PATMAll.cpp@ 274

Last change on this file since 274 was 274, checked in by vboxsync, 18 years ago
Update
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 32.5 KB

Line
1	/* $Id: PATMAll.cpp 274 2007-01-24 13:59:46Z vboxsync $ */
2	/** @file
3	* PATM - The Patch Manager, all contexts.
4	*/
5
6	/*
7	* Copyright (C) 2006 InnoTek Systemberatung GmbH
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License as published by the Free Software Foundation,
13	* in version 2 as it comes in the "COPYING" file of the VirtualBox OSE
14	* distribution. VirtualBox OSE is distributed in the hope that it will
15	* be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* If you received this file as part of a commercial VirtualBox
18	* distribution, then only the terms of your commercial VirtualBox
19	* license agreement apply instead of the previous paragraph.
20	*/
21
22	/*******************************************************************************
23	* Header Files *
24	*******************************************************************************/
25	#define LOG_GROUP LOG_GROUP_PATM
26	#include <VBox/patm.h>
27	#include <VBox/cpum.h>
28	#include <VBox/dis.h>
29	#include <VBox/disopcode.h>
30	#include <VBox/em.h>
31	#include <VBox/err.h>
32	#include <VBox/selm.h>
33	#include <VBox/mm.h>
34	#include "PATMInternal.h"
35	#include <VBox/vm.h>
36	#include "PATMA.h"
37
38	#include <VBox/log.h>
39	#include <iprt/assert.h>
40
41
42	/**
43	* Load virtualized flags.
44	*
45	* This function is called from CPUMRawEnter(). It doesn't have to update the
46	* IF and IOPL eflags bits, the caller will enforce those to set and 0 repectively.
47	*
48	* @param pVM VM handle.
49	* @param pCtxCore The cpu context core.
50	* @see pg_raw
51	*/
52	PATMDECL(void) PATMRawEnter(PVM pVM, PCPUMCTXCORE pCtxCore)
53	{
54	bool fPatchCode = PATMIsPatchGCAddr(pVM, (RTGCPTR)pCtxCore->eip);
55
56	/*
57	* Currently we don't bother to check whether PATM is enabled or not.
58	* For all cases where it isn't, IOPL will be safe and IF will be set.
59	*/
60	register uint32_t efl = pCtxCore->eflags.u32;
61	CTXSUFF(pVM->patm.s.pGCState)->uVMFlags = efl & PATM_VIRTUAL_FLAGS_MASK;
62	AssertMsg((efl & X86_EFL_IF) \|\| PATMShouldUseRawMode(pVM, (RTGCPTR)pCtxCore->eip), ("X86_EFL_IF is clear and PATM is disabled! (eip=%VGv eflags=%08x fPATM=%d pPATMGC=%VGv-%VGv\n", pCtxCore->eip, pCtxCore->eflags.u32, PATMIsEnabled(pVM), pVM->patm.s.pPatchMemGC, pVM->patm.s.pPatchMemGC + pVM->patm.s.cbPatchMem));
63
64	AssertReleaseMsg(CTXSUFF(pVM->patm.s.pGCState)->fPIF \|\| fPatchCode, ("fPIF=%d eip=%VGv\n", CTXSUFF(pVM->patm.s.pGCState)->fPIF, pCtxCore->eip));
65
66	efl &= ~PATM_VIRTUAL_FLAGS_MASK;
67	efl \|= X86_EFL_IF;
68	pCtxCore->eflags.u32 = efl;
69
70	#ifdef IN_RING3
71	#ifdef PATM_EMULATE_SYSENTER
72	PCPUMCTX pCtx;
73	int rc;
74
75	/* Check if the sysenter handler has changed. */
76	rc = CPUMQueryGuestCtxPtr(pVM, &pCtx);
77	AssertRC(rc);
78	if ( rc == VINF_SUCCESS
79	&& pCtx->SysEnter.cs != 0
80	&& pCtx->SysEnter.eip != 0
81	)
82	{
83	if (pVM->patm.s.pfnSysEnterGC != (RTGCPTR)pCtx->SysEnter.eip)
84	{
85	pVM->patm.s.pfnSysEnterPatchGC = 0;
86	pVM->patm.s.pfnSysEnterGC = 0;
87
88	Log2(("PATMRawEnter: installing sysenter patch for %VGv\n", pCtx->SysEnter.eip));
89	pVM->patm.s.pfnSysEnterPatchGC = PATMR3QueryPatchGCPtr(pVM, pCtx->SysEnter.eip);
90	if (pVM->patm.s.pfnSysEnterPatchGC == 0)
91	{
92	rc = PATMR3InstallPatch(pVM, pCtx->SysEnter.eip, PATMFL_SYSENTER \| PATMFL_CODE32);
93	if (rc == VINF_SUCCESS)
94	{
95	pVM->patm.s.pfnSysEnterPatchGC = PATMR3QueryPatchGCPtr(pVM, pCtx->SysEnter.eip);
96	pVM->patm.s.pfnSysEnterGC = (RTGCPTR)pCtx->SysEnter.eip;
97	Assert(pVM->patm.s.pfnSysEnterPatchGC);
98	}
99	}
100	else
101	pVM->patm.s.pfnSysEnterGC = (RTGCPTR)pCtx->SysEnter.eip;
102	}
103	}
104	else
105	{
106	pVM->patm.s.pfnSysEnterPatchGC = 0;
107	pVM->patm.s.pfnSysEnterGC = 0;
108	}
109	#endif
110	#endif
111	}
112
113
114	/**
115	* Restores virtualized flags.
