->page.GCPhys));
1709
1710	STAM_COUNTER_ADD(&pVM->csam.s.StatNrFlushes, 1);
1711
1712	if (fRemovePage)
1713	csamRemovePageRecord(pVM, addr);
1714	else
1715	{
1716	CSAMMarkPage(pVM, addr, false);
1717	pPageRec->page.GCPhys = 0;
1718	pPageRec->page.fFlags = 0;
1719	rc = PGMGstGetPage(pVCpu, addr, &pPageRec->page.fFlags, &pPageRec->page.GCPhys);
1720	if (rc == VINF_SUCCESS)
1721	pPageRec->page.u64Hash = csamR3CalcPageHash(pVM, addr);
1722
1723	if (pPageRec->page.pBitmap == NULL)
1724	{
1725	pPageRec->page.pBitmap = (uint8_t *)MMR3HeapAllocZ(pVM, MM_TAG_CSAM_PATCH, CSAM_PAGE_BITMAP_SIZE);
1726	Assert(pPageRec->page.pBitmap);
1727	if (pPageRec->page.pBitmap == NULL)
1728	return VERR_NO_MEMORY;
1729	}
1730	else
1731	memset(pPageRec->page.pBitmap, 0, CSAM_PAGE_BITMAP_SIZE);
1732	}
1733
1734
1735	/*
1736	* Inform patch manager about the flush; no need to repeat the above check twice.
1737	*/
1738	PATMR3FlushPage(pVM, addr);
1739
1740	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeFlushPage, a);
1741	return VINF_SUCCESS;
1742	}
1743	else
1744	{
1745	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeFlushPage, a);
1746	return VWRN_CSAM_PAGE_NOT_FOUND;
1747	}
1748	}
1749
1750	/**
1751	* Notify CSAM of a page flush
1752	*
1753	* @returns VBox status code
1754	* @param pVM Pointer to the VM.
1755	* @param addr GC address of the page to flush
1756	*/
1757	VMMR3_INT_DECL(int) CSAMR3FlushPage(PVM pVM, RTRCPTR addr)
1758	{
1759	return csamFlushPage(pVM, addr, true /* remove page record */);
1760	}
1761
1762	/**
1763	* Remove a CSAM monitored page. Use with care!
1764	*
1765	* @returns VBox status code
1766	* @param pVM Pointer to the VM.
1767	* @param addr GC address of the page to flush
1768	*/
1769	VMMR3_INT_DECL(int) CSAMR3RemovePage(PVM pVM, RTRCPTR addr)
1770	{
1771	PCSAMPAGEREC pPageRec;
1772	int rc;
1773
1774	AssertReturn(!HMIsEnabled(pVM), VERR_CSAM_HM_IPE);
1775
1776	addr = addr & PAGE_BASE_GC_MASK;
1777
1778	pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)(uintptr_t)addr);
1779	if (pPageRec)
1780	{
1781	rc = csamRemovePageRecord(pVM, addr);
1782	if (RT_SUCCESS(rc))
1783	PATMR3FlushPage(pVM, addr);
1784	return VINF_SUCCESS;
1785	}
1786	return VWRN_CSAM_PAGE_NOT_FOUND;
1787	}
1788
1789	/**
1790	* Check a page record in case a page has been changed
1791	*
1792	* @returns VBox status code. (trap handled or not)
1793	* @param pVM Pointer to the VM.
1794	* @param pInstrGC GC instruction pointer
1795	*/
1796	int csamR3CheckPageRecord(PVM pVM, RTRCPTR pInstrGC)
1797	{
1798	PCSAMPAGEREC pPageRec;
1799	uint64_t u64hash;
1800
1801	pInstrGC = pInstrGC & PAGE_BASE_GC_MASK;
1802
1803	pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)(uintptr_t)pInstrGC);
1804	if (pPageRec)
1805	{
1806	u64hash = csamR3CalcPageHash(pVM, pInstrGC);
1807	if (u64hash != pPageRec->page.u64Hash)
1808	csamFlushPage(pVM, pInstrGC, false /* don't remove page record */);
1809	}
1810	else
1811	return VWRN_CSAM_PAGE_NOT_FOUND;
1812
1813	return VINF_SUCCESS;
1814	}
1815
1816	/**
1817	* Returns monitor description based on CSAM tag
1818	*
1819	* @return description string
1820	* @param enmTag Owner tag
1821	*/
1822	const char *csamGetMonitorDescription(CSAMTAG enmTag)
1823	{
1824	if (enmTag == CSAM_TAG_PATM)
1825	return "CSAM-PATM self-modifying code monitor handler";
1826	else
1827	if (enmTag == CSAM_TAG_REM)
1828	return "CSAM-REM self-modifying code monitor handler";
1829	Assert(enmTag == CSAM_TAG_CSAM);
1830	return "CSAM self-modifying code monitor handler";
1831	}
1832
1833	/**
1834	* Adds page record to our lookup tree
1835	*
1836	* @returns CSAMPAGE ptr or NULL if failure
1837	* @param pVM Pointer to the VM.
1838	* @param GCPtr Page address
1839	* @param enmTag Owner tag
1840	* @param fCode32 16 or 32 bits code
1841	* @param fMonitorInvalidation Monitor page invalidation flag
1842	*/
1843	static PCSAMPAGE csamCreatePageRecord(PVM pVM, RTRCPTR GCPtr, CSAMTAG enmTag, bool fCode32, bool fMonitorInvalidation)
1844	{
1845	PCSAMPAGEREC pPage;
1846	int rc;
1847	bool ret;
1848	Assert(pVM->cCpus == 1);
1849	PVMCPU pVCpu = VMMGetCpu0(pVM);
1850
1851	Log(("New page record for %RRv\n", GCPtr & PAGE_BASE_GC_MASK));
1852
1853	pPage = (PCSAMPAGEREC)MMR3HeapAllocZ(pVM, MM_TAG_CSAM_PATCH, sizeof(CSAMPAGEREC));
1854	if (pPage == NULL)
1855	{
1856	AssertMsgFailed(("csamCreatePageRecord: Out of memory!!!!\n"));
1857	return NULL;
1858	}
1859	/* Round down to page boundary. */
1860	GCPtr = (GCPtr & PAGE_BASE_GC_MASK);
1861	pPage->Core.Key = (AVLPVKEY)(uintptr_t)GCPtr;
1862	pPage->page.pPageGC = GCPtr;
1863	pPage->page.fCode32 = fCode32;
1864	pPage->page.fMonitorInvalidation = fMonitorInvalidation;
1865	pPage->page.enmTag = enmTag;
1866	pPage->page.fMonitorActive = false;
1867	pPage->page.pBitmap = (uint8_t *)MMR3HeapAllocZ(pVM, MM_TAG_CSAM_PATCH, PAGE_SIZE/sizeof(uint8_t));
1868	rc = PGMGstGetPage(pVCpu, GCPtr, &pPage->page.fFlags, &pPage->page.GCPhys);
1869	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
1870
1871	pPage->page.u64Hash = csamR3CalcPageHash(pVM, GCPtr);
1872	ret = RTAvlPVInsert(&pVM->csam.s.pPageTree, &pPage->Core);
1873	Assert(ret);
1874
1875	#ifdef CSAM_MONITOR_CODE_PAGES
1876	AssertRelease(!fInCSAMCodePageInvalidate);
1877
1878	switch (enmTag)
1879	{
1880	case CSAM_TAG_PATM:
1881	case CSAM_TAG_REM:
1882	#ifdef CSAM_MONITOR_CSAM_CODE_PAGES
1883	case CSAM_TAG_CSAM:
1884	#endif
1885	{
1886	rc = PGMR3HandlerVirtualRegister(pVM, PGMVIRTHANDLERTYPE_WRITE, GCPtr, GCPtr + (PAGE_SIZE - 1) /* inclusive! */,
1887	(fMonitorInvalidation) ? CSAMCodePageInvalidate : 0, CSAMCodePageWriteHandler, "CSAMGCCodePageWriteHandler", 0,
1888	csamGetMonitorDescription(enmTag));
1889	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PGM_HANDLER_VIRTUAL_CONFLICT, ("PGMR3HandlerVirtualRegisterEx %RRv failed with %Rrc\n", GCPtr, rc));
1890	if (RT_FAILURE(rc))
1891	Log(("PGMR3HandlerVirtualRegisterEx for %RRv failed with %Rrc\n", GCPtr, rc));
1892
1893	/* Could fail, because it's already monitored. Don't treat that condition as fatal. */
1894
1895	/* Prefetch it in case it's not there yet. */
1896	rc = PGMPrefetchPage(pVCpu, GCPtr);
1897	AssertRC(rc);
1898
1899	rc = PGMShwMakePageReadonly(pVCpu, GCPtr, 0 /fFlags/);
1900	Assert(rc == VINF_SUCCESS \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT);
1901
1902	pPage->page.fMonitorActive = true;
1903	STAM_COUNTER_INC(&pVM->csam.s.StatPageMonitor);
1904	break;
1905	}
1906	default:
1907	break; /* to shut up GCC */
1908	}
1909
1910	Log(("csamCreatePageRecord %RRv GCPhys=%RGp\n", GCPtr, pPage->page.GCPhys));
1911
1912	#ifdef VBOX_WITH_STATISTICS
1913	switch (enmTag)
1914	{
1915	case CSAM_TAG_CSAM:
1916	STAM_COUNTER_INC(&pVM->csam.s.StatPageCSAM);
1917	break;
1918	case CSAM_TAG_PATM:
1919	STAM_COUNTER_INC(&pVM->csam.s.StatPagePATM);
1920	break;
1921	case CSAM_TAG_REM:
1922	STAM_COUNTER_INC(&pVM->csam.s.StatPageREM);
1923	break;
1924	default:
1925	break; /* to shut up GCC */
1926	}
1927	#endif
1928
1929	#endif
1930
1931	STAM_COUNTER_INC(&pVM->csam.s.StatNrPages);
1932	if (fMonitorInvalidation)
1933	STAM_COUNTER_INC(&pVM->csam.s.StatNrPagesInv);
1934
1935	return &pPage->page;
1936	}
1937
1938	/**
1939	* Monitors a code page (if not already monitored)
1940	*
1941	* @returns VBox status code
1942	* @param pVM Pointer to the VM.
1943	* @param pPageAddrGC The page to monitor
1944	* @param enmTag Monitor tag
1945	*/
1946	VMMR3DECL(int) CSAMR3MonitorPage(PVM pVM, RTRCPTR pPageAddrGC, CSAMTAG enmTag)
1947	{
1948	PCSAMPAGEREC pPageRec = NULL;
1949	int rc;
1950	bool fMonitorInvalidation;
1951	Assert(pVM->cCpus == 1);
1952	PVMCPU pVCpu = VMMGetCpu0(pVM);
1953	Assert(!HMIsEnabled(pVM));
1954
1955	/* Dirty pages must be handled before calling this function!. */
1956	Assert(!pVM->csam.s.cDirtyPages);
1957
1958	if (pVM->csam.s.fScanningStarted == false)
1959	return VINF_SUCCESS; /* too early */
1960
1961	pPageAddrGC &= PAGE_BASE_GC_MASK;
1962
1963	Log(("CSAMR3MonitorPage %RRv %d\n", pPageAddrGC, enmTag));
1964
1965	/** @todo implicit assumption */
1966	fMonitorInvalidation = (enmTag == CSAM_TAG_PATM);
1967
1968	pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)(uintptr_t)pPageAddrGC);
1969	if (pPageRec == NULL)
1970	{
1971	uint64_t fFlags;
1972
1973	rc = PGMGstGetPage(pVCpu, pPageAddrGC, &fFlags, NULL);
1974	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
1975	if ( rc == VINF_SUCCESS
1976	&& (fFlags & X86_PTE_US))
1977	{
1978	/* We don't care about user pages. */
1979	STAM_COUNTER_INC(&pVM->csam.s.StatNrUserPages);
1980	return VINF_SUCCESS;
1981	}
1982
1983	csamCreatePageRecord(pVM, pPageAddrGC, enmTag, true /* 32 bits code */, fMonitorInvalidation);
1984
1985	pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)(uintptr_t)pPageAddrGC);
1986	Assert(pPageRec);
1987	}
1988	/** @todo reference count */
1989
1990	#ifdef CSAM_MONITOR_CSAM_CODE_PAGES
1991	Assert(pPageRec->page.fMonitorActive);
1992	#endif
1993
1994	#ifdef CSAM_MONITOR_CODE_PAGES
1995	if (!pPageRec->page.fMonitorActive)
1996	{
1997	Log(("CSAMR3MonitorPage: activate monitoring for %RRv\n", pPageAddrGC));
1998
1999	rc = PGMR3HandlerVirtualRegister(pVM, PGMVIRTHANDLERTYPE_WRITE, pPageAddrGC, pPageAddrGC + (PAGE_SIZE - 1) /* inclusive! */,
2000	(fMonitorInvalidation) ? CSAMCodePageInvalidate : 0, CSAMCodePageWriteHandler, "CSAMGCCodePageWriteHandler", 0,
2001	csamGetMonitorDescription(enmTag));
2002	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PGM_HANDLER_VIRTUAL_CONFLICT, ("PGMR3HandlerVirtualRegisterEx %RRv failed with %Rrc\n", pPageAddrGC, rc));
2003	if (RT_FAILURE(rc))
2004	Log(("PGMR3HandlerVirtualRegisterEx for %RRv failed with %Rrc\n", pPageAddrGC, rc));
2005
2006	/* Could fail, because it's already monitored. Don't treat that condition as fatal. */
2007
2008	/* Prefetch it in case it's not there yet. */
2009	rc = PGMPrefetchPage(pVCpu, pPageAddrGC);
2010	AssertRC(rc);
2011
2012	rc = PGMShwMakePageReadonly(pVCpu, pPageAddrGC, 0 /fFlags/);
2013	Assert(rc == VINF_SUCCESS \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT);
2014
2015	STAM_COUNTER_INC(&pVM->csam.s.StatPageMonitor);
2016
2017	pPageRec->page.fMonitorActive = true;
2018	pPageRec->page.fMonitorInvalidation = fMonitorInvalidation;
2019	}
2020	else
2021	if ( !pPageRec->page.fMonitorInvalidation
2022	&& fMonitorInvalidation)
2023	{
2024	Assert(pPageRec->page.fMonitorActive);
2025	PGMHandlerVirtualChangeInvalidateCallback(pVM, pPageRec->page.pPageGC, CSAMCodePageInvalidate);
2026	pPageRec->page.fMonitorInvalidation = true;
2027	STAM_COUNTER_INC(&pVM->csam.s.StatNrPagesInv);
2028
2029	/* Prefetch it in case it's not there yet. */
2030	rc = PGMPrefetchPage(pVCpu, pPageAddrGC);
2031	AssertRC(rc);
2032
2033	/* Make sure it's readonly. Page invalidation may have modified the attributes. */
2034	rc = PGMShwMakePageReadonly(pVCpu, pPageAddrGC, 0 /fFlags/);
2035	Assert(rc == VINF_SUCCESS \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT);
2036	}
2037
2038	#if 0 /* def VBOX_STRICT -> very annoying) */
2039	if (pPageRec->page.fMonitorActive)
2040	{
2041	uint64_t fPageShw;
2042	RTHCPHYS GCPhys;
2043	rc = PGMShwGetPage(pVCpu, pPageAddrGC, &fPageShw, &GCPhys);
2044	// AssertMsg( (rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT)
2045	// \|\| !(fPageShw & X86_PTE_RW)
2046	// \|\| (pPageRec->page.GCPhys == 0), ("Shadow page flags for %RRv (%RHp) aren't readonly (%RX64)!!\n", pPageAddrGC, GCPhys, fPageShw));
2047	}
2048	#endif
2049
2050	if (pPageRec->page.GCPhys == 0)
2051	{
2052	/* Prefetch it in case it's not there yet. */
2053	rc = PGMPrefetchPage(pVCpu, pPageAddrGC);
2054	AssertRC(rc);
2055	/* The page was changed behind our back. It won't be made read-only until the next SyncCR3, so force it here. */
2056	rc = PGMShwMakePageReadonly(pVCpu, pPageAddrGC, 0 /fFlags/);
2057	Assert(rc == VINF_SUCCESS \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT);
2058	}
2059	#endif /* CSAM_MONITOR_CODE_PAGES */
2060	return VINF_SUCCESS;
2061	}
2062
2063	/**
2064	* Unmonitors a code page
2065	*
2066	* @returns VBox status code
2067	* @param pVM Pointer to the VM.
2068	* @param pPageAddrGC The page to monitor
2069	* @param enmTag Monitor tag
2070	*/
2071	VMMR3DECL(int) CSAMR3UnmonitorPage(PVM pVM, RTRCPTR pPageAddrGC, CSAMTAG enmTag)
2072	{
2073	Assert(!HMIsEnabled(pVM));
2074
2075	pPageAddrGC &= PAGE_BASE_GC_MASK;
2076
2077	Log(("CSAMR3UnmonitorPage %RRv %d\n", pPageAddrGC, enmTag));
2078
2079	Assert(enmTag == CSAM_TAG_REM);
2080
2081	#ifdef VBOX_STRICT
2082	PCSAMPAGEREC pPageRec;
2083
2084	pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)(uintptr_t)pPageAddrGC);
2085	Assert(pPageRec && pPageRec->page.enmTag == enmTag);
2086	#endif
2087	return CSAMR3RemovePage(pVM, pPageAddrGC);
2088	}
2089
2090	/**
2091	* Removes a page record from our lookup tree
2092	*
2093	* @returns VBox status code
2094	* @param pVM Pointer to the VM.
2095	* @param GCPtr Page address
2096	*/
2097	static int csamRemovePageRecord(PVM pVM, RTRCPTR GCPtr)
2098	{
2099	PCSAMPAGEREC pPageRec;
2100	Assert(pVM->cCpus == 1);
2101	PVMCPU pVCpu = VMMGetCpu0(pVM);
2102
2103	Log(("csamRemovePageRecord %RRv\n", GCPtr));
2104	pPageRec = (PCSAMPAGEREC)RTAvlPVRemove(&pVM->csam.s.pPageTree, (AVLPVKEY)(uintptr_t)GCPtr);
2105
2106	if (pPageRec)
2107	{
2108	STAM_COUNTER_INC(&pVM->csam.s.StatNrRemovedPages);
2109
2110	#ifdef CSAM_MONITOR_CODE_PAGES
2111	if (pPageRec->page.fMonitorActive)
2112	{
2113	/* @todo -> this is expensive (cr3 reload)!!!
2114	* if this happens often, then reuse it instead!!!
2115	*/
2116	Assert(!fInCSAMCodePageInvalidate);
2117	STAM_COUNTER_DEC(&pVM->csam.s.StatPageMonitor);
2118	PGMHandlerVirtualDeregister(pVM, GCPtr);
2119	}
2120	if (pPageRec->page.enmTag == CSAM_TAG_PATM)
2121	{
2122	/* Make sure the recompiler flushes its cache as this page is no longer monitored. */
2123	STAM_COUNTER_INC(&pVM->csam.s.StatPageRemoveREMFlush);
2124	CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_GLOBAL_TLB_FLUSH);
2125	}
2126	#endif
2127
2128	#ifdef VBOX_WITH_STATISTICS
2129	switch (pPageRec->page.enmTag)
2130	{
2131	case CSAM_TAG_CSAM:
2132	STAM_COUNTER_DEC(&pVM->csam.s.StatPageCSAM);
2133	break;
2134	case CSAM_TAG_PATM:
2135	STAM_COUNTER_DEC(&pVM->csam.s.StatPagePATM);
2136	break;
2137	case CSAM_TAG_REM:
2138	STAM_COUNTER_DEC(&pVM->csam.s.StatPageREM);
2139	break;
2140	default:
2141	break; /* to shut up GCC */
2142	}
2143	#endif
2144
2145	if (pPageRec->page.pBitmap) MMR3HeapFree(pPageRec->page.pBitmap);
2146	MMR3HeapFree(pPageRec);
2147	}
2148	else
2149	AssertFailed();
2150
2151	return VINF_SUCCESS;
2152	}
2153
2154	/**
2155	* Callback for delayed writes from non-EMT threads
2156	*
2157	* @param pVM Pointer to the VM.
2158	* @param GCPtr The virtual address the guest is writing to. (not correct if it's an alias!)
2159	* @param cbBuf How much it's reading/writing.
2160	*/
2161	static DECLCALLBACK(void) CSAMDelayedWriteHandler(PVM pVM, RTRCPTR GCPtr, size_t cbBuf)
2162	{
2163	int rc = PATMR3PatchWrite(pVM, GCPtr, (uint32_t)cbBuf);
2164	AssertRC(rc);
2165	}
2166
2167	/**
2168	* \#PF Handler callback for virtual access handler ranges.
2169	*
2170	* Important to realize that a physical page in a range can have aliases, and
2171	* for ALL and WRITE handlers these will also trigger.
2172	*
2173	* @returns VINF_SUCCESS if the handler have carried out the operation.
2174	* @returns VINF_PGM_HANDLER_DO_DEFAULT if the caller should carry out the access operation.
2175	* @param pVM Pointer to the VM.
2176	* @param GCPtr The virtual address the guest is writing to. (not correct if it's an alias!)
2177	* @param pvPtr The HC mapping of that address.
2178	* @param pvBuf What the guest is reading/writing.
2179	* @param cbBuf How much it's reading/writing.
2180	* @param enmAccessType The access type.
2181	* @param pvUser User argument.
2182	*/
2183	static DECLCALLBACK(int) CSAMCodePageWriteHandler(PVM pVM, RTGCPTR GCPtr, void pvPtr, void pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType, void *pvUser)
2184	{
2185	int rc;
2186
2187	Assert(enmAccessType == PGMACCESSTYPE_WRITE); NOREF(enmAccessType);
2188	Log(("CSAMCodePageWriteHandler: write to %RGv size=%zu\n", GCPtr, cbBuf));
2189	NOREF(pvUser);
2190
2191	if ( PAGE_ADDRESS(pvPtr) == PAGE_ADDRESS((uintptr_t)pvPtr + cbBuf - 1)
2192	&& !memcmp(pvPtr, pvBuf, cbBuf))
2193	{
2194	Log(("CSAMCodePageWriteHandler: dummy write -> ignore\n"));
2195	return VINF_PGM_HANDLER_DO_DEFAULT;
2196	}
2197
2198	if (VM_IS_EMT(pVM))
2199	rc = PATMR3PatchWrite(pVM, GCPtr, (uint32_t)cbBuf);
2200	else
2201	{
2202	/* Queue the write instead otherwise we'll get concurrency issues. */
2203	/** @note in theory not correct to let it write the data first before disabling a patch!
2204	* (if it writes the same data as the patch jump and we replace it with obsolete opcodes)
2205	*/
2206	Log(("CSAMCodePageWriteHandler: delayed write!\n"));
2207	AssertCompileSize(RTRCPTR, 4);
2208	rc = VMR3ReqCallVoidNoWait(pVM, VMCPUID_ANY, (PFNRT)CSAMDelayedWriteHandler, 3, pVM, (RTRCPTR)GCPtr, cbBuf);
2209	}
2210	AssertRC(rc);
2211
2212	return VINF_PGM_HANDLER_DO_DEFAULT;
2213	}
2214
2215	/**
2216	* \#PF Handler callback for invalidation of virtual access handler ranges.
2217	*
2218	* @param pVM Pointer to the VM.
2219	* @param GCPtr The virtual address the guest has changed.
2220	*/
2221	static DECLCALLBACK(int) CSAMCodePageInvalidate(PVM pVM, RTGCPTR GCPtr)
2222	{
2223	fInCSAMCodePageInvalidate = true;
2224	LogFlow(("CSAMCodePageInvalidate %RGv\n", GCPtr));
2225	/** @todo We can't remove the page (which unregisters the virtual handler) as we are called from a DoWithAll on the virtual handler tree. Argh. */
2226	csamFlushPage(pVM, GCPtr, false /* don't remove page! */);
2227	fInCSAMCodePageInvalidate = false;
2228	return VINF_SUCCESS;
2229	}
2230
2231	/**
2232	* Check if the current instruction has already been checked before
2233	*
2234	* @returns VBox status code. (trap handled or not)
2235	* @param pVM Pointer to the VM.
2236	* @param pInstr Instruction pointer
2237	* @param pPage CSAM patch structure pointer
2238	*/
2239	bool csamIsCodeScanned(PVM pVM, RTRCPTR pInstr, PCSAMPAGE *pPage)
2240	{
2241	PCSAMPAGEREC pPageRec;
2242	uint32_t offset;
2243
2244	STAM_PROFILE_START(&pVM->csam.s.StatTimeCheckAddr, a);
2245
2246	offset = pInstr & PAGE_OFFSET_MASK;
2247	pInstr = pInstr & PAGE_BASE_GC_MASK;
2248
2249	Assert(pPage);
2250
2251	if (pPage && (pPage)->pPageGC == pInstr)
2252	{
2253	if ((pPage)->pBitmap == NULL \|\| ASMBitTest((pPage)->pBitmap, offset))
2254	{
2255	STAM_COUNTER_ADD(&pVM->csam.s.StatNrKnownPagesHC, 1);
2256	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeCheckAddr, a);
2257	return true;
2258	}
2259	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeCheckAddr, a);
2260	return false;
2261	}
2262
2263	pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)(uintptr_t)pInstr);
2264	if (pPageRec)
2265	{
2266	if (pPage) *pPage= &pPageRec->page;
2267	if (pPageRec->page.pBitmap == NULL \|\| ASMBitTest(pPageRec->page.pBitmap, offset))
2268	{
2269	STAM_COUNTER_ADD(&pVM->csam.s.StatNrKnownPagesHC, 1);
2270	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeCheckAddr, a);
2271	return true;
2272	}
2273	}
2274	else
2275	{
2276	if (pPage) *pPage = NULL;
2277	}
2278	STAM_PROFILE_STOP(&pVM->csam.s.StatTimeCheckAddr, a);
2279	return false;
2280	}
2281
2282	/**
2283	* Mark an instruction in a page as scanned/not scanned
2284	*
2285	* @param pVM Pointer to the VM.
2286	* @param pPage Patch structure pointer
2287	* @param pInstr Instruction pointer
2288	* @param cbInstr Instruction size
2289	* @param fScanned Mark as scanned or not
2290	*/
2291	static void csamMarkCode(PVM pVM, PCSAMPAGE pPage, RTRCPTR pInstr, uint32_t cbInstr, bool fScanned)
2292	{
2293	LogFlow(("csamMarkCodeAsScanned %RRv cbInstr=%d\n", pInstr, cbInstr));
2294	CSAMMarkPage(pVM, pInstr, fScanned);
2295
2296	/** @todo should recreate empty bitmap if !fScanned */
2297	if (pPage->pBitmap == NULL)
2298	return;
2299
2300	if (fScanned)
2301	{
2302	// retn instructions can be scanned more than once
2303	if (ASMBitTest(pPage->pBitmap, pInstr & PAGE_OFFSET_MASK) == 0)
2304	{
2305	pPage->uSize += cbInstr;
2306	STAM_COUNTER_ADD(&pVM->csam.s.StatNrInstr, 1);
2307	}
2308	if (pPage->uSize >= PAGE_SIZE)
2309	{
2310	Log(("Scanned full page (%RRv) -> free bitmap\n", pInstr & PAGE_BASE_GC_MASK));
2311	MMR3HeapFree(pPage->pBitmap);
2312	pPage->pBitmap = NULL;
2313	}
2314	else
2315	ASMBitSet(pPage->pBitmap, pInstr & PAGE_OFFSET_MASK);
2316	}
2317	else
2318	ASMBitClear(pPage->pBitmap, pInstr & PAGE_OFFSET_MASK);
2319	}
2320
2321	/**
2322	* Mark an instruction in a page as scanned/not scanned
2323	*
2324	* @returns VBox status code.
2325	* @param pVM Pointer to the VM.
2326	* @param pInstr Instruction pointer
2327	* @param cbInstr Instruction size
2328	* @param fScanned Mark as scanned or not
2329	*/
2330	VMMR3_INT_DECL(int) CSAMR3MarkCode(PVM pVM, RTRCPTR pInstr, uint32_t cbInstr, bool fScanned)
2331	{
2332	PCSAMPAGE pPage = 0;
2333
2334	Assert(!fScanned); /* other case not implemented. */
2335	Assert(!PATMIsPatchGCAddr(pVM, pInstr));
2336	Assert(!HMIsEnabled(pVM));
2337
2338	if (csamIsCodeScanned(pVM, pInstr, &pPage) == false)
2339	{
2340	Assert(fScanned == true); /* other case should not be possible */
2341	return VINF_SUCCESS;
2342	}
2343
2344	Log(("CSAMR3MarkCode: %RRv size=%d fScanned=%d\n", pInstr, cbInstr, fScanned));
2345	csamMarkCode(pVM, pPage, pInstr, cbInstr, fScanned);
2346	return VINF_SUCCESS;
2347	}
2348
2349
2350	/**
2351	* Scan and analyse code
2352	*
2353	* @returns VBox status code.
2354	* @param pVM Pointer to the VM.
2355	* @param pCtxCore CPU context
2356	* @param pInstrGC Instruction pointer
2357	*/
2358	VMMR3_INT_DECL(int) CSAMR3CheckCodeEx(PVM pVM, PCPUMCTXCORE pCtxCore, RTRCPTR pInstrGC)
2359	{
2360	Assert(!HMIsEnabled(pVM));
2361	if (EMIsRawRing0Enabled(pVM) == false \|\| PATMIsPatchGCAddr(pVM, pInstrGC) == true)
2362	{
2363	// No use
2364	return VINF_SUCCESS;
2365	}
2366
2367	if (CSAMIsEnabled(pVM))
2368	{
2369	/* Assuming 32 bits code for now. */
2370	Assert(CPUMGetGuestCodeBits(VMMGetCpu0(pVM)) == 32);
2371
2372	pInstrGC = SELMToFlat(pVM, DISSELREG_CS, pCtxCore, pInstrGC);
2373	return CSAMR3CheckCode(pVM, pInstrGC);
2374	}
2375	return VINF_SUCCESS;
2376	}
2377
2378	/**
2379	* Scan and analyse code
2380	*
2381	* @returns VBox status code.
2382	* @param pVM Pointer to the VM.
2383	* @param pInstrGC Instruction pointer (0:32 virtual address)
2384	*/
2385	VMMR3_INT_DECL(int) CSAMR3CheckCode(PVM pVM, RTRCPTR pInstrGC)
2386	{
2387	int rc;
2388	PCSAMPAGE pPage = NULL;
2389	Assert(!HMIsEnabled(pVM));
2390
2391	if ( EMIsRawRing0Enabled(pVM) == false
2392	\|\| PATMIsPatchGCAddr(pVM, pInstrGC) == true)
2393	{
2394	/* Not active. */
2395	return VINF_SUCCESS;
2396	}
2397
2398	if (CSAMIsEnabled(pVM))
2399	{
2400	/* Cache record for csamR3GCVirtToHCVirt */
2401	CSAMP2GLOOKUPREC cacheRec;
2402	RT_ZERO(cacheRec);
2403
2404	STAM_PROFILE_START(&pVM->csam.s.StatTime, a);
2405	rc = csamAnalyseCallCodeStream(pVM, pInstrGC, pInstrGC, true /* 32 bits code */, CSAMR3AnalyseCallback, pPage, &cacheRec);
2406	STAM_PROFILE_STOP(&pVM->csam.s.StatTime, a);
2407	if (cacheRec.Lock.pvMap)
2408	PGMPhysReleasePageMappingLock(pVM, &cacheRec.Lock);
2409
2410	if (rc != VINF_SUCCESS)
2411	{
2412	Log(("csamAnalyseCodeStream failed with %d\n", rc));
2413	return rc;
2414	}
2415	}
2416	return VINF_SUCCESS;
2417	}
2418
2419	/**
2420	* Flush dirty code pages
2421	*
2422	* @returns VBox status code.
2423	* @param pVM Pointer to the VM.
2424	*/
2425	static int csamR3FlushDirtyPages(PVM pVM)
2426	{
2427	Assert(pVM->cCpus == 1);
2428	PVMCPU pVCpu = VMMGetCpu0(pVM);
2429
2430	STAM_PROFILE_START(&pVM->csam.s.StatFlushDirtyPages, a);
2431
2432	for (uint32_t i=0;i<pVM->csam.s.cDirtyPages;i++)
2433	{
2434	int rc;
2435	PCSAMPAGEREC pPageRec;
2436	RTRCPTR GCPtr = pVM->csam.s.pvDirtyBasePage[i];
2437
2438	GCPtr = GCPtr & PAGE_BASE_GC_MASK;
2439
2440	#ifdef VBOX_WITH_REM
2441	/* Notify the recompiler that this page has been changed. */
2442	REMR3NotifyCodePageChanged(pVM, pVCpu, GCPtr);
2443	#endif
2444
2445	/* Enable write protection again. (use the fault address as it might be an alias) */
2446	rc = PGMShwMakePageReadonly(pVCpu, pVM->csam.s.pvDirtyFaultPage[i], 0 /fFlags/);
2447	Assert(rc == VINF_SUCCESS \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT);
2448
2449	Log(("CSAMR3FlushDirtyPages: flush %RRv (modifypage rc=%Rrc)\n", pVM->csam.s.pvDirtyBasePage[i], rc));
2450
2451	pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)(uintptr_t)GCPtr);
2452	if (pPageRec && pPageRec->page.enmTag == CSAM_TAG_REM)
2453	{
2454	uint64_t fFlags;
2455
2456	rc = PGMGstGetPage(pVCpu, GCPtr, &fFlags, NULL);
2457	AssertMsg(RT_SUCCESS(rc) \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
2458	if ( rc == VINF_SUCCESS
2459	&& (fFlags & X86_PTE_US))
2460	{
2461	/* We don't care about user pages. */
2462	csamRemovePageRecord(pVM, GCPtr);
2463	STAM_COUNTER_INC(&pVM->csam.s.StatNrUserPages);
2464	}
2465	}
2466	}
2467	pVM->csam.s.cDirtyPages = 0;
2468	STAM_PROFILE_STOP(&pVM->csam.s.StatFlushDirtyPages, a);
2469	return VINF_SUCCESS;
2470	}
2471
2472	/**
2473	* Flush potential new code pages
2474	*
2475	* @returns VBox status code.
2476	* @param pVM Pointer to the VM.
2477	*/
2478	static int csamR3FlushCodePages(PVM pVM)
2479	{
2480	Assert(pVM->cCpus == 1);
2481	PVMCPU pVCpu = VMMGetCpu0(pVM);
2482
2483	for (uint32_t i=0;i<pVM->csam.s.cPossibleCodePages;i++)
2484	{
2485	RTRCPTR GCPtr = pVM->csam.s.pvPossibleCodePage[i];
2486
2487	GCPtr = GCPtr & PAGE_BASE_GC_MASK;
2488
2489	Log(("csamR3FlushCodePages: %RRv\n", GCPtr));
2490	PGMShwMakePageNotPresent(pVCpu, GCPtr, 0 /fFlags/);
2491	/* Resync the page to make sure instruction fetch will fault */
2492	CSAMMarkPage(pVM, GCPtr, false);
2493	}
2494	pVM->csam.s.cPossibleCodePages = 0;
2495	return VINF_SUCCESS;
2496	}
2497
2498	/**
2499	* Perform any pending actions
2500	*
2501	* @returns VBox status code.
2502	* @param pVM Pointer to the VM.
2503	* @param pVCpu Pointer to the VMCPU.
2504	*/
2505	VMMR3_INT_DECL(int) CSAMR3DoPendingAction(PVM pVM, PVMCPU pVCpu)
2506	{
2507	AssertReturn(!HMIsEnabled(pVM), VERR_CSAM_HM_IPE);
2508
2509	csamR3FlushDirtyPages(pVM);
2510	csamR3FlushCodePages(pVM);
2511
2512	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_CSAM_PENDING_ACTION);
2513	return VINF_SUCCESS;
2514	}
2515
2516	/**
2517	* Analyse interrupt and trap gates
2518	*
2519	* @returns VBox status code.
2520	* @param pVM Pointer to the VM.
2521	* @param iGate Start gate
2522	* @param cGates Number of gates to check
2523	*/
2524	VMMR3_INT_DECL(int) CSAMR3CheckGates(PVM pVM, uint32_t iGate, uint32_t cGates)
2525	{
2526	#ifdef VBOX_WITH_RAW_MODE
2527	Assert(pVM->cCpus == 1);
2528	PVMCPU pVCpu = VMMGetCpu0(pVM);
2529	uint16_t cbIDT;
2530	RTRCPTR GCPtrIDT = CPUMGetGuestIDTR(pVCpu, &cbIDT);
2531	uint32_t iGateEnd;
2532	uint32_t maxGates;
2533	VBOXIDTE aIDT[256];
2534	PVBOXIDTE pGuestIdte;
2535	int rc;
2536
2537	AssertReturn(!HMIsEnabled(pVM), VERR_CSAM_HM_IPE);
2538	if (EMIsRawRing0Enabled(pVM) == false)
2539	{
2540	/* Enabling interrupt gates only works when raw ring 0 is enabled. */
2541	//AssertFailed();
2542	return VINF_SUCCESS;
2543	}
2544
2545	/* We only check all gates once during a session */
2546	if ( !pVM->csam.s.fGatesChecked
2547	&& cGates != 256)
2548	return VINF_SUCCESS; /* too early */
2549
2550	/* We only check all gates once during a session */
2551	if ( pVM->csam.s.fGatesChecked
2552	&& cGates != 1)
2553	return VINF_SUCCESS; /* ignored */
2554
2555	Assert(cGates <= 256);
2556	if (!GCPtrIDT \|\| cGates > 256)
2557	return VERR_INVALID_PARAMETER;
2558
2559	if (cGates != 1)
2560	{
2561	pVM->csam.s.fGatesChecked = true;
2562	for (unsigned i=0;i<RT_ELEMENTS(pVM->csam.s.pvCallInstruction);i++)
2563	{
2564	RTRCPTR pHandler = pVM->csam.s.pvCallInstruction[i];
2565
2566	if (pHandler)
2567	{
2568	PCSAMPAGE pPage = NULL;
2569	CSAMP2GLOOKUPREC cacheRec; /* Cache record for csamR3GCVirtToHCVirt. */
2570	RT_ZERO(cacheRec);
2571
2572	Log(("CSAMCheckGates: checking previous call instruction %RRv\n", pHandler));
2573	STAM_PROFILE_START(&pVM->csam.s.StatTime, a);
2574	rc = csamAnalyseCodeStream(pVM, pHandler, pHandler, true, CSAMR3AnalyseCallback, pPage, &cacheRec);
2575	STAM_PROFILE_STOP(&pVM->csam.s.StatTime, a);
2576	if (cacheRec.Lock.pvMap)
2577	PGMPhysReleasePageMappingLock(pVM, &cacheRec.Lock);
2578
2579	if (rc != VINF_SUCCESS)
2580	{
2581	Log(("CSAMCheckGates: csamAnalyseCodeStream failed with %d\n", rc));
2582	continue;
2583	}
2584	}
2585	}
2586	}
2587
2588	/* Determine valid upper boundary. */
2589	maxGates = (cbIDT+1) / sizeof(VBOXIDTE);
2590	Assert(iGate < maxGates);
2591	if (iGate > maxGates)
2592	return VERR_INVALID_PARAMETER;
2593
2594	if (iGate + cGates > maxGates)
2595	cGates = maxGates - iGate;
2596
2597	GCPtrIDT = GCPtrIDT + iGate * sizeof(VBOXIDTE);
2598	iGateEnd = iGate + cGates;
2599
2600	STAM_PROFILE_START(&pVM->csam.s.StatCheckGates, a);
2601
2602	/*
2603	* Get IDT entries.
2604	*/
2605	rc = PGMPhysSimpleReadGCPtr(pVCpu, aIDT, GCPtrIDT, cGates*sizeof(VBOXIDTE));
2606	if (RT_FAILURE(rc))
2607	{
2608	AssertMsgRC(rc, ("Failed to read IDTE! rc=%Rrc\n", rc));
2609	STAM_PROFILE_STOP(&pVM->csam.s.StatCheckGates, a);
2610	return rc;
2611	}
2612	pGuestIdte = &aIDT[0];
2613
2614	for (/iGate/; iGate<iGateEnd; iGate++, pGuestIdte++)
2615	{
2616	Assert(TRPMR3GetGuestTrapHandler(pVM, iGate) == TRPM_INVALID_HANDLER);
2617
2618	if ( pGuestIdte->Gen.u1Present
2619	&& (pGuestIdte->Gen.u5Type2 == VBOX_IDTE_TYPE2_TRAP_32 \|\| pGuestIdte->Gen.u5Type2 == VBOX_IDTE_TYPE2_INT_32)
2620	&& (pGuestIdte->Gen.u2DPL == 3 \|\| pGuestIdte->Gen.u2DPL == 0)
2621	)
2622	{
2623	RTRCPTR pHandler;
2624	PCSAMPAGE pPage = NULL;
2625	DBGFSELINFO selInfo;
2626	CSAMP2GLOOKUPREC cacheRec; /* Cache record for csamR3GCVirtToHCVirt. */
2627	RT_ZERO(cacheRec);
2628
2629	pHandler = VBOXIDTE_OFFSET(*pGuestIdte);
2630	pHandler = SELMToFlatBySel(pVM, pGuestIdte->Gen.u16SegSel, pHandler);
2631
2632	rc = SELMR3GetSelectorInfo(pVM, pVCpu, pGuestIdte->Gen.u16SegSel, &selInfo);
2633	if ( RT_FAILURE(rc)
2634	\|\| (selInfo.fFlags & (DBGFSELINFO_FLAGS_NOT_PRESENT \| DBGFSELINFO_FLAGS_INVALID))
2635	\|\| selInfo.GCPtrBase != 0
2636	\|\| selInfo.cbLimit != ~0U
2637	)
2638	{
2639	/* Refuse to patch a handler whose idt cs selector isn't wide open. */
2640	Log(("CSAMCheckGates: check gate %d failed due to rc %Rrc GCPtrBase=%RRv limit=%x\n", iGate, rc, selInfo.GCPtrBase, selInfo.cbLimit));
2641	continue;
2642	}
2643
2644
2645	if (pGuestIdte->Gen.u5Type2 == VBOX_IDTE_TYPE2_TRAP_32)
2646	{
2647	Log(("CSAMCheckGates: check trap gate %d at %04X:%08X (flat %RRv)\n", iGate, pGuestIdte->Gen.u16SegSel, VBOXIDTE_OFFSET(*pGuestIdte), pHandler));
2648	}
2649	else
2650	{
2651	Log(("CSAMCheckGates: check interrupt gate %d at %04X:%08X (flat %RRv)\n", iGate, pGuestIdte->Gen.u16SegSel, VBOXIDTE_OFFSET(*pGuestIdte), pHandler));
2652	}
2653
2654	STAM_PROFILE_START(&pVM->csam.s.StatTime, b);
2655	rc = csamAnalyseCodeStream(pVM, pHandler, pHandler, true, CSAMR3AnalyseCallback, pPage, &cacheRec);
2656	STAM_PROFILE_STOP(&pVM->csam.s.StatTime, b);
2657	if (cacheRec.Lock.pvMap)
2658	PGMPhysReleasePageMappingLock(pVM, &cacheRec.Lock);
2659
2660	if (rc != VINF_SUCCESS)
2661	{
2662	Log(("CSAMCheckGates: csamAnalyseCodeStream failed with %d\n", rc));
2663	continue;
2664	}
2665	/* OpenBSD guest specific patch test. */
2666	if (iGate >= 0x20)
2667	{
2668	PCPUMCTX pCtx;
2669	DISCPUSTATE cpu;
2670	RTGCUINTPTR32 aOpenBsdPushCSOffset[3] = {0x03, /* OpenBSD 3.7 & 3.8 */
2671	0x2B, /* OpenBSD 4.0 installation ISO */
2672	0x2F}; /* OpenBSD 4.0 after install */
2673
2674	pCtx = CPUMQueryGuestCtxPtr(pVCpu);
2675
2676	for (unsigned i=0;i<RT_ELEMENTS(aOpenBsdPushCSOffset);i++)
2677	{
2678	rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pHandler - aOpenBsdPushCSOffset[i], &cpu, NULL);
2679	if ( rc == VINF_SUCCESS
2680	&& cpu.pCurInstr->uOpcode == OP_PUSH
2681	&& cpu.pCurInstr->fParam1 == OP_PARM_REG_CS)
2682	{
2683	rc = PATMR3InstallPatch(pVM, pHandler - aOpenBsdPushCSOffset[i], PATMFL_CODE32 \| PATMFL_GUEST_SPECIFIC);
2684	if (RT_SUCCESS(rc))
2685	Log(("Installed OpenBSD interrupt handler prefix instruction (push cs) patch\n"));
2686	}
2687	}
2688	}
2689
2690	/* Trap gates and certain interrupt gates. */
2691	uint32_t fPatchFlags = PATMFL_CODE32 \| PATMFL_IDTHANDLER;
2692
2693	if (pGuestIdte->Gen.u5Type2 == VBOX_IDTE_TYPE2_TRAP_32)
2694	fPatchFlags \|= PATMFL_TRAPHANDLER;
2695	else
2696	fPatchFlags \|= PATMFL_INTHANDLER;
2697
2698	switch (iGate) {
2699	case 8:
2700	case 10:
2701	case 11:
2702	case 12:
2703	case 13:
2704	case 14:
2705	case 17:
2706	fPatchFlags \|= PATMFL_TRAPHANDLER_WITH_ERRORCODE;
2707	break;
2708	default:
2709	/* No error code. */
2710	break;
2711	}
2712
2713	Log(("Installing %s gate handler for 0x%X at %RRv\n", (pGuestIdte->Gen.u5Type2 == VBOX_IDTE_TYPE2_TRAP_32) ? "trap" : "intr", iGate, pHandler));
2714
2715	rc = PATMR3InstallPatch(pVM, pHandler, fPatchFlags);
2716	if ( RT_SUCCESS(rc)
2717	\|\| rc == VERR_PATM_ALREADY_PATCHED)
2718	{
2719	Log(("Gate handler 0x%X is SAFE!\n", iGate));
2720
2721	RTRCPTR pNewHandlerGC = PATMR3QueryPatchGCPtr(pVM, pHandler);
2722	if (pNewHandlerGC)
2723	{
2724	rc = TRPMR3SetGuestTrapHandler(pVM, iGate, pNewHandlerGC);
2725	if (RT_FAILURE(rc))
2726	Log(("TRPMR3SetGuestTrapHandler %d failed with %Rrc\n", iGate, rc));
2727	}
2728	}
2729	}
2730	} /* for */
2731	STAM_PROFILE_STOP(&pVM->csam.s.StatCheckGates, a);
2732	#endif /* VBOX_WITH_RAW_MODE */
2733	return VINF_SUCCESS;
2734	}
2735
2736	/**
2737	* Record previous call instruction addresses
2738	*
2739	* @returns VBox status code.
2740	* @param pVM Pointer to the VM.
2741	* @param GCPtrCall Call address
2742	*/
2743	VMMR3DECL(int) CSAMR3RecordCallAddress(PVM pVM, RTRCPTR GCPtrCall)
2744	{
2745	Assert(!HMIsEnabled(pVM));
2746	for (unsigned i=0;i<RT_ELEMENTS(pVM->csam.s.pvCallInstruction);i++)
2747	{
2748	if (pVM->csam.s.pvCallInstruction[i] == GCPtrCall)
2749	return VINF_SUCCESS;
2750	}
2751
2752	Log(("CSAMR3RecordCallAddress %RRv\n", GCPtrCall));
2753
2754	pVM->csam.s.pvCallInstruction[pVM->csam.s.iCallInstruction++] = GCPtrCall;
2755	if (pVM->csam.s.iCallInstruction >= RT_ELEMENTS(pVM->csam.s.pvCallInstruction))
2756	pVM->csam.s.iCallInstruction = 0;
2757
2758	return VINF_SUCCESS;
2759	}
2760
2761
2762	/**
2763	* Query CSAM state (enabled/disabled)
2764	*
2765	* @returns true if enabled, false otherwise.
2766	* @param pUVM The user mode VM handle.
2767	*/
2768	VMMR3DECL(bool) CSAMR3IsEnabled(PUVM pUVM)
2769	{
2770	UVM_ASSERT_VALID_EXT_RETURN(pUVM, false);
2771	PVM pVM = pUVM->pVM;
2772	VM_ASSERT_VALID_EXT_RETURN(pVM, false);
2773	return CSAMIsEnabled(pVM);
2774	}
2775
2776
2777	/**
2778	* Enables or disables code scanning.
2779	*
2780	* @returns VBox status code.
2781	* @param pUVM The user mode VM handle.
2782	* @param fEnabled Whether to enable or disable scanning.
2783	*/
2784	VMMR3DECL(int) CSAMR3SetScanningEnabled(PUVM pUVM, bool fEnabled)
2785	{
2786	UVM_ASSERT_VALID_EXT_RETURN(pUVM, VERR_INVALID_VM_HANDLE);
2787	PVM pVM = pUVM->pVM;
2788	VM_ASSERT_VALID_EXT_RETURN(pVM, VERR_INVALID_VM_HANDLE);
2789
2790	if (HMIsEnabled(pVM))
2791	{
2792	Assert(!pVM->fCSAMEnabled);
2793	return VINF_SUCCESS;
2794	}
2795
2796	int rc;
2797	if (fEnabled)
2798	rc = CSAMEnableScanning(pVM);
2799	else
2800	rc = CSAMDisableScanning(pVM);
2801	return rc;
2802	}
2803
2804
2805	#ifdef VBOX_WITH_DEBUGGER
2806
2807	/**
2808	* @callback_method_impl{FNDBGCCMD, The '.csamoff' command.}
2809	*/
2810	static DECLCALLBACK(int) csamr3CmdOff(PCDBGCCMD pCmd, PDBGCCMDHLP pCmdHlp, PUVM pUVM, PCDBGCVAR paArgs, unsigned cArgs)
2811	{
2812	DBGC_CMDHLP_REQ_UVM_RET(pCmdHlp, pCmd, pUVM);
2813	NOREF(cArgs); NOREF(paArgs);
2814
2815	if (HMR3IsEnabled(pUVM))
2816	return DBGCCmdHlpPrintf(pCmdHlp, "CSAM is permanently disabled by HM.\n");
2817
2818	int rc = CSAMR3SetScanningEnabled(pUVM, false);
2819	if (RT_FAILURE(rc))
2820	return DBGCCmdHlpFailRc(pCmdHlp, pCmd, rc, "CSAMR3SetScanningEnabled");
2821	return DBGCCmdHlpPrintf(pCmdHlp, "CSAM Scanning disabled\n");
2822	}
2823
2824	/**
2825	* @callback_method_impl{FNDBGCCMD, The '.csamon' command.}
2826	*/
2827	static DECLCALLBACK(int) csamr3CmdOn(PCDBGCCMD pCmd, PDBGCCMDHLP pCmdHlp, PUVM pUVM, PCDBGCVAR paArgs, unsigned cArgs)
2828	{
2829	DBGC_CMDHLP_REQ_UVM_RET(pCmdHlp, pCmd, pUVM);
2830	NOREF(cArgs); NOREF(paArgs);
2831
2832	if (HMR3IsEnabled(pUVM))
2833	return DBGCCmdHlpPrintf(pCmdHlp, "CSAM is permanently disabled by HM.\n");
2834
2835	int rc = CSAMR3SetScanningEnabled(pUVM, true);
2836	if (RT_FAILURE(rc))
2837	return DBGCCmdHlpFailRc(pCmdHlp, pCmd, rc, "CSAMR3SetScanningEnabled");
2838	return DBGCCmdHlpPrintf(pCmdHlp, "CSAM Scanning enabled\n");
2839	}
2840
2841	#endif /* VBOX_WITH_DEBUGGER */

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMR3/CSAM.cpp@ 48568

Download in other formats: