VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMR3/CSAM.cpp@ 50653

Last change on this file since 50653 was 50575, checked in by vboxsync, 10 years ago

VMM: Added SSMR3RegisterStub and used it to provide saved state load-exec stubs for ignoring CSAM and PATM state when VBOX_WITH_RAW_MODE isn't defined or when HM is active.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Id Revision
File size: 100.0 KB
RevLine 
[23]1/* $Id: CSAM.cpp 50575 2014-02-25 13:07:16Z vboxsync $ */
[1]2/** @file
3 * CSAM - Guest OS Code Scanning and Analysis Manager
4 */
5
6/*
[44362]7 * Copyright (C) 2006-2013 Oracle Corporation
[1]8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
[5999]12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
[1]16 */
17
18/*******************************************************************************
19* Header Files *
20*******************************************************************************/
21#define LOG_GROUP LOG_GROUP_CSAM
[35346]22#include <VBox/vmm/cpum.h>
23#include <VBox/vmm/stam.h>
24#include <VBox/vmm/patm.h>
25#include <VBox/vmm/csam.h>
26#include <VBox/vmm/cpumdis.h>
27#include <VBox/vmm/pgm.h>
28#include <VBox/vmm/iom.h>
29#include <VBox/vmm/mm.h>
30#include <VBox/vmm/em.h>
[45620]31#include <VBox/vmm/hm.h>
[40274]32#ifdef VBOX_WITH_REM
33# include <VBox/vmm/rem.h>
34#endif
[35346]35#include <VBox/vmm/selm.h>
36#include <VBox/vmm/trpm.h>
37#include <VBox/vmm/cfgm.h>
[44373]38#include <VBox/vmm/ssm.h>
[1]39#include <VBox/param.h>
40#include <iprt/avl.h>
41#include <iprt/asm.h>
42#include <iprt/thread.h>
43#include "CSAMInternal.h"
[35346]44#include <VBox/vmm/vm.h>
[44373]45#include <VBox/vmm/uvm.h>
[45620]46
[1]47#include <VBox/dbg.h>
[45620]48#include <VBox/sup.h>
[1]49#include <VBox/err.h>
50#include <VBox/log.h>
[45620]51
52#include <VBox/dis.h>
53#include <VBox/disopcode.h>
[1]54#include <iprt/assert.h>
[23]55#include <iprt/string.h>
[35333]56#include "internal/pgm.h"
[1]57
58
59/* Enabled by default */
60#define CSAM_ENABLE
61
62/* Enable to monitor code pages for self-modifying code. */
63#define CSAM_MONITOR_CODE_PAGES
[23]64/* Enable to monitor all scanned pages
[1]65#define CSAM_MONITOR_CSAM_CODE_PAGES */
[7628]66/* Enable to scan beyond ret instructions.
[1859]67#define CSAM_ANALYSE_BEYOND_RET */
[1]68
69/*******************************************************************************
70* Internal Functions *
71*******************************************************************************/
72static DECLCALLBACK(int) csamr3Save(PVM pVM, PSSMHANDLE pSSM);
[22793]73static DECLCALLBACK(int) csamr3Load(PVM pVM, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass);
[1]74static DECLCALLBACK(int) CSAMCodePageWriteHandler(PVM pVM, RTGCPTR GCPtr, void *pvPtr, void *pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType, void *pvUser);
75static DECLCALLBACK(int) CSAMCodePageInvalidate(PVM pVM, RTGCPTR GCPtr);
76
[9344]77bool csamIsCodeScanned(PVM pVM, RTRCPTR pInstr, PCSAMPAGE *pPage);
78int csamR3CheckPageRecord(PVM pVM, RTRCPTR pInstr);
79static PCSAMPAGE csamCreatePageRecord(PVM pVM, RTRCPTR GCPtr, CSAMTAG enmTag, bool fCode32, bool fMonitorInvalidation = false);
80static int csamRemovePageRecord(PVM pVM, RTRCPTR GCPtr);
[1]81static int csamReinit(PVM pVM);
[9344]82static void csamMarkCode(PVM pVM, PCSAMPAGE pPage, RTRCPTR pInstr, uint32_t opsize, bool fScanned);
[9212]83static int csamAnalyseCodeStream(PVM pVM, RCPTRTYPE(uint8_t *) pInstrGC, RCPTRTYPE(uint8_t *) pCurInstrGC, bool fCode32,
[1]84 PFN_CSAMR3ANALYSE pfnCSAMR3Analyse, void *pUserData, PCSAMP2GLOOKUPREC pCacheRec);
85
86/** @todo Temporary for debugging. */
87static bool fInCSAMCodePageInvalidate = false;
88
[44399]89#ifdef VBOX_WITH_DEBUGGER
90static FNDBGCCMD csamr3CmdOn;
91static FNDBGCCMD csamr3CmdOff;
92#endif
93
94
[1]95/*******************************************************************************
96* Global Variables *
97*******************************************************************************/
98#ifdef VBOX_WITH_DEBUGGER
99/** Command descriptors. */
100static const DBGCCMD g_aCmds[] =
101{
[35696]102 /* pszCmd, cArgsMin, cArgsMax, paArgDesc, cArgDescs, fFlags, pfnHandler pszSyntax, ....pszDescription */
103 { "csamon", 0, 0, NULL, 0, 0, csamr3CmdOn, "", "Enable CSAM code scanning." },
104 { "csamoff", 0, 0, NULL, 0, 0, csamr3CmdOff, "", "Disable CSAM code scanning." },
[1]105};
106#endif
107
[23765]108/**
109 * SSM descriptor table for the CSAM structure.
110 */
111static const SSMFIELD g_aCsamFields[] =
112{
[23778]113 /** @todo there are more fields that can be ignored here. */
[23765]114 SSMFIELD_ENTRY_IGNORE( CSAM, offVM),
115 SSMFIELD_ENTRY_PAD_HC64( CSAM, Alignment0, sizeof(uint32_t)),
[23777]116 SSMFIELD_ENTRY_IGN_HCPTR( CSAM, pPageTree),
[23765]117 SSMFIELD_ENTRY( CSAM, aDangerousInstr),
118 SSMFIELD_ENTRY( CSAM, cDangerousInstr),
119 SSMFIELD_ENTRY( CSAM, iDangerousInstr),
[23778]120 SSMFIELD_ENTRY_RCPTR( CSAM, pPDBitmapGC), /// @todo ignore this?
121 SSMFIELD_ENTRY_RCPTR( CSAM, pPDHCBitmapGC), /// @todo ignore this?
[23777]122 SSMFIELD_ENTRY_IGN_HCPTR( CSAM, pPDBitmapHC),
123 SSMFIELD_ENTRY_IGN_HCPTR( CSAM, pPDGCBitmapHC),
124 SSMFIELD_ENTRY_IGN_HCPTR( CSAM, savedstate.pSSM),
[23765]125 SSMFIELD_ENTRY( CSAM, savedstate.cPageRecords),
126 SSMFIELD_ENTRY( CSAM, savedstate.cPatchPageRecords),
127 SSMFIELD_ENTRY( CSAM, cDirtyPages),
128 SSMFIELD_ENTRY_RCPTR_ARRAY( CSAM, pvDirtyBasePage),
129 SSMFIELD_ENTRY_RCPTR_ARRAY( CSAM, pvDirtyFaultPage),
130 SSMFIELD_ENTRY( CSAM, cPossibleCodePages),
131 SSMFIELD_ENTRY_RCPTR_ARRAY( CSAM, pvPossibleCodePage),
132 SSMFIELD_ENTRY_RCPTR_ARRAY( CSAM, pvCallInstruction),
133 SSMFIELD_ENTRY( CSAM, iCallInstruction),
134 SSMFIELD_ENTRY( CSAM, fScanningStarted),
135 SSMFIELD_ENTRY( CSAM, fGatesChecked),
[23770]136 SSMFIELD_ENTRY_PAD_HC( CSAM, Alignment1, 6, 2),
[23765]137 SSMFIELD_ENTRY_IGNORE( CSAM, StatNrTraps),
138 SSMFIELD_ENTRY_IGNORE( CSAM, StatNrPages),
139 SSMFIELD_ENTRY_IGNORE( CSAM, StatNrPagesInv),
140 SSMFIELD_ENTRY_IGNORE( CSAM, StatNrRemovedPages),
141 SSMFIELD_ENTRY_IGNORE( CSAM, StatNrPatchPages),
142 SSMFIELD_ENTRY_IGNORE( CSAM, StatNrPageNPHC),
143 SSMFIELD_ENTRY_IGNORE( CSAM, StatNrPageNPGC),
144 SSMFIELD_ENTRY_IGNORE( CSAM, StatNrFlushes),
145 SSMFIELD_ENTRY_IGNORE( CSAM, StatNrFlushesSkipped),
146 SSMFIELD_ENTRY_IGNORE( CSAM, StatNrKnownPagesHC),
147 SSMFIELD_ENTRY_IGNORE( CSAM, StatNrKnownPagesGC),
148 SSMFIELD_ENTRY_IGNORE( CSAM, StatNrInstr),
149 SSMFIELD_ENTRY_IGNORE( CSAM, StatNrBytesRead),
150 SSMFIELD_ENTRY_IGNORE( CSAM, StatNrOpcodeRead),
151 SSMFIELD_ENTRY_IGNORE( CSAM, StatTime),
152 SSMFIELD_ENTRY_IGNORE( CSAM, StatTimeCheckAddr),
153 SSMFIELD_ENTRY_IGNORE( CSAM, StatTimeAddrConv),
154 SSMFIELD_ENTRY_IGNORE( CSAM, StatTimeFlushPage),
155 SSMFIELD_ENTRY_IGNORE( CSAM, StatTimeDisasm),
156 SSMFIELD_ENTRY_IGNORE( CSAM, StatFlushDirtyPages),
157 SSMFIELD_ENTRY_IGNORE( CSAM, StatCheckGates),
158 SSMFIELD_ENTRY_IGNORE( CSAM, StatCodePageModified),
159 SSMFIELD_ENTRY_IGNORE( CSAM, StatDangerousWrite),
160 SSMFIELD_ENTRY_IGNORE( CSAM, StatInstrCacheHit),
161 SSMFIELD_ENTRY_IGNORE( CSAM, StatInstrCacheMiss),
162 SSMFIELD_ENTRY_IGNORE( CSAM, StatPagePATM),
163 SSMFIELD_ENTRY_IGNORE( CSAM, StatPageCSAM),
164 SSMFIELD_ENTRY_IGNORE( CSAM, StatPageREM),
165 SSMFIELD_ENTRY_IGNORE( CSAM, StatNrUserPages),
166 SSMFIELD_ENTRY_IGNORE( CSAM, StatPageMonitor),
167 SSMFIELD_ENTRY_IGNORE( CSAM, StatPageRemoveREMFlush),
168 SSMFIELD_ENTRY_IGNORE( CSAM, StatBitmapAlloc),
169 SSMFIELD_ENTRY_IGNORE( CSAM, StatScanNextFunction),
170 SSMFIELD_ENTRY_IGNORE( CSAM, StatScanNextFunctionFailed),
171 SSMFIELD_ENTRY_TERM()
172};
[1]173
[23765]174/** Fake type to simplify g_aCsamPDBitmapArray construction. */
175typedef struct
176{
177 uint8_t *a[CSAM_PGDIRBMP_CHUNKS];
178} CSAMPDBITMAPARRAY;
179
[1]180/**
[23765]181 * SSM descriptor table for the CSAM::pPDBitmapHC array.
182 */
183static SSMFIELD const g_aCsamPDBitmapArray[] =
184{
185 SSMFIELD_ENTRY_HCPTR_NI_ARRAY(CSAMPDBITMAPARRAY, a),
186 SSMFIELD_ENTRY_TERM()
187};
188
189/**
190 * SSM descriptor table for the CSAMPAGEREC structure.
191 */
192static const SSMFIELD g_aCsamPageRecFields[] =
193{
[23777]194 SSMFIELD_ENTRY_IGN_HCPTR( CSAMPAGEREC, Core.Key),
195 SSMFIELD_ENTRY_IGN_HCPTR( CSAMPAGEREC, Core.pLeft),
196 SSMFIELD_ENTRY_IGN_HCPTR( CSAMPAGEREC, Core.pRight),
[23765]197 SSMFIELD_ENTRY_IGNORE( CSAMPAGEREC, Core.uchHeight),
198 SSMFIELD_ENTRY_PAD_HC_AUTO( 3, 7),
199 SSMFIELD_ENTRY_RCPTR( CSAMPAGEREC, page.pPageGC),
200 SSMFIELD_ENTRY_PAD_HC_AUTO( 0, 4),
[23772]201 SSMFIELD_ENTRY_PAD_MSC32_AUTO( 4),
[23765]202 SSMFIELD_ENTRY_GCPHYS( CSAMPAGEREC, page.GCPhys),
203 SSMFIELD_ENTRY( CSAMPAGEREC, page.fFlags),
204 SSMFIELD_ENTRY( CSAMPAGEREC, page.uSize),
205 SSMFIELD_ENTRY_PAD_HC_AUTO( 0, 4),
206 SSMFIELD_ENTRY_HCPTR_NI( CSAMPAGEREC, page.pBitmap),
207 SSMFIELD_ENTRY( CSAMPAGEREC, page.fCode32),
208 SSMFIELD_ENTRY( CSAMPAGEREC, page.fMonitorActive),
209 SSMFIELD_ENTRY( CSAMPAGEREC, page.fMonitorInvalidation),
210 SSMFIELD_ENTRY_PAD_HC_AUTO( 1, 1),
211 SSMFIELD_ENTRY( CSAMPAGEREC, page.enmTag),
212 SSMFIELD_ENTRY( CSAMPAGEREC, page.u64Hash),
213 SSMFIELD_ENTRY_TERM()
214};
215
216
217/**
[1]218 * Initializes the CSAM.
219 *
220 * @returns VBox status code.
[41801]221 * @param pVM Pointer to the VM.
[1]222 */
[44385]223VMMR3_INT_DECL(int) CSAMR3Init(PVM pVM)
[1]224{
225 int rc;
226
[45620]227 /*
228 * We only need a saved state dummy loader if HM is enabled.
229 */
230 if (HMIsEnabled(pVM))
231 {
232 pVM->fCSAMEnabled = false;
[50575]233 return SSMR3RegisterStub(pVM, "CSAM", 0);
[45620]234 }
235
236 /*
237 * Raw-mode.
238 */
[1]239 LogFlow(("CSAMR3Init\n"));
240
241 /* Allocate bitmap for the page directory. */
242 rc = MMR3HyperAllocOnceNoRel(pVM, CSAM_PGDIRBMP_CHUNKS*sizeof(RTHCPTR), 0, MM_TAG_CSAM, (void **)&pVM->csam.s.pPDBitmapHC);
243 AssertRCReturn(rc, rc);
[9344]244 rc = MMR3HyperAllocOnceNoRel(pVM, CSAM_PGDIRBMP_CHUNKS*sizeof(RTRCPTR), 0, MM_TAG_CSAM, (void **)&pVM->csam.s.pPDGCBitmapHC);
[1]245 AssertRCReturn(rc, rc);
[13827]246 pVM->csam.s.pPDBitmapGC = MMHyperR3ToRC(pVM, pVM->csam.s.pPDGCBitmapHC);
247 pVM->csam.s.pPDHCBitmapGC = MMHyperR3ToRC(pVM, pVM->csam.s.pPDBitmapHC);
[1]248
249 rc = csamReinit(pVM);
250 AssertRCReturn(rc, rc);
251
252 /*
[33540]253 * Register save and load state notifiers.
[1]254 */
255 rc = SSMR3RegisterInternal(pVM, "CSAM", 0, CSAM_SSM_VERSION, sizeof(pVM->csam.s) + PAGE_SIZE*16,
[22480]256 NULL, NULL, NULL,
[1]257 NULL, csamr3Save, NULL,
258 NULL, csamr3Load, NULL);
259 AssertRCReturn(rc, rc);
260
261 STAM_REG(pVM, &pVM->csam.s.StatNrTraps, STAMTYPE_COUNTER, "/CSAM/PageTraps", STAMUNIT_OCCURENCES, "The number of CSAM page traps.");
262 STAM_REG(pVM, &pVM->csam.s.StatDangerousWrite, STAMTYPE_COUNTER, "/CSAM/DangerousWrites", STAMUNIT_OCCURENCES, "The number of dangerous writes that cause a context switch.");
263
264 STAM_REG(pVM, &pVM->csam.s.StatNrPageNPHC, STAMTYPE_COUNTER, "/CSAM/HC/PageNotPresent", STAMUNIT_OCCURENCES, "The number of CSAM pages marked not present.");
265 STAM_REG(pVM, &pVM->csam.s.StatNrPageNPGC, STAMTYPE_COUNTER, "/CSAM/GC/PageNotPresent", STAMUNIT_OCCURENCES, "The number of CSAM pages marked not present.");
266 STAM_REG(pVM, &pVM->csam.s.StatNrPages, STAMTYPE_COUNTER, "/CSAM/PageRec/AddedRW", STAMUNIT_OCCURENCES, "The number of CSAM page records (RW monitoring).");
267 STAM_REG(pVM, &pVM->csam.s.StatNrPagesInv, STAMTYPE_COUNTER, "/CSAM/PageRec/AddedRWI", STAMUNIT_OCCURENCES, "The number of CSAM page records (RW & invalidation monitoring).");
268 STAM_REG(pVM, &pVM->csam.s.StatNrRemovedPages, STAMTYPE_COUNTER, "/CSAM/PageRec/Removed", STAMUNIT_OCCURENCES, "The number of removed CSAM page records.");
269 STAM_REG(pVM, &pVM->csam.s.StatPageRemoveREMFlush,STAMTYPE_COUNTER, "/CSAM/PageRec/Removed/REMFlush", STAMUNIT_OCCURENCES, "The number of removed CSAM page records that caused a REM flush.");
[23]270
[1]271 STAM_REG(pVM, &pVM->csam.s.StatNrPatchPages, STAMTYPE_COUNTER, "/CSAM/PageRec/Patch", STAMUNIT_OCCURENCES, "The number of CSAM patch page records.");
272 STAM_REG(pVM, &pVM->csam.s.StatNrUserPages, STAMTYPE_COUNTER, "/CSAM/PageRec/Ignore/User", STAMUNIT_OCCURENCES, "The number of CSAM user page records (ignored).");
273 STAM_REG(pVM, &pVM->csam.s.StatPagePATM, STAMTYPE_COUNTER, "/CSAM/PageRec/Type/PATM", STAMUNIT_OCCURENCES, "The number of PATM page records.");
274 STAM_REG(pVM, &pVM->csam.s.StatPageCSAM, STAMTYPE_COUNTER, "/CSAM/PageRec/Type/CSAM", STAMUNIT_OCCURENCES, "The number of CSAM page records.");
275 STAM_REG(pVM, &pVM->csam.s.StatPageREM, STAMTYPE_COUNTER, "/CSAM/PageRec/Type/REM", STAMUNIT_OCCURENCES, "The number of REM page records.");
276 STAM_REG(pVM, &pVM->csam.s.StatPageMonitor, STAMTYPE_COUNTER, "/CSAM/PageRec/Monitored", STAMUNIT_OCCURENCES, "The number of monitored pages.");
277
278 STAM_REG(pVM, &pVM->csam.s.StatCodePageModified, STAMTYPE_COUNTER, "/CSAM/Monitor/DirtyPage", STAMUNIT_OCCURENCES, "The number of code page modifications.");
279
280 STAM_REG(pVM, &pVM->csam.s.StatNrFlushes, STAMTYPE_COUNTER, "/CSAM/PageFlushes", STAMUNIT_OCCURENCES, "The number of CSAM page flushes.");
281 STAM_REG(pVM, &pVM->csam.s.StatNrFlushesSkipped, STAMTYPE_COUNTER, "/CSAM/PageFlushesSkipped", STAMUNIT_OCCURENCES, "The number of CSAM page flushes that were skipped.");
282 STAM_REG(pVM, &pVM->csam.s.StatNrKnownPagesHC, STAMTYPE_COUNTER, "/CSAM/HC/KnownPageRecords", STAMUNIT_OCCURENCES, "The number of known CSAM page records.");
283 STAM_REG(pVM, &pVM->csam.s.StatNrKnownPagesGC, STAMTYPE_COUNTER, "/CSAM/GC/KnownPageRecords", STAMUNIT_OCCURENCES, "The number of known CSAM page records.");
284 STAM_REG(pVM, &pVM->csam.s.StatNrInstr, STAMTYPE_COUNTER, "/CSAM/ScannedInstr", STAMUNIT_OCCURENCES, "The number of scanned instructions.");
285 STAM_REG(pVM, &pVM->csam.s.StatNrBytesRead, STAMTYPE_COUNTER, "/CSAM/BytesRead", STAMUNIT_OCCURENCES, "The number of bytes read for scanning.");
286 STAM_REG(pVM, &pVM->csam.s.StatNrOpcodeRead, STAMTYPE_COUNTER, "/CSAM/OpcodeBytesRead", STAMUNIT_OCCURENCES, "The number of opcode bytes read by the recompiler.");
287
288 STAM_REG(pVM, &pVM->csam.s.StatBitmapAlloc, STAMTYPE_COUNTER, "/CSAM/Alloc/PageBitmap", STAMUNIT_OCCURENCES, "The number of page bitmap allocations.");
289
290 STAM_REG(pVM, &pVM->csam.s.StatInstrCacheHit, STAMTYPE_COUNTER, "/CSAM/Cache/Hit", STAMUNIT_OCCURENCES, "The number of dangerous instruction cache hits.");
291 STAM_REG(pVM, &pVM->csam.s.StatInstrCacheMiss, STAMTYPE_COUNTER, "/CSAM/Cache/Miss", STAMUNIT_OCCURENCES, "The number of dangerous instruction cache misses.");
292
293 STAM_REG(pVM, &pVM->csam.s.StatScanNextFunction, STAMTYPE_COUNTER, "/CSAM/Function/Scan/Success", STAMUNIT_OCCURENCES, "The number of found functions beyond the ret border.");
294 STAM_REG(pVM, &pVM->csam.s.StatScanNextFunctionFailed, STAMTYPE_COUNTER, "/CSAM/Function/Scan/Failed", STAMUNIT_OCCURENCES, "The number of refused functions beyond the ret border.");
[23]295
[1]296 STAM_REG(pVM, &pVM->csam.s.StatTime, STAMTYPE_PROFILE, "/PROF/CSAM/Scan", STAMUNIT_TICKS_PER_CALL, "Scanning overhead.");
297 STAM_REG(pVM, &pVM->csam.s.StatTimeCheckAddr, STAMTYPE_PROFILE, "/PROF/CSAM/CheckAddr", STAMUNIT_TICKS_PER_CALL, "Address check overhead.");
298 STAM_REG(pVM, &pVM->csam.s.StatTimeAddrConv, STAMTYPE_PROFILE, "/PROF/CSAM/AddrConv", STAMUNIT_TICKS_PER_CALL, "Address conversion overhead.");
299 STAM_REG(pVM, &pVM->csam.s.StatTimeFlushPage, STAMTYPE_PROFILE, "/PROF/CSAM/FlushPage", STAMUNIT_TICKS_PER_CALL, "Page flushing overhead.");
300 STAM_REG(pVM, &pVM->csam.s.StatTimeDisasm, STAMTYPE_PROFILE, "/PROF/CSAM/Disasm", STAMUNIT_TICKS_PER_CALL, "Disassembly overhead.");
301 STAM_REG(pVM, &pVM->csam.s.StatFlushDirtyPages, STAMTYPE_PROFILE, "/PROF/CSAM/FlushDirtyPage", STAMUNIT_TICKS_PER_CALL, "Dirty page flushing overhead.");
302 STAM_REG(pVM, &pVM->csam.s.StatCheckGates, STAMTYPE_PROFILE, "/PROF/CSAM/CheckGates", STAMUNIT_TICKS_PER_CALL, "CSAMR3CheckGates overhead.");
303
[7628]304 /*
[452]305 * Check CFGM option and enable/disable CSAM.
306 */
307 bool fEnabled;
308 rc = CFGMR3QueryBool(CFGMR3GetRoot(pVM), "CSAMEnabled", &fEnabled);
[13816]309 if (RT_FAILURE(rc))
[1]310#ifdef CSAM_ENABLE
[452]311 fEnabled = true;
312#else
313 fEnabled = false;
[1]314#endif
[452]315 if (fEnabled)
316 CSAMEnableScanning(pVM);
[1]317
318#ifdef VBOX_WITH_DEBUGGER
319 /*
320 * Debugger commands.
321 */
322 static bool fRegisteredCmds = false;
323 if (!fRegisteredCmds)
324 {
[25273]325 rc = DBGCRegisterCommands(&g_aCmds[0], RT_ELEMENTS(g_aCmds));
[13816]326 if (RT_SUCCESS(rc))
[1]327 fRegisteredCmds = true;
328 }
329#endif
330
331 return VINF_SUCCESS;
332}
333
334/**
335 * (Re)initializes CSAM
336 *
337 * @param pVM The VM.
338 */
339static int csamReinit(PVM pVM)
340{
341 /*
342 * Assert alignment and sizes.
343 */
344 AssertRelease(!(RT_OFFSETOF(VM, csam.s) & 31));
345 AssertRelease(sizeof(pVM->csam.s) <= sizeof(pVM->csam.padding));
[45620]346 AssertRelease(!HMIsEnabled(pVM));
[1]347
348 /*
349 * Setup any fixed pointers and offsets.
350 */
351 pVM->csam.s.offVM = RT_OFFSETOF(VM, patm);
352
353 pVM->csam.s.fGatesChecked = false;
354 pVM->csam.s.fScanningStarted = false;
355
[19141]356 PVMCPU pVCpu = &pVM->aCpus[0]; /* raw mode implies 1 VPCU */
357 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_CSAM_PENDING_ACTION);
[1]358 pVM->csam.s.cDirtyPages = 0;
359 /* not necessary */
360 memset(pVM->csam.s.pvDirtyBasePage, 0, sizeof(pVM->csam.s.pvDirtyBasePage));
361 memset(pVM->csam.s.pvDirtyFaultPage, 0, sizeof(pVM->csam.s.pvDirtyFaultPage));
362
363 memset(&pVM->csam.s.aDangerousInstr, 0, sizeof(pVM->csam.s.aDangerousInstr));
364 pVM->csam.s.cDangerousInstr = 0;
365 pVM->csam.s.iDangerousInstr = 0;
366
[5198]367 memset(pVM->csam.s.pvCallInstruction, 0, sizeof(pVM->csam.s.pvCallInstruction));
368 pVM->csam.s.iCallInstruction = 0;
369
[1]370 /** @note never mess with the pgdir bitmap here! */
371 return VINF_SUCCESS;
372}
373
374/**
375 * Applies relocations to data and code managed by this
376 * component. This function will be called at init and
377 * whenever the VMM need to relocate itself inside the GC.
378 *
379 * The csam will update the addresses used by the switcher.
380 *
381 * @param pVM The VM.
382 * @param offDelta Relocation delta.
383 */
[44385]384VMMR3_INT_DECL(void) CSAMR3Relocate(PVM pVM, RTGCINTPTR offDelta)
[1]385{
[45620]386 if (offDelta && !HMIsEnabled(pVM))
[1]387 {
388 /* Adjust pgdir and page bitmap pointers. */
[13827]389 pVM->csam.s.pPDBitmapGC = MMHyperR3ToRC(pVM, pVM->csam.s.pPDGCBitmapHC);
390 pVM->csam.s.pPDHCBitmapGC = MMHyperR3ToRC(pVM, pVM->csam.s.pPDBitmapHC);
[1]391
392 for(int i=0;i<CSAM_PGDIRBMP_CHUNKS;i++)
393 {
394 if (pVM->csam.s.pPDGCBitmapHC[i])
395 {
396 pVM->csam.s.pPDGCBitmapHC[i] += offDelta;
397 }
398 }
399 }
400 return;
401}
402
403/**
404 * Terminates the csam.
405 *
406 * Termination means cleaning up and freeing all resources,
407 * the VM it self is at this point powered off or suspended.
408 *
409 * @returns VBox status code.
[41801]410 * @param pVM Pointer to the VM.
[1]411 */
[44385]412VMMR3_INT_DECL(int) CSAMR3Term(PVM pVM)
[1]413{
[45620]414 if (HMIsEnabled(pVM))
415 return VINF_SUCCESS;
416
[1]417 int rc;
418
419 rc = CSAMR3Reset(pVM);
420 AssertRC(rc);
421
422 /* @todo triggers assertion in MMHyperFree */
423#if 0
424 for(int i=0;i<CSAM_PAGEBMP_CHUNKS;i++)
425 {
426 if (pVM->csam.s.pPDBitmapHC[i])
427 MMHyperFree(pVM, pVM->csam.s.pPDBitmapHC[i]);
428 }
429#endif
430
431 return VINF_SUCCESS;
432}
433
434/**
435 * CSAM reset callback.
436 *
437 * @returns VBox status code.
438 * @param pVM The VM which is reset.
439 */
[44385]440VMMR3_INT_DECL(int) CSAMR3Reset(PVM pVM)
[1]441{
[45620]442 if (HMIsEnabled(pVM))
443 return VINF_SUCCESS;
444
[1]445 /* Clear page bitmaps. */
[45620]446 for (int i = 0; i < CSAM_PGDIRBMP_CHUNKS; i++)
[1]447 {
448 if (pVM->csam.s.pPDBitmapHC[i])
449 {
450 Assert((CSAM_PAGE_BITMAP_SIZE& 3) == 0);
451 ASMMemZero32(pVM->csam.s.pPDBitmapHC[i], CSAM_PAGE_BITMAP_SIZE);
452 }
453 }
454
455 /* Remove all CSAM page records. */
[45620]456 for (;;)
[1]457 {
458 PCSAMPAGEREC pPageRec = (PCSAMPAGEREC)RTAvlPVGetBestFit(&pVM->csam.s.pPageTree, 0, true);
[45620]459 if (!pPageRec)
[1]460 break;
[45620]461 csamRemovePageRecord(pVM, pPageRec->page.pPageGC);
[1]462 }
463 Assert(!pVM->csam.s.pPageTree);
464
465 csamReinit(pVM);
466
467 return VINF_SUCCESS;
468}
469
470
471/**
472 * Callback function for RTAvlPVDoWithAll
473 *
474 * Counts the number of records in the tree
475 *
476 * @returns VBox status code.
477 * @param pNode Current node
478 * @param pcPatches Pointer to patch counter
479 */
480static DECLCALLBACK(int) CountRecord(PAVLPVNODECORE pNode, void *pcPatches)
481{
[39078]482 NOREF(pNode);
[1]483 *(uint32_t *)pcPatches = *(uint32_t *)pcPatches + 1;
484 return VINF_SUCCESS;
485}
486
487/**
488 * Callback function for RTAvlPVDoWithAll
489 *
490 * Saves the state of the page record
491 *
492 * @returns VBox status code.
493 * @param pNode Current node
[41800]494 * @param pVM1 Pointer to the VM
[1]495 */
496static DECLCALLBACK(int) SavePageState(PAVLPVNODECORE pNode, void *pVM1)
497{
498 PVM pVM = (PVM)pVM1;
499 PCSAMPAGEREC pPage = (PCSAMPAGEREC)pNode;
500 CSAMPAGEREC page = *pPage;
501 PSSMHANDLE pSSM = pVM->csam.s.savedstate.pSSM;
502 int rc;
503
504 /* Save the page record itself */
505 rc = SSMR3PutMem(pSSM, &page, sizeof(page));
506 AssertRCReturn(rc, rc);
507
508 if (page.page.pBitmap)
509 {
510 rc = SSMR3PutMem(pSSM, page.page.pBitmap, CSAM_PAGE_BITMAP_SIZE);
511 AssertRCReturn(rc, rc);
512 }
513
514 return VINF_SUCCESS;
515}
516
517/**
518 * Execute state save operation.
519 *
520 * @returns VBox status code.
[41800]521 * @param pVM Pointer to the VM.
[1]522 * @param pSSM SSM operation handle.
523 */
524static DECLCALLBACK(int) csamr3Save(PVM pVM, PSSMHANDLE pSSM)
525{
526 CSAM csamInfo = pVM->csam.s;
527 int rc;
528
529 /*
530 * Count the number of page records in the tree (feeling lazy)
531 */
532 csamInfo.savedstate.cPageRecords = 0;
533 RTAvlPVDoWithAll(&pVM->csam.s.pPageTree, true, CountRecord, &csamInfo.savedstate.cPageRecords);
534
535 /*
536 * Save CSAM structure
537 */
538 pVM->csam.s.savedstate.pSSM = pSSM;
539 rc = SSMR3PutMem(pSSM, &csamInfo, sizeof(csamInfo));
540 AssertRCReturn(rc, rc);
541
542 /* Save pgdir bitmap */
543 rc = SSMR3PutMem(pSSM, csamInfo.pPDBitmapHC, CSAM_PGDIRBMP_CHUNKS*sizeof(RTHCPTR));
544 AssertRCReturn(rc, rc);
545
546 for (unsigned i=0;i<CSAM_PGDIRBMP_CHUNKS;i++)
547 {
548 if(csamInfo.pPDBitmapHC[i])
549 {
550 /* Save the page bitmap. */
551 rc = SSMR3PutMem(pSSM, csamInfo.pPDBitmapHC[i], CSAM_PAGE_BITMAP_SIZE);
552 AssertRCReturn(rc, rc);
553 }
554 }
555
556 /*
557 * Save page records
558 */
559 rc = RTAvlPVDoWithAll(&pVM->csam.s.pPageTree, true, SavePageState, pVM);
560 AssertRCReturn(rc, rc);
561
562 /** @note we don't restore aDangerousInstr; it will be recreated automatically. */
563 return VINF_SUCCESS;
564}
565
[45620]566
[1]567/**
568 * Execute state load operation.
569 *
570 * @returns VBox status code.
[41800]571 * @param pVM Pointer to the VM.
[1]572 * @param pSSM SSM operation handle.
[22480]573 * @param uVersion Data layout version.
[22793]574 * @param uPass The data pass.
[1]575 */
[22793]576static DECLCALLBACK(int) csamr3Load(PVM pVM, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass)
[1]577{
578 int rc;
579 CSAM csamInfo;
580
[22793]581 Assert(uPass == SSM_PASS_FINAL); NOREF(uPass);
[22480]582 if (uVersion != CSAM_SSM_VERSION)
[11792]583 {
[22480]584 AssertMsgFailed(("csamR3Load: Invalid version uVersion=%d!\n", uVersion));
[1]585 return VERR_SSM_UNSUPPORTED_DATA_UNIT_VERSION;
[11792]586 }
[1]587
588 pVM->csam.s.savedstate.pSSM = pSSM;
589
590 /*
591 * Restore CSAM structure
592 */
[23765]593 RT_ZERO(csamInfo);
[49247]594 rc = SSMR3GetStructEx(pSSM, &csamInfo, sizeof(csamInfo), SSMSTRUCT_FLAGS_MEM_BAND_AID_RELAXED, &g_aCsamFields[0], NULL);
[1]595 AssertRCReturn(rc, rc);
596
597 pVM->csam.s.fGatesChecked = csamInfo.fGatesChecked;
598 pVM->csam.s.fScanningStarted = csamInfo.fScanningStarted;
599
600 /* Restore dirty code page info. */
601 pVM->csam.s.cDirtyPages = csamInfo.cDirtyPages;
602 memcpy(pVM->csam.s.pvDirtyBasePage, csamInfo.pvDirtyBasePage, sizeof(pVM->csam.s.pvDirtyBasePage));
603 memcpy(pVM->csam.s.pvDirtyFaultPage, csamInfo.pvDirtyFaultPage, sizeof(pVM->csam.s.pvDirtyFaultPage));
604
[1830]605 /* Restore possible code page */
606 pVM->csam.s.cPossibleCodePages = csamInfo.cPossibleCodePages;
607 memcpy(pVM->csam.s.pvPossibleCodePage, csamInfo.pvPossibleCodePage, sizeof(pVM->csam.s.pvPossibleCodePage));
608
[1]609 /* Restore pgdir bitmap (we'll change the pointers next). */
[23765]610 rc = SSMR3GetStructEx(pSSM, pVM->csam.s.pPDBitmapHC, sizeof(uint8_t *) * CSAM_PGDIRBMP_CHUNKS,
[49247]611 SSMSTRUCT_FLAGS_MEM_BAND_AID_RELAXED, &g_aCsamPDBitmapArray[0], NULL);
[1]612 AssertRCReturn(rc, rc);
613
614 /*
615 * Restore page bitmaps
616 */
617 for (unsigned i=0;i<CSAM_PGDIRBMP_CHUNKS;i++)
618 {
619 if(pVM->csam.s.pPDBitmapHC[i])
620 {
621 rc = MMHyperAlloc(pVM, CSAM_PAGE_BITMAP_SIZE, 0, MM_TAG_CSAM, (void **)&pVM->csam.s.pPDBitmapHC[i]);
[13816]622 if (RT_FAILURE(rc))
[1]623 {
[20011]624 Log(("MMHyperAlloc failed with %Rrc\n", rc));
[1]625 return rc;
626 }
627 /* Convert to GC pointer. */
[13827]628 pVM->csam.s.pPDGCBitmapHC[i] = MMHyperR3ToRC(pVM, pVM->csam.s.pPDBitmapHC[i]);
[1]629 Assert(pVM->csam.s.pPDGCBitmapHC[i]);
630
631 /* Restore the bitmap. */
632 rc = SSMR3GetMem(pSSM, pVM->csam.s.pPDBitmapHC[i], CSAM_PAGE_BITMAP_SIZE);
633 AssertRCReturn(rc, rc);
634 }
635 else
636 {
637 Assert(!pVM->csam.s.pPDGCBitmapHC[i]);
638 pVM->csam.s.pPDGCBitmapHC[i] = 0;
639 }
640 }
641
642 /*
643 * Restore page records
644 */
645 for (uint32_t i=0;i<csamInfo.savedstate.cPageRecords + csamInfo.savedstate.cPatchPageRecords;i++)
646 {
647 CSAMPAGEREC page;
648 PCSAMPAGE pPage;
649
[23765]650 RT_ZERO(page);
[49247]651 rc = SSMR3GetStructEx(pSSM, &page, sizeof(page), SSMSTRUCT_FLAGS_MEM_BAND_AID_RELAXED, &g_aCsamPageRecFields[0], NULL);
[1]652 AssertRCReturn(rc, rc);
653
654 /*
655 * Recreate the page record
656 */
657 pPage = csamCreatePageRecord(pVM, page.page.pPageGC, page.page.enmTag, page.page.fCode32, page.page.fMonitorInvalidation);
658 AssertReturn(pPage, VERR_NO_MEMORY);
659
660 pPage->GCPhys = page.page.GCPhys;
661 pPage->fFlags = page.page.fFlags;
662 pPage->u64Hash = page.page.u64Hash;
663
664 if (page.page.pBitmap)
665 {
666 rc = SSMR3GetMem(pSSM, pPage->pBitmap, CSAM_PAGE_BITMAP_SIZE);
667 AssertRCReturn(rc, rc);
668 }
669 else
670 {
671 MMR3HeapFree(pPage->pBitmap);
672 pPage->pBitmap = 0;
673 }
674 }
675
[23765]676 /* Note: we don't restore aDangerousInstr; it will be recreated automatically. */
[1]677 memset(&pVM->csam.s.aDangerousInstr, 0, sizeof(pVM->csam.s.aDangerousInstr));
678 pVM->csam.s.cDangerousInstr = 0;
679 pVM->csam.s.iDangerousInstr = 0;
680 return VINF_SUCCESS;
681}
682
683/**
684 * Convert guest context address to host context pointer
685 *
[44362]686 * @returns Byte pointer (ring-3 context) corresponding to pGCPtr on success,
687 * NULL on failure.
[41801]688 * @param pVM Pointer to the VM.
[1]689 * @param pCacheRec Address conversion cache record
690 * @param pGCPtr Guest context pointer
691 * @returns Host context pointer or NULL in case of an error
692 *
693 */
[44362]694static uint8_t *csamR3GCVirtToHCVirt(PVM pVM, PCSAMP2GLOOKUPREC pCacheRec, RCPTRTYPE(uint8_t *) pGCPtr)
[1]695{
696 int rc;
[44362]697 void *pHCPtr;
[22890]698 Assert(pVM->cCpus == 1);
[18927]699 PVMCPU pVCpu = VMMGetCpu0(pVM);
[1]700
701 STAM_PROFILE_START(&pVM->csam.s.StatTimeAddrConv, a);
702
703 pHCPtr = PATMR3GCPtrToHCPtr(pVM, pGCPtr);
[32431]704 if (pHCPtr)
[44362]705 return (uint8_t *)pHCPtr;
[1]706
707 if (pCacheRec->pPageLocStartHC)
708 {
709 uint32_t offset = pGCPtr & PAGE_OFFSET_MASK;
710 if (pCacheRec->pGuestLoc == (pGCPtr & PAGE_BASE_GC_MASK))
711 {
712 STAM_PROFILE_STOP(&pVM->csam.s.StatTimeAddrConv, a);
713 return pCacheRec->pPageLocStartHC + offset;
714 }
715 }
716
[30500]717 /* Release previous lock if any. */
718 if (pCacheRec->Lock.pvMap)
719 {
720 PGMPhysReleasePageMappingLock(pVM, &pCacheRec->Lock);
721 pCacheRec->Lock.pvMap = NULL;
722 }
723
724 rc = PGMPhysGCPtr2CCPtrReadOnly(pVCpu, pGCPtr, (const void **)&pHCPtr, &pCacheRec->Lock);
[1]725 if (rc != VINF_SUCCESS)
726 {
[13822]727//// AssertMsgRC(rc, ("MMR3PhysGCVirt2HCVirtEx failed for %RRv\n", pGCPtr));
[1]728 STAM_PROFILE_STOP(&pVM->csam.s.StatTimeAddrConv, a);
729 return NULL;
730 }
731
[44362]732 pCacheRec->pPageLocStartHC = (uint8_t*)((uintptr_t)pHCPtr & PAGE_BASE_HC_MASK);
[18927]733 pCacheRec->pGuestLoc = pGCPtr & PAGE_BASE_GC_MASK;
[1]734 STAM_PROFILE_STOP(&pVM->csam.s.StatTimeAddrConv, a);
[44362]735 return (uint8_t *)pHCPtr;
[1]736}
737
[41791]738
739/** For csamR3ReadBytes. */
740typedef struct CSAMDISINFO
741{
742 PVM pVM;
743 uint8_t const *pbSrcInstr; /* aka pInstHC */
744} CSAMDISINFO, *PCSAMDISINFO;
745
746
[1]747/**
[41658]748 * @callback_method_impl{FNDISREADBYTES}
[1]749 */
[41769]750static DECLCALLBACK(int) csamR3ReadBytes(PDISCPUSTATE pDis, uint8_t offInstr, uint8_t cbMinRead, uint8_t cbMaxRead)
[1]751{
[41791]752 PCSAMDISINFO pDisInfo = (PCSAMDISINFO)pDis->pvUser;
[1]753
[41769]754 /*
755 * We are not interested in patched instructions, so read the original opcode bytes.
756 *
757 * Note! single instruction patches (int3) are checked in CSAMR3AnalyseCallback
758 *
759 * Since we're decoding one instruction at the time, we don't need to be
760 * concerned about any patched instructions following the first one. We
761 * could in fact probably skip this PATM call for offInstr != 0.
762 */
763 size_t cbRead = cbMaxRead;
764 RTUINTPTR uSrcAddr = pDis->uInstrAddr + offInstr;
[41791]765 int rc = PATMR3ReadOrgInstr(pDisInfo->pVM, pDis->uInstrAddr + offInstr, &pDis->abInstr[offInstr], cbRead, &cbRead);
[41769]766 if (RT_SUCCESS(rc))
767 {
768 if (cbRead >= cbMinRead)
769 {
[41771]770 pDis->cbCachedInstr = offInstr + (uint8_t)cbRead;
[41769]771 return rc;
772 }
[41760]773
[41771]774 cbMinRead -= (uint8_t)cbRead;
775 cbMaxRead -= (uint8_t)cbRead;
776 offInstr += (uint8_t)cbRead;
[41769]777 uSrcAddr += cbRead;
778 }
779
780 /*
781 * The current byte isn't a patch instruction byte.
782 */
[41791]783 AssertPtr(pDisInfo->pbSrcInstr);
[41769]784 if ((pDis->uInstrAddr >> PAGE_SHIFT) == ((uSrcAddr + cbMaxRead - 1) >> PAGE_SHIFT))
[1]785 {
[41791]786 memcpy(&pDis->abInstr[offInstr], &pDisInfo->pbSrcInstr[offInstr], cbMaxRead);
[41769]787 offInstr += cbMaxRead;
788 rc = VINF_SUCCESS;
[1]789 }
[41769]790 else if ( (pDis->uInstrAddr >> PAGE_SHIFT) == ((uSrcAddr + cbMinRead - 1) >> PAGE_SHIFT)
[41791]791 || PATMIsPatchGCAddr(pDisInfo->pVM, uSrcAddr) /** @todo does CSAM actually analyze patch code, or is this just a copy&past check? */
[41769]792 )
[41760]793 {
[41873]794 memcpy(&pDis->abInstr[offInstr], &pDisInfo->pbSrcInstr[offInstr], cbMinRead);
[41769]795 offInstr += cbMinRead;
796 rc = VINF_SUCCESS;
[41760]797 }
[41769]798 else
799 {
800 /* Crossed page boundrary, pbSrcInstr is no good... */
[41791]801 rc = PGMPhysSimpleReadGCPtr(VMMGetCpu0(pDisInfo->pVM), &pDis->abInstr[offInstr], uSrcAddr, cbMinRead);
[41769]802 offInstr += cbMinRead;
803 }
[1]804
[41760]805 pDis->cbCachedInstr = offInstr;
806 return rc;
[1]807}
808
[41769]809DECLINLINE(int) csamR3DISInstr(PVM pVM, RTRCPTR InstrGC, uint8_t *InstrHC, DISCPUMODE enmCpuMode,
[41671]810 PDISCPUSTATE pCpu, uint32_t *pcbInstr, char *pszOutput, size_t cbOutput)
[1]811{
[41791]812 CSAMDISINFO DisInfo = { pVM, InstrHC };
[1]813#ifdef DEBUG
[41810]814 return DISInstrToStrEx(InstrGC, enmCpuMode, csamR3ReadBytes, &DisInfo, DISOPTYPE_ALL,
[41671]815 pCpu, pcbInstr, pszOutput, cbOutput);
[1]816#else
817 /* We are interested in everything except harmless stuff */
[41671]818 if (pszOutput)
[41810]819 return DISInstrToStrEx(InstrGC, enmCpuMode, csamR3ReadBytes, &DisInfo,
820 ~(DISOPTYPE_INVALID | DISOPTYPE_HARMLESS | DISOPTYPE_RRM_MASK),
[41671]821 pCpu, pcbInstr, pszOutput, cbOutput);
[41886]822 return DISInstrEx(InstrGC, enmCpuMode, ~(DISOPTYPE_INVALID | DISOPTYPE_HARMLESS | DISOPTYPE_RRM_MASK),
823 csamR3ReadBytes, &DisInfo, pCpu, pcbInstr);
[1]824#endif
825}
826
827/**
828 * Analyses the instructions following the cli for compliance with our heuristics for cli
829 *
830 * @returns VBox status code.
[41801]831 * @param pVM Pointer to the VM.
[1]832 * @param pCpu CPU disassembly state
833 * @param pInstrGC Guest context pointer to privileged instruction
834 * @param pCurInstrGC Guest context pointer to the current instruction
835 * @param pCacheRec GC to HC cache record
836 * @param pUserData User pointer (callback specific)
837 *
838 */
[9212]839static int CSAMR3AnalyseCallback(PVM pVM, DISCPUSTATE *pCpu, RCPTRTYPE(uint8_t *) pInstrGC, RCPTRTYPE(uint8_t *) pCurInstrGC,
[1]840 PCSAMP2GLOOKUPREC pCacheRec, void *pUserData)
841{
842 PCSAMPAGE pPage = (PCSAMPAGE)pUserData;
843 int rc;
[39078]844 NOREF(pInstrGC);
[1]845
[41737]846 switch (pCpu->pCurInstr->uOpcode)
[1]847 {
848 case OP_INT:
[41739]849 Assert(pCpu->Param1.fUse & DISUSE_IMMEDIATE8);
[41741]850 if (pCpu->Param1.uValue == 3)
[1]851 {
852 //two byte int 3
853 return VINF_SUCCESS;
854 }
855 break;
856
[45276]857 /* removing breaks win2k guests? */
858 case OP_IRET:
859 if (EMIsRawRing1Enabled(pVM))
860 break;
861 /* no break */
862
[1]863 case OP_ILLUD2:
864 /* This appears to be some kind of kernel panic in Linux 2.4; no point to continue. */
865 case OP_RETN:
866 case OP_INT3:
867 case OP_INVALID:
868 return VINF_SUCCESS;
869 }
870
871 // Check for exit points
[41737]872 switch (pCpu->pCurInstr->uOpcode)
[1]873 {
874 /* It's not a good idea to patch pushf instructions:
875 * - increases the chance of conflicts (code jumping to the next instruction)
876 * - better to patch the cli
877 * - code that branches before the cli will likely hit an int 3
878 * - in general doesn't offer any benefits as we don't allow nested patch blocks (IF is always 1)
879 */
880 case OP_PUSHF:
881 case OP_POPF:
882 break;
883
884 case OP_CLI:
885 {
[41732]886 uint32_t cbInstrs = 0;
887 uint32_t cbCurInstr = pCpu->cbInstr;
888 bool fCode32 = pPage->fCode32;
[1]889
[21443]890 Assert(fCode32);
[1]891
[21443]892 PATMR3AddHint(pVM, pCurInstrGC, (fCode32) ? PATMFL_CODE32 : 0);
893
[1]894 /* Make sure the instructions that follow the cli have not been encountered before. */
895 while (true)
896 {
897 DISCPUSTATE cpu;
898
[41732]899 if (cbInstrs + cbCurInstr >= SIZEOF_NEARJUMP32)
[1]900 break;
901
[41732]902 if (csamIsCodeScanned(pVM, pCurInstrGC + cbCurInstr, &pPage) == true)
[1]903 {
[42782]904 /* We've scanned the next instruction(s) already. This means we've
905 followed a branch that ended up there before -> dangerous!! */
[41732]906 PATMR3DetectConflict(pVM, pCurInstrGC, pCurInstrGC + cbCurInstr);
[1]907 break;
908 }
[41732]909 pCurInstrGC += cbCurInstr;
910 cbInstrs += cbCurInstr;
[1]911
[30500]912 { /* Force pCurInstrHC out of scope after we stop using it (page lock!) */
[44362]913 uint8_t *pCurInstrHC = csamR3GCVirtToHCVirt(pVM, pCacheRec, pCurInstrGC);
[30497]914 if (pCurInstrHC == NULL)
915 {
[44362]916 Log(("csamR3GCVirtToHCVirt failed for %RRv\n", pCurInstrGC));
[30497]917 break;
918 }
919 Assert(VALID_PTR(pCurInstrHC));
920
[41769]921 rc = csamR3DISInstr(pVM, pCurInstrGC, pCurInstrHC, (fCode32) ? DISCPUMODE_32BIT : DISCPUMODE_16BIT,
[41732]922 &cpu, &cbCurInstr, NULL, 0);
[1]923 }
[25226]924 AssertRC(rc);
[13816]925 if (RT_FAILURE(rc))
[1]926 break;
927 }
928 break;
929 }
930
[45276]931#ifdef VBOX_WITH_RAW_RING1
932 case OP_MOV:
933 /* mov xx, CS is a dangerous instruction as our raw ring usage leaks through. */
934 if ( EMIsRawRing1Enabled(pVM)
[48936]935 && (pCpu->Param2.fUse & DISUSE_REG_SEG)
[45276]936 && (pCpu->Param2.Base.idxSegReg == DISSELREG_CS))
937 {
938 Log(("CSAM: Patching dangerous 'mov xx, cs' instruction at %RGv with an int3\n", pCurInstrGC));
939 if (PATMR3HasBeenPatched(pVM, pCurInstrGC) == false)
940 {
941 rc = PATMR3InstallPatch(pVM, pCurInstrGC, (pPage->fCode32) ? PATMFL_CODE32 : 0);
942 if (RT_FAILURE(rc))
943 {
944 Log(("PATMR3InstallPatch failed with %d\n", rc));
945 return VWRN_CONTINUE_ANALYSIS;
946 }
947 }
948 return VWRN_CONTINUE_ANALYSIS;
949 }
950 break;
951#endif
952
[1]953 case OP_PUSH:
[45276]954 /** @todo broken comparison!! should be if ((pCpu->Param1.fUse & DISUSE_REG_SEG) && (pCpu->Param1.Base.idxSegReg == DISSELREG_SS)) */
[41738]955 if (pCpu->pCurInstr->fParam1 != OP_PARM_REG_CS)
[1]956 break;
957
958 /* no break */
[45276]959#ifndef VBOX_WITH_SAFE_STR
[1]960 case OP_STR:
[45276]961#endif
[1]962 case OP_LSL:
963 case OP_LAR:
964 case OP_SGDT:
965 case OP_SLDT:
966 case OP_SIDT:
967 case OP_SMSW:
968 case OP_VERW:
969 case OP_VERR:
970 case OP_CPUID:
971 case OP_IRET:
972#ifdef DEBUG
[41737]973 switch(pCpu->pCurInstr->uOpcode)
[1]974 {
975 case OP_STR:
[13822]976 Log(("Privileged instruction at %RRv: str!!\n", pCurInstrGC));
[1]977 break;
978 case OP_LSL:
[13822]979 Log(("Privileged instruction at %RRv: lsl!!\n", pCurInstrGC));
[1]980 break;
981 case OP_LAR:
[13822]982 Log(("Privileged instruction at %RRv: lar!!\n", pCurInstrGC));
[1]983 break;
984 case OP_SGDT:
[13822]985 Log(("Privileged instruction at %RRv: sgdt!!\n", pCurInstrGC));
[1]986 break;
987 case OP_SLDT:
[13822]988 Log(("Privileged instruction at %RRv: sldt!!\n", pCurInstrGC));
[1]989 break;
990 case OP_SIDT:
[13822]991 Log(("Privileged instruction at %RRv: sidt!!\n", pCurInstrGC));
[1]992 break;
993 case OP_SMSW:
[13822]994 Log(("Privileged instruction at %RRv: smsw!!\n", pCurInstrGC));
[1]995 break;
996 case OP_VERW:
[13822]997 Log(("Privileged instruction at %RRv: verw!!\n", pCurInstrGC));
[1]998 break;
999 case OP_VERR:
[13822]1000 Log(("Privileged instruction at %RRv: verr!!\n", pCurInstrGC));
[1]1001 break;
1002 case OP_CPUID:
[13822]1003 Log(("Privileged instruction at %RRv: cpuid!!\n", pCurInstrGC));
[1]1004 break;
1005 case OP_PUSH:
[13822]1006 Log(("Privileged instruction at %RRv: push cs!!\n", pCurInstrGC));
[1]1007 break;
1008 case OP_IRET:
[13822]1009 Log(("Privileged instruction at %RRv: iret!!\n", pCurInstrGC));
[1]1010 break;
1011 }
1012#endif
1013
1014 if (PATMR3HasBeenPatched(pVM, pCurInstrGC) == false)
1015 {
1016 rc = PATMR3InstallPatch(pVM, pCurInstrGC, (pPage->fCode32) ? PATMFL_CODE32 : 0);
[13816]1017 if (RT_FAILURE(rc))
[1]1018 {
1019 Log(("PATMR3InstallPatch failed with %d\n", rc));
1020 return VWRN_CONTINUE_ANALYSIS;
1021 }
1022 }
[41737]1023 if (pCpu->pCurInstr->uOpcode == OP_IRET)
[1]1024 return VINF_SUCCESS; /* Look no further in this branch. */
1025
1026 return VWRN_CONTINUE_ANALYSIS;
1027
1028 case OP_JMP:
1029 case OP_CALL:
1030 {
1031 // return or jump/call through a jump table
[41738]1032 if (OP_PARM_VTYPE(pCpu->pCurInstr->fParam1) != OP_PARM_J)
[1]1033 {
1034#ifdef DEBUG
[41737]1035 switch(pCpu->pCurInstr->uOpcode)
[1]1036 {
1037 case OP_JMP:
[13822]1038 Log(("Control Flow instruction at %RRv: jmp!!\n", pCurInstrGC));
[1]1039 break;
1040 case OP_CALL:
[13822]1041 Log(("Control Flow instruction at %RRv: call!!\n", pCurInstrGC));
[1]1042 break;
1043 }
1044#endif
1045 return VWRN_CONTINUE_ANALYSIS;
1046 }
1047 return VWRN_CONTINUE_ANALYSIS;
1048 }
1049
1050 }
1051
1052 return VWRN_CONTINUE_ANALYSIS;
1053}
1054
1055#ifdef CSAM_ANALYSE_BEYOND_RET
1056/**
1057 * Wrapper for csamAnalyseCodeStream for call instructions.
1058 *
1059 * @returns VBox status code.
[41801]1060 * @param pVM Pointer to the VM.
[1]1061 * @param pInstrGC Guest context pointer to privileged instruction
1062 * @param pCurInstrGC Guest context pointer to the current instruction
1063 * @param fCode32 16 or 32 bits code
1064 * @param pfnCSAMR3Analyse Callback for testing the disassembled instruction
1065 * @param pUserData User pointer (callback specific)
1066 *
1067 */
[9212]1068static int csamAnalyseCallCodeStream(PVM pVM, RCPTRTYPE(uint8_t *) pInstrGC, RCPTRTYPE(uint8_t *) pCurInstrGC, bool fCode32,
[1]1069 PFN_CSAMR3ANALYSE pfnCSAMR3Analyse, void *pUserData, PCSAMP2GLOOKUPREC pCacheRec)
1070{
1071 int rc;
1072 CSAMCALLEXITREC CallExitRec;
1073 PCSAMCALLEXITREC pOldCallRec;
1074 PCSAMPAGE pPage = 0;
1075 uint32_t i;
1076
1077 CallExitRec.cInstrAfterRet = 0;
1078
1079 pOldCallRec = pCacheRec->pCallExitRec;
1080 pCacheRec->pCallExitRec = &CallExitRec;
1081
1082 rc = csamAnalyseCodeStream(pVM, pInstrGC, pCurInstrGC, fCode32, pfnCSAMR3Analyse, pUserData, pCacheRec);
1083
1084 for (i=0;i<CallExitRec.cInstrAfterRet;i++)
1085 {
1086 PCSAMPAGE pPage = 0;
1087
1088 pCurInstrGC = CallExitRec.pInstrAfterRetGC[i];
1089
1090 /* Check if we've previously encountered the instruction after the ret. */
1091 if (csamIsCodeScanned(pVM, pCurInstrGC, &pPage) == false)
1092 {
1093 DISCPUSTATE cpu;
[41732]1094 uint32_t cbInstr;
[4953]1095 int rc2;
[1]1096#ifdef DEBUG
1097 char szOutput[256];
1098#endif
1099 if (pPage == NULL)
1100 {
1101 /* New address; let's take a look at it. */
1102 pPage = csamCreatePageRecord(pVM, pCurInstrGC, CSAM_TAG_CSAM, fCode32);
1103 if (pPage == NULL)
1104 {
1105 rc = VERR_NO_MEMORY;
1106 goto done;
1107 }
1108 }
1109
1110 /**
1111 * Some generic requirements for recognizing an adjacent function:
1112 * - alignment fillers that consist of:
1113 * - nop
1114 * - lea genregX, [genregX (+ 0)]
1115 * - push ebp after the filler (can extend this later); aligned at at least a 4 byte boundary
1116 */
[41658]1117 for (int j = 0; j < 16; j++)
[1]1118 {
[44362]1119 uint8_t *pCurInstrHC = csamR3GCVirtToHCVirt(pVM, pCacheRec, pCurInstrGC);
[1]1120 if (pCurInstrHC == NULL)
1121 {
[44362]1122 Log(("csamR3GCVirtToHCVirt failed for %RRv\n", pCurInstrGC));
[1]1123 goto done;
1124 }
1125 Assert(VALID_PTR(pCurInstrHC));
1126
1127 STAM_PROFILE_START(&pVM->csam.s.StatTimeDisasm, a);
1128#ifdef DEBUG
[41769]1129 rc2 = csamR3DISInstr(pVM, pCurInstrGC, pCurInstrHC, (fCode32) ? DISCPUMODE_32BIT : DISCPUMODE_16BIT,
[41732]1130 &cpu, &cbInstr, szOutput, sizeof(szOutput));
[13816]1131 if (RT_SUCCESS(rc2)) Log(("CSAM Call Analysis: %s", szOutput));
[1]1132#else
[41769]1133 rc2 = csamR3DISInstr(pVM, pCurInstrGC, pCurInstrHC, (fCode32) ? DISCPUMODE_32BIT : DISCPUMODE_16BIT,
[41732]1134 &cpu, &cbInstr, NULL, 0);
[1]1135#endif
1136 STAM_PROFILE_STOP(&pVM->csam.s.StatTimeDisasm, a);
[13816]1137 if (RT_FAILURE(rc2))
[1]1138 {
[13822]1139 Log(("Disassembly failed at %RRv with %Rrc (probably page not present) -> return to caller\n", pCurInstrGC, rc2));
[1]1140 goto done;
1141 }
1142
[41732]1143 STAM_COUNTER_ADD(&pVM->csam.s.StatNrBytesRead, cbInstr);
[1]1144
[9212]1145 RCPTRTYPE(uint8_t *) addr = 0;
[1]1146 PCSAMPAGE pJmpPage = NULL;
1147
[41732]1148 if (PAGE_ADDRESS(pCurInstrGC) != PAGE_ADDRESS(pCurInstrGC + cbInstr - 1))
[1]1149 {
[41732]1150 if (!PGMGstIsPagePresent(pVM, pCurInstrGC + cbInstr - 1))
[1]1151 {
1152 /// @todo fault in the page
[13822]1153 Log(("Page for current instruction %RRv is not present!!\n", pCurInstrGC));
[1]1154 goto done;
1155 }
1156 //all is fine, let's continue
[41732]1157 csamR3CheckPageRecord(pVM, pCurInstrGC + cbInstr - 1);
[1]1158 }
1159
[41737]1160 switch (cpu.pCurInstr->uOpcode)
[1]1161 {
1162 case OP_NOP:
[1859]1163 case OP_INT3:
[1]1164 break; /* acceptable */
1165
1166 case OP_LEA:
1167 /* Must be similar to:
1168 *
1169 * lea esi, [esi]
1170 * lea esi, [esi+0]
[23]1171 * Any register is allowed as long as source and destination are identical.
[1]1172 */
[41739]1173 if ( cpu.Param1.fUse != DISUSE_REG_GEN32
1174 || ( cpu.Param2.flags != DISUSE_REG_GEN32
1175 && ( !(cpu.Param2.flags & DISUSE_REG_GEN32)
1176 || !(cpu.Param2.flags & (DISUSE_DISPLACEMENT8|DISUSE_DISPLACEMENT16|DISUSE_DISPLACEMENT32))
[41741]1177 || cpu.Param2.uValue != 0
[1]1178 )
1179 )
[41739]1180 || cpu.Param1.base.reg_gen32 != cpu.Param2.base.reg_gen32
[1]1181 )
1182 {
1183 STAM_COUNTER_INC(&pVM->csam.s.StatScanNextFunctionFailed);
1184 goto next_function;
1185 }
1186 break;
1187
1188 case OP_PUSH:
1189 {
1190 if ( (pCurInstrGC & 0x3) != 0
[41739]1191 || cpu.Param1.fUse != DISUSE_REG_GEN32
1192 || cpu.Param1.base.reg_gen32 != USE_REG_EBP
[1]1193 )
1194 {
1195 STAM_COUNTER_INC(&pVM->csam.s.StatScanNextFunctionFailed);
1196 goto next_function;
1197 }
1198
1199 if (csamIsCodeScanned(pVM, pCurInstrGC, &pPage) == false)
1200 {
1201 CSAMCALLEXITREC CallExitRec2;
1202 CallExitRec2.cInstrAfterRet = 0;
1203
1204 pCacheRec->pCallExitRec = &CallExitRec2;
1205
1206 /* Analyse the function. */
[13822]1207 Log(("Found new function at %RRv\n", pCurInstrGC));
[1]1208 STAM_COUNTER_INC(&pVM->csam.s.StatScanNextFunction);
1209 csamAnalyseCallCodeStream(pVM, pInstrGC, pCurInstrGC, fCode32, pfnCSAMR3Analyse, pUserData, pCacheRec);
1210 }
1211 goto next_function;
1212 }
1213
1214 case OP_SUB:
1215 {
1216 if ( (pCurInstrGC & 0x3) != 0
[41739]1217 || cpu.Param1.fUse != DISUSE_REG_GEN32
1218 || cpu.Param1.base.reg_gen32 != USE_REG_ESP
[1]1219 )
1220 {
1221 STAM_COUNTER_INC(&pVM->csam.s.StatScanNextFunctionFailed);
1222 goto next_function;
1223 }
1224
1225 if (csamIsCodeScanned(pVM, pCurInstrGC, &pPage) == false)
1226 {
1227 CSAMCALLEXITREC CallExitRec2;
1228 CallExitRec2.cInstrAfterRet = 0;
1229
1230 pCacheRec->pCallExitRec = &CallExitRec2;
1231
1232 /* Analyse the function. */
[13822]1233 Log(("Found new function at %RRv\n", pCurInstrGC));
[1]1234 STAM_COUNTER_INC(&pVM->csam.s.StatScanNextFunction);
1235 csamAnalyseCallCodeStream(pVM, pInstrGC, pCurInstrGC, fCode32, pfnCSAMR3Analyse, pUserData, pCacheRec);
1236 }
1237 goto next_function;
1238 }
1239
1240 default:
1241 STAM_COUNTER_INC(&pVM->csam.s.StatScanNextFunctionFailed);
1242 goto next_function;
1243 }
1244 /* Mark it as scanned. */
[41732]1245 csamMarkCode(pVM, pPage, pCurInstrGC, cbInstr, true);
1246 pCurInstrGC += cbInstr;
[1]1247 } /* for at most 16 instructions */
1248next_function:
1249 ; /* MSVC complains otherwise */
1250 }
1251 }
1252done:
1253 pCacheRec->pCallExitRec = pOldCallRec;
1254 return rc;
1255}
1256#else
1257#define csamAnalyseCallCodeStream csamAnalyseCodeStream
1258#endif
1259
1260/**
1261 * Disassembles the code stream until the callback function detects a failure or decides everything is acceptable
1262 *
1263 * @returns VBox status code.
[41801]1264 * @param pVM Pointer to the VM.
[1]1265 * @param pInstrGC Guest context pointer to privileged instruction
1266 * @param pCurInstrGC Guest context pointer to the current instruction
1267 * @param fCode32 16 or 32 bits code
1268 * @param pfnCSAMR3Analyse Callback for testing the disassembled instruction
1269 * @param pUserData User pointer (callback specific)
1270 *
1271 */
[9212]1272static int csamAnalyseCodeStream(PVM pVM, RCPTRTYPE(uint8_t *) pInstrGC, RCPTRTYPE(uint8_t *) pCurInstrGC, bool fCode32,
[1]1273 PFN_CSAMR3ANALYSE pfnCSAMR3Analyse, void *pUserData, PCSAMP2GLOOKUPREC pCacheRec)
1274{
1275 DISCPUSTATE cpu;
1276 PCSAMPAGE pPage = (PCSAMPAGE)pUserData;
1277 int rc = VWRN_CONTINUE_ANALYSIS;
[41732]1278 uint32_t cbInstr;
[4953]1279 int rc2;
[22890]1280 Assert(pVM->cCpus == 1);
[18927]1281 PVMCPU pVCpu = VMMGetCpu0(pVM);
[1]1282
1283#ifdef DEBUG
1284 char szOutput[256];
1285#endif
1286
[13822]1287 LogFlow(("csamAnalyseCodeStream: code at %RRv depth=%d\n", pCurInstrGC, pCacheRec->depth));
[1]1288
1289 pVM->csam.s.fScanningStarted = true;
1290
1291 pCacheRec->depth++;
1292 /*
1293 * Limit the call depth. (rather arbitrary upper limit; too low and we won't detect certain
1294 * cpuid instructions in Linux kernels; too high and we waste too much time scanning code)
1295 * (512 is necessary to detect cpuid instructions in Red Hat EL4; see defect 1355)
1296 * @note we are using a lot of stack here. couple of 100k when we go to the full depth (!)
1297 */
1298 if (pCacheRec->depth > 512)
1299 {
[13822]1300 LogFlow(("CSAM: maximum calldepth reached for %RRv\n", pCurInstrGC));
[1]1301 pCacheRec->depth--;
1302 return VINF_SUCCESS; //let's not go on forever
1303 }
1304
1305 Assert(!PATMIsPatchGCAddr(pVM, pCurInstrGC));
1306 csamR3CheckPageRecord(pVM, pCurInstrGC);
1307
1308 while(rc == VWRN_CONTINUE_ANALYSIS)
1309 {
1310 if (csamIsCodeScanned(pVM, pCurInstrGC, &pPage) == false)
1311 {
1312 if (pPage == NULL)
1313 {
1314 /* New address; let's take a look at it. */
1315 pPage = csamCreatePageRecord(pVM, pCurInstrGC, CSAM_TAG_CSAM, fCode32);
1316 if (pPage == NULL)
1317 {
1318 rc = VERR_NO_MEMORY;
1319 goto done;
1320 }
1321 }
1322 }
1323 else
1324 {
[13822]1325 LogFlow(("Code at %RRv has been scanned before\n", pCurInstrGC));
[1]1326 rc = VINF_SUCCESS;
1327 goto done;
1328 }
1329
[30500]1330 { /* Force pCurInstrHC out of scope after we stop using it (page lock!) */
[44362]1331 uint8_t *pCurInstrHC = csamR3GCVirtToHCVirt(pVM, pCacheRec, pCurInstrGC);
[30497]1332 if (pCurInstrHC == NULL)
1333 {
[44362]1334 Log(("csamR3GCVirtToHCVirt failed for %RRv\n", pCurInstrGC));
[30497]1335 rc = VERR_PATCHING_REFUSED;
1336 goto done;
1337 }
1338 Assert(VALID_PTR(pCurInstrHC));
[1]1339
[30497]1340 STAM_PROFILE_START(&pVM->csam.s.StatTimeDisasm, a);
[1]1341#ifdef DEBUG
[41769]1342 rc2 = csamR3DISInstr(pVM, pCurInstrGC, pCurInstrHC, fCode32 ? DISCPUMODE_32BIT : DISCPUMODE_16BIT,
[41732]1343 &cpu, &cbInstr, szOutput, sizeof(szOutput));
[30497]1344 if (RT_SUCCESS(rc2)) Log(("CSAM Analysis: %s", szOutput));
[1]1345#else
[41769]1346 rc2 = csamR3DISInstr(pVM, pCurInstrGC, pCurInstrHC, fCode32 ? DISCPUMODE_32BIT : DISCPUMODE_16BIT,
[41732]1347 &cpu, &cbInstr, NULL, 0);
[1]1348#endif
[30497]1349 STAM_PROFILE_STOP(&pVM->csam.s.StatTimeDisasm, a);
1350 }
[13816]1351 if (RT_FAILURE(rc2))
[1]1352 {
[13822]1353 Log(("Disassembly failed at %RRv with %Rrc (probably page not present) -> return to caller\n", pCurInstrGC, rc2));
[1]1354 rc = VINF_SUCCESS;
1355 goto done;
1356 }
1357
[41732]1358 STAM_COUNTER_ADD(&pVM->csam.s.StatNrBytesRead, cbInstr);
[1]1359
[41732]1360 csamMarkCode(pVM, pPage, pCurInstrGC, cbInstr, true);
[1]1361
[9212]1362 RCPTRTYPE(uint8_t *) addr = 0;
[1]1363 PCSAMPAGE pJmpPage = NULL;
1364
[41732]1365 if (PAGE_ADDRESS(pCurInstrGC) != PAGE_ADDRESS(pCurInstrGC + cbInstr - 1))
[1]1366 {
[41732]1367 if (!PGMGstIsPagePresent(pVCpu, pCurInstrGC + cbInstr - 1))
[1]1368 {
1369 /// @todo fault in the page
[13822]1370 Log(("Page for current instruction %RRv is not present!!\n", pCurInstrGC));
[1]1371 rc = VWRN_CONTINUE_ANALYSIS;
1372 goto next_please;
1373 }
1374 //all is fine, let's continue
[41732]1375 csamR3CheckPageRecord(pVM, pCurInstrGC + cbInstr - 1);
[1]1376 }
1377 /*
1378 * If it's harmless, then don't bother checking it (the disasm tables had better be accurate!)
1379 */
[41738]1380 if ((cpu.pCurInstr->fOpType & ~DISOPTYPE_RRM_MASK) == DISOPTYPE_HARMLESS)
[1]1381 {
1382 AssertMsg(pfnCSAMR3Analyse(pVM, &cpu, pInstrGC, pCurInstrGC, pCacheRec, (void *)pPage) == VWRN_CONTINUE_ANALYSIS, ("Instruction incorrectly marked harmless?!?!?\n"));
1383 rc = VWRN_CONTINUE_ANALYSIS;
1384 goto next_please;
1385 }
1386
1387#ifdef CSAM_ANALYSE_BEYOND_RET
1388 /* Remember the address of the instruction following the ret in case the parent instruction was a call. */
[23]1389 if ( pCacheRec->pCallExitRec
[41737]1390 && cpu.pCurInstr->uOpcode == OP_RETN
[1]1391 && pCacheRec->pCallExitRec->cInstrAfterRet < CSAM_MAX_CALLEXIT_RET)
1392 {
[41732]1393 pCacheRec->pCallExitRec->pInstrAfterRetGC[pCacheRec->pCallExitRec->cInstrAfterRet] = pCurInstrGC + cbInstr;
[1]1394 pCacheRec->pCallExitRec->cInstrAfterRet++;
1395 }
1396#endif
1397
1398 rc = pfnCSAMR3Analyse(pVM, &cpu, pInstrGC, pCurInstrGC, pCacheRec, (void *)pPage);
1399 if (rc == VINF_SUCCESS)
1400 goto done;
1401
1402 // For our first attempt, we'll handle only simple relative jumps and calls (immediate offset coded in instruction)
[41738]1403 if ( ((cpu.pCurInstr->fOpType & DISOPTYPE_CONTROLFLOW) && (OP_PARM_VTYPE(cpu.pCurInstr->fParam1) == OP_PARM_J))
[41739]1404 || (cpu.pCurInstr->uOpcode == OP_CALL && cpu.Param1.fUse == DISUSE_DISPLACEMENT32)) /* simple indirect call (call dword ptr [address]) */
[1]1405 {
[5205]1406 /* We need to parse 'call dword ptr [address]' type of calls to catch cpuid instructions in some recent Linux distributions (e.g. OpenSuse 10.3) */
[41737]1407 if ( cpu.pCurInstr->uOpcode == OP_CALL
[41739]1408 && cpu.Param1.fUse == DISUSE_DISPLACEMENT32)
[5205]1409 {
1410 addr = 0;
[41739]1411 PGMPhysSimpleReadGCPtr(pVCpu, &addr, (RTRCUINTPTR)cpu.Param1.uDisp.i32, sizeof(addr));
[5205]1412 }
1413 else
1414 addr = CSAMResolveBranch(&cpu, pCurInstrGC);
1415
[1]1416 if (addr == 0)
1417 {
[41739]1418 Log(("We don't support far jumps here!! (%08X)\n", cpu.Param1.fUse));
[1]1419 rc = VINF_SUCCESS;
1420 break;
1421 }
1422 Assert(!PATMIsPatchGCAddr(pVM, addr));
1423
1424 /* If the target address lies in a patch generated jump, then special action needs to be taken. */
1425 PATMR3DetectConflict(pVM, pCurInstrGC, addr);
1426
1427 /* Same page? */
1428 if (PAGE_ADDRESS(addr) != PAGE_ADDRESS(pCurInstrGC ))
1429 {
[18988]1430 if (!PGMGstIsPagePresent(pVCpu, addr))
[1]1431 {
[13822]1432 Log(("Page for current instruction %RRv is not present!!\n", addr));
[1]1433 rc = VWRN_CONTINUE_ANALYSIS;
1434 goto next_please;
1435 }
1436
1437 /* All is fine, let's continue. */
1438 csamR3CheckPageRecord(pVM, addr);
1439 }
1440
1441 pJmpPage = NULL;
1442 if (csamIsCodeScanned(pVM, addr, &pJmpPage) == false)
1443 {
1444 if (pJmpPage == NULL)
1445 {
1446 /* New branch target; let's take a look at it. */
1447 pJmpPage = csamCreatePageRecord(pVM, addr, CSAM_TAG_CSAM, fCode32);
1448 if (pJmpPage == NULL)
1449 {
1450 rc = VERR_NO_MEMORY;
1451 goto done;
1452 }
1453 Assert(pPage);
1454 }
[41737]1455 if (cpu.pCurInstr->uOpcode == OP_CALL)
[1]1456 rc = csamAnalyseCallCodeStream(pVM, pInstrGC, addr, fCode32, pfnCSAMR3Analyse, (void *)pJmpPage, pCacheRec);
1457 else
1458 rc = csamAnalyseCodeStream(pVM, pInstrGC, addr, fCode32, pfnCSAMR3Analyse, (void *)pJmpPage, pCacheRec);
1459
1460 if (rc != VINF_SUCCESS) {
1461 goto done;
1462 }
1463 }
[41737]1464 if (cpu.pCurInstr->uOpcode == OP_JMP)
[1]1465 {//unconditional jump; return to caller
1466 rc = VINF_SUCCESS;
1467 goto done;
1468 }
1469
1470 rc = VWRN_CONTINUE_ANALYSIS;
[41738]1471 } //if ((cpu.pCurInstr->fOpType & DISOPTYPE_CONTROLFLOW) && (OP_PARM_VTYPE(cpu.pCurInstr->fParam1) == OP_PARM_J))
[1]1472#ifdef CSAM_SCAN_JUMP_TABLE
1473 else
[41737]1474 if ( cpu.pCurInstr->uOpcode == OP_JMP
[41739]1475 && (cpu.Param1.fUse & (DISUSE_DISPLACEMENT32|DISUSE_INDEX|DISUSE_SCALE)) == (DISUSE_DISPLACEMENT32|DISUSE_INDEX|DISUSE_SCALE)
[1]1476 )
1477 {
[41739]1478 RTRCPTR pJumpTableGC = (RTRCPTR)cpu.Param1.disp32;
[1]1479 uint8_t *pJumpTableHC;
1480 int rc2;
1481
1482 Log(("Jump through jump table\n"));
1483
[30497]1484 rc2 = PGMPhysGCPtr2CCPtrReadOnly(pVCpu, pJumpTableGC, (PRTHCPTR)&pJumpTableHC, missing page lock);
[1]1485 if (rc2 == VINF_SUCCESS)
1486 {
1487 for (uint32_t i=0;i<2;i++)
1488 {
1489 uint64_t fFlags;
1490
[41739]1491 addr = pJumpTableGC + cpu.Param1.scale * i;
[1]1492 /* Same page? */
1493 if (PAGE_ADDRESS(addr) != PAGE_ADDRESS(pJumpTableGC))
1494 break;
[23]1495
[41739]1496 addr = *(RTRCPTR *)(pJumpTableHC + cpu.Param1.scale * i);
[1]1497
[18988]1498 rc2 = PGMGstGetPage(pVCpu, addr, &fFlags, NULL);
[23]1499 if ( rc2 != VINF_SUCCESS
[1]1500 || (fFlags & X86_PTE_US)
1501 || !(fFlags & X86_PTE_P)
1502 )
1503 break;
1504
[13822]1505 Log(("Jump to %RRv\n", addr));
[1]1506
1507 pJmpPage = NULL;
1508 if (csamIsCodeScanned(pVM, addr, &pJmpPage) == false)
1509 {
1510 if (pJmpPage == NULL)
1511 {
1512 /* New branch target; let's take a look at it. */
1513 pJmpPage = csamCreatePageRecord(pVM, addr, CSAM_TAG_CSAM, fCode32);
1514 if (pJmpPage == NULL)
1515 {
1516 rc = VERR_NO_MEMORY;
1517 goto done;
1518 }
1519 Assert(pPage);
1520 }
1521 rc = csamAnalyseCodeStream(pVM, pInstrGC, addr, fCode32, pfnCSAMR3Analyse, (void *)pJmpPage, pCacheRec);
1522 if (rc != VINF_SUCCESS) {
1523 goto done;
1524 }
1525 }
1526 }
1527 }
1528 }
1529#endif
1530 if (rc != VWRN_CONTINUE_ANALYSIS) {
1531 break; //done!
1532 }
1533next_please:
[41737]1534 if (cpu.pCurInstr->uOpcode == OP_JMP)
[1]1535 {
1536 rc = VINF_SUCCESS;
1537 goto done;
1538 }
[41732]1539 pCurInstrGC += cbInstr;
[1]1540 }
1541done:
1542 pCacheRec->depth--;
1543 return rc;
1544}
1545
1546
1547/**
1548 * Calculates the 64 bits hash value for the current page
1549 *
1550 * @returns hash value
[41801]1551 * @param pVM Pointer to the VM.
[1]1552 * @param pInstr Page address
1553 */
[9344]1554uint64_t csamR3CalcPageHash(PVM pVM, RTRCPTR pInstr)
[1]1555{
1556 uint64_t hash = 0;
1557 uint32_t val[5];
1558 int rc;
[22890]1559 Assert(pVM->cCpus == 1);
[18927]1560 PVMCPU pVCpu = VMMGetCpu0(pVM);
[1]1561
1562 Assert((pInstr & PAGE_OFFSET_MASK) == 0);
1563
[18927]1564 rc = PGMPhysSimpleReadGCPtr(pVCpu, &val[0], pInstr, sizeof(val[0]));
[13818]1565 AssertMsg(RT_SUCCESS(rc) || rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
[1]1566 if (rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT)
1567 {
[13822]1568 Log(("csamR3CalcPageHash: page %RRv not present!!\n", pInstr));
[1]1569 return ~0ULL;
1570 }
1571
[18927]1572 rc = PGMPhysSimpleReadGCPtr(pVCpu, &val[1], pInstr+1024, sizeof(val[0]));
[13818]1573 AssertMsg(RT_SUCCESS(rc) || rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
[1]1574 if (rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT)
1575 {
[13822]1576 Log(("csamR3CalcPageHash: page %RRv not present!!\n", pInstr));
[1]1577 return ~0ULL;
1578 }
1579
[18927]1580 rc = PGMPhysSimpleReadGCPtr(pVCpu, &val[2], pInstr+2048, sizeof(val[0]));
[13818]1581 AssertMsg(RT_SUCCESS(rc) || rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
[1]1582 if (rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT)
1583 {
[13822]1584 Log(("csamR3CalcPageHash: page %RRv not present!!\n", pInstr));
[1]1585 return ~0ULL;
1586 }
1587
[18927]1588 rc = PGMPhysSimpleReadGCPtr(pVCpu, &val[3], pInstr+3072, sizeof(val[0]));
[13818]1589 AssertMsg(RT_SUCCESS(rc) || rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
[1]1590 if (rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT)
1591 {
[13822]1592 Log(("csamR3CalcPageHash: page %RRv not present!!\n", pInstr));
[1]1593 return ~0ULL;
1594 }
1595
[18927]1596 rc = PGMPhysSimpleReadGCPtr(pVCpu, &val[4], pInstr+4092, sizeof(val[0]));
[13818]1597 AssertMsg(RT_SUCCESS(rc) || rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
[1]1598 if (rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT)
1599 {
[13822]1600 Log(("csamR3CalcPageHash: page %RRv not present!!\n", pInstr));
[1]1601 return ~0ULL;
1602 }
1603
1604 // don't want to get division by zero traps
1605 val[2] |= 1;
1606 val[4] |= 1;
1607
1608 hash = (uint64_t)val[0] * (uint64_t)val[1] / (uint64_t)val[2] + (val[3]%val[4]);
1609 return (hash == ~0ULL) ? hash - 1 : hash;
1610}
1611
1612
1613/**
1614 * Notify CSAM of a page flush
1615 *
1616 * @returns VBox status code
[41801]1617 * @param pVM Pointer to the VM.
[1]1618 * @param addr GC address of the page to flush
1619 * @param fRemovePage Page removal flag
1620 */
[9344]1621static int csamFlushPage(PVM pVM, RTRCPTR addr, bool fRemovePage)
[1]1622{
1623 PCSAMPAGEREC pPageRec;
1624 int rc;
1625 RTGCPHYS GCPhys = 0;
1626 uint64_t fFlags = 0;
[22890]1627 Assert(pVM->cCpus == 1 || !CSAMIsEnabled(pVM));
[1]1628
1629 if (!CSAMIsEnabled(pVM))
1630 return VINF_SUCCESS;
[45620]1631 Assert(!HMIsEnabled(pVM));
[1]1632
[19263]1633 PVMCPU pVCpu = VMMGetCpu0(pVM);
1634
[1]1635 STAM_PROFILE_START(&pVM->csam.s.StatTimeFlushPage, a);
1636
1637 addr = addr & PAGE_BASE_GC_MASK;
1638
1639 /*
1640 * Note: searching for the page in our tree first is more expensive (skipped flushes are two orders of magnitude more common)
1641 */
1642 if (pVM->csam.s.pPageTree == NULL)
1643 {
1644 STAM_PROFILE_STOP(&pVM->csam.s.StatTimeFlushPage, a);
1645 return VWRN_CSAM_PAGE_NOT_FOUND;
1646 }
1647
[18988]1648 rc = PGMGstGetPage(pVCpu, addr, &fFlags, &GCPhys);
[1]1649 /* Returned at a very early stage (no paging yet presumably). */
1650 if (rc == VERR_NOT_SUPPORTED)
1651 {
1652 STAM_PROFILE_STOP(&pVM->csam.s.StatTimeFlushPage, a);
1653 return rc;
1654 }
1655
[13816]1656 if (RT_SUCCESS(rc))
[1]1657 {
1658 if ( (fFlags & X86_PTE_US)
1659 || rc == VERR_PGM_PHYS_PAGE_RESERVED
1660 )
1661 {
1662 /* User page -> not relevant for us. */
1663 STAM_COUNTER_ADD(&pVM->csam.s.StatNrFlushesSkipped, 1);
1664 STAM_PROFILE_STOP(&pVM->csam.s.StatTimeFlushPage, a);
1665 return VINF_SUCCESS;
1666 }
1667 }
1668 else
1669 if (rc != VERR_PAGE_NOT_PRESENT && rc != VERR_PAGE_TABLE_NOT_PRESENT)
[13822]1670 AssertMsgFailed(("PGMR3GetPage %RRv failed with %Rrc\n", addr, rc));
[1]1671
[36912]1672 pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)(uintptr_t)addr);
[1]1673 if (pPageRec)
1674 {
1675 if ( GCPhys == pPageRec->page.GCPhys
1676 && (fFlags & X86_PTE_P))
1677 {
1678 STAM_COUNTER_ADD(&pVM->csam.s.StatNrFlushesSkipped, 1);
1679 STAM_PROFILE_STOP(&pVM->csam.s.StatTimeFlushPage, a);
1680 return VINF_SUCCESS;
1681 }
1682
[13824]1683 Log(("CSAMR3FlushPage: page %RRv has changed -> FLUSH (rc=%Rrc) (Phys: %RGp vs %RGp)\n", addr, rc, GCPhys, pPageRec->page.GCPhys));
[1]1684
1685 STAM_COUNTER_ADD(&pVM->csam.s.StatNrFlushes, 1);
1686
1687 if (fRemovePage)
1688 csamRemovePageRecord(pVM, addr);
1689 else
1690 {
1691 CSAMMarkPage(pVM, addr, false);
1692 pPageRec->page.GCPhys = 0;
1693 pPageRec->page.fFlags = 0;
[18988]1694 rc = PGMGstGetPage(pVCpu, addr, &pPageRec->page.fFlags, &pPageRec->page.GCPhys);
[1]1695 if (rc == VINF_SUCCESS)
1696 pPageRec->page.u64Hash = csamR3CalcPageHash(pVM, addr);
[760]1697
1698 if (pPageRec->page.pBitmap == NULL)
1699 {
1700 pPageRec->page.pBitmap = (uint8_t *)MMR3HeapAllocZ(pVM, MM_TAG_CSAM_PATCH, CSAM_PAGE_BITMAP_SIZE);
1701 Assert(pPageRec->page.pBitmap);
1702 if (pPageRec->page.pBitmap == NULL)
1703 return VERR_NO_MEMORY;
1704 }
1705 else
1706 memset(pPageRec->page.pBitmap, 0, CSAM_PAGE_BITMAP_SIZE);
[1]1707 }
1708
1709
1710 /*
1711 * Inform patch manager about the flush; no need to repeat the above check twice.
1712 */
1713 PATMR3FlushPage(pVM, addr);
1714
1715 STAM_PROFILE_STOP(&pVM->csam.s.StatTimeFlushPage, a);
1716 return VINF_SUCCESS;
1717 }
1718 else
1719 {
1720 STAM_PROFILE_STOP(&pVM->csam.s.StatTimeFlushPage, a);
1721 return VWRN_CSAM_PAGE_NOT_FOUND;
1722 }
1723}
1724
1725/**
1726 * Notify CSAM of a page flush
1727 *
1728 * @returns VBox status code
[41801]1729 * @param pVM Pointer to the VM.
[1]1730 * @param addr GC address of the page to flush
1731 */
[44385]1732VMMR3_INT_DECL(int) CSAMR3FlushPage(PVM pVM, RTRCPTR addr)
[1]1733{
1734 return csamFlushPage(pVM, addr, true /* remove page record */);
1735}
1736
1737/**
[1994]1738 * Remove a CSAM monitored page. Use with care!
1739 *
1740 * @returns VBox status code
[41801]1741 * @param pVM Pointer to the VM.
[1994]1742 * @param addr GC address of the page to flush
1743 */
[44385]1744VMMR3_INT_DECL(int) CSAMR3RemovePage(PVM pVM, RTRCPTR addr)
[1994]1745{
[1996]1746 PCSAMPAGEREC pPageRec;
1747 int rc;
1748
[45620]1749 AssertReturn(!HMIsEnabled(pVM), VERR_CSAM_HM_IPE);
1750
[1996]1751 addr = addr & PAGE_BASE_GC_MASK;
1752
[36912]1753 pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)(uintptr_t)addr);
[1996]1754 if (pPageRec)
1755 {
1756 rc = csamRemovePageRecord(pVM, addr);
[13816]1757 if (RT_SUCCESS(rc))
[1996]1758 PATMR3FlushPage(pVM, addr);
1759 return VINF_SUCCESS;
1760 }
1761 return VWRN_CSAM_PAGE_NOT_FOUND;
[1994]1762}
1763
1764/**
[1]1765 * Check a page record in case a page has been changed
1766 *
1767 * @returns VBox status code. (trap handled or not)
[41801]1768 * @param pVM Pointer to the VM.
[1]1769 * @param pInstrGC GC instruction pointer
1770 */
[9344]1771int csamR3CheckPageRecord(PVM pVM, RTRCPTR pInstrGC)
[1]1772{
1773 PCSAMPAGEREC pPageRec;
1774 uint64_t u64hash;
1775
1776 pInstrGC = pInstrGC & PAGE_BASE_GC_MASK;
1777
[36912]1778 pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)(uintptr_t)pInstrGC);
[1]1779 if (pPageRec)
1780 {
1781 u64hash = csamR3CalcPageHash(pVM, pInstrGC);
1782 if (u64hash != pPageRec->page.u64Hash)
[760]1783 csamFlushPage(pVM, pInstrGC, false /* don't remove page record */);
[1]1784 }
1785 else
1786 return VWRN_CSAM_PAGE_NOT_FOUND;
[760]1787
[1]1788 return VINF_SUCCESS;
1789}
1790
1791/**
1792 * Returns monitor description based on CSAM tag
1793 *
1794 * @return description string
1795 * @param enmTag Owner tag
1796 */
1797const char *csamGetMonitorDescription(CSAMTAG enmTag)
1798{
1799 if (enmTag == CSAM_TAG_PATM)
1800 return "CSAM-PATM self-modifying code monitor handler";
1801 else
1802 if (enmTag == CSAM_TAG_REM)
1803 return "CSAM-REM self-modifying code monitor handler";
1804 Assert(enmTag == CSAM_TAG_CSAM);
1805 return "CSAM self-modifying code monitor handler";
1806}
1807
1808/**
1809 * Adds page record to our lookup tree
1810 *
1811 * @returns CSAMPAGE ptr or NULL if failure
[41801]1812 * @param pVM Pointer to the VM.
[1]1813 * @param GCPtr Page address
1814 * @param enmTag Owner tag
1815 * @param fCode32 16 or 32 bits code
1816 * @param fMonitorInvalidation Monitor page invalidation flag
1817 */
[9344]1818static PCSAMPAGE csamCreatePageRecord(PVM pVM, RTRCPTR GCPtr, CSAMTAG enmTag, bool fCode32, bool fMonitorInvalidation)
[1]1819{
1820 PCSAMPAGEREC pPage;
1821 int rc;
1822 bool ret;
[22890]1823 Assert(pVM->cCpus == 1);
[18927]1824 PVMCPU pVCpu = VMMGetCpu0(pVM);
[1]1825
[13822]1826 Log(("New page record for %RRv\n", GCPtr & PAGE_BASE_GC_MASK));
[1]1827
1828 pPage = (PCSAMPAGEREC)MMR3HeapAllocZ(pVM, MM_TAG_CSAM_PATCH, sizeof(CSAMPAGEREC));
1829 if (pPage == NULL)
1830 {
1831 AssertMsgFailed(("csamCreatePageRecord: Out of memory!!!!\n"));
1832 return NULL;
1833 }
1834 /* Round down to page boundary. */
1835 GCPtr = (GCPtr & PAGE_BASE_GC_MASK);
[36912]1836 pPage->Core.Key = (AVLPVKEY)(uintptr_t)GCPtr;
[1]1837 pPage->page.pPageGC = GCPtr;
1838 pPage->page.fCode32 = fCode32;
1839 pPage->page.fMonitorInvalidation = fMonitorInvalidation;
1840 pPage->page.enmTag = enmTag;
1841 pPage->page.fMonitorActive = false;
1842 pPage->page.pBitmap = (uint8_t *)MMR3HeapAllocZ(pVM, MM_TAG_CSAM_PATCH, PAGE_SIZE/sizeof(uint8_t));
[18988]1843 rc = PGMGstGetPage(pVCpu, GCPtr, &pPage->page.fFlags, &pPage->page.GCPhys);
[13818]1844 AssertMsg(RT_SUCCESS(rc) || rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
[1]1845
1846 pPage->page.u64Hash = csamR3CalcPageHash(pVM, GCPtr);
1847 ret = RTAvlPVInsert(&pVM->csam.s.pPageTree, &pPage->Core);
1848 Assert(ret);
1849
1850#ifdef CSAM_MONITOR_CODE_PAGES
1851 AssertRelease(!fInCSAMCodePageInvalidate);
1852
1853 switch (enmTag)
1854 {
1855 case CSAM_TAG_PATM:
1856 case CSAM_TAG_REM:
1857#ifdef CSAM_MONITOR_CSAM_CODE_PAGES
1858 case CSAM_TAG_CSAM:
1859#endif
1860 {
[25273]1861 rc = PGMR3HandlerVirtualRegister(pVM, PGMVIRTHANDLERTYPE_WRITE, GCPtr, GCPtr + (PAGE_SIZE - 1) /* inclusive! */,
1862 (fMonitorInvalidation) ? CSAMCodePageInvalidate : 0, CSAMCodePageWriteHandler, "CSAMGCCodePageWriteHandler", 0,
1863 csamGetMonitorDescription(enmTag));
[13822]1864 AssertMsg(RT_SUCCESS(rc) || rc == VERR_PGM_HANDLER_VIRTUAL_CONFLICT, ("PGMR3HandlerVirtualRegisterEx %RRv failed with %Rrc\n", GCPtr, rc));
[13816]1865 if (RT_FAILURE(rc))
[13822]1866 Log(("PGMR3HandlerVirtualRegisterEx for %RRv failed with %Rrc\n", GCPtr, rc));
[1]1867
1868 /* Could fail, because it's already monitored. Don't treat that condition as fatal. */
1869
1870 /* Prefetch it in case it's not there yet. */
[18992]1871 rc = PGMPrefetchPage(pVCpu, GCPtr);
[1]1872 AssertRC(rc);
1873
[30326]1874 rc = PGMShwMakePageReadonly(pVCpu, GCPtr, 0 /*fFlags*/);
[1]1875 Assert(rc == VINF_SUCCESS || rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT);
1876
1877 pPage->page.fMonitorActive = true;
1878 STAM_COUNTER_INC(&pVM->csam.s.StatPageMonitor);
1879 break;
1880 }
1881 default:
1882 break; /* to shut up GCC */
1883 }
1884
[13824]1885 Log(("csamCreatePageRecord %RRv GCPhys=%RGp\n", GCPtr, pPage->page.GCPhys));
[1]1886
1887#ifdef VBOX_WITH_STATISTICS
1888 switch (enmTag)
1889 {
1890 case CSAM_TAG_CSAM:
1891 STAM_COUNTER_INC(&pVM->csam.s.StatPageCSAM);
1892 break;
1893 case CSAM_TAG_PATM:
1894 STAM_COUNTER_INC(&pVM->csam.s.StatPagePATM);
1895 break;
1896 case CSAM_TAG_REM:
1897 STAM_COUNTER_INC(&pVM->csam.s.StatPageREM);
1898 break;
1899 default:
1900 break; /* to shut up GCC */
1901 }
1902#endif
1903
1904#endif
1905
1906 STAM_COUNTER_INC(&pVM->csam.s.StatNrPages);
1907 if (fMonitorInvalidation)
1908 STAM_COUNTER_INC(&pVM->csam.s.StatNrPagesInv);
1909
1910 return &pPage->page;
1911}
1912
1913/**
1914 * Monitors a code page (if not already monitored)
1915 *
1916 * @returns VBox status code
[41801]1917 * @param pVM Pointer to the VM.
[1]1918 * @param pPageAddrGC The page to monitor
1919 * @param enmTag Monitor tag
1920 */
[12989]1921VMMR3DECL(int) CSAMR3MonitorPage(PVM pVM, RTRCPTR pPageAddrGC, CSAMTAG enmTag)
[1]1922{
1923 PCSAMPAGEREC pPageRec = NULL;
1924 int rc;
1925 bool fMonitorInvalidation;
[22890]1926 Assert(pVM->cCpus == 1);
[45620]1927 PVMCPU pVCpu = VMMGetCpu0(pVM);
1928 Assert(!HMIsEnabled(pVM));
[1]1929
1930 /* Dirty pages must be handled before calling this function!. */
1931 Assert(!pVM->csam.s.cDirtyPages);
1932
1933 if (pVM->csam.s.fScanningStarted == false)
1934 return VINF_SUCCESS; /* too early */
1935
1936 pPageAddrGC &= PAGE_BASE_GC_MASK;
1937
[13822]1938 Log(("CSAMR3MonitorPage %RRv %d\n", pPageAddrGC, enmTag));
[1]1939
1940 /** @todo implicit assumption */
1941 fMonitorInvalidation = (enmTag == CSAM_TAG_PATM);
1942
[36912]1943 pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)(uintptr_t)pPageAddrGC);
[1]1944 if (pPageRec == NULL)
1945 {
1946 uint64_t fFlags;
1947
[18988]1948 rc = PGMGstGetPage(pVCpu, pPageAddrGC, &fFlags, NULL);
[13818]1949 AssertMsg(RT_SUCCESS(rc) || rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
[1]1950 if ( rc == VINF_SUCCESS
1951 && (fFlags & X86_PTE_US))
1952 {
1953 /* We don't care about user pages. */
1954 STAM_COUNTER_INC(&pVM->csam.s.StatNrUserPages);
1955 return VINF_SUCCESS;
1956 }
1957
1958 csamCreatePageRecord(pVM, pPageAddrGC, enmTag, true /* 32 bits code */, fMonitorInvalidation);
1959
[36912]1960 pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)(uintptr_t)pPageAddrGC);
[1]1961 Assert(pPageRec);
1962 }
1963 /** @todo reference count */
1964
1965#ifdef CSAM_MONITOR_CSAM_CODE_PAGES
1966 Assert(pPageRec->page.fMonitorActive);
1967#endif
1968
1969#ifdef CSAM_MONITOR_CODE_PAGES
1970 if (!pPageRec->page.fMonitorActive)
1971 {
[13822]1972 Log(("CSAMR3MonitorPage: activate monitoring for %RRv\n", pPageAddrGC));
[1]1973
1974 rc = PGMR3HandlerVirtualRegister(pVM, PGMVIRTHANDLERTYPE_WRITE, pPageAddrGC, pPageAddrGC + (PAGE_SIZE - 1) /* inclusive! */,
1975 (fMonitorInvalidation) ? CSAMCodePageInvalidate : 0, CSAMCodePageWriteHandler, "CSAMGCCodePageWriteHandler", 0,
1976 csamGetMonitorDescription(enmTag));
[13822]1977 AssertMsg(RT_SUCCESS(rc) || rc == VERR_PGM_HANDLER_VIRTUAL_CONFLICT, ("PGMR3HandlerVirtualRegisterEx %RRv failed with %Rrc\n", pPageAddrGC, rc));
[13816]1978 if (RT_FAILURE(rc))
[13822]1979 Log(("PGMR3HandlerVirtualRegisterEx for %RRv failed with %Rrc\n", pPageAddrGC, rc));
[1]1980
1981 /* Could fail, because it's already monitored. Don't treat that condition as fatal. */
1982
1983 /* Prefetch it in case it's not there yet. */
[18992]1984 rc = PGMPrefetchPage(pVCpu, pPageAddrGC);
[1]1985 AssertRC(rc);
1986
[30326]1987 rc = PGMShwMakePageReadonly(pVCpu, pPageAddrGC, 0 /*fFlags*/);
[1]1988 Assert(rc == VINF_SUCCESS || rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT);
1989
1990 STAM_COUNTER_INC(&pVM->csam.s.StatPageMonitor);
1991
1992 pPageRec->page.fMonitorActive = true;
1993 pPageRec->page.fMonitorInvalidation = fMonitorInvalidation;
1994 }
1995 else
1996 if ( !pPageRec->page.fMonitorInvalidation
1997 && fMonitorInvalidation)
1998 {
1999 Assert(pPageRec->page.fMonitorActive);
2000 PGMHandlerVirtualChangeInvalidateCallback(pVM, pPageRec->page.pPageGC, CSAMCodePageInvalidate);
2001 pPageRec->page.fMonitorInvalidation = true;
2002 STAM_COUNTER_INC(&pVM->csam.s.StatNrPagesInv);
2003
2004 /* Prefetch it in case it's not there yet. */
[18992]2005 rc = PGMPrefetchPage(pVCpu, pPageAddrGC);
[1]2006 AssertRC(rc);
2007
2008 /* Make sure it's readonly. Page invalidation may have modified the attributes. */
[30326]2009 rc = PGMShwMakePageReadonly(pVCpu, pPageAddrGC, 0 /*fFlags*/);
[1]2010 Assert(rc == VINF_SUCCESS || rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT);
2011 }
2012
[27]2013#if 0 /* def VBOX_STRICT -> very annoying) */
[1]2014 if (pPageRec->page.fMonitorActive)
2015 {
2016 uint64_t fPageShw;
2017 RTHCPHYS GCPhys;
[18988]2018 rc = PGMShwGetPage(pVCpu, pPageAddrGC, &fPageShw, &GCPhys);
[208]2019// AssertMsg( (rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT)
2020// || !(fPageShw & X86_PTE_RW)
[13825]2021// || (pPageRec->page.GCPhys == 0), ("Shadow page flags for %RRv (%RHp) aren't readonly (%RX64)!!\n", pPageAddrGC, GCPhys, fPageShw));
[1]2022 }
2023#endif
2024
2025 if (pPageRec->page.GCPhys == 0)
2026 {
2027 /* Prefetch it in case it's not there yet. */
[18992]2028 rc = PGMPrefetchPage(pVCpu, pPageAddrGC);
[1]2029 AssertRC(rc);
2030 /* The page was changed behind our back. It won't be made read-only until the next SyncCR3, so force it here. */
[30326]2031 rc = PGMShwMakePageReadonly(pVCpu, pPageAddrGC, 0 /*fFlags*/);
[1]2032 Assert(rc == VINF_SUCCESS || rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT);
2033 }
2034#endif /* CSAM_MONITOR_CODE_PAGES */
2035 return VINF_SUCCESS;
2036}
2037
2038/**
[8217]2039 * Unmonitors a code page
2040 *
2041 * @returns VBox status code
[41801]2042 * @param pVM Pointer to the VM.
[8217]2043 * @param pPageAddrGC The page to monitor
2044 * @param enmTag Monitor tag
2045 */
[12989]2046VMMR3DECL(int) CSAMR3UnmonitorPage(PVM pVM, RTRCPTR pPageAddrGC, CSAMTAG enmTag)
[8217]2047{
[45620]2048 Assert(!HMIsEnabled(pVM));
2049
[8217]2050 pPageAddrGC &= PAGE_BASE_GC_MASK;
2051
[13822]2052 Log(("CSAMR3UnmonitorPage %RRv %d\n", pPageAddrGC, enmTag));
[8217]2053
2054 Assert(enmTag == CSAM_TAG_REM);
2055
2056#ifdef VBOX_STRICT
2057 PCSAMPAGEREC pPageRec;
2058
[36969]2059 pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)(uintptr_t)pPageAddrGC);
[8217]2060 Assert(pPageRec && pPageRec->page.enmTag == enmTag);
2061#endif
2062 return CSAMR3RemovePage(pVM, pPageAddrGC);
2063}
2064
2065/**
[1]2066 * Removes a page record from our lookup tree
2067 *
2068 * @returns VBox status code
[41801]2069 * @param pVM Pointer to the VM.
[1]2070 * @param GCPtr Page address
2071 */
[9344]2072static int csamRemovePageRecord(PVM pVM, RTRCPTR GCPtr)
[1]2073{
2074 PCSAMPAGEREC pPageRec;
[22890]2075 Assert(pVM->cCpus == 1);
[18927]2076 PVMCPU pVCpu = VMMGetCpu0(pVM);
[1]2077
[13822]2078 Log(("csamRemovePageRecord %RRv\n", GCPtr));
[36912]2079 pPageRec = (PCSAMPAGEREC)RTAvlPVRemove(&pVM->csam.s.pPageTree, (AVLPVKEY)(uintptr_t)GCPtr);
[1]2080
2081 if (pPageRec)
2082 {
2083 STAM_COUNTER_INC(&pVM->csam.s.StatNrRemovedPages);
2084
2085#ifdef CSAM_MONITOR_CODE_PAGES
2086 if (pPageRec->page.fMonitorActive)
2087 {
2088 /* @todo -> this is expensive (cr3 reload)!!!
2089 * if this happens often, then reuse it instead!!!
2090 */
2091 Assert(!fInCSAMCodePageInvalidate);
2092 STAM_COUNTER_DEC(&pVM->csam.s.StatPageMonitor);
2093 PGMHandlerVirtualDeregister(pVM, GCPtr);
2094 }
2095 if (pPageRec->page.enmTag == CSAM_TAG_PATM)
2096 {
2097 /* Make sure the recompiler flushes its cache as this page is no longer monitored. */
2098 STAM_COUNTER_INC(&pVM->csam.s.StatPageRemoveREMFlush);
[18927]2099 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_GLOBAL_TLB_FLUSH);
[1]2100 }
2101#endif
2102
2103#ifdef VBOX_WITH_STATISTICS
2104 switch (pPageRec->page.enmTag)
2105 {
2106 case CSAM_TAG_CSAM:
2107 STAM_COUNTER_DEC(&pVM->csam.s.StatPageCSAM);
2108 break;
2109 case CSAM_TAG_PATM:
2110 STAM_COUNTER_DEC(&pVM->csam.s.StatPagePATM);
2111 break;
2112 case CSAM_TAG_REM:
2113 STAM_COUNTER_DEC(&pVM->csam.s.StatPageREM);
2114 break;
2115 default:
2116 break; /* to shut up GCC */
2117 }
2118#endif
2119
2120 if (pPageRec->page.pBitmap) MMR3HeapFree(pPageRec->page.pBitmap);
2121 MMR3HeapFree(pPageRec);
2122 }
2123 else
2124 AssertFailed();
2125
2126 return VINF_SUCCESS;
2127}
2128
2129/**
2130 * Callback for delayed writes from non-EMT threads
2131 *
[41800]2132 * @param pVM Pointer to the VM.
[1]2133 * @param GCPtr The virtual address the guest is writing to. (not correct if it's an alias!)
2134 * @param cbBuf How much it's reading/writing.
2135 */
[9344]2136static DECLCALLBACK(void) CSAMDelayedWriteHandler(PVM pVM, RTRCPTR GCPtr, size_t cbBuf)
[1]2137{
[14075]2138 int rc = PATMR3PatchWrite(pVM, GCPtr, (uint32_t)cbBuf);
[1]2139 AssertRC(rc);
2140}
2141
2142/**
[25647]2143 * \#PF Handler callback for virtual access handler ranges.
[1]2144 *
2145 * Important to realize that a physical page in a range can have aliases, and
2146 * for ALL and WRITE handlers these will also trigger.
2147 *
2148 * @returns VINF_SUCCESS if the handler have carried out the operation.
2149 * @returns VINF_PGM_HANDLER_DO_DEFAULT if the caller should carry out the access operation.
[41800]2150 * @param pVM Pointer to the VM.
[1]2151 * @param GCPtr The virtual address the guest is writing to. (not correct if it's an alias!)
2152 * @param pvPtr The HC mapping of that address.
2153 * @param pvBuf What the guest is reading/writing.
2154 * @param cbBuf How much it's reading/writing.
2155 * @param enmAccessType The access type.
2156 * @param pvUser User argument.
2157 */
2158static DECLCALLBACK(int) CSAMCodePageWriteHandler(PVM pVM, RTGCPTR GCPtr, void *pvPtr, void *pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType, void *pvUser)
2159{
2160 int rc;
2161
[39078]2162 Assert(enmAccessType == PGMACCESSTYPE_WRITE); NOREF(enmAccessType);
[13823]2163 Log(("CSAMCodePageWriteHandler: write to %RGv size=%zu\n", GCPtr, cbBuf));
[39078]2164 NOREF(pvUser);
[1]2165
[16552]2166 if ( PAGE_ADDRESS(pvPtr) == PAGE_ADDRESS((uintptr_t)pvPtr + cbBuf - 1)
2167 && !memcmp(pvPtr, pvBuf, cbBuf))
2168 {
2169 Log(("CSAMCodePageWriteHandler: dummy write -> ignore\n"));
2170 return VINF_PGM_HANDLER_DO_DEFAULT;
2171 }
2172
[1]2173 if (VM_IS_EMT(pVM))
[14075]2174 rc = PATMR3PatchWrite(pVM, GCPtr, (uint32_t)cbBuf);
[1]2175 else
2176 {
2177 /* Queue the write instead otherwise we'll get concurrency issues. */
2178 /** @note in theory not correct to let it write the data first before disabling a patch!
2179 * (if it writes the same data as the patch jump and we replace it with obsolete opcodes)
2180 */
2181 Log(("CSAMCodePageWriteHandler: delayed write!\n"));
[9344]2182 AssertCompileSize(RTRCPTR, 4);
[23016]2183 rc = VMR3ReqCallVoidNoWait(pVM, VMCPUID_ANY, (PFNRT)CSAMDelayedWriteHandler, 3, pVM, (RTRCPTR)GCPtr, cbBuf);
[1]2184 }
2185 AssertRC(rc);
2186
2187 return VINF_PGM_HANDLER_DO_DEFAULT;
2188}
2189
2190/**
[25647]2191 * \#PF Handler callback for invalidation of virtual access handler ranges.
[1]2192 *
[41800]2193 * @param pVM Pointer to the VM.
[1]2194 * @param GCPtr The virtual address the guest has changed.
2195 */
2196static DECLCALLBACK(int) CSAMCodePageInvalidate(PVM pVM, RTGCPTR GCPtr)
2197{
2198 fInCSAMCodePageInvalidate = true;
[13823]2199 LogFlow(("CSAMCodePageInvalidate %RGv\n", GCPtr));
[1]2200 /** @todo We can't remove the page (which unregisters the virtual handler) as we are called from a DoWithAll on the virtual handler tree. Argh. */
2201 csamFlushPage(pVM, GCPtr, false /* don't remove page! */);
2202 fInCSAMCodePageInvalidate = false;
2203 return VINF_SUCCESS;
2204}
2205
2206/**
2207 * Check if the current instruction has already been checked before
2208 *
2209 * @returns VBox status code. (trap handled or not)
[41801]2210 * @param pVM Pointer to the VM.
[1]2211 * @param pInstr Instruction pointer
2212 * @param pPage CSAM patch structure pointer
2213 */
[9344]2214bool csamIsCodeScanned(PVM pVM, RTRCPTR pInstr, PCSAMPAGE *pPage)
[1]2215{
2216 PCSAMPAGEREC pPageRec;
2217 uint32_t offset;
2218
2219 STAM_PROFILE_START(&pVM->csam.s.StatTimeCheckAddr, a);
2220
2221 offset = pInstr & PAGE_OFFSET_MASK;
2222 pInstr = pInstr & PAGE_BASE_GC_MASK;
2223
2224 Assert(pPage);
2225
2226 if (*pPage && (*pPage)->pPageGC == pInstr)
2227 {
2228 if ((*pPage)->pBitmap == NULL || ASMBitTest((*pPage)->pBitmap, offset))
2229 {
2230 STAM_COUNTER_ADD(&pVM->csam.s.StatNrKnownPagesHC, 1);
2231 STAM_PROFILE_STOP(&pVM->csam.s.StatTimeCheckAddr, a);
2232 return true;
2233 }
2234 STAM_PROFILE_STOP(&pVM->csam.s.StatTimeCheckAddr, a);
2235 return false;
2236 }
2237
[36912]2238 pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)(uintptr_t)pInstr);
[1]2239 if (pPageRec)
2240 {
2241 if (pPage) *pPage= &pPageRec->page;
2242 if (pPageRec->page.pBitmap == NULL || ASMBitTest(pPageRec->page.pBitmap, offset))
2243 {
2244 STAM_COUNTER_ADD(&pVM->csam.s.StatNrKnownPagesHC, 1);
2245 STAM_PROFILE_STOP(&pVM->csam.s.StatTimeCheckAddr, a);
2246 return true;
2247 }
2248 }
2249 else
2250 {
2251 if (pPage) *pPage = NULL;
2252 }
2253 STAM_PROFILE_STOP(&pVM->csam.s.StatTimeCheckAddr, a);
2254 return false;
2255}
2256
2257/**
2258 * Mark an instruction in a page as scanned/not scanned
2259 *
[41801]2260 * @param pVM Pointer to the VM.
[1]2261 * @param pPage Patch structure pointer
2262 * @param pInstr Instruction pointer
[41732]2263 * @param cbInstr Instruction size
[1]2264 * @param fScanned Mark as scanned or not
2265 */
[41732]2266static void csamMarkCode(PVM pVM, PCSAMPAGE pPage, RTRCPTR pInstr, uint32_t cbInstr, bool fScanned)
[1]2267{
[41732]2268 LogFlow(("csamMarkCodeAsScanned %RRv cbInstr=%d\n", pInstr, cbInstr));
[1]2269 CSAMMarkPage(pVM, pInstr, fScanned);
2270
2271 /** @todo should recreate empty bitmap if !fScanned */
2272 if (pPage->pBitmap == NULL)
2273 return;
2274
2275 if (fScanned)
2276 {
2277 // retn instructions can be scanned more than once
2278 if (ASMBitTest(pPage->pBitmap, pInstr & PAGE_OFFSET_MASK) == 0)
2279 {
[41732]2280 pPage->uSize += cbInstr;
[1]2281 STAM_COUNTER_ADD(&pVM->csam.s.StatNrInstr, 1);
2282 }
2283 if (pPage->uSize >= PAGE_SIZE)
2284 {
[13822]2285 Log(("Scanned full page (%RRv) -> free bitmap\n", pInstr & PAGE_BASE_GC_MASK));
[1]2286 MMR3HeapFree(pPage->pBitmap);
2287 pPage->pBitmap = NULL;
2288 }
2289 else
2290 ASMBitSet(pPage->pBitmap, pInstr & PAGE_OFFSET_MASK);
2291 }
2292 else
2293 ASMBitClear(pPage->pBitmap, pInstr & PAGE_OFFSET_MASK);
2294}
2295
2296/**
2297 * Mark an instruction in a page as scanned/not scanned
2298 *
2299 * @returns VBox status code.
[41801]2300 * @param pVM Pointer to the VM.
[1]2301 * @param pInstr Instruction pointer
[41732]2302 * @param cbInstr Instruction size
[1]2303 * @param fScanned Mark as scanned or not
2304 */
[44385]2305VMMR3_INT_DECL(int) CSAMR3MarkCode(PVM pVM, RTRCPTR pInstr, uint32_t cbInstr, bool fScanned)
[1]2306{
2307 PCSAMPAGE pPage = 0;
2308
2309 Assert(!fScanned); /* other case not implemented. */
2310 Assert(!PATMIsPatchGCAddr(pVM, pInstr));
[45620]2311 Assert(!HMIsEnabled(pVM));
[1]2312
2313 if (csamIsCodeScanned(pVM, pInstr, &pPage) == false)
2314 {
2315 Assert(fScanned == true); /* other case should not be possible */
2316 return VINF_SUCCESS;
2317 }
2318
[41732]2319 Log(("CSAMR3MarkCode: %RRv size=%d fScanned=%d\n", pInstr, cbInstr, fScanned));
2320 csamMarkCode(pVM, pPage, pInstr, cbInstr, fScanned);
[1]2321 return VINF_SUCCESS;
2322}
2323
2324
2325/**
[882]2326 * Scan and analyse code
[1]2327 *
[882]2328 * @returns VBox status code.
[41801]2329 * @param pVM Pointer to the VM.
[9675]2330 * @param pCtxCore CPU context
[882]2331 * @param pInstrGC Instruction pointer
[1]2332 */
[44385]2333VMMR3_INT_DECL(int) CSAMR3CheckCodeEx(PVM pVM, PCPUMCTXCORE pCtxCore, RTRCPTR pInstrGC)
[1]2334{
[45620]2335 Assert(!HMIsEnabled(pVM));
[882]2336 if (EMIsRawRing0Enabled(pVM) == false || PATMIsPatchGCAddr(pVM, pInstrGC) == true)
[1]2337 {
2338 // No use
2339 return VINF_SUCCESS;
2340 }
2341
2342 if (CSAMIsEnabled(pVM))
2343 {
[9658]2344 /* Assuming 32 bits code for now. */
[42186]2345 Assert(CPUMGetGuestCodeBits(VMMGetCpu0(pVM)) == 32);
[1359]2346
[41727]2347 pInstrGC = SELMToFlat(pVM, DISSELREG_CS, pCtxCore, pInstrGC);
[1086]2348 return CSAMR3CheckCode(pVM, pInstrGC);
2349 }
2350 return VINF_SUCCESS;
2351}
2352
2353/**
2354 * Scan and analyse code
2355 *
2356 * @returns VBox status code.
[41801]2357 * @param pVM Pointer to the VM.
[1086]2358 * @param pInstrGC Instruction pointer (0:32 virtual address)
2359 */
[44385]2360VMMR3_INT_DECL(int) CSAMR3CheckCode(PVM pVM, RTRCPTR pInstrGC)
[1086]2361{
2362 int rc;
2363 PCSAMPAGE pPage = NULL;
[45620]2364 Assert(!HMIsEnabled(pVM));
[1086]2365
[32431]2366 if ( EMIsRawRing0Enabled(pVM) == false
[30572]2367 || PATMIsPatchGCAddr(pVM, pInstrGC) == true)
[1086]2368 {
[30572]2369 /* Not active. */
[1086]2370 return VINF_SUCCESS;
2371 }
2372
2373 if (CSAMIsEnabled(pVM))
2374 {
[44362]2375 /* Cache record for csamR3GCVirtToHCVirt */
[26263]2376 CSAMP2GLOOKUPREC cacheRec;
2377 RT_ZERO(cacheRec);
[1086]2378
[1]2379 STAM_PROFILE_START(&pVM->csam.s.StatTime, a);
[1086]2380 rc = csamAnalyseCallCodeStream(pVM, pInstrGC, pInstrGC, true /* 32 bits code */, CSAMR3AnalyseCallback, pPage, &cacheRec);
[1]2381 STAM_PROFILE_STOP(&pVM->csam.s.StatTime, a);
[30500]2382 if (cacheRec.Lock.pvMap)
2383 PGMPhysReleasePageMappingLock(pVM, &cacheRec.Lock);
2384
[1]2385 if (rc != VINF_SUCCESS)
2386 {
2387 Log(("csamAnalyseCodeStream failed with %d\n", rc));
2388 return rc;
2389 }
2390 }
2391 return VINF_SUCCESS;
2392}
2393
2394/**
2395 * Flush dirty code pages
2396 *
2397 * @returns VBox status code.
[41801]2398 * @param pVM Pointer to the VM.
[1]2399 */
[1830]2400static int csamR3FlushDirtyPages(PVM pVM)
[1]2401{
[22890]2402 Assert(pVM->cCpus == 1);
[18927]2403 PVMCPU pVCpu = VMMGetCpu0(pVM);
2404
[1]2405 STAM_PROFILE_START(&pVM->csam.s.StatFlushDirtyPages, a);
2406
2407 for (uint32_t i=0;i<pVM->csam.s.cDirtyPages;i++)
2408 {
2409 int rc;
2410 PCSAMPAGEREC pPageRec;
[9344]2411 RTRCPTR GCPtr = pVM->csam.s.pvDirtyBasePage[i];
[1]2412
2413 GCPtr = GCPtr & PAGE_BASE_GC_MASK;
2414
[40274]2415#ifdef VBOX_WITH_REM
2416 /* Notify the recompiler that this page has been changed. */
[18927]2417 REMR3NotifyCodePageChanged(pVM, pVCpu, GCPtr);
[40274]2418#endif
[1]2419
2420 /* Enable write protection again. (use the fault address as it might be an alias) */
[30326]2421 rc = PGMShwMakePageReadonly(pVCpu, pVM->csam.s.pvDirtyFaultPage[i], 0 /*fFlags*/);
[1]2422 Assert(rc == VINF_SUCCESS || rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT);
2423
[13822]2424 Log(("CSAMR3FlushDirtyPages: flush %RRv (modifypage rc=%Rrc)\n", pVM->csam.s.pvDirtyBasePage[i], rc));
[1]2425
[36912]2426 pPageRec = (PCSAMPAGEREC)RTAvlPVGet(&pVM->csam.s.pPageTree, (AVLPVKEY)(uintptr_t)GCPtr);
[1]2427 if (pPageRec && pPageRec->page.enmTag == CSAM_TAG_REM)
2428 {
2429 uint64_t fFlags;
2430
[18988]2431 rc = PGMGstGetPage(pVCpu, GCPtr, &fFlags, NULL);
[13818]2432 AssertMsg(RT_SUCCESS(rc) || rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc = %Rrc\n", rc));
[1]2433 if ( rc == VINF_SUCCESS
2434 && (fFlags & X86_PTE_US))
2435 {
2436 /* We don't care about user pages. */
2437 csamRemovePageRecord(pVM, GCPtr);
2438 STAM_COUNTER_INC(&pVM->csam.s.StatNrUserPages);
2439 }
2440 }
2441 }
2442 pVM->csam.s.cDirtyPages = 0;
2443 STAM_PROFILE_STOP(&pVM->csam.s.StatFlushDirtyPages, a);
2444 return VINF_SUCCESS;
2445}
2446
2447/**
[1830]2448 * Flush potential new code pages
2449 *
2450 * @returns VBox status code.
[41801]2451 * @param pVM Pointer to the VM.
[1830]2452 */
2453static int csamR3FlushCodePages(PVM pVM)
2454{
[22890]2455 Assert(pVM->cCpus == 1);
[18927]2456 PVMCPU pVCpu = VMMGetCpu0(pVM);
2457
[1830]2458 for (uint32_t i=0;i<pVM->csam.s.cPossibleCodePages;i++)
2459 {
[18927]2460 RTRCPTR GCPtr = pVM->csam.s.pvPossibleCodePage[i];
[1830]2461
2462 GCPtr = GCPtr & PAGE_BASE_GC_MASK;
2463
[13822]2464 Log(("csamR3FlushCodePages: %RRv\n", GCPtr));
[30326]2465 PGMShwMakePageNotPresent(pVCpu, GCPtr, 0 /*fFlags*/);
[1833]2466 /* Resync the page to make sure instruction fetch will fault */
[1830]2467 CSAMMarkPage(pVM, GCPtr, false);
2468 }
2469 pVM->csam.s.cPossibleCodePages = 0;
2470 return VINF_SUCCESS;
2471}
2472
2473/**
2474 * Perform any pending actions
2475 *
2476 * @returns VBox status code.
[41801]2477 * @param pVM Pointer to the VM.
2478 * @param pVCpu Pointer to the VMCPU.
[1830]2479 */
[44385]2480VMMR3_INT_DECL(int) CSAMR3DoPendingAction(PVM pVM, PVMCPU pVCpu)
[1830]2481{
[45620]2482 AssertReturn(!HMIsEnabled(pVM), VERR_CSAM_HM_IPE);
2483
[1830]2484 csamR3FlushDirtyPages(pVM);
2485 csamR3FlushCodePages(pVM);
2486
[19141]2487 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_CSAM_PENDING_ACTION);
[1830]2488 return VINF_SUCCESS;
2489}
2490
2491/**
[1]2492 * Analyse interrupt and trap gates
2493 *
2494 * @returns VBox status code.
[41801]2495 * @param pVM Pointer to the VM.
[1]2496 * @param iGate Start gate
2497 * @param cGates Number of gates to check
2498 */
[44385]2499VMMR3_INT_DECL(int) CSAMR3CheckGates(PVM pVM, uint32_t iGate, uint32_t cGates)
[1]2500{
[43872]2501#ifdef VBOX_WITH_RAW_MODE
[22890]2502 Assert(pVM->cCpus == 1);
[18927]2503 PVMCPU pVCpu = VMMGetCpu0(pVM);
[1]2504 uint16_t cbIDT;
[18927]2505 RTRCPTR GCPtrIDT = CPUMGetGuestIDTR(pVCpu, &cbIDT);
[1]2506 uint32_t iGateEnd;
2507 uint32_t maxGates;
2508 VBOXIDTE aIDT[256];
2509 PVBOXIDTE pGuestIdte;
2510 int rc;
2511
[45620]2512 AssertReturn(!HMIsEnabled(pVM), VERR_CSAM_HM_IPE);
[1]2513 if (EMIsRawRing0Enabled(pVM) == false)
2514 {
2515 /* Enabling interrupt gates only works when raw ring 0 is enabled. */
[455]2516 //AssertFailed();
[1]2517 return VINF_SUCCESS;
2518 }
2519
[347]2520 /* We only check all gates once during a session */
2521 if ( !pVM->csam.s.fGatesChecked
2522 && cGates != 256)
2523 return VINF_SUCCESS; /* too early */
2524
2525 /* We only check all gates once during a session */
2526 if ( pVM->csam.s.fGatesChecked
2527 && cGates != 1)
2528 return VINF_SUCCESS; /* ignored */
2529
[1974]2530 Assert(cGates <= 256);
2531 if (!GCPtrIDT || cGates > 256)
2532 return VERR_INVALID_PARAMETER;
2533
[347]2534 if (cGates != 1)
[5198]2535 {
[347]2536 pVM->csam.s.fGatesChecked = true;
[5198]2537 for (unsigned i=0;i<RT_ELEMENTS(pVM->csam.s.pvCallInstruction);i++)
2538 {
[9344]2539 RTRCPTR pHandler = pVM->csam.s.pvCallInstruction[i];
[347]2540
[5200]2541 if (pHandler)
[5198]2542 {
[5200]2543 PCSAMPAGE pPage = NULL;
[44362]2544 CSAMP2GLOOKUPREC cacheRec; /* Cache record for csamR3GCVirtToHCVirt. */
[26263]2545 RT_ZERO(cacheRec);
[5200]2546
[13822]2547 Log(("CSAMCheckGates: checking previous call instruction %RRv\n", pHandler));
[5200]2548 STAM_PROFILE_START(&pVM->csam.s.StatTime, a);
2549 rc = csamAnalyseCodeStream(pVM, pHandler, pHandler, true, CSAMR3AnalyseCallback, pPage, &cacheRec);
2550 STAM_PROFILE_STOP(&pVM->csam.s.StatTime, a);
[30500]2551 if (cacheRec.Lock.pvMap)
2552 PGMPhysReleasePageMappingLock(pVM, &cacheRec.Lock);
2553
[5200]2554 if (rc != VINF_SUCCESS)
2555 {
2556 Log(("CSAMCheckGates: csamAnalyseCodeStream failed with %d\n", rc));
2557 continue;
2558 }
[5198]2559 }
2560 }
2561 }
2562
[1]2563 /* Determine valid upper boundary. */
2564 maxGates = (cbIDT+1) / sizeof(VBOXIDTE);
2565 Assert(iGate < maxGates);
2566 if (iGate > maxGates)
2567 return VERR_INVALID_PARAMETER;
2568
2569 if (iGate + cGates > maxGates)
2570 cGates = maxGates - iGate;
[23]2571
[1]2572 GCPtrIDT = GCPtrIDT + iGate * sizeof(VBOXIDTE);
2573 iGateEnd = iGate + cGates;
2574
2575 STAM_PROFILE_START(&pVM->csam.s.StatCheckGates, a);
2576
2577 /*
2578 * Get IDT entries.
2579 */
[30495]2580 rc = PGMPhysSimpleReadGCPtr(pVCpu, aIDT, GCPtrIDT, cGates*sizeof(VBOXIDTE));
2581 if (RT_FAILURE(rc))
[1]2582 {
[30495]2583 AssertMsgRC(rc, ("Failed to read IDTE! rc=%Rrc\n", rc));
2584 STAM_PROFILE_STOP(&pVM->csam.s.StatCheckGates, a);
2585 return rc;
[1]2586 }
[30495]2587 pGuestIdte = &aIDT[0];
[1]2588
2589 for (/*iGate*/; iGate<iGateEnd; iGate++, pGuestIdte++)
2590 {
[347]2591 Assert(TRPMR3GetGuestTrapHandler(pVM, iGate) == TRPM_INVALID_HANDLER);
[1]2592
2593 if ( pGuestIdte->Gen.u1Present
2594 && (pGuestIdte->Gen.u5Type2 == VBOX_IDTE_TYPE2_TRAP_32 || pGuestIdte->Gen.u5Type2 == VBOX_IDTE_TYPE2_INT_32)
2595 && (pGuestIdte->Gen.u2DPL == 3 || pGuestIdte->Gen.u2DPL == 0)
2596 )
2597 {
[9344]2598 RTRCPTR pHandler;
[1]2599 PCSAMPAGE pPage = NULL;
[19334]2600 DBGFSELINFO selInfo;
[44362]2601 CSAMP2GLOOKUPREC cacheRec; /* Cache record for csamR3GCVirtToHCVirt. */
[26263]2602 RT_ZERO(cacheRec);
[1]2603
[9412]2604 pHandler = VBOXIDTE_OFFSET(*pGuestIdte);
[9675]2605 pHandler = SELMToFlatBySel(pVM, pGuestIdte->Gen.u16SegSel, pHandler);
[1]2606
[18927]2607 rc = SELMR3GetSelectorInfo(pVM, pVCpu, pGuestIdte->Gen.u16SegSel, &selInfo);
[13816]2608 if ( RT_FAILURE(rc)
[19334]2609 || (selInfo.fFlags & (DBGFSELINFO_FLAGS_NOT_PRESENT | DBGFSELINFO_FLAGS_INVALID))
[1799]2610 || selInfo.GCPtrBase != 0
2611 || selInfo.cbLimit != ~0U
2612 )
2613 {
2614 /* Refuse to patch a handler whose idt cs selector isn't wide open. */
[13822]2615 Log(("CSAMCheckGates: check gate %d failed due to rc %Rrc GCPtrBase=%RRv limit=%x\n", iGate, rc, selInfo.GCPtrBase, selInfo.cbLimit));
[1799]2616 continue;
2617 }
2618
[7628]2619
[1]2620 if (pGuestIdte->Gen.u5Type2 == VBOX_IDTE_TYPE2_TRAP_32)
2621 {
[13822]2622 Log(("CSAMCheckGates: check trap gate %d at %04X:%08X (flat %RRv)\n", iGate, pGuestIdte->Gen.u16SegSel, VBOXIDTE_OFFSET(*pGuestIdte), pHandler));
[1]2623 }
2624 else
2625 {
[13822]2626 Log(("CSAMCheckGates: check interrupt gate %d at %04X:%08X (flat %RRv)\n", iGate, pGuestIdte->Gen.u16SegSel, VBOXIDTE_OFFSET(*pGuestIdte), pHandler));
[1]2627 }
2628
[25273]2629 STAM_PROFILE_START(&pVM->csam.s.StatTime, b);
[1]2630 rc = csamAnalyseCodeStream(pVM, pHandler, pHandler, true, CSAMR3AnalyseCallback, pPage, &cacheRec);
[25273]2631 STAM_PROFILE_STOP(&pVM->csam.s.StatTime, b);
[30500]2632 if (cacheRec.Lock.pvMap)
2633 PGMPhysReleasePageMappingLock(pVM, &cacheRec.Lock);
2634
[1]2635 if (rc != VINF_SUCCESS)
2636 {
2637 Log(("CSAMCheckGates: csamAnalyseCodeStream failed with %d\n", rc));
[347]2638 continue;
[1]2639 }
[846]2640 /* OpenBSD guest specific patch test. */
[347]2641 if (iGate >= 0x20)
[1]2642 {
[846]2643 PCPUMCTX pCtx;
2644 DISCPUSTATE cpu;
[9220]2645 RTGCUINTPTR32 aOpenBsdPushCSOffset[3] = {0x03, /* OpenBSD 3.7 & 3.8 */
[846]2646 0x2B, /* OpenBSD 4.0 installation ISO */
2647 0x2F}; /* OpenBSD 4.0 after install */
2648
[18927]2649 pCtx = CPUMQueryGuestCtxPtr(pVCpu);
[846]2650
[11311]2651 for (unsigned i=0;i<RT_ELEMENTS(aOpenBsdPushCSOffset);i++)
[846]2652 {
[18927]2653 rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pHandler - aOpenBsdPushCSOffset[i], &cpu, NULL);
[846]2654 if ( rc == VINF_SUCCESS
[41737]2655 && cpu.pCurInstr->uOpcode == OP_PUSH
[41738]2656 && cpu.pCurInstr->fParam1 == OP_PARM_REG_CS)
[846]2657 {
2658 rc = PATMR3InstallPatch(pVM, pHandler - aOpenBsdPushCSOffset[i], PATMFL_CODE32 | PATMFL_GUEST_SPECIFIC);
[13816]2659 if (RT_SUCCESS(rc))
[846]2660 Log(("Installed OpenBSD interrupt handler prefix instruction (push cs) patch\n"));
2661 }
2662 }
[347]2663 }
[208]2664
[347]2665 /* Trap gates and certain interrupt gates. */
2666 uint32_t fPatchFlags = PATMFL_CODE32 | PATMFL_IDTHANDLER;
[1]2667
[347]2668 if (pGuestIdte->Gen.u5Type2 == VBOX_IDTE_TYPE2_TRAP_32)
2669 fPatchFlags |= PATMFL_TRAPHANDLER;
2670 else
2671 fPatchFlags |= PATMFL_INTHANDLER;
[1]2672
[347]2673 switch (iGate) {
2674 case 8:
2675 case 10:
2676 case 11:
2677 case 12:
2678 case 13:
2679 case 14:
2680 case 17:
2681 fPatchFlags |= PATMFL_TRAPHANDLER_WITH_ERRORCODE;
2682 break;
2683 default:
2684 /* No error code. */
2685 break;
2686 }
[1]2687
[13822]2688 Log(("Installing %s gate handler for 0x%X at %RRv\n", (pGuestIdte->Gen.u5Type2 == VBOX_IDTE_TYPE2_TRAP_32) ? "trap" : "intr", iGate, pHandler));
[1]2689
[347]2690 rc = PATMR3InstallPatch(pVM, pHandler, fPatchFlags);
[48936]2691 if ( RT_SUCCESS(rc)
[45276]2692 || rc == VERR_PATM_ALREADY_PATCHED)
[347]2693 {
2694 Log(("Gate handler 0x%X is SAFE!\n", iGate));
2695
[9344]2696 RTRCPTR pNewHandlerGC = PATMR3QueryPatchGCPtr(pVM, pHandler);
[347]2697 if (pNewHandlerGC)
[208]2698 {
[347]2699 rc = TRPMR3SetGuestTrapHandler(pVM, iGate, pNewHandlerGC);
[13816]2700 if (RT_FAILURE(rc))
[13818]2701 Log(("TRPMR3SetGuestTrapHandler %d failed with %Rrc\n", iGate, rc));
[1]2702 }
2703 }
2704 }
[347]2705 } /* for */
[1]2706 STAM_PROFILE_STOP(&pVM->csam.s.StatCheckGates, a);
[43872]2707#endif /* VBOX_WITH_RAW_MODE */
[1]2708 return VINF_SUCCESS;
2709}
2710
2711/**
[5198]2712 * Record previous call instruction addresses
2713 *
2714 * @returns VBox status code.
[41801]2715 * @param pVM Pointer to the VM.
[5198]2716 * @param GCPtrCall Call address
2717 */
[12989]2718VMMR3DECL(int) CSAMR3RecordCallAddress(PVM pVM, RTRCPTR GCPtrCall)
[5198]2719{
[45620]2720 Assert(!HMIsEnabled(pVM));
[5198]2721 for (unsigned i=0;i<RT_ELEMENTS(pVM->csam.s.pvCallInstruction);i++)
2722 {
2723 if (pVM->csam.s.pvCallInstruction[i] == GCPtrCall)
2724 return VINF_SUCCESS;
2725 }
2726
[13822]2727 Log(("CSAMR3RecordCallAddress %RRv\n", GCPtrCall));
[5198]2728
2729 pVM->csam.s.pvCallInstruction[pVM->csam.s.iCallInstruction++] = GCPtrCall;
2730 if (pVM->csam.s.iCallInstruction >= RT_ELEMENTS(pVM->csam.s.pvCallInstruction))
2731 pVM->csam.s.iCallInstruction = 0;
2732
2733 return VINF_SUCCESS;
2734}
2735
2736
2737/**
[1]2738 * Query CSAM state (enabled/disabled)
2739 *
[44373]2740 * @returns true if enabled, false otherwise.
2741 * @param pUVM The user mode VM handle.
[1]2742 */
[44373]2743VMMR3DECL(bool) CSAMR3IsEnabled(PUVM pUVM)
[1]2744{
[44373]2745 UVM_ASSERT_VALID_EXT_RETURN(pUVM, false);
2746 PVM pVM = pUVM->pVM;
2747 VM_ASSERT_VALID_EXT_RETURN(pVM, false);
2748 return CSAMIsEnabled(pVM);
[1]2749}
2750
[44385]2751
2752/**
2753 * Enables or disables code scanning.
2754 *
2755 * @returns VBox status code.
2756 * @param pUVM The user mode VM handle.
2757 * @param fEnabled Whether to enable or disable scanning.
2758 */
2759VMMR3DECL(int) CSAMR3SetScanningEnabled(PUVM pUVM, bool fEnabled)
2760{
2761 UVM_ASSERT_VALID_EXT_RETURN(pUVM, VERR_INVALID_VM_HANDLE);
2762 PVM pVM = pUVM->pVM;
2763 VM_ASSERT_VALID_EXT_RETURN(pVM, VERR_INVALID_VM_HANDLE);
2764
[45620]2765 if (HMIsEnabled(pVM))
2766 {
2767 Assert(!pVM->fCSAMEnabled);
2768 return VINF_SUCCESS;
2769 }
2770
[44385]2771 int rc;
2772 if (fEnabled)
2773 rc = CSAMEnableScanning(pVM);
2774 else
2775 rc = CSAMDisableScanning(pVM);
2776 return rc;
2777}
2778
2779
[1]2780#ifdef VBOX_WITH_DEBUGGER
[35694]2781
[1]2782/**
[44399]2783 * @callback_method_impl{FNDBGCCMD, The '.csamoff' command.}
[1]2784 */
[44399]2785static DECLCALLBACK(int) csamr3CmdOff(PCDBGCCMD pCmd, PDBGCCMDHLP pCmdHlp, PUVM pUVM, PCDBGCVAR paArgs, unsigned cArgs)
[1]2786{
[44399]2787 DBGC_CMDHLP_REQ_UVM_RET(pCmdHlp, pCmd, pUVM);
[39078]2788 NOREF(cArgs); NOREF(paArgs);
[1]2789
[45620]2790 if (HMR3IsEnabled(pUVM))
2791 return DBGCCmdHlpPrintf(pCmdHlp, "CSAM is permanently disabled by HM.\n");
2792
[44399]2793 int rc = CSAMR3SetScanningEnabled(pUVM, false);
[35694]2794 if (RT_FAILURE(rc))
[44399]2795 return DBGCCmdHlpFailRc(pCmdHlp, pCmd, rc, "CSAMR3SetScanningEnabled");
[35694]2796 return DBGCCmdHlpPrintf(pCmdHlp, "CSAM Scanning disabled\n");
[1]2797}
2798
2799/**
[44399]2800 * @callback_method_impl{FNDBGCCMD, The '.csamon' command.}
[1]2801 */
[44399]2802static DECLCALLBACK(int) csamr3CmdOn(PCDBGCCMD pCmd, PDBGCCMDHLP pCmdHlp, PUVM pUVM, PCDBGCVAR paArgs, unsigned cArgs)
[1]2803{
[44399]2804 DBGC_CMDHLP_REQ_UVM_RET(pCmdHlp, pCmd, pUVM);
[39078]2805 NOREF(cArgs); NOREF(paArgs);
[1]2806
[45620]2807 if (HMR3IsEnabled(pUVM))
2808 return DBGCCmdHlpPrintf(pCmdHlp, "CSAM is permanently disabled by HM.\n");
2809
[44399]2810 int rc = CSAMR3SetScanningEnabled(pUVM, true);
[35694]2811 if (RT_FAILURE(rc))
[44399]2812 return DBGCCmdHlpFailRc(pCmdHlp, pCmd, rc, "CSAMR3SetScanningEnabled");
[35694]2813 return DBGCCmdHlpPrintf(pCmdHlp, "CSAM Scanning enabled\n");
[1]2814}
[35694]2815
2816#endif /* VBOX_WITH_DEBUGGER */
Note: See TracBrowser for help on using the repository browser.

© 2023 Oracle
Contact – Privacy policy – Terms of Use