116	*
117	* This function is called from CPUMRawLeave(). It will update the eflags register.
118	*
119	** @note Only here we are allowed to switch back to guest code (without a special reason such as a trap in patch code)!!
120	*
121	* @param pVM VM handle.
122	* @param pCtxCore The cpu context core.
123	* @param rawRC Raw mode return code
124	* @see @ref pg_raw
125	*/
126	PATMDECL(void) PATMRawLeave(PVM pVM, PCPUMCTXCORE pCtxCore, int rawRC)
127	{
128	bool fPatchCode = PATMIsPatchGCAddr(pVM, (RTGCPTR)pCtxCore->eip);
129	/*
130	* We will only be called if PATMRawEnter was previously called.
131	*/
132	register uint32_t efl = pCtxCore->eflags.u32;
133	efl = (efl & ~PATM_VIRTUAL_FLAGS_MASK) \| (CTXSUFF(pVM->patm.s.pGCState)->uVMFlags & PATM_VIRTUAL_FLAGS_MASK);
134	pCtxCore->eflags.u32 = efl;
135	CTXSUFF(pVM->patm.s.pGCState)->uVMFlags = X86_EFL_IF;
136
137	AssertReleaseMsg((efl & X86_EFL_IF) \|\| fPatchCode, ("Inconsistent state at %VGv\n", pCtxCore->eip));
138	AssertReleaseMsg(CTXSUFF(pVM->patm.s.pGCState)->fPIF \|\| fPatchCode, ("fPIF=%d eip=%VGv\n", CTXSUFF(pVM->patm.s.pGCState)->fPIF, pCtxCore->eip));
139
140	#ifdef IN_RING3
141	if ( (efl & X86_EFL_IF)
142	&& fPatchCode
143	)
144	{
145	if ( rawRC < VINF_PATM_LEAVEGC_FIRST
146	\|\| rawRC > VINF_PATM_LEAVEGC_LAST)
147	{
148	/*
149	* Golden rules:
150	* - Don't interrupt special patch streams that replace special instructions
151	* - Don't break instruction fusing (sti, pop ss, mov ss)
152	* - Don't go back to an instruction that has been overwritten by a patch jump
153	* - Don't interrupt an idt handler on entry (1st instruction); technically incorrect
154	*
155	*/
156	if (CTXSUFF(pVM->patm.s.pGCState)->fPIF == 1) /* consistent patch instruction state */
157	{
158	PATMTRANSSTATE enmState;
159	RTGCPTR pOrgInstrGC = PATMR3PatchToGCPtr(pVM, pCtxCore->eip, &enmState);
160
161	AssertRelease(pOrgInstrGC);
162
163	Assert(enmState != PATMTRANS_OVERWRITTEN);
164	if (enmState == PATMTRANS_SAFE)
165	{
166	Assert(!PATMFindActivePatchByEntrypoint(pVM, pOrgInstrGC));
167	Log(("Switchback from %VGv to %VGv (Psp=%x)\n", pCtxCore->eip, pOrgInstrGC, CTXSUFF(pVM->patm.s.pGCState)->Psp));
168	STAM_COUNTER_INC(&pVM->patm.s.StatSwitchBack);
169	pCtxCore->eip = pOrgInstrGC;
170	fPatchCode = false; /* to reset the stack ptr */
171
172	CTXSUFF(pVM->patm.s.pGCState)->GCPtrInhibitInterrupts = 0; /* reset this pointer; safe otherwise the state would be PATMTRANS_INHIBITIRQ */
173	}
174	else
175	{
176	LogFlow(("Patch address %VGv can't be interrupted (state=%d)!\n", pCtxCore->eip, enmState));
177	STAM_COUNTER_INC(&pVM->patm.s.StatSwitchBackFail);
178	}
179	}
180	else
181	{
182	LogFlow(("Patch address %VGv can't be interrupted (fPIF=%d)!\n", pCtxCore->eip, CTXSUFF(pVM->patm.s.pGCState)->fPIF));
183	STAM_COUNTER_INC(&pVM->patm.s.StatSwitchBackFail);
184	}
185	}
186	}
187	#else /* !IN_RING3 */
188	AssertMsgFailed(("!IN_RING3"));
189	#endif /* !IN_RING3 */
190
191	if (!fPatchCode)
192	{
193	if (CTXSUFF(pVM->patm.s.pGCState)->GCPtrInhibitInterrupts == (RTGCPTR)pCtxCore->eip)
194	{
195	EMSetInhibitInterruptsPC(pVM, pCtxCore->eip);
196	}
197	CTXSUFF(pVM->patm.s.pGCState)->GCPtrInhibitInterrupts = 0;
198
199	/* Reset the stack pointer to the top of the stack. */
200	#ifdef DEBUG
201	if (CTXSUFF(pVM->patm.s.pGCState)->Psp != PATM_STACK_SIZE)
202	{
203	LogFlow(("PATMRawLeave: Reset PATM stack (Psp = %x)\n", CTXSUFF(pVM->patm.s.pGCState)->Psp));
204	}
205	#endif
206	CTXSUFF(pVM->patm.s.pGCState)->Psp = PATM_STACK_SIZE;
207	}
208	}
209
210	/**
211	* Get the EFLAGS.
212	* This is a worker for CPUMRawGetEFlags().
213	*
214	* @returns The eflags.
215	* @param pVM The VM handle.
216	* @param pCtxCore The context core.
217	*/
218	PATMDECL(uint32_t) PATMRawGetEFlags(PVM pVM, PCCPUMCTXCORE pCtxCore)
219	{
220	uint32_t efl = pCtxCore->eflags.u32;
221	efl &= ~PATM_VIRTUAL_FLAGS_MASK;
222	efl \|= pVM->patm.s.CTXSUFF(pGCState)->uVMFlags & PATM_VIRTUAL_FLAGS_MASK;
223	return efl;
224	}
225
226	/**
227	* Updates the EFLAGS.
228	* This is a worker for CPUMRawSetEFlags().
229	*
230	* @param pVM The VM handle.
231	* @param pCtxCore The context core.
232	* @param efl The new EFLAGS value.
233	*/
234	PATMDECL(void) PATMRawSetEFlags(PVM pVM, PCPUMCTXCORE pCtxCore, uint32_t efl)
235	{
236	pVM->patm.s.CTXSUFF(pGCState)->uVMFlags = efl & PATM_VIRTUAL_FLAGS_MASK;
237	efl &= ~PATM_VIRTUAL_FLAGS_MASK;
238	efl \|= X86_EFL_IF;
239	pCtxCore->eflags.u32 = efl;
240	}
241
242	/**
243	* Check if we must use raw mode (patch code being executed)
244	*
245	* @param pVM VM handle.
246	* @param pAddrGC Guest context address
247	*/
248	PATMDECL(bool) PATMShouldUseRawMode(PVM pVM, RTGCPTR pAddrGC)
249	{
250	return ( PATMIsEnabled(pVM)
251	&& ((pAddrGC >= pVM->patm.s.pPatchMemGC && pAddrGC < pVM->patm.s.pPatchMemGC + pVM->patm.s.cbPatchMem))) ? true : false;
252	}
253
254	/**
255	* Returns the guest context pointer and size of the GC context structure
256	*
257	* @returns VBox status code.
258	* @param pVM The VM to operate on.
259	*/
260	PATMDECL(GCPTRTYPE(PPATMGCSTATE)) PATMQueryGCState(PVM pVM)
261	{
262	return pVM->patm.s.pGCStateGC;
263	}
264
265	/**
266	* Checks whether the GC address is part of our patch region
267	*
268	* @returns VBox status code.
269	* @param pVM The VM to operate on.
270	* @param pAddrGC Guest context address
271	*/
272	PATMDECL(bool) PATMIsPatchGCAddr(PVM pVM, RTGCPTR pAddrGC)
273	{
274	return (PATMIsEnabled(pVM) && pAddrGC >= pVM->patm.s.pPatchMemGC && pAddrGC < pVM->patm.s.pPatchMemGC + pVM->patm.s.cbPatchMem) ? true : false;
275	}
276
277	/**
278	* Set parameters for pending MMIO patch operation
279	*
280	* @returns VBox status code.
281	* @param pDevIns Device instance.
282	* @param GCPhys MMIO physical address
283	* @param pCachedData GC pointer to cached data
284	*/
285	PATMDECL(int) PATMSetMMIOPatchInfo(PVM pVM, RTGCPHYS GCPhys, RTGCPTR pCachedData)
286	{
287	pVM->patm.s.mmio.GCPhys = GCPhys;
288	pVM->patm.s.mmio.pCachedData = pCachedData;
289
290	return VINF_SUCCESS;
291	}
292
293	/**
294	* Checks if the interrupt flag is enabled or not.
295	*
296	* @returns true if it's enabled.
297	* @returns false if it's diabled.
298	*
299	* @param pVM The VM handle.
300	*/
301	PATMDECL(bool) PATMAreInterruptsEnabled(PVM pVM)
302	{
303	PCPUMCTX pCtx = 0;
304	int rc;
305
306	rc = CPUMQueryGuestCtxPtr(pVM, &pCtx);
307	AssertRC(rc);
308
309	return PATMAreInterruptsEnabledByCtxCore(pVM, CPUMCTX2CORE(pCtx));
310	}
311
312	/**
313	* Checks if the interrupt flag is enabled or not.
314	*
315	* @returns true if it's enabled.
316	* @returns false if it's diabled.
317	*
318	* @param pVM The VM handle.
319	* @param pCtxCore CPU context
320	*/
321	PATMDECL(bool) PATMAreInterruptsEnabledByCtxCore(PVM pVM, PCPUMCTXCORE pCtxCore)
322	{
323	if (PATMIsEnabled(pVM))
324	{
325	if (PATMIsPatchGCAddr(pVM, (RTGCPTR)pCtxCore->eip))
326	return false;
327	}
328	return !!(pCtxCore->eflags.u32 & X86_EFL_IF);
329	}
330
331	/**
332	* Check if the instruction is patched as a duplicated function
333	*
334	* @returns patch record
335	* @param pVM The VM to operate on.
336	* @param pInstrGC Guest context point to the instruction
337	*
338	*/
339	PATMDECL(PPATMPATCHREC) PATMQueryFunctionPatch(PVM pVM, RTGCPTR pInstrGC)
340	{
341	PPATMPATCHREC pRec;
342
343	pRec = (PPATMPATCHREC)RTAvloGCPtrGet(&CTXSUFF(pVM->patm.s.PatchLookupTree)->PatchTree, pInstrGC);
344	if ( pRec
345	&& (pRec->patch.uState == PATCH_ENABLED)
346	&& (pRec->patch.flags & (PATMFL_DUPLICATE_FUNCTION\|PATMFL_CALLABLE_AS_FUNCTION))
347	)
348	return pRec;
349	return 0;
350	}
351
352	/**
353	* Checks if the int 3 was caused by a patched instruction
354	*
355	* @returns VBox status
356	*
357	* @param pVM The VM handle.
358	* @param pInstrGC Instruction pointer
359	* @param pOpcode Original instruction opcode (out, optional)
360	* @param pSize Original instruction size (out, optional)
361	*/
362	PATMDECL(bool) PATMIsInt3Patch(PVM pVM, RTGCPTR pInstrGC, uint32_t pOpcode, uint32_t pSize)
363	{
364	PPATMPATCHREC pRec;
365
366	pRec = (PPATMPATCHREC)RTAvloGCPtrGet(&CTXSUFF(pVM->patm.s.PatchLookupTree)->PatchTree, pInstrGC);
367	if ( pRec
368	&& (pRec->patch.uState == PATCH_ENABLED)
369	&& (pRec->patch.flags & (PATMFL_INT3_REPLACEMENT\|PATMFL_INT3_REPLACEMENT_BLOCK))
370	)
371	{
372	if (pOpcode) *pOpcode = pRec->patch.opcode;
373	if (pSize) *pSize = pRec->patch.cbPrivInstr;
374	return true;
375	}
376	return false;
377	}
378
379	/**
380	* Emulate sysenter, sysexit and syscall instructions
381	*
382	* @returns VBox status
383	*
384	* @param pVM The VM handle.
385	* @param pCtxCore The relevant core context.
386	* @param pCpu Disassembly context
387	*/
388	PATMDECL(int) PATMSysCall(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu)
389	{
390	PCPUMCTX pCtx;
391	int rc;
392
393	rc = CPUMQueryGuestCtxPtr(pVM, &pCtx);
394	AssertRCReturn(rc, VINF_EM_RAW_RING_SWITCH);
395
396	if (pCpu->pCurInstr->opcode == OP_SYSENTER)
397	{
398	if ( pCtx->SysEnter.cs == 0
399	\|\| (pRegFrame->cs & X86_SEL_RPL) != 3
400	\|\| pVM->patm.s.pfnSysEnterPatchGC == 0
401	\|\| pVM->patm.s.pfnSysEnterGC != (RTGCPTR)pCtx->SysEnter.eip
402	\|\| !(PATMRawGetEFlags(pVM, pRegFrame) & X86_EFL_IF))
403	goto end;
404
405	Log2(("PATMSysCall: sysenter from %VGv to %VGv\n", pRegFrame->eip, pVM->patm.s.pfnSysEnterPatchGC));
406	/** @todo the base and limit are forced to 0 & 4G-1 resp. We assume the selector is wide open here. */
407	/** @note The Intel manual suggests that the OS is responsible for this. */
408	pRegFrame->cs = (pCtx->SysEnter.cs & ~X86_SEL_RPL) \| 1;
409	pRegFrame->eip = /** @todo ugly conversion! */(uint32_t)pVM->patm.s.pfnSysEnterPatchGC;
410	pRegFrame->ss = pRegFrame->cs + 8; /* SysEnter.cs + 8 */
411	pRegFrame->esp = pCtx->SysEnter.esp;
412	pRegFrame->eflags.u32 &= ~(X86_EFL_VM\|X86_EFL_RF);
413	pRegFrame->eflags.u32 \|= X86_EFL_IF;
414
415	/* Turn off interrupts. */
416	pVM->patm.s.CTXSUFF(pGCState)->uVMFlags &= ~X86_EFL_IF;
417
418	STAM_COUNTER_INC(&pVM->patm.s.StatSysEnter);
419
420	return VINF_SUCCESS;
421	}
422	else
423	if (pCpu->pCurInstr->opcode == OP_SYSEXIT)
424	{
425	if ( pCtx->SysEnter.cs == 0
426	\|\| (pRegFrame->cs & X86_SEL_RPL) != 1
427	\|\| !(PATMRawGetEFlags(pVM, pRegFrame) & X86_EFL_IF))
428	goto end;
429
430	Log2(("PATMSysCall: sysexit from %VGv to %VGv\n", pRegFrame->eip, pRegFrame->edx));
431
432	pRegFrame->cs = ((pCtx->SysEnter.cs + 16) & ~X86_SEL_RPL) \| 3;
433	pRegFrame->eip = pRegFrame->edx;
434	pRegFrame->ss = pRegFrame->cs + 8; /* SysEnter.cs + 24 */
435	pRegFrame->esp = pRegFrame->ecx;
436
437	STAM_COUNTER_INC(&pVM->patm.s.StatSysExit);
438
439	return VINF_SUCCESS;
440	}
441	else
442	if (pCpu->pCurInstr->opcode == OP_SYSCALL)
443	{
444	/** @todo implement syscall */
445	}
446	else
447	if (pCpu->pCurInstr->opcode == OP_SYSRET)
448	{
449	/** @todo implement sysret */
450	}
451
452	end:
453	return VINF_EM_RAW_RING_SWITCH;
454	}
455
456	/**
457	* Checks if the illegal instruction was caused by a patched instruction
458	*
459	* @returns VBox status
460	*
461	* @param pVM The VM handle.
462	* @param pCtxCore The relevant core context.
463	*/
464	PATMDECL(int) PATMHandleIllegalInstrTrap(PVM pVM, PCPUMCTXCORE pRegFrame)
465	{
466	PPATMPATCHREC pRec;
467	int rc;
468
469	/* Very important check -> otherwise we have a security leak. */
470	AssertReturn((pRegFrame->ss & X86_SEL_RPL) == 1, VERR_ACCESS_DENIED);
471	Assert(PATMIsPatchGCAddr(pVM, (RTGCPTR)pRegFrame->eip));
472
473	/* OP_ILLUD2 in PATM generated code? */
474	if (CTXSUFF(pVM->patm.s.pGCState)->uPendingAction)
475	{
476	LogFlow(("PATMGC: Pending action %x at %VGv\n", CTXSUFF(pVM->patm.s.pGCState)->uPendingAction, pRegFrame->eip));
477
478	/* Private PATM interface (@todo hack due to lack of anything generic). */
479	/* Parameters:
480	* eax = Pending action (currently PATM_ACTION_LOOKUP_ADDRESS)
481	* ecx = PATM_ACTION_MAGIC
482	*/
483	if ( (pRegFrame->eax & CTXSUFF(pVM->patm.s.pGCState)->uPendingAction)
484	&& pRegFrame->ecx == PATM_ACTION_MAGIC
485	)
486	{
487	CTXSUFF(pVM->patm.s.pGCState)->uPendingAction = 0;
488
489	switch (pRegFrame->eax)
490	{
491	case PATM_ACTION_LOOKUP_ADDRESS:
492	{
493	/* Parameters:
494	* edx = GC address to find
495	* edi = PATCHJUMPTABLE ptr
496	*/
497	AssertMsg(!pRegFrame->edi \|\| PATMIsPatchGCAddr(pVM, (RTGCPTR)pRegFrame->edi), ("edx = %VGv\n", pRegFrame->edi));
498
499	Log(("PATMGC: lookup %VGv jump table=%VGv\n", pRegFrame->edx, pRegFrame->edi));
500
501	pRec = PATMQueryFunctionPatch(pVM, (RTGCPTR)(pRegFrame->edx));
502	if (pRec)
503	{
504	if (pRec->patch.uState == PATCH_ENABLED)
505	{
506	RTGCUINTPTR pRelAddr = pRec->patch.pPatchBlockOffset; /* make it relative */
507	rc = PATMAddBranchToLookupCache(pVM, (RTGCPTR)pRegFrame->edi, (RTGCPTR)pRegFrame->edx, pRelAddr);
508	if (rc == VINF_SUCCESS)
509	{
510	pRegFrame->eip += PATM_ILLEGAL_INSTR_SIZE;
511	pRegFrame->eax = pRelAddr;
512	STAM_COUNTER_INC(&pVM->patm.s.StatFunctionFound);
513	return VINF_SUCCESS;
514	}
515	AssertFailed();
516	}
517	else
518	{
519	pRegFrame->eip += PATM_ILLEGAL_INSTR_SIZE;
520	pRegFrame->eax = 0; /* make it fault */
521	STAM_COUNTER_INC(&pVM->patm.s.StatFunctionNotFound);
522	return VINF_SUCCESS;
523	}
524	}
525	else
526	{
527	#if 0
528	if (pRegFrame->edx == 0x806eca98)
529	{
530	pRegFrame->eip += PATM_ILLEGAL_INSTR_SIZE;
531	pRegFrame->eax = 0; /* make it fault */
532	STAM_COUNTER_INC(&pVM->patm.s.StatFunctionNotFound);
533	return VINF_SUCCESS;
534	}
535	#endif
536	STAM_COUNTER_INC(&pVM->patm.s.StatFunctionNotFound);
537	return VINF_PATM_DUPLICATE_FUNCTION;
538	}
539	}
540
541	case PATM_ACTION_DISPATCH_PENDING_IRQ:
542	/* Parameters:
543	* edi = GC address to jump to
544	*/
545	Log(("PATMGC: Dispatch pending interrupt; eip=%VGv->%VGv\n", pRegFrame->eip, pRegFrame->edi));
546
547	/* Change EIP to the guest address the patch would normally jump to after setting IF. */
548	pRegFrame->eip = pRegFrame->edi;
549
550	Assert(pVM->patm.s.CTXSUFF(pGCState)->Restore.uFlags == (PATM_RESTORE_EAX\|PATM_RESTORE_ECX\|PATM_RESTORE_EDI));
551	Assert(pVM->patm.s.CTXSUFF(pGCState)->fPIF == 0);
552
553	pRegFrame->eax = pVM->patm.s.CTXSUFF(pGCState)->Restore.uEAX;
554	pRegFrame->ecx = pVM->patm.s.CTXSUFF(pGCState)->Restore.uECX;
555	pRegFrame->edi = pVM->patm.s.CTXSUFF(pGCState)->Restore.uEDI;
556
557	pVM->patm.s.CTXSUFF(pGCState)->Restore.uFlags = 0;
558
559	/* We are no longer executing PATM code; set PIF again. */
560	pVM->patm.s.CTXSUFF(pGCState)->fPIF = 1;
561
562	STAM_COUNTER_INC(&pVM->patm.s.StatCheckPendingIRQ);
563
564	/* The caller will call trpmGCExitTrap, which will dispatch pending interrupts for us. */
565	return VINF_SUCCESS;
566
567	case PATM_ACTION_PENDING_IRQ_AFTER_IRET:
568	/* Parameters:
569	* edi = GC address to jump to
570	*/
571	Log(("PATMGC: Dispatch pending interrupt (iret); eip=%VGv->%VGv\n", pRegFrame->eip, pRegFrame->edi));
572	Assert(pVM->patm.s.CTXSUFF(pGCState)->Restore.uFlags == (PATM_RESTORE_EAX\|PATM_RESTORE_ECX\|PATM_RESTORE_EDI));
573	Assert(pVM->patm.s.CTXSUFF(pGCState)->fPIF == 0);
574
575	/* Change EIP to the guest address of the iret. */
576	pRegFrame->eip = pRegFrame->edi;
577
578	pRegFrame->eax = pVM->patm.s.CTXSUFF(pGCState)->Restore.uEAX;
579	pRegFrame->ecx = pVM->patm.s.CTXSUFF(pGCState)->Restore.uECX;
580	pRegFrame->edi = pVM->patm.s.CTXSUFF(pGCState)->Restore.uEDI;
581	pVM->patm.s.CTXSUFF(pGCState)->Restore.uFlags = 0;
582	return VINF_PATM_PENDING_IRQ_AFTER_IRET;
583
584	#ifdef DEBUG
585	case PATM_ACTION_LOG_CLI:
586	Log(("PATMGC: CLI at %VGv (current IF=%d iopl=%d)\n", pRegFrame->eip, !!(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags & X86_EFL_IF), X86_EFL_GET_IOPL(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags) ));
587	pRegFrame->eip += PATM_ILLEGAL_INSTR_SIZE;
588	return VINF_SUCCESS;
589
590	case PATM_ACTION_LOG_STI:
591	Log(("PATMGC: STI at %VGv (current IF=%d iopl=%d)\n", pRegFrame->eip, !!(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags & X86_EFL_IF), X86_EFL_GET_IOPL(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags) ));
592	pRegFrame->eip += PATM_ILLEGAL_INSTR_SIZE;
593	return VINF_SUCCESS;
594
595	case PATM_ACTION_LOG_POPF_IF1:
596	Log(("PATMGC: POPF setting IF at %VGv (current IF=%d iopl=%d)\n", pRegFrame->eip, !!(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags & X86_EFL_IF), X86_EFL_GET_IOPL(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags)));
597	pRegFrame->eip += PATM_ILLEGAL_INSTR_SIZE;
598	return VINF_SUCCESS;
599
600	case PATM_ACTION_LOG_POPF_IF0:
601	Log(("PATMGC: POPF at %VGv (current IF=%d iopl=%d)\n", pRegFrame->eip, !!(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags & X86_EFL_IF), X86_EFL_GET_IOPL(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags)));
602	pRegFrame->eip += PATM_ILLEGAL_INSTR_SIZE;
603	return VINF_SUCCESS;
604
605	case PATM_ACTION_LOG_PUSHF:
606	Log(("PATMGC: PUSHF at %VGv (current IF=%d iopl=%d)\n", pRegFrame->eip, !!(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags & X86_EFL_IF), X86_EFL_GET_IOPL(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags) ));
607	pRegFrame->eip += PATM_ILLEGAL_INSTR_SIZE;
608	return VINF_SUCCESS;
609
610	case PATM_ACTION_LOG_IF1:
611	Log(("PATMGC: IF=1 escape from %VGv\n", pRegFrame->eip));
612	pRegFrame->eip += PATM_ILLEGAL_INSTR_SIZE;
613	return VINF_SUCCESS;
614
615	case PATM_ACTION_LOG_IRET:
616	{
617	#ifdef IN_GC
618	char pIretFrame = (char )pRegFrame->edx;
619	uint32_t eip, selCS, uEFlags;
620
621	rc = MMGCRamRead(pVM, &eip, pIretFrame, 4);
622	rc \|= MMGCRamRead(pVM, &selCS, pIretFrame + 4, 4);
623	rc \|= MMGCRamRead(pVM, &uEFlags, pIretFrame + 8, 4);
624	if (rc == VINF_SUCCESS)
625	{
626	Log(("PATMGC: IRET stack frame: return address %04X:%VGv eflags=%08x\n", selCS, eip, uEFlags));
627	}
628	#endif
629	Log(("PATMGC: IRET from %VGv (IF->1) current eflags=%x\n", pRegFrame->eip, pVM->patm.s.CTXSUFF(pGCState)->uVMFlags));
630	pRegFrame->eip += PATM_ILLEGAL_INSTR_SIZE;
631	return VINF_SUCCESS;
632	}
633
634	case PATM_ACTION_LOG_RET:
635	Log(("PATMGC: RET to %VGv iopl=%d\n", pRegFrame->edx, X86_EFL_GET_IOPL(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags)));
636	pRegFrame->eip += PATM_ILLEGAL_INSTR_SIZE;
637	return VINF_SUCCESS;
638	#endif
639	default:
640	AssertFailed();
641	break;
642	}
643	}
644	else
645	AssertFailed();
646	CTXSUFF(pVM->patm.s.pGCState)->uPendingAction = 0;
647	}
648	AssertMsgFailed(("Unexpected OP_ILLUD2 in patch code at %VGv (pending action %x)!!!!\n", pRegFrame->eip, CTXSUFF(pVM->patm.s.pGCState)->uPendingAction));
649	return VINF_EM_RAW_EMULATE_INSTR;
650	}
651
652	/**
653	* Checks if the int 3 was caused by a patched instruction
654	*
655	* @returns VBox status
656	*
657	* @param pVM The VM handle.
658	* @param pCtxCore The relevant core context.
659	*/
660	PATMDECL(int) PATMHandleInt3PatchTrap(PVM pVM, PCPUMCTXCORE pRegFrame)
661	{
662	PPATMPATCHREC pRec;
663	int rc;
664
665	Assert((pRegFrame->ss & X86_SEL_RPL) == 1);
666
667	/* Int 3 in PATM generated code? (most common case) */
668	if (PATMIsPatchGCAddr(pVM, (RTGCPTR)pRegFrame->eip))
669	{
670	/* @note hardcoded assumption about it being a single byte int 3 instruction. */
671	pRegFrame->eip--;
672	return VINF_PATM_PATCH_INT3;
673	}
674
675	/** @todo could use simple caching here to speed things up. */
676	pRec = (PPATMPATCHREC)RTAvloGCPtrGet(&CTXSUFF(pVM->patm.s.PatchLookupTree)->PatchTree, (RTGCPTR)(pRegFrame->eip - 1)); /* eip is pointing to the instruction after 'int 3' already */
677	if (pRec && pRec->patch.uState == PATCH_ENABLED)
678	{
679	if (pRec->patch.flags & PATMFL_INT3_REPLACEMENT_BLOCK)
680	{
681	Assert(pRec->patch.opcode == OP_CLI);
682	/* This is a special cli block that was turned into an int 3 patch. We jump to the generated code manually. */
683	pRegFrame->eip = (uint32_t)PATCHCODE_PTR_GC(&pRec->patch);
684	STAM_COUNTER_INC(&pVM->patm.s.StatInt3BlockRun);
685	return VINF_SUCCESS;
686	}
687	else
688	if (pRec->patch.flags & PATMFL_INT3_REPLACEMENT)
689	{
690	uint32_t size, cbOp;
691	DISCPUSTATE cpu;
692
693	/* eip is pointing to the instruction after 'int 3' already */
694	pRegFrame->eip = pRegFrame->eip - 1;
695
696	PATM_STAT_RUN_INC(&pRec->patch);
697
698	Log(("PATMHandleInt3PatchTrap found int3 for %s at %VGv\n", patmGetInstructionString(pRec->patch.opcode, 0), pRegFrame->eip));
699
700	switch(pRec->patch.opcode)
701	{
702	case OP_CPUID:
703	case OP_IRET:
704	break;
705
706	case OP_STR:
707	case OP_SGDT:
708	case OP_SLDT:
709	case OP_SIDT:
710	case OP_LSL:
711	case OP_LAR:
712	case OP_SMSW:
713	case OP_VERW:
714	case OP_VERR:
715	default:
716	PATM_STAT_FAULT_INC(&pRec->patch);
717	pRec->patch.cTraps++;
718	return VINF_EM_RAW_EMULATE_INSTR;
719	}
720
721	cpu.mode = SELMIsSelector32Bit(pVM, pRegFrame->cs, 0) ? CPUMODE_32BIT : CPUMODE_16BIT;
722	if(cpu.mode != CPUMODE_32BIT)
723	{
724	AssertFailed();
725	return VINF_EM_RAW_EMULATE_INSTR;
726	}
727	rc = DISCoreOne(&cpu, (RTUINTPTR)&pRec->patch.aPrivInstr[0], &cbOp);
728	if (VBOX_FAILURE(rc))
729	{
730	Log(("DISCoreOne failed with %Vrc\n", rc));
731	PATM_STAT_FAULT_INC(&pRec->patch);
732	pRec->patch.cTraps++;
733	return VINF_EM_RAW_EMULATE_INSTR;
734	}
735
736	rc = EMInterpretInstructionCPU(pVM, &cpu, pRegFrame, 0 /* not relevant here */, &size);
737	if (rc != VINF_SUCCESS)
738	{
739	Log(("EMInterpretInstructionCPU failed with %Vrc\n", rc));
740	PATM_STAT_FAULT_INC(&pRec->patch);
741	pRec->patch.cTraps++;
742	return VINF_EM_RAW_EMULATE_INSTR;
743	}
744
745	pRegFrame->eip += cpu.opsize;
746	return VINF_SUCCESS;
747	}
748	}
749	return VERR_PATCH_NOT_FOUND;
750	}
751
752	/**
753	* Adds branch pair to the lookup cache of the particular branch instruction
754	*
755	* @returns VBox status
756	* @param pVM The VM to operate on.
757	* @param pJumpTableGC Pointer to branch instruction lookup cache
758	* @param pBranchTarget Original branch target
759	* @param pRelBranchPatch Relative duplicated function address
760	*/
761	int PATMAddBranchToLookupCache(PVM pVM, RTGCPTR pJumpTableGC, RTGCPTR pBranchTarget, RTGCUINTPTR pRelBranchPatch)
762	{
763	PPATCHJUMPTABLE pJumpTable;
764
765	Log(("PATMAddBranchToLookupCache: Adding (%VGv->%VGv (%VGv)) to table %VGv\n", pBranchTarget, pRelBranchPatch + pVM->patm.s.pPatchMemGC, pRelBranchPatch, pJumpTableGC));
766
767	AssertReturn(PATMIsPatchGCAddr(pVM, pJumpTableGC), VERR_INVALID_PARAMETER);
768
769	#ifdef IN_GC
770	pJumpTable = (PPATCHJUMPTABLE) pJumpTableGC;
771	#else
772	pJumpTable = (PPATCHJUMPTABLE) (pJumpTableGC - pVM->patm.s.pPatchMemGC + pVM->patm.s.pPatchMemHC);
773	#endif
774	Log(("Nr addresses = %d, insert pos = %d\n", pJumpTable->cAddresses, pJumpTable->ulInsertPos));
775	if (pJumpTable->cAddresses < pJumpTable->nrSlots)
776	{
777	uint32_t i;
778
779	for (i=0;i<pJumpTable->nrSlots;i++)
780	{
781	if (pJumpTable->Slot[i].pInstrGC == 0)
782	{
783	pJumpTable->Slot[i].pInstrGC = pBranchTarget;
784	/* Relative address - eases relocation */
785	pJumpTable->Slot[i].pRelPatchGC = pRelBranchPatch;
786	pJumpTable->cAddresses++;
787	break;
788	}
789	}
790	AssertReturn(i < pJumpTable->nrSlots, VERR_INTERNAL_ERROR);
791	#ifdef VBOX_WITH_STATISTICS
792	STAM_COUNTER_INC(&pVM->patm.s.StatFunctionLookupInsert);
793	if (pVM->patm.s.StatU32FunctionMaxSlotsUsed < i)
794	pVM->patm.s.StatU32FunctionMaxSlotsUsed = i + 1;
795	#endif
796	}
797	else
798	{
799	/* Replace an old entry. */
800	/** @todo replacement strategy isn't really bright. change to something better if required. */
801	Assert(pJumpTable->ulInsertPos < pJumpTable->nrSlots);
802	Assert((pJumpTable->nrSlots & 1) == 0);
803
804	pJumpTable->ulInsertPos &= (pJumpTable->nrSlots-1);
805	pJumpTable->Slot[pJumpTable->ulInsertPos].pInstrGC = pBranchTarget;
806	/* Relative address - eases relocation */
807	pJumpTable->Slot[pJumpTable->ulInsertPos].pRelPatchGC = pRelBranchPatch;
808
809	pJumpTable->ulInsertPos = (pJumpTable->ulInsertPos+1) & (pJumpTable->nrSlots-1);
810
811	STAM_COUNTER_INC(&pVM->patm.s.StatFunctionLookupReplace);
812	}
813
814	return VINF_SUCCESS;
815	}
816
817	/**
818	* Return the name of the patched instruction
819	*
820	* @returns instruction name
821	*
822	* @param opcode DIS instruction opcode
823	* @param fPatchFlags Patch flags
824	*/
825	PATMDECL(char *)patmGetInstructionString(uint32_t opcode, uint32_t fPatchFlags)
826	{
827	char *pszInstr = NULL;
828
829	switch (opcode)
830	{
831	case OP_CLI:
832	pszInstr = "cli";
833	break;
834	case OP_PUSHF:
835	pszInstr = "pushf";
836	break;
837	case OP_POPF:
838	pszInstr = "popf";
839	break;
840	case OP_STR:
841	pszInstr = "str";
842	break;
843	case OP_LSL:
844	pszInstr = "lsl";
845	break;
846	case OP_LAR:
847	pszInstr = "lar";
848	break;
849	case OP_SGDT:
850	pszInstr = "sgdt";
851	break;
852	case OP_SLDT:
853	pszInstr = "sldt";
854	break;
855	case OP_SIDT:
856	pszInstr = "sidt";
857	break;
858	case OP_SMSW:
859	pszInstr = "smsw";
860	break;
861	case OP_VERW:
862	pszInstr = "verw";
863	break;
864	case OP_VERR:
865	pszInstr = "verr";
866	break;
867	case OP_CPUID:
868	pszInstr = "cpuid";
869	break;
870	case OP_JMP:
871	pszInstr = "jmp";
872	break;
873	case OP_JO:
874	pszInstr = "jo";
875	break;
876	case OP_JNO:
877	pszInstr = "jno";
878	break;
879	case OP_JC:
880	pszInstr = "jc";
881	break;
882	case OP_JNC:
883	pszInstr = "jnc";
884	break;
885	case OP_JE:
886	pszInstr = "je";
887	break;
888	case OP_JNE:
889	pszInstr = "jne";
890	break;
891	case OP_JBE:
892	pszInstr = "jbe";
893	break;
894	case OP_JNBE:
895	pszInstr = "jnbe";
896	break;
897	case OP_JS:
898	pszInstr = "js";
899	break;
900	case OP_JNS:
901	pszInstr = "jns";
902	break;
903	case OP_JP:
904	pszInstr = "jp";
905	break;
906	case OP_JNP:
907	pszInstr = "jnp";
908	break;
909	case OP_JL:
910	pszInstr = "jl";
911	break;
912	case OP_JNL:
913	pszInstr = "jnl";
914	break;
915	case OP_JLE:
916	pszInstr = "jle";
917	break;
918	case OP_JNLE:
919	pszInstr = "jnle";
920	break;
921	case OP_JECXZ:
922	pszInstr = "jecxz";
923	break;
924	case OP_LOOP:
925	pszInstr = "loop";
926	break;
927	case OP_LOOPNE:
928	pszInstr = "loopne";
929	break;
930	case OP_LOOPE:
931	pszInstr = "loope";
932	break;
933	case OP_MOV:
934	if (fPatchFlags & PATMFL_IDTHANDLER)
935	{
936	pszInstr = "mov (Int/Trap Handler)";
937	}
938	break;
939	case OP_SYSENTER:
940	pszInstr = "sysenter";
941	break;
942	case OP_PUSH:
943	pszInstr = "push (cs)";
944	break;
945	case OP_CALL:
946	pszInstr = "call";
947	break;
948	case OP_IRET:
949	pszInstr = "iret";
950	break;
951	}
952	return pszInstr;
953	}

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/PATM/VMMAll/PATMAll.cpp@ 274

Download in other formats: